@c9up/warden 0.1.18 → 0.1.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AuthManager.d.ts +46 -1
- package/dist/AuthManager.d.ts.map +1 -1
- package/dist/AuthManager.js +71 -10
- package/dist/AuthManager.js.map +1 -1
- package/dist/Authenticator.d.ts +13 -1
- package/dist/Authenticator.d.ts.map +1 -1
- package/dist/Authenticator.js +33 -15
- package/dist/Authenticator.js.map +1 -1
- package/dist/RememberMeToken.d.ts +70 -0
- package/dist/RememberMeToken.d.ts.map +1 -1
- package/dist/RememberMeToken.js +102 -0
- package/dist/RememberMeToken.js.map +1 -1
- package/dist/Secret.d.ts +11 -0
- package/dist/Secret.d.ts.map +1 -0
- package/dist/Secret.js +36 -0
- package/dist/Secret.js.map +1 -0
- package/dist/bouncer/Bouncer.d.ts +14 -0
- package/dist/bouncer/Bouncer.d.ts.map +1 -1
- package/dist/bouncer/Bouncer.js +23 -4
- package/dist/bouncer/Bouncer.js.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts +9 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.js +17 -1
- package/dist/bouncer/PolicyAuthorizer.js.map +1 -1
- package/dist/bouncer/evaluate.d.ts +14 -2
- package/dist/bouncer/evaluate.d.ts.map +1 -1
- package/dist/bouncer/evaluate.js +16 -5
- package/dist/bouncer/evaluate.js.map +1 -1
- package/dist/bouncer/types.d.ts +4 -2
- package/dist/bouncer/types.d.ts.map +1 -1
- package/dist/index.d.ts +3 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/sanitize.d.ts +10 -0
- package/dist/sanitize.d.ts.map +1 -0
- package/dist/sanitize.js +15 -0
- package/dist/sanitize.js.map +1 -0
- package/dist/strategies/SessionStrategy.d.ts +26 -0
- package/dist/strategies/SessionStrategy.d.ts.map +1 -1
- package/dist/strategies/SessionStrategy.js +49 -0
- package/dist/strategies/SessionStrategy.js.map +1 -1
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +1 -1
- package/src/AuthManager.ts +86 -10
- package/src/Authenticator.ts +49 -20
- package/src/RememberMeToken.ts +134 -0
- package/src/Secret.ts +41 -0
- package/src/bouncer/Bouncer.ts +32 -3
- package/src/bouncer/PolicyAuthorizer.ts +20 -1
- package/src/bouncer/evaluate.ts +26 -6
- package/src/bouncer/types.ts +4 -2
- package/src/index.ts +7 -1
- package/src/sanitize.ts +17 -0
- package/src/strategies/SessionStrategy.ts +54 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RememberMeToken.js","sourceRoot":"","sources":["../src/RememberMeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"RememberMeToken.js","sourceRoot":"","sources":["../src/RememberMeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAyBxC,iFAAiF;AACjF,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,2EAA2E;QAC3E,gEAAgE;QAChE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;YAClE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,MAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAC/B,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,UAAU,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,UAAU,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAc;IAClE,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAAuB,EACvB,UAAkB,EAClB,YAAY,GAAG,qBAAqB;IAEpC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO;QACN,MAAM,EAAE;YACP,UAAU;YACV,WAAW,EAAE,MAAM;YACnB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI;SAClC;QACD,KAAK,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC;KAC3C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,MAA6B,EAC7B,WAAoB,EACpB,UAAkB,EAClB,YAAY,GAAG,qBAAqB;IAEpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpC,uEAAuE;QACvE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;IACjD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAEtE,OAAO;QACN,MAAM,EAAE,MAAM,CAAC,WAAW;QAC1B,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;KAClD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,2BAA2B;IAC9B,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,KAAK,CAAC,MAAM,CAAC,KAA4B;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CACX,UAAkB,EAClB,IAAY,EACZ,SAAiB;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE;YAC1B,GAAG,GAAG;YACN,IAAI;YACJ,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAuB;QAC7C,KAAK,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAe;IAC3B;;;;OAIG;IACH,MAAM,CAAC,MAAM,CACZ,KAAa;QAEb,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,CAAC,IAAI,CAAC,OAAe,qBAAqB;QAI/C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAC1B,MAAuB,EACvB,IAAY,EACZ,SAAiB;QAOjB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO;YACN,MAAM;YACN,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;SAClD,CAAC;IACH,CAAC;IAED,UAAU,CAAS;IACnB,WAAW,CAAkB;IAC7B,IAAI,CAAS;IACb,SAAS,CAAO;IAChB,SAAS,CAAO;IAChB,SAAS,CAAO;IAChB,0EAA0E;IAC1E,KAAK,CAAkB;IAEvB,YAAY,UAQX;QACA,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CACtB,gBAAgB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,MAA6B;QAC9C,OAAO,IAAI,eAAe,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACP,OAAO;YACN,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;SACnC,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,SAAS;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAsB;QAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;CACD"}
|
package/dist/Secret.d.ts
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export declare class Secret<T> {
|
|
2
|
+
#private;
|
|
3
|
+
constructor(value: T, redactedKeyword?: string);
|
|
4
|
+
/** Redacted placeholder, so `JSON.stringify` never emits the secret. */
|
|
5
|
+
toJSON(): string;
|
|
6
|
+
/** Redacted placeholder for string coercion and template literals. */
|
|
7
|
+
toString(): string;
|
|
8
|
+
/** Release the underlying value — the one deliberate way to read it. */
|
|
9
|
+
release(): T;
|
|
10
|
+
}
|
|
11
|
+
//# sourceMappingURL=Secret.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Secret.d.ts","sourceRoot":"","sources":["../src/Secret.ts"],"names":[],"mappings":"AAYA,qBAAa,MAAM,CAAC,CAAC;;gBAIR,KAAK,EAAE,CAAC,EAAE,eAAe,GAAE,MAAiB;IAKxD,wEAAwE;IACxE,MAAM,IAAI,MAAM;IAIhB,sEAAsE;IACtE,QAAQ,IAAI,MAAM;IASlB,wEAAwE;IACxE,OAAO,IAAI,CAAC;CAGZ"}
|
package/dist/Secret.js
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Wraps a sensitive value so it never leaks through a log, `JSON.stringify`, or
|
|
3
|
+
* `util.inspect`. Read it back deliberately with {@link Secret.release}.
