@ddd-ts-kit/auth 0.0.0-stage → 0.1.0

package/dist/jwt/session-of-claims.js

@@ -0,0 +1,71 @@
+/** RFC 8693: the party acting for the subject is the `sub` of the `act` claim. */
+const ACTOR_CLAIM = 'act';
+const NEVER_ISSUED = new Date(0);
+/**
+ * The session a verified token stands for. Registered claims only (RFC 7519, OpenID Connect
+ * Core, RFC 8176, RFC 8693): the identity provider decides what they say.
+ */
+export function sessionOfClaims(claims, actor, options) {
+    const issuedAt = instantOf(claims['iat']);
+    return {
+        id: textOf(claims['sid']) ?? textOf(claims['jti']) ?? `${actor.id}@${String(issuedAt?.getTime() ?? 0)}`,
+        actor,
+        issuedAt: issuedAt ?? NEVER_ISSUED,
+        authenticationMethod: methodOf(claims, options.authenticationMethod),
+        ...optional('expiresAt', instantOf(claims['exp'])),
+        ...optional('authenticationStrength', strengthOf(claims)),
+        ...optional('impersonatedBy', impersonatorOf(claims[options.impersonatorClaim ?? ACTOR_CLAIM])),
+        ...optional('locale', textOf(claims['locale'])),
+        ...optional('timeZone', textOf(claims['zoneinfo'])),
+        extensions: options.toSessionExtensions?.(claims) ?? {},
+    };
+}
+/** A NumericDate (RFC 7519): seconds since the epoch. */
+function instantOf(claim) {
+    return typeof claim === 'number' && Number.isFinite(claim) ? new Date(claim * 1000) : undefined;
+}
+function textOf(claim) {
+    return typeof claim === 'string' && claim !== '' ? claim : undefined;
+}
+function methodOf(claims, configured) {
+    if (typeof configured === 'function') {
+        return configured(claims);
+    }
+    return configured ?? (methodReferencesOf(claims)?.includes('pwd') === true ? 'password' : 'token');
+}
+function methodReferencesOf(claims) {
+    const references = claims['amr'];
+    if (!Array.isArray(references)) {
+        return undefined;
+    }
+    return references.filter((reference) => typeof reference === 'string');
+}
+function optional(key, value) {
+    if (value === undefined) {
+        return {};
+    }
+    const present = {};
+    present[key] = value;
+    return present;
+}
+/** `amr` (RFC 8176) says how; `acr` says how sure, in the vocabulary of the provider. */
+function strengthOf(claims) {
+    const references = methodReferencesOf(claims);
+    const assuranceLevel = textOf(claims['acr']);
+    if (references === undefined && assuranceLevel === undefined) {
+        return undefined;
+    }
+    return {
+        ...(references === undefined ? {} : { mfa: references.includes('mfa') }),
+        ...(assuranceLevel === undefined ? {} : { assuranceLevel }),
+    };
+}
+/** The claim is the id itself, or an object naming it under `sub` (RFC 8693) or `id`. */
+function impersonatorOf(claim) {
+    if (typeof claim !== 'object' || claim === null) {
+        return textOf(claim);
+    }
+    const named = { ...claim };
+    return textOf(named['sub']) ?? textOf(named['id']);
+}
+//# sourceMappingURL=session-of-claims.js.map

package/dist/jwt/session-of-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-of-claims.js","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAeA,kFAAkF;AAClF,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAmB,MAAS,EAAE,KAAY,EAAE,OAA+B;IACxG,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE;QACvG,KAAK;QACL,QAAQ,EAAE,QAAQ,IAAI,YAAY;QAClC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACpE,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,GAAG,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,GAAG,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,WAAW,CAAC,CAAC,CAAC;QAC/F,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,UAAU,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CACf,MAAS,EACT,UAA0D;IAE1D,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAA4B,GAAQ,EAAE,KAAwB;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAErB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7C,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/jwt/without-trailing-slashes.d.ts

