@ddd-ts-kit/auth 0.0.0-stage → 0.1.0

package/dist/rebac/relation-based-authorizer.js

@@ -0,0 +1,113 @@
+import { isAnonymous } from '@ddd-ts-kit/kernel';
+import { ALLOWED, deny } from '../authorization/decision.js';
+import { DenialReason } from '../authorization/denial-reason.js';
+import { Evaluation } from './evaluation.js';
+import { objectOf } from './object-of.js';
+import { parseObject } from './parse-object.js';
+import { ReverseExpansionLimitError } from './reverse-expansion-limit-error.js';
+import { SchemaError } from './schema-error.js';
+const DEFAULT_MAX_DEPTH = 16;
+const DEFAULT_LIST_LIMIT = 10_000;
+/**
+ * ReBAC in the manner of Zanzibar, evaluated in process: a permission holds when the rewrites
+ * of the schema find a path of stored tuples from the object to the actor.
+ */
+export class RelationBasedAuthorizer {
+    options;
+    constructor(options) {
+        this.options = options;
+        assertMappingResolves(options);
+    }
+    async check(request) {
+        if (isAnonymous(request.actor)) {
+            return deny(DenialReason.anonymous);
+        }
+        if (request.resource === undefined) {
+            return deny(DenialReason.resourceRequired);
+        }
+        const name = this.mapped(request.resource.type, request.permission);
+        if (name === undefined) {
+            return deny(DenialReason.unmappedPermission);
+        }
+        const evaluation = this.evaluation(request.actor, { exhaustive: false });
+        const { allowed } = await evaluation.evaluate(objectOf(request.resource), name);
+        if (evaluation.depthExceeded) {
+            return deny(DenialReason.depthExceeded);
+        }
+        return allowed ? ALLOWED : deny(DenialReason.noRelation);
+    }
+    /**
+     * By reverse expansion: walks every tuple reachable from the actor, then checks each object
+     * of the type it met. Cost: one read per reachable subject and userset, plus one check per
+     * candidate. Fine for thousands of tuples per actor, not for a search index.
+     */
+    async listAccessible({ actor, permission, resourceType }) {
+        const name = this.mapped(resourceType, permission);
+        if (isAnonymous(actor) || name === undefined) {
+            return { kind: 'none' };
+        }
+        const ids = [];
+        for (const object of await this.reachable(this.subjectOf(actor), resourceType)) {
+            const evaluation = this.evaluation(actor, { exhaustive: false });
+            const { allowed } = await evaluation.evaluate(object, name);
+            if (allowed && !evaluation.depthExceeded) {
+                ids.push(parseObject(object).id);
+            }
+        }
+        return { kind: 'ids', ids: ids.sort() };
+    }
+    /** Why is this allowed, or not: the whole evaluation tree, every branch visited. For debugging. */
+    async expand(request) {
+        const name = this.mapped(request.resource.type, request.permission);
+        if (name === undefined) {
+            throw new SchemaError(`No schema permission is mapped to "${request.permission.id}" for "${request.resource.type}".`);
+        }
+        return this.evaluation(request.actor, { exhaustive: true }).evaluate(objectOf(request.resource), name);
+    }
+    mapped(resourceType, permission) {
+        return this.options.mapping[resourceType]?.[permission.id];
+    }
+    evaluation(actor, { exhaustive }) {
+        const { schema, store, maxDepth = DEFAULT_MAX_DEPTH } = this.options;
+        return new Evaluation({ schema, store, subject: this.subjectOf(actor), maxDepth, exhaustive });
+    }
+    subjectOf(actor) {
+        return this.options.subjectOf?.(actor) ?? `${actor.type}:${actor.id}`;
+    }
+    async reachable(subject, resourceType) {
+        const { store, listLimit = DEFAULT_LIST_LIMIT } = this.options;
+        const seen = new Set([subject]);
+        const candidates = new Set();
+        // A set also iterates over what is added while iterating: `seen` is the queue of the walk.
+        for (const current of seen) {
+            if (seen.size > listLimit) {
+                throw new ReverseExpansionLimitError(listLimit);
+            }
+            for (const { object } of await store.readBySubject(current)) {
+                if (parseObject(object).type === resourceType) {
+                    candidates.add(object);
+                }
+                for (const next of this.subjectFormsOf(object)) {
+                    seen.add(next);
+                }
+            }
+        }
+        return [...candidates];
+    }
+    /** How an object may itself be the subject of a tuple: as such, or as one of its usersets. */
+    subjectFormsOf(object) {
+        const { type } = parseObject(object);
+        return [object, ...this.options.schema.usersetsOf(type).map((relation) => `${object}#${relation}`)];
+    }
+}
+function assertMappingResolves({ schema, mapping }) {
+    for (const [type, names] of Object.entries(mapping)) {
+        for (const [permissionId, name] of Object.entries(names)) {
+            if (schema.resolve(type, name) !== undefined) {
+                continue;
+            }
+            throw new SchemaError(`"${permissionId}" is mapped to "${type}#${name}", which the schema does not declare.`);
+        }
+    }
+}
+//# sourceMappingURL=relation-based-authorizer.js.map