|
|
4
|
+
*
|
|
5
|
+
* AdonisJS takes this from `@adonisjs/core/helpers`, and its `RememberMeToken`
|
|
6
|
+
* hands secrets out wrapped in one. Warden carries its own copy rather than
|
|
7
|
+
* importing `@c9up/ream`: it has no runtime dependencies and ships a standalone
|
|
8
|
+
* entry point, so reaching for a peer here would break the framework-free mode.
|
|
9
|
+
* Same reason every native package carries its own platform map.
|
|
10
|
+
*/
|
|
11
|
+
const REDACTED = "[redacted]";
|
|
12
|
+
export class Secret {
|
|
13
|
+
#value;
|
|
14
|
+
#keyword;
|
|
15
|
+
constructor(value, redactedKeyword = REDACTED) {
|
|
16
|
+
this.#value = value;
|
|
17
|
+
this.#keyword = redactedKeyword;
|
|
18
|
+
}
|
|
19
|
+
/** Redacted placeholder, so `JSON.stringify` never emits the secret. */
|
|
20
|
+
toJSON() {
|
|
21
|
+
return this.#keyword;
|
|
22
|
+
}
|
|
23
|
+
/** Redacted placeholder for string coercion and template literals. */
|
|
24
|
+
toString() {
|
|
25
|
+
return this.#keyword;
|
|
26
|
+
}
|
|
27
|
+
/** Redacted placeholder for `console.log` / `util.inspect`. */
|
|
28
|
+
[Symbol.for("nodejs.util.inspect.custom")]() {
|
|
29
|
+
return this.#keyword;
|
|
30
|
+
}
|
|
31
|
+
/** Release the underlying value — the one deliberate way to read it. */
|
|
32
|
+
release() {
|
|
33
|
+
return this.#value;
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
//# sourceMappingURL=Secret.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Secret.js","sourceRoot":"","sources":["../src/Secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,OAAO,MAAM;IACT,MAAM,CAAI;IACV,QAAQ,CAAS;IAE1B,YAAY,KAAQ,EAAE,kBAA0B,QAAQ;QACvD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;IACjC,CAAC;IAED,wEAAwE;IACxE,MAAM;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,sEAAsE;IACtE,QAAQ;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,wEAAwE;IACxE,OAAO;QACN,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;CACD"}
|
|
@@ -15,10 +15,24 @@ import type { Scope } from "../rights/types.js";
|
|
|
15
15
|
import { AbilitiesBuilder } from "./AbilitiesBuilder.js";
|
|
16
16
|
import { AuthorizationResponse } from "./AuthorizationResponse.js";
|
|
17
17
|
import type { BasePolicy } from "./BasePolicy.js";
|
|
18
|
+
import { type ResponseBuilder } from "./evaluate.js";
|
|
18
19
|
import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
|
|
19
20
|
import type { Ability, AbilityOptions, AuthorizerResponse, BouncerContext, PolicyContainerResolver } from "./types.js";
|
|
20
21
|
export declare class Bouncer {
|
|
21
22
|
#private;
|
|
23
|
+
/**
|
|
24
|
+
* How a bare boolean from an ability or a policy becomes an
|
|
25
|
+
* {@link AuthorizationResponse} (AdonisJS `Bouncer.responseBuilder`).
|
|
26
|
+
*
|
|
27
|
+
* Replace it once at boot to give every `return false` a house message and
|
|
28
|
+
* status instead of a naked 403:
|
|
29
|
+
*
|
|
30
|
+
* ```ts
|
|
31
|
+
* Bouncer.responseBuilder = (value) =>
|
|
32
|
+
* value === false ? AuthorizationResponse.deny('Nope', 404) : normalizeResponse(value)
|
|
33
|
+
* ```
|
|
34
|
+
*/
|
|
35
|
+
static responseBuilder: ResponseBuilder;
|
|
22
36
|
constructor(user: UserPayload | (() => UserPayload | null) | null, abilities?: Record<string, Ability<never[]>>, policies?: Record<string, new () => BasePolicy>, context?: BouncerContext);
|
|
23
37
|
/**
|
|
24
38
|
* Point the bouncer at an IoC resolver, so a policy's constructor
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"Bouncer.d.ts","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAwB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAIN,KAAK,eAAe,EAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EAEd,uBAAuB,EACvB,MAAM,YAAY,CAAC;AAEpB,qBAAa,OAAO;;IACnB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,eAAe,EAAE,eAAe,CAA0B;gBAehE,IAAI,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,EACrD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,EAC/C,OAAO,CAAC,EAAE,cAAc;IAWzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,IAAI;IAmBvE;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EACnC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,EACpE,OAAO,CAAC,EAAE,cAAc,GACtB,gBAAgB;IAInB,wDAAwD;IACxD,IAAI,KAAK,IAAI,KAAK,CAEjB;IAmBD;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GAChE,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EACpC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,KAAK,kBAAkB,GACvE,OAAO,CAAC,IAAI,CAAC;IAmChB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAI9D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,EAAE;QACzB,OAAO,EAAE;YACR,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SAC7D,CAAC;KACF,CAeC;IAWF,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,UAAU,CAAC,GAAG,MAAM,GAAG,gBAAgB;IA2C/D,6DAA6D;IAC7D,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,qBAAqB,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5E,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,kEAAkE;IAClE,MAAM,CAAC,IAAI,SAAS,OAAO,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,OAAO,CAAC;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,6EAA6E;IAC7E,SAAS,CAAC,IAAI,SAAS,OAAO,EAAE,EAC/B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EACtB,GAAG,IAAI,EAAE,IAAI,GACX,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CA4D7D"}
|
package/dist/bouncer/Bouncer.js
CHANGED
|
@@ -10,13 +10,27 @@
|
|
|
10
10
|
* `RightsResolver` (D4); abilities/policy methods receive `(user, ...args)` and
|
|
11
11
|
* the developer writes the predicate, exactly as Adonis does.