@@ -0,0 +1,3 @@
+/** `value` without the slashes it ends with. */
+export declare function withoutTrailingSlashes(value: string): string;
+//# sourceMappingURL=without-trailing-slashes.d.ts.map

package/dist/jwt/without-trailing-slashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"without-trailing-slashes.d.ts","sourceRoot":"","sources":["../../src/jwt/without-trailing-slashes.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/jwt/without-trailing-slashes.js

@@ -0,0 +1,9 @@
+/** `value` without the slashes it ends with. */
+export function withoutTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/') {
+        end -= 1;
+    }
+    return value.slice(0, end);
+}
+//# sourceMappingURL=without-trailing-slashes.js.map

package/dist/jwt/without-trailing-slashes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"without-trailing-slashes.js","sourceRoot":"","sources":["../../src/jwt/without-trailing-slashes.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAEvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,3 @@
+export { JwtAuthenticator, type JwtAuthenticatorOptions } from './jwt/jwt-authenticator.js';
+export { keycloakAuthenticator, type KeycloakAuthenticatorOptions } from './jwt/keycloak-authenticator.js';
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,KAAK,4BAA4B,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/jwt.js

@@ -0,0 +1,3 @@
+export { JwtAuthenticator } from './jwt/jwt-authenticator.js';
+export { keycloakAuthenticator } from './jwt/keycloak-authenticator.js';
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgC,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAqC,MAAM,iCAAiC,CAAC"}

package/dist/permissions/define-permissions.d.ts

@@ -0,0 +1,13 @@
+import type { Permission } from './permission.js';
+export interface PermissionDeclaration {
+    readonly description: string;
+}
+export type PermissionSet<Context extends string, Name extends string> = {
+    readonly [N in Name]: Permission<`${Context}:${N}`>;
+};
+/**
+ * The permissions of one bounded context, as data:
+ * `definePermissions('billing', { 'invoice.issue': { description: 'Issue an invoice' } })`.
+ */
+export declare function definePermissions<const Context extends string, const Declarations extends Readonly<Record<string, PermissionDeclaration>>>(context: Context, declarations: Declarations): PermissionSet<Context, keyof Declarations & string>;
+//# sourceMappingURL=define-permissions.d.ts.map

package/dist/permissions/define-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-permissions.d.ts","sourceRoot":"","sources":["../../src/permissions/define-permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAAI;IACvE,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,OAAO,IAAI,CAAC,EAAE,CAAC;CACpD,CAAC;AAKF;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,CAAC,OAAO,SAAS,MAAM,EAC5B,KAAK,CAAC,YAAY,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,EAC1E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,YAAY,GAAG,MAAM,CAAC,CAWnG"}

package/dist/permissions/define-permissions.js

@@ -0,0 +1,23 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+const CONTEXT_PATTERN = /^[a-z][a-z0-9-]*$/;
+const NAME_PATTERN = /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*$/;
+/**
+ * The permissions of one bounded context, as data:
+ * `definePermissions('billing', { 'invoice.issue': { description: 'Issue an invoice' } })`.
+ */
+export function definePermissions(context, declarations) {
+    assertMatches(context, CONTEXT_PATTERN, 'context');
+    const permissions = Object.entries(declarations).map(([name, { description }]) => {
+        assertMatches(name, NAME_PATTERN, 'permission');
+        return [name, Object.freeze({ id: `${context}:${name}`, context, name, description })];
+    });
+    // eslint-disable-next-line ddd-ts-kit/clean-no-escape-hatch -- one entry was built per key of Declarations with the id of that key, which the compiler cannot follow through Object.fromEntries
+    return Object.freeze(Object.fromEntries(permissions));
+}
+function assertMatches(value, pattern, what) {
+    if (pattern.test(value)) {
+        return;
+    }
+    throw new AuthorizationSetupError(`"${value}" is not a valid ${what} name: lower-case words, digits and dashes${what === 'permission' ? ', dot-separated' : ''}.`);
+}
+//# sourceMappingURL=define-permissions.js.map

