@ddd-ts-kit/auth 0.0.0-stage → 0.1.1

package/dist/abac/attribute-policy.d.ts

@@ -0,0 +1,13 @@
+import type { Grant } from '../permissions/grant.js';
+import type { Condition } from './condition.js';
+export interface AttributePolicy {
+    readonly name: string;
+    readonly effect: 'permit' | 'forbid';
+    readonly grants: readonly string[];
+    readonly when: Condition;
+}
+/** Allows the permissions when the condition holds, unless a `forbid` policy applies. */
+export declare function permit(name: string, permissions: readonly Grant[], when?: Condition): AttributePolicy;
+/** Refuses the permissions when the condition holds, whatever the `permit` policies say. */
+export declare function forbid(name: string, permissions: readonly Grant[], when?: Condition): AttributePolicy;
+//# sourceMappingURL=attribute-policy.d.ts.map

package/dist/abac/attribute-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-policy.d.ts","sourceRoot":"","sources":["../../src/abac/attribute-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,yFAAyF;AACzF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,KAAK,EAAE,EAAE,IAAI,GAAE,SAAsB,GAAG,eAAe,CAEjH;AAED,4FAA4F;AAC5F,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,KAAK,EAAE,EAAE,IAAI,GAAE,SAAsB,GAAG,eAAe,CAEjH"}

package/dist/abac/attribute-policy.js

@@ -0,0 +1,10 @@
+import { grantPattern } from '../permissions/grant-pattern.js';
+/** Allows the permissions when the condition holds, unless a `forbid` policy applies. */
+export function permit(name, permissions, when = () => true) {
+    return { name, effect: 'permit', grants: permissions.map(grantPattern), when };
+}
+/** Refuses the permissions when the condition holds, whatever the `permit` policies say. */
+export function forbid(name, permissions, when = () => true) {
+    return { name, effect: 'forbid', grants: permissions.map(grantPattern), when };
+}
+//# sourceMappingURL=attribute-policy.js.map

package/dist/abac/attribute-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-policy.js","sourceRoot":"","sources":["../../src/abac/attribute-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAU/D,yFAAyF;AACzF,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,WAA6B,EAAE,IAAI,GAAc,GAAG,EAAE,CAAC,IAAI;IAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,WAA6B,EAAE,IAAI,GAAc,GAAG,EAAE,CAAC,IAAI;IAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC"}

package/dist/abac/condition.d.ts

@@ -0,0 +1,6 @@
+import type { PolicyInput } from './policy-input.js';
+export type Condition = (input: PolicyInput) => boolean;
+export declare function anyOf(...conditions: readonly Condition[]): Condition;
+export declare function allOf(...conditions: readonly Condition[]): Condition;
+export declare function not(condition: Condition): Condition;
+//# sourceMappingURL=condition.d.ts.map

package/dist/abac/condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../src/abac/condition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC;AAExD,wBAAgB,KAAK,CAAC,GAAG,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,CAEpE;AAED,wBAAgB,KAAK,CAAC,GAAG,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,CAEpE;AAED,wBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAEnD"}

package/dist/abac/condition.js

@@ -0,0 +1,10 @@
+export function anyOf(...conditions) {
+    return (input) => conditions.some((condition) => condition(input));
+}
+export function allOf(...conditions) {
+    return (input) => conditions.every((condition) => condition(input));
+}
+export function not(condition) {
+    return (input) => !condition(input);
+}
+//# sourceMappingURL=condition.js.map

package/dist/abac/condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../src/abac/condition.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,KAAK,CAAC,GAAG,UAAgC;IACvD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,UAAgC;IACvD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,SAAoB;IACtC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/abac/policy-based-authorizer.d.ts