|
|
12
12
|
*/
|
|
13
|
+
var _a;
|
|
13
14
|
import { WardenError } from "../errors.js";
|
|
14
15
|
import { AbilitiesBuilder } from "./AbilitiesBuilder.js";
|
|
15
16
|
import { AuthorizationResponse } from "./AuthorizationResponse.js";
|
|
16
|
-
import { evaluate, isAction, throwAuthorizationFailure } from "./evaluate.js";
|
|
17
|
+
import { defaultResponseBuilder, evaluate, isAction, throwAuthorizationFailure, } from "./evaluate.js";
|
|
17
18
|
import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
|
|
18
19
|
import { emptyPermissions } from "./policyContext.js";
|
|
19
20
|
export class Bouncer {
|
|
21
|
+
/**
|
|
22
|
+
* How a bare boolean from an ability or a policy becomes an
|
|
23
|
+
* {@link AuthorizationResponse} (AdonisJS `Bouncer.responseBuilder`).
|
|
24
|
+
*
|
|
25
|
+
* Replace it once at boot to give every `return false` a house message and
|
|
26
|
+
* status instead of a naked 403:
|
|
27
|
+
*
|
|
28
|
+
* ```ts
|
|
29
|
+
* Bouncer.responseBuilder = (value) =>
|
|
30
|
+
* value === false ? AuthorizationResponse.deny('Nope', 404) : normalizeResponse(value)
|
|
31
|
+
* ```
|
|
32
|
+
*/
|
|
33
|
+
static responseBuilder = defaultResponseBuilder;
|
|
20
34
|
#userOrResolver;
|
|
21
35
|
/** Lazily-resolved user cache (`undefined` until `#getUser` runs). */
|
|
22
36
|
#user;
|
|
@@ -165,7 +179,7 @@ export class Bouncer {
|
|
|
165
179
|
: () => this.#construct(policy);
|
|
166
180
|
// The PolicyAuthorizer inherits the Bouncer's scope + the shared memoized
|
|
167
181
|
// resolve so every policy check sees the active `(user, scope)` (AC1/AC3).
|
|
168
|
-
return new PolicyAuthorizer(this.#getUser(), factory, this.#scope, () => this.#resolvePermissions(), this.#emitter);
|
|
182
|
+
return new PolicyAuthorizer(this.#getUser(), factory, this.#scope, () => this.#resolvePermissions(), this.#emitter, _a.responseBuilder);
|
|
169
183
|
}
|
|
170
184
|
/**
|
|
171
185
|
* Construct a policy instance via the container resolver when present (Adonis
|
|
@@ -177,10 +191,13 @@ export class Bouncer {
|
|
|
177
191
|
: Promise.resolve(new ctor());
|
|
178
192
|
}
|
|
179
193
|
/** Emit `authorization:finished` when an emitter is wired (no-op otherwise). */
|
|
180
|
-
#emit(action, response) {
|
|
194
|
+
#emit(action, response, parameters) {
|
|
181
195
|
this.#emitter?.emit("authorization:finished", {
|
|
182
196
|
user: this.#getUser(),
|
|
183
197
|
action,
|
|
198
|
+
// What the check was ABOUT. AdonisJS carries it, and without it an
|
|
199
|
+
// audit log can say "Ada was denied editPost" but never which post.