package/dist/permissions/define-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-permissions.js","sourceRoot":"","sources":["../../src/permissions/define-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAWjF,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAG/B,OAAgB,EAAE,YAA0B;IAC5C,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE;QAC/E,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAEhD,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,gMAAgM;IAChM,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAwD,CAAC;AAC/G,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;IACjE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uBAAuB,CAC/B,IAAI,KAAK,oBAAoB,IAAI,6CAA6C,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,CAChI,CAAC;AACJ,CAAC"}

package/dist/permissions/grant-covers.d.ts

@@ -0,0 +1,3 @@
+import type { Permission } from './permission.js';
+export declare function grantCovers(pattern: string, permission: Permission): boolean;
+//# sourceMappingURL=grant-covers.d.ts.map

package/dist/permissions/grant-covers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-covers.d.ts","sourceRoot":"","sources":["../../src/permissions/grant-covers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAE5E"}

package/dist/permissions/grant-covers.js

@@ -0,0 +1,5 @@
+import { EVERYTHING } from './grant-pattern.js';
+export function grantCovers(pattern, permission) {
+    return pattern === EVERYTHING || pattern === permission.id || pattern === `${permission.context}:*`;
+}
+//# sourceMappingURL=grant-covers.js.map

package/dist/permissions/grant-covers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-covers.js","sourceRoot":"","sources":["../../src/permissions/grant-covers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,UAAsB;IACjE,OAAO,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,CAAC,EAAE,IAAI,OAAO,KAAK,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC;AACtG,CAAC"}

package/dist/permissions/grant-pattern.d.ts

@@ -0,0 +1,5 @@
+import type { Grant } from './grant.js';
+/** The pattern that grants every permission of every context. */
+export declare const EVERYTHING = "*";
+export declare function grantPattern(grant: Grant): string;
+//# sourceMappingURL=grant-pattern.d.ts.map

package/dist/permissions/grant-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-pattern.d.ts","sourceRoot":"","sources":["../../src/permissions/grant-pattern.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,iEAAiE;AACjE,eAAO,MAAM,UAAU,MAAM,CAAC;AAI9B,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAQjD"}

package/dist/permissions/grant-pattern.js

@@ -0,0 +1,12 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+/** The pattern that grants every permission of every context. */
+export const EVERYTHING = '*';
+const GRANT_PATTERN = /^[a-z][a-z0-9-]*:(\*|[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*)$/;
+export function grantPattern(grant) {
+    const pattern = typeof grant === 'string' ? grant : grant.id;
+    if (pattern !== EVERYTHING && !GRANT_PATTERN.test(pattern)) {
+        throw new AuthorizationSetupError(`"${pattern}" is not a grant: use a permission, its id, "<context>:*" or "*".`);
+    }
+    return pattern;
+}
+//# sourceMappingURL=grant-pattern.js.map

package/dist/permissions/grant-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-pattern.js","sourceRoot":"","sources":["../../src/permissions/grant-pattern.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,iEAAiE;AACjE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAE9B,MAAM,aAAa,GAAG,4DAA4D,CAAC;AAEnF,MAAM,UAAU,YAAY,CAAC,KAAY;IACvC,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAE7D,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,IAAI,OAAO,mEAAmE,CAAC,CAAC;IACpH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/permissions/grant.d.ts

@@ -0,0 +1,4 @@
+import type { Permission } from './permission.js';
+/** A permission, its id, every permission of a context (`billing:*`) or everything (`*`). */
+export type Grant = Permission | string;
+//# sourceMappingURL=grant.d.ts.map

package/dist/permissions/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../src/permissions/grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,6FAA6F;AAC7F,MAAM,MAAM,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC"}

package/dist/permissions/grant.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=grant.js.map

package/dist/permissions/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../../src/permissions/grant.ts"],"names":[],"mappings":""}

package/dist/permissions/is-permission.d.ts

@@ -0,0 +1,3 @@
+import type { Permission } from './permission.js';
+export declare function isPermission(value: unknown): value is Permission;
+//# sourceMappingURL=is-permission.d.ts.map

package/dist/permissions/is-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-permission.d.ts","sourceRoot":"","sources":["../../src/permissions/is-permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAUhE"}