@@ -0,0 +1,23 @@
+import { type Clock } from '@ddd-ts-kit/kernel';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { CheckRequest } from '../authorization/check-request.js';
+import { type Decision } from '../authorization/decision.js';
+import type { AttributePolicy } from './attribute-policy.js';
+import type { ResourceAttributes } from './resource-attributes.js';
+export interface PolicyBasedAuthorizerOptions {
+    readonly policies: readonly AttributePolicy[];
+    readonly clock: Clock;
+    readonly attributes?: ResourceAttributes;
+}
+/**
+ * ABAC: rules over the attributes of the actor, of the resource and of the moment. A matching
+ * `forbid` wins over every `permit`; with no matching `permit` the answer is no. It does not
+ * implement `listAccessible`: an arbitrary predicate cannot be turned into a query.
+ */
+export declare class PolicyBasedAuthorizer implements Authorizer {
+    private readonly options;
+    constructor(options: PolicyBasedAuthorizerOptions);
+    check(request: CheckRequest): Promise<Decision>;
+    private inputOf;
+}
+//# sourceMappingURL=policy-based-authorizer.d.ts.map

package/dist/abac/policy-based-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-based-authorizer.d.ts","sourceRoot":"","sources":["../../src/abac/policy-based-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAG5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,4BAA4B,EAAI;IAEhE,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBpD;YAEa,OAAO;CAatB"}

package/dist/abac/policy-based-authorizer.js

@@ -0,0 +1,39 @@
+import { isAnonymous } from '@ddd-ts-kit/kernel';
+import { ALLOWED, deny } from '../authorization/decision.js';
+import { DenialReason } from '../authorization/denial-reason.js';
+import { grantCovers } from '../permissions/grant-covers.js';
+/**
+ * ABAC: rules over the attributes of the actor, of the resource and of the moment. A matching
+ * `forbid` wins over every `permit`; with no matching `permit` the answer is no. It does not
+ * implement `listAccessible`: an arbitrary predicate cannot be turned into a query.
+ */
+export class PolicyBasedAuthorizer {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async check(request) {
+        if (isAnonymous(request.actor)) {
+            return deny(DenialReason.anonymous);
+        }
+        const input = await this.inputOf(request);
+        const applying = this.options.policies.filter((policy) => policy.grants.some((pattern) => grantCovers(pattern, request.permission)) && policy.when(input));
+        if (applying.some((policy) => policy.effect === 'forbid')) {
+            return deny(DenialReason.explicitDeny);
+        }
+        return applying.length > 0 ? ALLOWED : deny(DenialReason.noMatchingPolicy);
+    }
+    async inputOf(request) {
+        const { resource } = request;
+        const attributes = resource === undefined ? undefined : await this.options.attributes?.of(resource);
+        return {
+            actor: request.actor,
+            permission: request.permission,
+            ...(resource === undefined ? {} : { resource }),
+            attributes: attributes ?? {},
+            context: request.context ?? {},
+            now: this.options.clock.now(),
+        };
+    }
+}
+//# sourceMappingURL=policy-based-authorizer.js.map

package/dist/abac/policy-based-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-based-authorizer.js","sourceRoot":"","sources":["../../src/abac/policy-based-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAiB,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAW7D;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACH,OAAO;IAApC,YAA6B,OAAqC;uBAArC,OAAO;IAAiC,CAAC;IAEtE,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAC5G,CAAC;QAEF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAqB;QACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpG,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,UAAU,EAAE,UAAU,IAAI,EAAE;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/abac/policy-input.d.ts

@@ -0,0 +1,17 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { AuthorizationContext } from '../authorization/authorization-context.js';
+import type { ResourceRef } from '../authorization/resource-ref.js';
+import type { Permission } from '../permissions/permission.js';
+import type { ResourceAttributeValues } from './resource-attribute-values.js';
+/** Everything a rule may look at. */
+export interface PolicyInput {
+    readonly actor: Actor;
+    readonly permission: Permission;
+    readonly resource?: ResourceRef;
+    /** Empty when the request names no resource or the port knows nothing about it. */
+    readonly attributes: ResourceAttributeValues;
+    readonly context: AuthorizationContext;
+    /** From the `Clock` port. */
+    readonly now: Date;
+}
+//# sourceMappingURL=policy-input.d.ts.map

package/dist/abac/policy-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-input.d.ts","sourceRoot":"","sources":["../../src/abac/policy-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB"}

package/dist/abac/policy-input.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-input.js.map

package/dist/abac/policy-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-input.js","sourceRoot":"","sources":["../../src/abac/policy-input.ts"],"names":[],"mappings":""}