|
|
200
|
+
parameters,
|
|
184
201
|
response,
|
|
185
202
|
});
|
|
186
203
|
}
|
|
@@ -208,8 +225,9 @@ export class Bouncer {
|
|
|
208
225
|
allowGuest: resolved.allowGuest,
|
|
209
226
|
run: (user) => resolved.execute(user, ...args),
|
|
210
227
|
args,
|
|
228
|
+
responseBuilder: _a.responseBuilder,
|
|
211
229
|
});
|
|
212
|
-
this.#emit(action, response);
|
|
230
|
+
this.#emit(action, response, args);
|
|
213
231
|
return response;
|
|
214
232
|
}
|
|
215
233
|
#resolveAbility(name) {
|
|
@@ -234,4 +252,5 @@ export class Bouncer {
|
|
|
234
252
|
};
|
|
235
253
|
}
|
|
236
254
|
}
|
|
255
|
+
_a = Bouncer;
|
|
237
256
|
//# sourceMappingURL=Bouncer.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG
|
|
1
|
+
{"version":3,"file":"Bouncer.js","sourceRoot":"","sources":["../../src/bouncer/Bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACN,sBAAsB,EACtB,QAAQ,EACR,QAAQ,EAER,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAUtD,MAAM,OAAO,OAAO;IACnB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,eAAe,GAAoB,sBAAsB,CAAC;IAExD,eAAe,CAAkD;IAC1E,sEAAsE;IACtE,KAAK,CAAiC;IAC7B,UAAU,CAAmC;IAC7C,SAAS,CAAuC;IAChD,MAAM,CAAQ;IACd,SAAS,CAA6B;IAC/C,kBAAkB,CAAsC;IAC/C,QAAQ,CAA6B;IAC9C,0FAA0F;IAC1F,SAAS,CAA4C;IAErD,YACC,IAAqD,EACrD,SAA4C,EAC5C,QAA+C,EAC/C,OAAwB;QAExB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,iBAA2C;QAC/D,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,QAAQ;QACP,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK;gBACT,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU;oBACzC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;oBACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAM,CACZ,IAAY,EACZ,UAAoE,EACpE,OAAwB;QAExB,OAAO,IAAI,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QAClB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS;gBACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;oBAC5C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;oBAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAaD,MAAM,CAAC,OAAO,CACb,iBAE6C,EAC7C,aAAwD;QAExD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,GAAG,iBAAiB,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,iBAAiB,CAAC,UAAU,IAAI,KAAK,CAAC;YACnD,GAAG,GAAG,aAAa,CAAC;QACrB,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,mEAAmE,EACnE,EAAE,IAAI,EAAE,sDAAsD,EAAE,CAChE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CACf,IAAwB,EACxB,GAAG,IAAe,EACG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,OAAgB,EAAE,MAAe;QACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACM,eAAe,GAKpB;QACH,OAAO,EAAE;YACR,GAAG,EAAE,CAAC,MAAc,EAAE,GAAG,IAAe,EAAoB,EAAE;gBAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACxC,OAAO,KAAK,KAAK,SAAS;oBACzB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,EAAE,CAAC,MAAc,EAAE,GAAG,IAAe,EAAoB,EAAE;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACxC,OAAO,KAAK,KAAK,SAAS;oBACzB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1D,CAAC;SACD;KACD,CAAC;IAEF;oFACgF;IAChF,YAAY,CAAC,MAAc;QAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,MAAuC;QAC3C,MAAM,OAAO,GACZ,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,gBAAgB,CAC1B,IAAI,CAAC,QAAQ,EAAE,EACf,OAAO,EACP,IAAI,CAAC,MAAM,EACX,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAChC,IAAI,CAAC,QAAQ,EACb,EAAO,CAAC,eAAe,CACvB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAA0B;QACpC,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,gFAAgF;IAChF,KAAK,CACJ,MAAc,EACd,QAA+B,EAC/B,UAAqB;QAErB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM;YACN,mEAAmE;YACnE,oEAAoE;YACpE,UAAU;YACV,QAAQ;SACR,CAAC,CAAC;IACJ,CAAC;IAQD,OAAO,CACN,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAQD,KAAK,CAAC,MAAM,CACX,OAAkC,EAClC,GAAG,IAAe;QAElB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IAQD,KAAK,CAAC,SAAS,CACd,OAAkC,EAClC,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,OAAkC,EAClC,IAAe;QAEf,MAAM,QAAQ,GACb,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YAC9C,IAAI;YACJ,eAAe,EAAE,EAAO,CAAC,eAAe;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACpB,iBAAiB,EACjB,eAAe,IAAI,kCAAkC,EACrD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,OAAO,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,cAAc,IAAI,kCAAkC,EACpD;oBACC,IAAI,EAAE,mEAAmE;iBACzE,CACD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;IACH,CAAC"}
|
|
@@ -9,12 +9,20 @@ import type { UserPayload } from "../AuthManager.js";
|
|
|
9
9
|
import type { EffectivePermissions, Scope } from "../rights/types.js";
|
|
10
10
|
import type { AuthorizationResponse } from "./AuthorizationResponse.js";
|
|
11
11
|
import { BasePolicy } from "./BasePolicy.js";
|
|
12
|
+
import { type ResponseBuilder } from "./evaluate.js";
|
|
12
13
|
import type { BouncerEmitter } from "./types.js";
|
|
13
14
|
export declare class PolicyAuthorizer {
|
|
14
15
|
#private;
|
|
15
|
-
constructor(user: UserPayload | null, factory: () => Promise<BasePolicy>, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>, emitter?: BouncerEmitter);
|
|
16
|
+
constructor(user: UserPayload | null, factory: () => Promise<BasePolicy>, scope?: Scope, resolvePermissions?: () => Promise<EffectivePermissions>, emitter?: BouncerEmitter, responseBuilder?: ResponseBuilder);
|
|
16
17
|
/** Run a check and resolve to the full response (D8 — fresh policy per check). */
|
|
17
18
|
execute(action: string, ...args: unknown[]): Promise<AuthorizationResponse>;
|
|
19
|
+
/**
|
|
20
|
+
* Swap the event sink after construction (AdonisJS `setEmitter`).
|
|
21
|
+
*
|
|
22
|
+
* The Bouncer passes its own down, but an authorizer built directly — a
|
|
23
|
+
* test, a console command — had no way to be given one.