package/dist/permissions/is-permission.js

@@ -0,0 +1,10 @@
+export function isPermission(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    if (!('id' in value) || !('context' in value) || !('name' in value) || !('description' in value)) {
+        return false;
+    }
+    return typeof value.id === 'string' && value.id === `${String(value.context)}:${String(value.name)}`;
+}
+//# sourceMappingURL=is-permission.js.map

package/dist/permissions/is-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-permission.js","sourceRoot":"","sources":["../../src/permissions/is-permission.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE,CAAC;QACjG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AACvG,CAAC"}

package/dist/permissions/permission-registry.d.ts

@@ -0,0 +1,12 @@
+import type { Permission } from './permission.js';
+/** Every permission of the application, for generated documentation and administration screens. */
+export declare class PermissionRegistry {
+    private readonly byId;
+    static of(...sets: readonly Readonly<Record<string, Permission>>[]): PermissionRegistry;
+    all(): readonly Permission[];
+    contexts(): readonly string[];
+    inContext(context: string): readonly Permission[];
+    find(id: string): Permission | undefined;
+    private add;
+}
+//# sourceMappingURL=permission-registry.d.ts.map

package/dist/permissions/permission-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-registry.d.ts","sourceRoot":"","sources":["../../src/permissions/permission-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,mGAAmG;AACnG,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IAEtD,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,GAAG,kBAAkB,CAQtF;IAED,GAAG,IAAI,SAAS,UAAU,EAAE,CAE3B;IAED,QAAQ,IAAI,SAAS,MAAM,EAAE,CAE5B;IAED,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,CAEhD;IAED,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEvC;IAED,OAAO,CAAC,GAAG;CAOZ"}

package/dist/permissions/permission-registry.js

@@ -0,0 +1,31 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+/** Every permission of the application, for generated documentation and administration screens. */
+export class PermissionRegistry {
+    byId = new Map();
+    static of(...sets) {
+        const registry = new PermissionRegistry();
+        for (const permission of sets.flatMap((set) => Object.values(set))) {
+            registry.add(permission);
+        }
+        return registry;
+    }
+    all() {
+        return [...this.byId.values()].sort((left, right) => left.id.localeCompare(right.id));
+    }
+    contexts() {
+        return [...new Set(this.all().map((permission) => permission.context))];
+    }
+    inContext(context) {
+        return this.all().filter((permission) => permission.context === context);
+    }
+    find(id) {
+        return this.byId.get(id);
+    }
+    add(permission) {
+        if (this.byId.has(permission.id)) {
+            throw new AuthorizationSetupError(`Permission "${permission.id}" is declared twice.`);
+        }
+        this.byId.set(permission.id, permission);
+    }
+}
+//# sourceMappingURL=permission-registry.js.map

package/dist/permissions/permission-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-registry.js","sourceRoot":"","sources":["../../src/permissions/permission-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,mGAAmG;AACnG,MAAM,OAAO,kBAAkB;IACZ,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEtD,MAAM,CAAC,EAAE,CAAC,GAAG,IAAqD;QAChE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,EAAU;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAEO,GAAG,CAAC,UAAsB;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,eAAe,UAAU,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/permissions/permission.d.ts

@@ -0,0 +1,9 @@
+/** A right somebody may hold, declared once by the context that owns it. */
+export interface Permission<Id extends string = string> {
+    /** Stable and unique: `<context>:<name>`. What roles, policies and audit trails refer to. */
+    readonly id: Id;
+    readonly context: string;
+    readonly name: string;
+    readonly description: string;
+}
+//# sourceMappingURL=permission.d.ts.map

package/dist/permissions/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/permissions/permission.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,UAAU,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM;IACpD,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}

package/dist/permissions/permission.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permission.js.map

package/dist/permissions/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/permissions/permission.ts"],"names":[],"mappings":""}

package/dist/policies/define-policy.d.ts

@@ -0,0 +1,4 @@
+import type { Policy } from './policy.js';
+/** Lives in `application/authorization/<name>.policy.ts`, with a spec of its own. */
+export declare function definePolicy<Subject>(policy: Policy<Subject>): Policy<Subject>;
+//# sourceMappingURL=define-policy.d.ts.map