package/dist/rebac/relation-based-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-based-authorizer.js","sourceRoot":"","sources":["../../src/rebac/relation-based-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAiB,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAchD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACL,OAAO;IAApC,YAA6B,OAAuC;uBAAvC,OAAO;QAClC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAe;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAEnD,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,MAAM,CAAC,OAA0E;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CACnB,sCAAsC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACzG,CAAC;IAEO,MAAM,CAAC,YAAoB,EAAE,UAAsB;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,UAAU,CAAC,KAAY,EAAE,EAAE,UAAU,EAAoC;QAC/E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAErE,OAAO,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;IAEO,SAAS,CAAC,KAAY;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,YAAoB;QAC3D,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,2FAA2F;QAC3F,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;YAED,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9C,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,8FAA8F;IACtF,cAAc,CAAC,MAAc;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAErC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAkC;IAChF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,IAAI,YAAY,mBAAmB,IAAI,IAAI,IAAI,uCAAuC,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/rebac/relation-tuple-store.d.ts

@@ -0,0 +1,16 @@
+import type { RelationTuple } from './relation-tuple.js';
+/**
+ * Where relation tuples live. A SQL adapter writes in the transaction of the current unit of
+ * work, so a tuple and the aggregate it describes are committed together.
+ */
+export declare abstract class RelationTupleStore {
+    static readonly tokenKey = "auth.RelationTupleStore";
+    /** Writing a tuple that exists changes nothing. */
+    abstract write(tuples: readonly RelationTuple[]): Promise<void>;
+    /** Deleting a tuple that does not exist changes nothing. */
+    abstract delete(tuples: readonly RelationTuple[]): Promise<void>;
+    abstract readByObject(object: string, relation: string): Promise<readonly RelationTuple[]>;
+    /** Exact match on the subject, a userset included: the reverse lookup. */
+    abstract readBySubject(subject: string): Promise<readonly RelationTuple[]>;
+}
+//# sourceMappingURL=relation-tuple-store.d.ts.map

package/dist/rebac/relation-tuple-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple-store.d.ts","sourceRoot":"","sources":["../../src/rebac/relation-tuple-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,8BAAsB,kBAAkB;IACtC,MAAM,CAAC,QAAQ,CAAC,QAAQ,6BAA6B;IAErD,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAE3F,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;CAC5E"}

package/dist/rebac/relation-tuple-store.js

@@ -0,0 +1,8 @@
+/**
+ * Where relation tuples live. A SQL adapter writes in the transaction of the current unit of
+ * work, so a tuple and the aggregate it describes are committed together.
+ */
+export class RelationTupleStore {
+    static tokenKey = 'auth.RelationTupleStore';
+}
+//# sourceMappingURL=relation-tuple-store.js.map

package/dist/rebac/relation-tuple-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple-store.js","sourceRoot":"","sources":["../../src/rebac/relation-tuple-store.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAgB,kBAAkB;IACtC,MAAM,CAAU,QAAQ,GAAG,yBAAyB,CAAC;CAYtD"}