|
|
24
|
+
*/
|
|
25
|
+
setEmitter(emitter?: BouncerEmitter): this;
|
|
18
26
|
/** True iff the action is authorized. Never throws on denial. */
|
|
19
27
|
allows(action: string, ...args: unknown[]): Promise<boolean>;
|
|
20
28
|
/** Boolean negation of {@link allows}. Never throws on denial. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"PolicyAuthorizer.d.ts","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAIN,KAAK,eAAe,EAEpB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA6CjD,qBAAa,gBAAgB;;gBAS3B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,EAClC,KAAK,GAAE,KAAgB,EACvB,kBAAkB,GAAE,MAAM,OAAO,CAAC,oBAAoB,CACb,EACzC,OAAO,CAAC,EAAE,cAAc,EACxB,eAAe,CAAC,EAAE,eAAe;IAUlC,kFAAkF;IAC5E,OAAO,CACZ,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IA6BjC;;;;;OAKG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI;IAK1C,iEAAiE;IAC3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,kEAAkE;IAC5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlE,6EAA6E;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}
|
|
@@ -49,12 +49,14 @@ export class PolicyAuthorizer {
|
|
|
49
49
|
#scope;
|
|
50
50
|
#resolvePermissions;
|
|
51
51
|
#emitter;
|
|
52
|
-
|
|
52
|
+
#responseBuilder;
|
|
53
|
+
constructor(user, factory, scope = "global", resolvePermissions = () => Promise.resolve(emptyPermissions(scope)), emitter, responseBuilder) {
|
|
53
54
|
this.#user = user;
|
|
54
55
|
this.#factory = factory;
|
|
55
56
|
this.#scope = scope;
|
|
56
57
|
this.#resolvePermissions = resolvePermissions;
|
|
57
58
|
this.#emitter = emitter;
|
|
59
|
+
this.#responseBuilder = responseBuilder;
|
|
58
60
|
}
|
|
59
61
|
/** Run a check and resolve to the full response (D8 — fresh policy per check). */
|
|
60
62
|
async execute(action, ...args) {
|
|
@@ -73,14 +75,28 @@ export class PolicyAuthorizer {
|
|
|
73
75
|
args,
|
|
74
76
|
before: policy.before?.bind(policy),
|
|
75
77
|
after: policy.after?.bind(policy),
|
|
78
|
+
responseBuilder: this.#responseBuilder,
|
|
76
79
|
});
|
|
77
80
|
this.#emitter?.emit("authorization:finished", {
|
|
78
81
|
user: this.#user,
|
|
79
82
|
action,
|
|
83
|
+
// Same payload as an ability check: which resource the decision was
|
|
84
|
+
// about, not just that a decision happened.
|
|
85
|
+
parameters: args,
|
|
80
86
|
response,
|
|
81
87
|
});
|
|
82
88
|
return response;
|
|
83
89
|
}
|
|
90
|
+
/**
|
|
91
|
+
* Swap the event sink after construction (AdonisJS `setEmitter`).
|
|
92
|
+
*
|
|
93
|
+
* The Bouncer passes its own down, but an authorizer built directly — a
|
|
94
|
+
* test, a console command — had no way to be given one.
|
|
95
|
+
*/
|
|
96
|
+
setEmitter(emitter) {
|
|
97
|
+
this.#emitter = emitter;
|
|
98
|
+
return this;
|
|
99
|
+
}
|
|
84
100
|
/** True iff the action is authorized. Never throws on denial. */
|
|
85
101
|
async allows(action, ...args) {
|
|
86
102
|
return (await this.execute(action, ...args)).authorized;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,
|
|
1
|
+
{"version":3,"file":"PolicyAuthorizer.js","sourceRoot":"","sources":["../../src/bouncer/PolicyAuthorizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAEN,QAAQ,EACR,QAAQ,EAER,yBAAyB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,MAAkB,EAAE,MAAc;IAC9D,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,YAAY,GACjB,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KACC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EACxD,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,UAAU,CAAC,SAAS;QAC9B,KAAK,KAAK,MAAM,CAAC,SAAS,EAC1B,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACnC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,WAAW,MAAM,CAAC,WAAW,CAAC,IAAI,oBAAoB,MAAM,GAAG,EAC/D,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,KAAK,CAAqB;IAC1B,QAAQ,CAA4B;IACpC,MAAM,CAAQ;IACd,mBAAmB,CAAsC;IAClE,QAAQ,CAA6B;IAC5B,gBAAgB,CAA8B;IAEvD,YACC,IAAwB,EACxB,OAAkC,EAClC,QAAe,QAAQ,EACvB,qBAA0D,GAAG,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACzC,OAAwB,EACxB,eAAiC;QAEjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;YACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC;YACpC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,gBAAgB;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,wBAAwB,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM;YACN,oEAAoE;YACpE,4CAA4C;YAC5C,UAAU,EAAE,IAAI;YAChB,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAwB;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAG,IAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC1B,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;CACD"}
|
|
@@ -12,8 +12,18 @@ import { AuthorizationResponse } from "./AuthorizationResponse.js";
|
|
|
12
12
|
import type { AuthorizerResponse, HookResponse } from "./types.js";
|
|
13
13
|
/** A policy action method / ability callback, structurally. */
|
|
14
14
|
export type Action = (user: UserPayload | null, ...args: unknown[]) => AuthorizerResponse;
|
|
15
|
-
/**
|
|
16
|
-
export
|
|
15
|
+
/** Turns whatever an ability returned into an {@link AuthorizationResponse}. */
|
|
16
|
+
export type ResponseBuilder = (value: boolean | AuthorizationResponse) => AuthorizationResponse;
|
|
17
|
+
/** The default: boolean sugar → response; an explicit response passes through (D7). */
|
|
18
|
+
export declare const defaultResponseBuilder: ResponseBuilder;
|
|
19
|
+
/**
|
|
20
|
+
* Boolean sugar → response, through whatever builder is installed.
|
|
21
|
+
*
|
|
22
|
+
* `Bouncer.responseBuilder` replaces it app-wide, which is how you give every
|
|
23
|
+
* bare `return false` a house message and status instead of a naked 403
|
|
24
|
+
* (AdonisJS `Bouncer.responseBuilder`).