package/dist/policies/define-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-policy.d.ts","sourceRoot":"","sources":["../../src/policies/define-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAQ9E"}

package/dist/policies/define-policy.js

@@ -0,0 +1,10 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+const POLICY_NAME_PATTERN = /^[a-z][a-z0-9]*([.-][a-z0-9]+)*$/;
+/** Lives in `application/authorization/<name>.policy.ts`, with a spec of its own. */
+export function definePolicy(policy) {
+    if (!POLICY_NAME_PATTERN.test(policy.name)) {
+        throw new AuthorizationSetupError(`"${policy.name}" is not a valid policy name: lower-case words separated by dots or dashes, as it becomes a reason code.`);
+    }
+    return Object.freeze({ ...policy });
+}
+//# sourceMappingURL=define-policy.js.map

package/dist/policies/define-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-policy.js","sourceRoot":"","sources":["../../src/policies/define-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAE/D,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAU,MAAuB;IAC3D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,CAAC,IAAI,0GAA0G,CAC1H,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/policies/policy-access.d.ts

@@ -0,0 +1,32 @@
+import { type Actor, type Clock } from '@ddd-ts-kit/kernel';
+import type { Access } from '../authorization/access.js';
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import { type Decision } from '../authorization/decision.js';
+import type { OnDecision } from '../authorization/on-decision.js';
+import type { ResourceRef } from '../authorization/resource-ref.js';
+import type { Permission } from '../permissions/permission.js';
+import type { Policy } from './policy.js';
+export interface PolicyAccessOptions {
+    /** Asked after the policies, with the resource the subject stands for. */
+    readonly authorizer?: Authorizer;
+    readonly policies?: readonly Policy<unknown>[];
+    readonly clock: Clock;
+    /** How a subject (an aggregate, a read model) names its resource. Default: a `ResourceRef` is itself. */
+    readonly resourceOf?: (subject: unknown) => ResourceRef | undefined;
+    readonly onDecision?: OnDecision;
+}
+/** No policy and no authorizer can answer for the permission: refused, as everything undeclared. */
+export declare const NO_POLICY = "NO_POLICY";
+/** The `Access` of this package: every policy of the permission, then the authorizer, must allow. */
+export declare class PolicyAccess implements Access {
+    private readonly options;
+    private readonly policiesByPermission;
+    constructor(options: PolicyAccessOptions);
+    authorize(actor: Actor, permission: Permission, subject: unknown): Promise<void>;
+    decide(actor: Actor, permission: Permission, subject: unknown): Promise<Decision>;
+    scope(actor: Actor, permission: Permission, resourceType: string): Promise<AccessScope>;
+    private resourceOf;
+    private evaluate;
+}
+//# sourceMappingURL=policy-access.d.ts.map

package/dist/policies/policy-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-access.d.ts","sourceRoot":"","sources":["../../src/policies/policy-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAI5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAIpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yGAAyG;IACzG,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,oGAAoG;AACpG,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,qGAAqG;AACrG,qBAAa,YAAa,YAAW,MAAM;IAG7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAwC;IAE7E,YAA6B,OAAO,EAAE,mBAAmB,EAMxD;IAEK,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrF;IAEK,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQtF;IAEK,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAY5F;IAED,OAAO,CAAC,UAAU;YAIJ,QAAQ;CAoBvB"}