package/dist/rebac/relation-tuple.d.ts

@@ -0,0 +1,12 @@
+/**
+ * One fact: `subject` has `relation` to `object`. Written `object#relation@subject` in the
+ * Zanzibar paper: `document:1#editor@user:ada`, `document:1#editor@group:eng#member`.
+ */
+export interface RelationTuple {
+    /** Such as `document:1`: the type, a colon, the id. */
+    readonly object: string;
+    readonly relation: string;
+    /** `<type>:<id>`, or the userset `<type>:<id>#<relation>`: everybody having that relation. */
+    readonly subject: string;
+}
+//# sourceMappingURL=relation-tuple.d.ts.map

package/dist/rebac/relation-tuple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple.d.ts","sourceRoot":"","sources":["../../src/rebac/relation-tuple.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B"}

package/dist/rebac/relation-tuple.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=relation-tuple.js.map

package/dist/rebac/relation-tuple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple.js","sourceRoot":"","sources":["../../src/rebac/relation-tuple.ts"],"names":[],"mappings":""}

package/dist/rebac/resolution.d.ts

@@ -0,0 +1,9 @@
+import type { Rewrite } from './rewrite.js';
+export type Resolution = {
+    readonly kind: 'relation';
+    readonly subjects: readonly string[];
+} | {
+    readonly kind: 'permission';
+    readonly rewrite: Rewrite;
+};
+//# sourceMappingURL=resolution.d.ts.map

package/dist/rebac/resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../src/rebac/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC"}

package/dist/rebac/resolution.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolution.js.map

package/dist/rebac/resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.js","sourceRoot":"","sources":["../../src/rebac/resolution.ts"],"names":[],"mappings":""}

package/dist/rebac/reverse-expansion-limit-error.d.ts

@@ -0,0 +1,5 @@
+/** A listing reached more subjects than `listLimit`: an incomplete list is never returned. */
+export declare class ReverseExpansionLimitError extends Error {
+    constructor(limit: number);
+}
+//# sourceMappingURL=reverse-expansion-limit-error.d.ts.map

package/dist/rebac/reverse-expansion-limit-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-expansion-limit-error.d.ts","sourceRoot":"","sources":["../../src/rebac/reverse-expansion-limit-error.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF"}

package/dist/rebac/reverse-expansion-limit-error.js

@@ -0,0 +1,8 @@
+/** A listing reached more subjects than `listLimit`: an incomplete list is never returned. */
+export class ReverseExpansionLimitError extends Error {
+    constructor(limit) {
+        super(`The reverse expansion walked through more than ${limit} subjects. Narrow the model or delegate listing to a dedicated service.`);
+        this.name = 'ReverseExpansionLimitError';
+    }
+}
+//# sourceMappingURL=reverse-expansion-limit-error.js.map

package/dist/rebac/reverse-expansion-limit-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-expansion-limit-error.js","sourceRoot":"","sources":["../../src/rebac/reverse-expansion-limit-error.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,KAAa;QACvB,KAAK,CACH,kDAAkD,KAAK,yEAAyE,CACjI,CAAC;QAEF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF"}

package/dist/rebac/rewrite.d.ts

@@ -0,0 +1,24 @@
+export interface SetRewrite {
+    readonly kind: 'union' | 'intersection';
+    readonly children: readonly Rewrite[];
+}
+export interface ExclusionRewrite {
+    readonly kind: 'exclusion';
+    readonly base: Rewrite;
+    readonly subtract: Rewrite;
+}
+/** Tuple to userset: follow `relation` to other objects and ask `permission` there. */
+export interface FromRewrite {
+    readonly kind: 'from';
+    readonly relation: string;
+    readonly permission: string;
+}
+/** A name alone is a computed userset: another relation or permission of the same object. */
+export type Rewrite = string | SetRewrite | ExclusionRewrite | FromRewrite;
+export declare function union(...children: readonly Rewrite[]): SetRewrite;
+export declare function intersection(...children: readonly Rewrite[]): SetRewrite;
+/** Everybody in `base` who is not in `subtract`. */
+export declare function exclusion(base: Rewrite, subtract: Rewrite): ExclusionRewrite;
+/** `from('parent', 'edit')`: whoever may edit the parent. */
+export declare function from(relation: string, permission: string): FromRewrite;
+//# sourceMappingURL=rewrite.d.ts.map