|
|
25
|
+
*/
|
|
26
|
+
export declare function normalizeResponse(value: boolean | AuthorizationResponse, builder?: ResponseBuilder): AuthorizationResponse;
|
|
17
27
|
/**
|
|
18
28
|
* Type guard for a callable action. A function's parameter/return types are not
|
|
19
29
|
* observable at runtime, so this asserts the structural `Action` shape from a
|
|
@@ -32,5 +42,7 @@ export declare function evaluate(params: {
|
|
|
32
42
|
args: unknown[];
|
|
33
43
|
before?: (user: UserPayload | null, action: string, ...args: unknown[]) => HookResponse;
|
|
34
44
|
after?: (user: UserPayload | null, action: string, result: AuthorizationResponse, ...args: unknown[]) => HookResponse;
|
|
45
|
+
/** Overrides how a bare boolean becomes a response. */
|
|
46
|
+
responseBuilder?: ResponseBuilder;
|
|
35
47
|
}): Promise<AuthorizationResponse>;
|
|
36
48
|
//# sourceMappingURL=evaluate.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,
|
|
1
|
+
{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,+DAA+D;AAC/D,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;AAExB,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,CAC7B,KAAK,EAAE,OAAO,GAAG,qBAAqB,KAClC,qBAAqB,CAAC;AAE3B,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,EAAE,eAKpC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,OAAO,GAAG,qBAAqB,EACtC,OAAO,GAAE,eAAwC,GAC/C,qBAAqB,CAEvB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,qBAAqB,GAC7B,KAAK,CASP;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACtC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACtD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,CACR,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,KAAK,CAAC,EAAE,CACP,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAC7B,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,YAAY,CAAC;IAClB,uDAAuD;IACvD,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiCjC"}
|
package/dist/bouncer/evaluate.js
CHANGED
|
@@ -9,12 +9,22 @@
|
|
|
9
9
|
*/
|
|
10
10
|
import { WardenError } from "../errors.js";
|
|
11
11
|
import { AuthorizationResponse } from "./AuthorizationResponse.js";
|
|
12
|
-
/**
|
|
13
|
-
export
|
|
12
|
+
/** The default: boolean sugar → response; an explicit response passes through (D7). */
|
|
13
|
+
export const defaultResponseBuilder = (value) => {
|
|
14
14
|
if (value instanceof AuthorizationResponse) {
|
|
15
15
|
return value;
|
|
16
16
|
}
|
|
17
17
|
return value ? AuthorizationResponse.allow() : AuthorizationResponse.deny();
|
|
18
|
+
};
|
|
19
|
+
/**
|
|
20
|
+
* Boolean sugar → response, through whatever builder is installed.
|
|
21
|
+
*
|
|
22
|
+
* `Bouncer.responseBuilder` replaces it app-wide, which is how you give every
|
|
23
|
+
* bare `return false` a house message and status instead of a naked 403
|
|
24
|
+
* (AdonisJS `Bouncer.responseBuilder`).
|
|
25
|
+
*/
|
|
26
|
+
export function normalizeResponse(value, builder = defaultResponseBuilder) {
|
|
27
|
+
return builder(value);
|
|
18
28
|
}
|
|
19
29
|
/**
|
|
20
30
|
* Type guard for a callable action. A function's parameter/return types are not
|
|
@@ -35,12 +45,13 @@ export function throwAuthorizationFailure(response) {
|
|
|
35
45
|
/** Run the D5 evaluation pipeline and resolve to the final response. */
|
|
36
46
|
export async function evaluate(params) {
|
|
37
47
|
const { user, action, allowGuest, run, args, before, after } = params;
|
|
48
|
+
const builder = params.responseBuilder ?? defaultResponseBuilder;
|
|
38
49
|
let response;
|
|
39
50
|
// (1) before — non-undefined short-circuits the action.
|
|
40
51
|
if (before) {
|
|
41
52
|
const early = await before(user, action, ...args);
|
|
42
53
|
if (early !== undefined) {
|
|
43
|
-
response = normalizeResponse(early);
|
|
54
|
+
response = normalizeResponse(early, builder);
|
|
44
55
|
}
|
|
45
56
|
}
|
|
46
57
|
// (2) guest-deny + (3) action — only if before did not short-circuit.
|
|
@@ -49,7 +60,7 @@ export async function evaluate(params) {
|
|
|
49
60
|
response = AuthorizationResponse.deny();
|
|
50
61
|
}
|
|
51
62
|
else {
|
|
52
|
-
response = normalizeResponse(await run(user));
|
|
63
|
+
response = normalizeResponse(await run(user), builder);
|
|
53
64
|
}
|
|
54
65
|
}
|
|
55
66
|
// (4) after — non-undefined overrides. Receives the resource args (Adonis
|
|
@@ -57,7 +68,7 @@ export async function evaluate(params) {
|
|
|
57
68
|
if (after) {
|
|
58
69
|
const override = await after(user, action, response, ...args);
|
|
59
70
|
if (override !== undefined) {
|
|
60
|
-
response = normalizeResponse(override);
|
|
71
|
+
response = normalizeResponse(override, builder);
|
|
61
72
|
}
|
|
62
73
|
}
|
|
63
74
|
return response;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/bouncer/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAcnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAoB,CAAC,KAAK,EAAE,EAAE;IAChE,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAChC,KAAsC,EACtC,UAA2B,sBAAsB;IAEjD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CACxC,QAA+B;IAE/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,QAAQ,CAAC,OAAO,IAAI,sBAAsB,EAC1C;QACC,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;KAC9B,CACD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAmB9B;IACA,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAEjE,IAAI,QAA2C,CAAC;IAEhD,wDAAwD;IACxD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}
|
package/dist/bouncer/types.d.ts
CHANGED
|
@@ -20,8 +20,10 @@ export interface PolicyContainerResolver {
|
|
|
20
20
|
}
|
|
21
21
|
/**
|
|
22
22
|
* Agnostic event sink (Adonis `Bouncer.emitter`). When present, an
|
|
23
|
-
* `authorization:finished` event fires after every ability/policy evaluation
|
|
24
|
-
* `{ user, action, response }
|
|
23
|
+
* `authorization:finished` event fires after every ability/policy evaluation
|
|
24
|
+
* with `{ user, action, parameters, response }` (AdonisJS `BouncerEvents`).