package/dist/abac/resource-attribute-values.d.ts

@@ -0,0 +1,3 @@
+import type { ActorAttribute } from '@ddd-ts-kit/kernel';
+export type ResourceAttributeValues = Readonly<Record<string, ActorAttribute>>;
+//# sourceMappingURL=resource-attribute-values.d.ts.map

package/dist/abac/resource-attribute-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-attribute-values.d.ts","sourceRoot":"","sources":["../../src/abac/resource-attribute-values.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC"}

package/dist/abac/resource-attribute-values.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-attribute-values.js.map

package/dist/abac/resource-attribute-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-attribute-values.js","sourceRoot":"","sources":["../../src/abac/resource-attribute-values.ts"],"names":[],"mappings":""}

package/dist/abac/resource-attributes.d.ts

@@ -0,0 +1,8 @@
+import type { ResourceRef } from '../authorization/resource-ref.js';
+import type { ResourceAttributeValues } from './resource-attribute-values.js';
+/** Where the attributes of an element come from: a projection, a cache, the owning context. */
+export declare abstract class ResourceAttributes {
+    static readonly tokenKey = "auth.ResourceAttributes";
+    abstract of(resource: ResourceRef): Promise<ResourceAttributeValues | undefined>;
+}
+//# sourceMappingURL=resource-attributes.d.ts.map

package/dist/abac/resource-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-attributes.d.ts","sourceRoot":"","sources":["../../src/abac/resource-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,+FAA+F;AAC/F,8BAAsB,kBAAkB;IACtC,MAAM,CAAC,QAAQ,CAAC,QAAQ,6BAA6B;IAErD,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;CAClF"}

package/dist/abac/resource-attributes.js

@@ -0,0 +1,5 @@
+/** Where the attributes of an element come from: a projection, a cache, the owning context. */
+export class ResourceAttributes {
+    static tokenKey = 'auth.ResourceAttributes';
+}
+//# sourceMappingURL=resource-attributes.js.map

package/dist/abac/resource-attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-attributes.js","sourceRoot":"","sources":["../../src/abac/resource-attributes.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,MAAM,OAAgB,kBAAkB;IACtC,MAAM,CAAU,QAAQ,GAAG,yBAAyB,CAAC;CAGtD"}

package/dist/authentication/actor-of.d.ts

@@ -0,0 +1,7 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+/**
+ * The actor a boundary received, anonymous when there is none. Takes the principal (a session
+ * or an actor) or the request context that holds it.
+ */
+export declare function actorOf(source: unknown): Actor;
+//# sourceMappingURL=actor-of.d.ts.map

package/dist/authentication/actor-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-of.d.ts","sourceRoot":"","sources":["../../src/authentication/actor-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,CAE9C"}

package/dist/authentication/actor-of.js

@@ -0,0 +1,9 @@
+import { sessionOf } from './session-of.js';
+/**
+ * The actor a boundary received, anonymous when there is none. Takes the principal (a session
+ * or an actor) or the request context that holds it.
+ */
+export function actorOf(source) {
+    return sessionOf(source).actor;
+}
+//# sourceMappingURL=actor-of.js.map

package/dist/authentication/actor-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-of.js","sourceRoot":"","sources":["../../src/authentication/actor-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe;IACrC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;AACjC,CAAC"}

package/dist/authentication/authenticator.d.ts

@@ -0,0 +1,11 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+/**
+ * Who is calling. A platform concern at the boundary: an adapter verifies the credential and
+ * produces an actor. Answers the anonymous actor when there is no credential, and raises
+ * `InvalidCredentialError` when one is presented and not acceptable.
+ */
+export declare abstract class Authenticator {
+    static readonly tokenKey: string;
+    abstract authenticate(credential: string | undefined): Promise<Actor>;
+}
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/authentication/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/authentication/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,8BAAsB,aAAa;IACjC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAwB;IAExD,QAAQ,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACvE"}

package/dist/authentication/authenticator.js

@@ -0,0 +1,9 @@
+/**
+ * Who is calling. A platform concern at the boundary: an adapter verifies the credential and
+ * produces an actor. Answers the anonymous actor when there is no credential, and raises
+ * `InvalidCredentialError` when one is presented and not acceptable.
+ */
+export class Authenticator {
+    static tokenKey = 'auth.Authenticator';
+}
+//# sourceMappingURL=authenticator.js.map