package/dist/policies/policy-access.js

@@ -0,0 +1,78 @@
+import { isAnonymous } from '@ddd-ts-kit/kernel';
+import { ALLOWED, deny } from '../authorization/decision.js';
+import { decisionRecordOf } from '../authorization/decision-record-of.js';
+import { DenialReason } from '../authorization/denial-reason.js';
+import { isResourceRef } from '../authorization/is-resource-ref.js';
+import { ForbiddenError } from '../errors/forbidden-error.js';
+import { ListingNotSupportedError } from '../errors/listing-not-supported-error.js';
+import { UnauthenticatedError } from '../errors/unauthenticated-error.js';
+/** No policy and no authorizer can answer for the permission: refused, as everything undeclared. */
+export const NO_POLICY = 'NO_POLICY';
+/** The `Access` of this package: every policy of the permission, then the authorizer, must allow. */
+export class PolicyAccess {
+    options;
+    policiesByPermission = new Map();
+    constructor(options) {
+        this.options = options;
+        for (const policy of options.policies ?? []) {
+            const sharing = this.policiesByPermission.get(policy.permission.id) ?? [];
+            this.policiesByPermission.set(policy.permission.id, [...sharing, policy]);
+        }
+    }
+    async authorize(actor, permission, subject) {
+        const decision = await this.decide(actor, permission, subject);
+        if (decision.allowed) {
+            return;
+        }
+        throw isAnonymous(actor) ? new UnauthenticatedError() : new ForbiddenError(permission.id, decision.reason);
+    }
+    async decide(actor, permission, subject) {
+        const resource = this.resourceOf(subject);
+        const request = { actor, permission, ...(resource === undefined ? {} : { resource }), context: { subject } };
+        const decision = isAnonymous(actor) ? deny(DenialReason.anonymous) : await this.evaluate(request, subject);
+        await this.options.onDecision?.(decisionRecordOf(request, decision));
+        return decision;
+    }
+    async scope(actor, permission, resourceType) {
+        if (isAnonymous(actor)) {
+            return { kind: 'none' };
+        }
+        const { authorizer } = this.options;
+        if (authorizer?.listAccessible === undefined) {
+            throw new ListingNotSupportedError();
+        }
+        return authorizer.listAccessible({ actor, permission, resourceType });
+    }
+    resourceOf(subject) {
+        return (this.options.resourceOf ?? resourceRefOf)(subject);
+    }
+    async evaluate(request, subject) {
+        const policies = this.policiesByPermission.get(request.permission.id) ?? [];
+        const { authorizer, clock } = this.options;
+        if (policies.length === 0 && authorizer === undefined) {
+            return deny(NO_POLICY);
+        }
+        const context = { now: clock.now() };
+        for (const policy of policies) {
+            const verdict = verdictOf(policy, { actor: request.actor, subject }, context);
+            if (!verdict.allowed) {
+                return verdict;
+            }
+        }
+        return authorizer === undefined ? ALLOWED : authorizer.check(request);
+    }
+}
+function resourceRefOf(subject) {
+    return isResourceRef(subject) ? subject : undefined;
+}
+function verdictOf(policy, { actor, subject }, context) {
+    if (policy.appliesTo !== undefined && !policy.appliesTo(subject)) {
+        return deny(DenialReason.subjectMismatch);
+    }
+    const verdict = policy.allows(actor, subject, context);
+    if (typeof verdict !== 'boolean') {
+        return verdict;
+    }
+    return verdict ? ALLOWED : deny(policy.name);
+}
+//# sourceMappingURL=policy-access.js.map

package/dist/policies/policy-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-access.js","sourceRoot":"","sources":["../../src/policies/policy-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAA0B,MAAM,oBAAoB,CAAC;AAKzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAiB,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAe1E,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,qGAAqG;AACrG,MAAM,OAAO,YAAY;IAGM,OAAO;IAFnB,oBAAoB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAE7E,YAA6B,OAA4B;uBAA5B,OAAO;QAClC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAE1E,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAY,EAAE,UAAsB,EAAE,OAAgB;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAE/D,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,UAAsB,EAAE,OAAgB;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7G,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3G,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAErE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAY,EAAE,UAAsB,EAAE,YAAoB;QACpE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEpC,IAAI,UAAU,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,UAAU,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,UAAU,CAAC,OAAgB;QACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,OAAgB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YAE9E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;CACF;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAOD,SAAS,SAAS,CAAC,MAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAU,EAAE,OAAsB;IAC5F,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvD,IAAI,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/policies/policy-context.d.ts