|
|
25
|
+
* `parameters` are the arguments the check ran against — an audit log needs
|
|
26
|
+
* them to say WHICH resource was refused. No-op when absent.
|
|
25
27
|
*/
|
|
26
28
|
export interface BouncerEmitter {
|
|
27
29
|
emit(event: string, payload: unknown): void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvD;AAED
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/bouncer/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CAClC;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC3B,OAAO,GACP,qBAAqB,GACrB,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,CAAC;AAE5C,wGAAwG;AACxG,MAAM,MAAM,YAAY,GACrB,OAAO,GACP,qBAAqB,GACrB,SAAS,GACT,OAAO,CAAC,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,CACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,IAAI,EAAE,OAAO,EAAE,KACd,kBAAkB,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC1C"}
|
package/dist/index.d.ts
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
export type { AuthAttempt, ExtractedCredentials } from "./Authenticator.js";
|
|
7
7
|
export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
|
|
8
8
|
export type { AuthConfig, AuthResult, AuthStrategy, UserPayload, } from "./AuthManager.js";
|
|
9
|
-
export { AuthManager, type WardenEmitter } from "./AuthManager.js";
|
|
9
|
+
export { AuthManager, authEventPrefix, type WardenEmitter, } from "./AuthManager.js";
|
|
10
10
|
export type { AuthRateLimiterConfig } from "./AuthRateLimiter.js";
|
|
11
11
|
export { AuthRateLimiter } from "./AuthRateLimiter.js";
|
|
12
12
|
export { AbilitiesBuilder } from "./bouncer/AbilitiesBuilder.js";
|
|
@@ -40,13 +40,14 @@ export type { RedisBlacklistConfig, RedisLikeClient, } from "./RedisBlacklistDri
|
|
|
40
40
|
export { RedisBlacklistDriver } from "./RedisBlacklistDriver.js";
|
|
41
41
|
export type { RefreshTokenDriver, StoredRefreshToken, } from "./RefreshTokenStore.js";
|
|
42
42
|
export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
|
|
43
|
-
export { DEFAULT_SECRET_LENGTH, decodeTokenValue, encodeTokenValue, hashSecret, MemoryRememberMeTokenDriver, type MintedRememberMeToken, mintRememberMeToken, type RememberMeTokenDriver, type StoredRememberMeToken, safeCompareHashes, verifyAndRecycleRememberMeToken, } from "./RememberMeToken.js";
|
|
43
|
+
export { DEFAULT_SECRET_LENGTH, decodeTokenValue, encodeTokenValue, hashSecret, MemoryRememberMeTokenDriver, type MintedRememberMeToken, mintRememberMeToken, RememberMeToken, type RememberMeTokenDriver, type StoredRememberMeToken, safeCompareHashes, verifyAndRecycleRememberMeToken, } from "./RememberMeToken.js";
|
|
44
44
|
export type { BlacklistDegradeEvent, ResilientBlacklistConfig, } from "./ResilientBlacklistDriver.js";
|
|
45
45
|
export { ResilientBlacklistDriver } from "./ResilientBlacklistDriver.js";
|
|
46
46
|
export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
|
|
47
47
|
export { RightsResolver } from "./rights/RightsResolver.js";
|
|
48
48
|
export type { EffectivePermissions, RightsStore, Scope, } from "./rights/types.js";
|
|
49
49
|
export { scopeKey } from "./rights/types.js";
|
|
50
|
+
export { Secret } from "./Secret.js";
|
|
50
51
|
export type { ApiKeyConfig } from "./strategies/ApiKeyStrategy.js";
|
|
51
52
|
export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
|
|
52
53
|
export type { BasicAuthConfig } from "./strategies/BasicAuthStrategy.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,WAAW,EACX,eAAe,EACf,KAAK,aAAa,GAClB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EACX,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,uBAAuB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,YAAY,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,GACT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACX,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,eAAe,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,eAAe,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC5E,YAAY,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACX,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EACX,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACX,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,KAAK,GACL,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACX,YAAY,EACZ,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
* @implements FR48, FR49, FR50, FR51, FR52, FR53
|
|
5
5
|
*/
|
|
6
6
|
export { API_KEY_GUARD_NAMES, Authenticator, extractCredentials, GuardAccessor, } from "./Authenticator.js";
|
|
7
|
-
export { AuthManager } from "./AuthManager.js";
|
|
7
|
+
export { AuthManager, authEventPrefix, } from "./AuthManager.js";
|
|
8
8
|
export { AuthRateLimiter } from "./AuthRateLimiter.js";
|
|
9
9
|
export { AbilitiesBuilder } from "./bouncer/AbilitiesBuilder.js";
|
|
10
10
|
export { AuthorizationResponse } from "./bouncer/AuthorizationResponse.js";
|
|
@@ -26,11 +26,12 @@ export { MemoryWebauthnChallengeStore, MemoryWebauthnCredentialStore, WebauthnPr
|
|
|
26
26
|
export { quasarConnection } from "./quasar.js";
|
|
27
27
|
export { RedisBlacklistDriver } from "./RedisBlacklistDriver.js";
|
|
28
28
|
export { generateRefreshToken, MemoryRefreshTokenDriver, } from "./RefreshTokenStore.js";
|
|