package/dist/rebac/rewrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../src/rebac/rewrite.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE3E,wBAAgB,KAAK,CAAC,GAAG,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAEjE;AAED,wBAAgB,YAAY,CAAC,GAAG,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAExE;AAED,oDAAoD;AACpD,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAE5E;AAED,6DAA6D;AAC7D,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAEtE"}

package/dist/rebac/rewrite.js

@@ -0,0 +1,15 @@
+export function union(...children) {
+    return { kind: 'union', children };
+}
+export function intersection(...children) {
+    return { kind: 'intersection', children };
+}
+/** Everybody in `base` who is not in `subtract`. */
+export function exclusion(base, subtract) {
+    return { kind: 'exclusion', base, subtract };
+}
+/** `from('parent', 'edit')`: whoever may edit the parent. */
+export function from(relation, permission) {
+    return { kind: 'from', relation, permission };
+}
+//# sourceMappingURL=rewrite.js.map

package/dist/rebac/rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/rebac/rewrite.ts"],"names":[],"mappings":"AAqBA,MAAM,UAAU,KAAK,CAAC,GAAG,QAA4B;IACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,QAA4B;IAC1D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,QAAiB;IACxD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,IAAI,CAAC,QAAgB,EAAE,UAAkB;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC"}

package/dist/rebac/schema-checked-tuple-store.d.ts

@@ -0,0 +1,14 @@
+import type { RelationTuple } from './relation-tuple.js';
+import type { RelationTupleStore } from './relation-tuple-store.js';
+import type { Schema } from './schema.js';
+/** Refuses, on write, a tuple the schema does not describe. Reads and deletions pass through. */
+export declare class SchemaCheckedTupleStore implements RelationTupleStore {
+    private readonly schema;
+    private readonly store;
+    constructor(schema: Schema, store: RelationTupleStore);
+    write(tuples: readonly RelationTuple[]): Promise<void>;
+    delete(tuples: readonly RelationTuple[]): Promise<void>;
+    readByObject(object: string, relation: string): Promise<readonly RelationTuple[]>;
+    readBySubject(subject: string): Promise<readonly RelationTuple[]>;
+}
+//# sourceMappingURL=schema-checked-tuple-store.d.ts.map

package/dist/rebac/schema-checked-tuple-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-checked-tuple-store.d.ts","sourceRoot":"","sources":["../../src/rebac/schema-checked-tuple-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,iGAAiG;AACjG,qBAAa,uBAAwB,YAAW,kBAAkB;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,kBAAkB,EACxC;IAEE,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D;IAED,MAAM,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAEhF;IAED,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAEhE;CACF"}

package/dist/rebac/schema-checked-tuple-store.js

@@ -0,0 +1,25 @@
+/** Refuses, on write, a tuple the schema does not describe. Reads and deletions pass through. */
+export class SchemaCheckedTupleStore {
+    schema;
+    store;
+    constructor(schema, store) {
+        this.schema = schema;
+        this.store = store;
+    }
+    async write(tuples) {
+        for (const tuple of tuples) {
+            this.schema.assertWritable(tuple);
+        }
+        await this.store.write(tuples);
+    }
+    delete(tuples) {
+        return this.store.delete(tuples);
+    }
+    readByObject(object, relation) {
+        return this.store.readByObject(object, relation);
+    }
+    readBySubject(subject) {
+        return this.store.readBySubject(subject);
+    }
+}
+//# sourceMappingURL=schema-checked-tuple-store.js.map

package/dist/rebac/schema-checked-tuple-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-checked-tuple-store.js","sourceRoot":"","sources":["../../src/rebac/schema-checked-tuple-store.ts"],"names":[],"mappings":"AAIA,iGAAiG;AACjG,MAAM,OAAO,uBAAuB;IAEf,MAAM;IACN,KAAK;IAFxB,YACmB,MAAc,EACd,KAAyB;sBADzB,MAAM;qBACN,KAAK;IACrB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,MAAgC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,MAAgC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,QAAgB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/rebac/schema-definition.d.ts

