@c9up/warden 0.1.20 → 0.1.22

package/src/bouncer/AuthorizationResponse.ts

@@ -15,6 +15,12 @@ export class AuthorizationResponse {
 	/** i18n binding set via {@link t} (Adonis `AuthorizationResponse.t`). */
 	translation?: { identifier: string; data?: Record<string, unknown> };
 
+	/**
+	 * Private because a response is only ever built through allow() / deny(), so the pair stays consistent.
+	 *
+	 * `private` and not `#`: a private CONSTRUCTOR has no native form. It is the
+	 * one place the keyword expresses something `#` cannot.
+	 */
 	private constructor(authorized: boolean, message?: string, status?: number) {
 		this.authorized = authorized;
 		this.message = message;

package/src/native/generated.ts

@@ -0,0 +1,23 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+
+export declare function jwtSign(payload: string, secret: string): string;
+
+export declare function jwtVerify(token: string, secret: string): string;
+
+export declare function constantTimeEq(a: string, b: string): boolean;
+
+export declare function hmacSign(data: string, secret: string): string;
+
+export declare function hmacVerify(
+	data: string,
+	signature: string,
+	secret: string,
+): boolean;
+
+export declare function randomBytes(len: number): string;
+
+export declare function randomHex(len: number): string;

package/src/native.ts

@@ -21,15 +21,14 @@ const platformMap: Record<string, string> = {
 	"win32-x64": "win32-x64-msvc",
 };
 
-export interface NativeWarden {
-	jwtSign(payload: string, secret: string): string;
-	jwtVerify(token: string, secret: string): string;
-	constantTimeEq(a: string, b: string): boolean;
-	hmacSign(data: string, secret: string): string;
-	hmacVerify(data: string, signature: string, secret: string): boolean;
-	randomBytes(len: number): string;
-	randomHex(len: number): string;
-}
+/**
+ * The engine's surface, as the Rust declares it.
+ *
+ * Derived from `./native/generated.js` — written by `pnpm build:napi-types`
+ * from napi-derive's own `type-def` output — rather than restated here, where
+ * nothing would notice a `pub fn` gaining a parameter or changing its return.
+ */
+export type NativeWarden = typeof import("./native/generated.js");
 
 let native: NativeWarden | undefined;
 

package/src/rights/MemoryRightsStore.ts

@@ -15,11 +15,11 @@ import { type RightsStore, type Scope, scopeKey } from "./types.js";
 
 export class MemoryRightsStore implements RightsStore {
 	/** scopeKey → role → permissions */
-	private readonly roleDefs = new Map<string, Map<string, Set<string>>>();
+	readonly #roleDefs = new Map<string, Map<string, Set<string>>>();
 	/** scopeKey → userId → roles */
-	private readonly userRoleMap = new Map<string, Map<string, Set<string>>>();
+	readonly #userRoleMap = new Map<string, Map<string, Set<string>>>();
 	/** scopeKey → userId → directly granted permissions */
-	private readonly userGrantMap = new Map<string, Map<string, Set<string>>>();
+	readonly #userGrantMap = new Map<string, Map<string, Set<string>>>();
 
 	// — read contract —
 
@@ -27,15 +27,15 @@ export class MemoryRightsStore implements RightsStore {
 		role: string,
 		scope: Scope,
 	): Promise<readonly string[]> {
-		return snapshot(this.roleDefs.get(scopeKey(scope))?.get(role));
+		return snapshot(this.#roleDefs.get(scopeKey(scope))?.get(role));
 	}
 
 	async userRoles(userId: string, scope: Scope): Promise<readonly string[]> {
-		return snapshot(this.userRoleMap.get(scopeKey(scope))?.get(userId));
+		return snapshot(this.#userRoleMap.get(scopeKey(scope))?.get(userId));
 	}
 
 	async userGrants(userId: string, scope: Scope): Promise<readonly string[]> {
-		return snapshot(this.userGrantMap.get(scopeKey(scope))?.get(userId));
+		return snapshot(this.#userGrantMap.get(scopeKey(scope))?.get(userId));
 	}
 
 	// — seeding (in-memory driver only; not part of RightsStore) —
@@ -45,24 +45,24 @@ export class MemoryRightsStore implements RightsStore {
 		permissions: readonly string[],
 		scope: Scope = "global",
 	): this {
-		const set = bucket(this.roleDefs, scopeKey(scope), role);
+		const set = bucket(this.#roleDefs, scopeKey(scope), role);
 		set.clear();
 		for (const perm of permissions) set.add(perm);
 		return this;
 	}
 
 	assignRole(userId: string, role: string, scope: Scope = "global"): this {
-		bucket(this.userRoleMap, scopeKey(scope), userId).add(role);
+		bucket(this.#userRoleMap, scopeKey(scope), userId).add(role);
 		return this;
 	}
 
 	grant(userId: string, permission: string, scope: Scope = "global"): this {
-		bucket(this.userGrantMap, scopeKey(scope), userId).add(permission);
+		bucket(this.#userGrantMap, scopeKey(scope), userId).add(permission);
 		return this;
 	}
 
 	revoke(userId: string, permission: string, scope: Scope = "global"): this {
-		this.userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
+		this.#userGrantMap.get(scopeKey(scope))?.get(userId)?.delete(permission);
 		return this;
 	}
 }