29
|
-
export { DEFAULT_SECRET_LENGTH, decodeTokenValue, encodeTokenValue, hashSecret, MemoryRememberMeTokenDriver, mintRememberMeToken, safeCompareHashes, verifyAndRecycleRememberMeToken, } from "./RememberMeToken.js";
|
|
29
|
+
export { DEFAULT_SECRET_LENGTH, decodeTokenValue, encodeTokenValue, hashSecret, MemoryRememberMeTokenDriver, mintRememberMeToken, RememberMeToken, safeCompareHashes, verifyAndRecycleRememberMeToken, } from "./RememberMeToken.js";
|
|
30
30
|
export { ResilientBlacklistDriver } from "./ResilientBlacklistDriver.js";
|
|
31
31
|
export { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
|
|
32
32
|
export { RightsResolver } from "./rights/RightsResolver.js";
|
|
33
33
|
export { scopeKey } from "./rights/types.js";
|
|
34
|
+
export { Secret } from "./Secret.js";
|
|
34
35
|
export { ApiKeyStrategy } from "./strategies/ApiKeyStrategy.js";
|
|
35
36
|
export { BasicAuthStrategy, basicAuthChallenge, decodeBasicAuth, safeCompare, } from "./strategies/BasicAuthStrategy.js";
|
|
36
37
|
export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACN,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,aAAa,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,WAAW,EACX,eAAe,GAEf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,MAAM,EACN,UAAU,EACV,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EACN,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,OAAO,EACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,UAAU,EACV,IAAI,GACJ,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUvE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAO5E,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAY5E,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EACN,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,2BAA2B,EAE3B,mBAAmB,EACnB,eAAe,EAGf,iBAAiB,EACjB,+BAA+B,GAC/B,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAM5D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACX,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Strip the prototype-pollution keys from a user payload.
|
|
3
|
+
*
|
|
4
|
+
* Lives in its own module so `AuthManager` and `Authenticator` do not have to
|
|
5
|
+
* import each other's values: the manager builds an authenticator, and the
|
|
6
|
+
* authenticator sanitises — putting both in one file made a runtime cycle.
|
|
7
|
+
*/
|
|
8
|
+
import type { UserPayload } from "./AuthManager.js";
|
|
9
|
+
export declare function sanitizePayload(user: UserPayload): void;
|
|
10
|
+
//# sourceMappingURL=sanitize.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAMvD"}
|
package/dist/sanitize.js
ADDED
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Strip the prototype-pollution keys from a user payload.
|
|
3
|
+
*
|
|
4
|
+
* Lives in its own module so `AuthManager` and `Authenticator` do not have to
|
|
5
|
+
* import each other's values: the manager builds an authenticator, and the
|
|
6
|
+
* authenticator sanitises — putting both in one file made a runtime cycle.
|
|
7
|
+
*/
|
|
8
|
+
export function sanitizePayload(user) {
|
|
9
|
+
for (const key of ["__proto__", "constructor", "prototype"]) {
|
|
10
|
+
if (key in user) {
|
|
11
|
+
delete user[key];
|
|
12
|
+
}
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
//# sourceMappingURL=sanitize.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACjB,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}
|
|
@@ -55,6 +55,32 @@ export declare class SessionStrategy implements AuthStrategy {
|
|
|
55
55
|
get rememberMeCookieName(): string;
|
|
56
56
|
/** Whether "keep me signed in" is wired at all. */
|
|
57
57
|
get usesRememberMeTokens(): boolean;
|
|
58
|
+
/**
|
|
59
|
+
* Whether the current user was revived from a remember-me cookie rather
|
|
60
|
+
* than signing in (AdonisJS `viaRemember`).
|
|
61
|
+
*
|
|
62
|
+
* This is the distinction that lets an app demand the password again before
|
|
63
|
+
* something sensitive — changing an email, spending money, deleting an
|
|
64
|
+
* account. Nothing reported it, so a session restored from a cookie looked
|
|
65
|
+
* exactly like one where the user had just typed their password.
|
|
66
|
+
*/
|
|
67
|
+
get viaRemember(): boolean;
|
|
68
|
+
/**
|
|
69
|
+
* Whether a remember-me token was even tried on this request (AdonisJS
|
|
70
|
+
* `attemptedViaRemember`) — true whether or not it worked.
|
|
71
|
+
*/
|
|
72
|
+
get attemptedViaRemember(): boolean;
|
|
73
|
+
/**
|
|
74
|
+
* Whether `logout()` ran on this guard (AdonisJS `isLoggedOut`).
|
|
75
|
+
*
|
|
76
|
+
* A handler that logs out and then keeps working — clearing a cart, writing
|
|
77
|
+
* an audit line — could not tell that the session was already gone.
|
|
78
|
+
*/
|
|
79
|
+
get isLoggedOut(): boolean;
|
|
80
|
+
/** The session key the user id is stored under (AdonisJS `sessionKeyName`). */
|
|
81
|
+
get sessionKeyName(): string;
|
|
82
|
+
/** The cookie key the remember-me token is stored under (AdonisJS `rememberMeKeyName`). */
|
|
83
|
+
get rememberMeKeyName(): string;
|
|
58
84
|
/**
|
|
59
85
|
* Mint a remember-me token for `user` and return the cookie value the caller
|
|
60
86
|
* must set. `null` when the feature is not wired.
|