@@ -0,0 +1,3 @@
+import type { TypeDefinition } from './type-definition.js';
+export type SchemaDefinition = Readonly<Record<string, TypeDefinition>>;
+//# sourceMappingURL=schema-definition.d.ts.map

package/dist/rebac/schema-definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-definition.d.ts","sourceRoot":"","sources":["../../src/rebac/schema-definition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC"}

package/dist/rebac/schema-definition.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-definition.js.map

package/dist/rebac/schema-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-definition.js","sourceRoot":"","sources":["../../src/rebac/schema-definition.ts"],"names":[],"mappings":""}

package/dist/rebac/schema-error.d.ts

@@ -0,0 +1,5 @@
+/** A schema that contradicts itself, found when it is defined. */
+export declare class SchemaError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=schema-error.d.ts.map

package/dist/rebac/schema-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-error.d.ts","sourceRoot":"","sources":["../../src/rebac/schema-error.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/rebac/schema-error.js

@@ -0,0 +1,8 @@
+/** A schema that contradicts itself, found when it is defined. */
+export class SchemaError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SchemaError';
+    }
+}
+//# sourceMappingURL=schema-error.js.map

package/dist/rebac/schema-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-error.js","sourceRoot":"","sources":["../../src/rebac/schema-error.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/rebac/schema.d.ts

@@ -0,0 +1,18 @@
+import type { RelationTuple } from './relation-tuple.js';
+import type { Resolution } from './resolution.js';
+import type { Rewrite } from './rewrite.js';
+import type { SchemaDefinition } from './schema-definition.js';
+/** The object types, their relations and how permissions derive from them. Built by `defineSchema`. */
+export declare class Schema {
+    private readonly definition;
+    constructor(definition: SchemaDefinition);
+    types(): readonly string[];
+    relations(type: string): Readonly<Record<string, readonly string[]>>;
+    permissions(type: string): Readonly<Record<string, Rewrite>>;
+    resolve(type: string, name: string): Resolution | undefined;
+    /** The names of `type` that some relation accepts as a userset, such as `member` of a group. */
+    usersetsOf(type: string): readonly string[];
+    /** Refuses a tuple the schema does not describe, before it is stored. */
+    assertWritable(tuple: RelationTuple): void;
+}
+//# sourceMappingURL=schema.d.ts.map

package/dist/rebac/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/rebac/schema.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,uGAAuG;AACvG,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,gBAAgB,EAAI;IAE7D,KAAK,IAAI,SAAS,MAAM,EAAE,CAEzB;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAEnE;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE3D;IAED,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAU1D;IAED,gGAAgG;IAChG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAO1C;IAED,yEAAyE;IACzE,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAczC;CACF"}

package/dist/rebac/schema.js

@@ -0,0 +1,49 @@
+import { InvalidTupleError } from './invalid-tuple-error.js';
+import { parseObject } from './parse-object.js';
+import { parseSubject } from './parse-subject.js';
+/** The object types, their relations and how permissions derive from them. Built by `defineSchema`. */
+export class Schema {
+    definition;
+    constructor(definition) {
+        this.definition = definition;
+    }
+    types() {
+        return Object.keys(this.definition);
+    }
+    relations(type) {
+        return this.definition[type]?.relations ?? {};
+    }
+    permissions(type) {
+        return this.definition[type]?.permissions ?? {};
+    }
+    resolve(type, name) {
+        const subjects = this.relations(type)[name];
+        if (subjects !== undefined) {
+            return { kind: 'relation', subjects };
+        }
+        const rewrite = this.permissions(type)[name];
+        return rewrite === undefined ? undefined : { kind: 'permission', rewrite };
+    }
+    /** The names of `type` that some relation accepts as a userset, such as `member` of a group. */
+    usersetsOf(type) {
+        const accepted = this.types()
+            .flatMap((other) => Object.values(this.relations(other)).flat())
+            .filter((subject) => subject.startsWith(`${type}#`))
+            .map((subject) => subject.slice(type.length + 1));
+        return [...new Set(accepted)];
+    }
+    /** Refuses a tuple the schema does not describe, before it is stored. */
+    assertWritable(tuple) {
+        const { type } = parseObject(tuple.object);
+        const resolution = this.resolve(type, tuple.relation);
+        if (resolution?.kind !== 'relation') {
+            throw new InvalidTupleError(`"${tuple.relation}" is not a relation of "${type}": only relations are written.`);
+        }
+        const subject = parseSubject(tuple.subject);
+        const kind = subject.relation === undefined ? subject.type : `${subject.type}#${subject.relation}`;
+        if (!resolution.subjects.includes(kind)) {
+            throw new InvalidTupleError(`"${type}#${tuple.relation}" does not accept a subject of kind "${kind}".`);
+        }
+    }
+}
+//# sourceMappingURL=schema.js.map