@@ -0,0 +1,5 @@
+export interface PolicyContext {
+    /** From the `Clock` port, so a rule about time is testable. */
+    readonly now: Date;
+}
+//# sourceMappingURL=policy-context.d.ts.map

package/dist/policies/policy-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-context.d.ts","sourceRoot":"","sources":["../../src/policies/policy-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB"}

package/dist/policies/policy-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-context.js.map

package/dist/policies/policy-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-context.js","sourceRoot":"","sources":["../../src/policies/policy-context.ts"],"names":[],"mappings":""}

package/dist/policies/policy.d.ts

@@ -0,0 +1,18 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { Decision } from '../authorization/decision.js';
+import type { Permission } from '../permissions/permission.js';
+import type { PolicyContext } from './policy-context.js';
+/**
+ * A named rule that needs loaded state: "only the author may edit, and not after publication".
+ * `allows` is declared with method syntax on purpose: a method parameter is compared
+ * bivariantly, so policies about different subjects can be listed together.
+ */
+export interface Policy<Subject> {
+    /** Stable: it is the reason of the refusal when `allows` answers `false`. */
+    readonly name: string;
+    readonly permission: Permission;
+    /** Tells whether a value is a subject of this policy; anything else is refused. */
+    appliesTo?(subject: unknown): subject is Subject;
+    allows(actor: Actor, subject: Subject, context: PolicyContext): boolean | Decision;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/policies/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policies/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,mFAAmF;IACnF,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC;IACjD,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;CACpF"}

package/dist/policies/policy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy.js.map

package/dist/policies/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policies/policy.ts"],"names":[],"mappings":""}

package/dist/rbac/role-based-authorizer.d.ts

@@ -0,0 +1,35 @@
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { CheckRequest } from '../authorization/check-request.js';
+import { type Decision } from '../authorization/decision.js';
+import type { ListRequest } from '../authorization/list-request.js';
+import type { Grant } from '../permissions/grant.js';
+export interface RoleBasedAuthorizerOptions {
+    /** What each role grants: permissions, `billing:*` for a whole context, `*` for everything. */
+    readonly roles: Readonly<Record<string, readonly Grant[]>>;
+    /** The roles a role includes: `{ admin: ['accountant'] }` gives an admin all an accountant has. */
+    readonly inherits?: Readonly<Record<string, readonly string[]>>;
+    /**
+     * Turns the tenant check on: the tenant the request targets, or `undefined` when it targets
+     * none. A request about another tenant than the actor's is refused. See `tenantOfContext`.
+     */
+    readonly tenantOf?: (request: CheckRequest) => string | undefined | Promise<string | undefined>;
+    /** Roles that act across tenants, such as a platform operator. */
+    readonly crossTenantRoles?: readonly string[];
+    /** The role given to actors of type `system`, which carry none. Default: no role. */
+    readonly systemRole?: string;
+}
+/** RBAC: an actor may do what one of its roles grants. It decides on actions, not on elements. */
+export declare class RoleBasedAuthorizer implements Authorizer {
+    private readonly options;
+    private readonly grants;
+    constructor(options: RoleBasedAuthorizerOptions);
+    check(request: CheckRequest): Promise<Decision>;
+    /** Constant time: everything, nothing, or the rows of the actor's tenant. */
+    listAccessible({ actor, permission }: ListRequest): Promise<AccessScope>;
+    private holds;
+    private rolesOf;
+    private targetsAnotherTenant;
+    private crossesTenants;
+}
+//# sourceMappingURL=role-based-authorizer.d.ts.map

package/dist/rbac/role-based-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-based-authorizer.d.ts","sourceRoot":"","sources":["../../src/rbac/role-based-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAKrD,MAAM,WAAW,0BAA0B;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3D,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChG,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,kGAAkG;AAClG,qBAAa,mBAAoB,YAAW,UAAU;IAGxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,YAA6B,OAAO,EAAE,0BAA0B,EAE/D;IAEK,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAUpD;IAED,6EAA6E;IACvE,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAU7E;IAED,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,OAAO;YAMD,oBAAoB;IAUlC,OAAO,CAAC,cAAc;CAKvB"}