package/dist/rebac/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/rebac/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAMlD,uGAAuG;AACvG,MAAM,OAAO,MAAM;IACY,UAAU;IAAvC,YAA6B,UAA4B;0BAA5B,UAAU;IAAqB,CAAC;IAE7D,KAAK;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,IAAY;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAE7C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAC7E,CAAC;IAED,gGAAgG;IAChG,UAAU,CAAC,IAAY;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE;aAC1B,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC/D,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,cAAc,CAAC,KAAoB;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,UAAU,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC,QAAQ,2BAA2B,IAAI,gCAAgC,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEnG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,wCAAwC,IAAI,IAAI,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;CACF"}

package/dist/rebac/subject-ref.d.ts

@@ -0,0 +1,6 @@
+import type { ResourceRef } from '../authorization/resource-ref.js';
+export interface SubjectRef extends ResourceRef {
+    /** Present for a userset. */
+    readonly relation?: string;
+}
+//# sourceMappingURL=subject-ref.d.ts.map

package/dist/rebac/subject-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-ref.d.ts","sourceRoot":"","sources":["../../src/rebac/subject-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/rebac/subject-ref.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=subject-ref.js.map

package/dist/rebac/subject-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-ref.js","sourceRoot":"","sources":["../../src/rebac/subject-ref.ts"],"names":[],"mappings":""}

package/dist/rebac/tuple-key.d.ts

@@ -0,0 +1,3 @@
+import type { RelationTuple } from './relation-tuple.js';
+export declare function tupleKey(tuple: RelationTuple): string;
+//# sourceMappingURL=tuple-key.d.ts.map

package/dist/rebac/tuple-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuple-key.d.ts","sourceRoot":"","sources":["../../src/rebac/tuple-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAErD"}

package/dist/rebac/tuple-key.js

@@ -0,0 +1,4 @@
+export function tupleKey(tuple) {
+    return `${tuple.object}#${tuple.relation}@${tuple.subject}`;
+}
+//# sourceMappingURL=tuple-key.js.map

package/dist/rebac/tuple-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuple-key.js","sourceRoot":"","sources":["../../src/rebac/tuple-key.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC"}

package/dist/rebac/type-definition.d.ts

@@ -0,0 +1,7 @@
+import type { Rewrite } from './rewrite.js';
+export interface TypeDefinition {
+    /** For each relation, who may be its subject: `'user'`, or the userset `'group#member'`. */
+    readonly relations?: Readonly<Record<string, readonly string[]>>;
+    readonly permissions?: Readonly<Record<string, Rewrite>>;
+}
+//# sourceMappingURL=type-definition.d.ts.map

package/dist/rebac/type-definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-definition.d.ts","sourceRoot":"","sources":["../../src/rebac/type-definition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D"}

package/dist/rebac/type-definition.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=type-definition.js.map

package/dist/rebac/type-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-definition.js","sourceRoot":"","sources":["../../src/rebac/type-definition.ts"],"names":[],"mappings":""}

package/dist/rebac.d.ts

@@ -0,0 +1,22 @@
+export { defineSchema } from './rebac/define-schema.js';
+export type { ExpandNode } from './rebac/expand-node.js';
+export { InMemoryRelationTupleStore } from './rebac/in-memory-relation-tuple-store.js';
+export { InvalidTupleError } from './rebac/invalid-tuple-error.js';
+export { objectOf } from './rebac/object-of.js';
+export { parseObject } from './rebac/parse-object.js';
+export { parseSubject } from './rebac/parse-subject.js';
+export type { PermissionMapping } from './rebac/permission-mapping.js';
+export { RelationBasedAuthorizer, type RelationBasedAuthorizerOptions } from './rebac/relation-based-authorizer.js';
+export type { RelationTuple } from './rebac/relation-tuple.js';
+export { RelationTupleStore } from './rebac/relation-tuple-store.js';
+export type { Resolution } from './rebac/resolution.js';
+export { ReverseExpansionLimitError } from './rebac/reverse-expansion-limit-error.js';
+export { exclusion, from, intersection, union, type ExclusionRewrite, type FromRewrite, type Rewrite, type SetRewrite, } from './rebac/rewrite.js';
+export { Schema } from './rebac/schema.js';
+export { SchemaCheckedTupleStore } from './rebac/schema-checked-tuple-store.js';
+export type { SchemaDefinition } from './rebac/schema-definition.js';
+export { SchemaError } from './rebac/schema-error.js';
+export type { SubjectRef } from './rebac/subject-ref.js';
+export { tupleKey } from './rebac/tuple-key.js';
+export type { TypeDefinition } from './rebac/type-definition.js';
+//# sourceMappingURL=rebac.d.ts.map

package/dist/rebac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebac.d.ts","sourceRoot":"","sources":["../src/rebac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,KAAK,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACpH,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EACL,SAAS,EACT,IAAI,EACJ,YAAY,EACZ,KAAK,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/rebac.js

@@ -0,0 +1,15 @@
+export { defineSchema } from './rebac/define-schema.js';
+export { InMemoryRelationTupleStore } from './rebac/in-memory-relation-tuple-store.js';
+export { InvalidTupleError } from './rebac/invalid-tuple-error.js';
+export { objectOf } from './rebac/object-of.js';
+export { parseObject } from './rebac/parse-object.js';
+export { parseSubject } from './rebac/parse-subject.js';
+export { RelationBasedAuthorizer } from './rebac/relation-based-authorizer.js';
+export { RelationTupleStore } from './rebac/relation-tuple-store.js';
+export { ReverseExpansionLimitError } from './rebac/reverse-expansion-limit-error.js';
+export { exclusion, from, intersection, union, } from './rebac/rewrite.js';
+export { Schema } from './rebac/schema.js';
+export { SchemaCheckedTupleStore } from './rebac/schema-checked-tuple-store.js';
+export { SchemaError } from './rebac/schema-error.js';
+export { tupleKey } from './rebac/tuple-key.js';
+//# sourceMappingURL=rebac.js.map

package/dist/rebac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebac.js","sourceRoot":"","sources":["../src/rebac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAuC,MAAM,sCAAsC,CAAC;AAEpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EACL,SAAS,EACT,IAAI,EACJ,YAAY,EACZ,KAAK,GAKN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/testing/actor-builder.d.ts

@@ -0,0 +1,21 @@
+import type { Actor, ActorAttribute, ActorType } from '@ddd-ts-kit/kernel';
+import { Builder, type Defaults } from '@ddd-ts-kit/testing';
+interface ActorProps {
+    id: string;
+    type: ActorType;
+    tenantId: string | undefined;
+    roles: readonly string[];
+    attributes: Readonly<Record<string, ActorAttribute>>;
+}
+/** By default a user without tenant, role or attribute, with an id of its own: `actor-1`, `actor-2`... */
+export declare class ActorBuilder extends Builder<ActorProps, Actor> {
+    named(id: string): this;
+    ofTenant(tenantId: string): this;
+    withRole(...roles: readonly string[]): this;
+    withAttributes(attributes: Readonly<Record<string, ActorAttribute>>): this;
+    asService(): this;
+    protected defaults(): Defaults<ActorProps>;
+    protected construct({ tenantId, ...actor }: ActorProps): Actor;
+}
+export {};
+//# sourceMappingURL=actor-builder.d.ts.map

package/dist/testing/actor-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-builder.d.ts","sourceRoot":"","sources":["../../src/testing/actor-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEvE,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACtD;AAED,0GAA0G;AAC1G,qBAAa,YAAa,SAAQ,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC;IAC1D,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEtB;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE/B;IAED,QAAQ,CAAC,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAE1C;IAED,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG,IAAI,CAEzE;IAED,SAAS,IAAI,IAAI,CAEhB;IAED,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAEzC;IAED,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,UAAU,GAAG,KAAK,CAE7D;CACF"}