package/dist/authentication/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/authentication/authenticator.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAgB,aAAa;IACjC,MAAM,CAAU,QAAQ,GAAW,oBAAoB,CAAC;CAGzD"}

package/dist/authentication/bearer-credential.d.ts

@@ -0,0 +1,7 @@
+import type { HeaderValues } from './header-values.js';
+/**
+ * The token of `Authorization: Bearer <token>`, or `undefined` without the header. A header
+ * that is there and is not a well-formed bearer credential is refused, never ignored.
+ */
+export declare function bearerCredential(headers: HeaderValues): string | undefined;
+//# sourceMappingURL=bearer-credential.d.ts.map

package/dist/authentication/bearer-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-credential.d.ts","sourceRoot":"","sources":["../../src/authentication/bearer-credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAe1E"}

package/dist/authentication/bearer-credential.js

@@ -0,0 +1,19 @@
+import { InvalidCredentialError } from '../errors/invalid-credential-error.js';
+const BEARER = /^Bearer +([A-Za-z0-9._~+/-]+=*)$/i;
+/**
+ * The token of `Authorization: Bearer <token>`, or `undefined` without the header. A header
+ * that is there and is not a well-formed bearer credential is refused, never ignored.
+ */
+export function bearerCredential(headers) {
+    const name = Object.keys(headers).find((header) => header.toLowerCase() === 'authorization');
+    const value = name === undefined ? undefined : headers[name];
+    if (value === undefined) {
+        return undefined;
+    }
+    const token = typeof value === 'string' ? BEARER.exec(value)?.[1] : undefined;
+    if (token === undefined) {
+        throw new InvalidCredentialError('MALFORMED_AUTHORIZATION_HEADER');
+    }
+    return token;
+}
+//# sourceMappingURL=bearer-credential.js.map

package/dist/authentication/bearer-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-credential.js","sourceRoot":"","sources":["../../src/authentication/bearer-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,MAAM,MAAM,GAAG,mCAAmC,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,sBAAsB,CAAC,gCAAgC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/authentication/header-values.d.ts

@@ -0,0 +1,2 @@
+export type HeaderValues = Readonly<Record<string, string | readonly string[] | undefined>>;
+//# sourceMappingURL=header-values.d.ts.map

package/dist/authentication/header-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-values.d.ts","sourceRoot":"","sources":["../../src/authentication/header-values.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC"}

package/dist/authentication/header-values.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=header-values.js.map

package/dist/authentication/header-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-values.js","sourceRoot":"","sources":["../../src/authentication/header-values.ts"],"names":[],"mappings":""}

package/dist/authentication/in-actor-context.d.ts

@@ -0,0 +1,15 @@
+import type { ActorContext } from '@ddd-ts-kit/kernel';
+interface WithPrincipal {
+    readonly context: {
+        readonly principal?: unknown;
+    };
+}
+/**
+ * Wraps a route handler so that everything it calls sees the actor through `ActorContext`:
+ * repositories stamping audit columns, tenant scoping. Use cases still get it in the message.
+ * Not needed when the adapter of @ddd-ts-kit/http is given an `executionScope` and the actor
+ * context is a `ScopedActorContext` over it, as `kernelModule()` binds them.
+ */
+export declare function inActorContext<Input extends WithPrincipal, Output>(actorContext: ActorContext, handle: (input: Input) => Output): (input: Input) => Output;
+export {};
+//# sourceMappingURL=in-actor-context.d.ts.map

package/dist/authentication/in-actor-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-actor-context.d.ts","sourceRoot":"","sources":["../../src/authentication/in-actor-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAS,aAAa,EAAE,MAAM,EAChE,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAC/B,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAE1B"}

package/dist/authentication/in-actor-context.js

@@ -0,0 +1,11 @@
+import { actorOf } from './actor-of.js';
+/**
+ * Wraps a route handler so that everything it calls sees the actor through `ActorContext`:
+ * repositories stamping audit columns, tenant scoping. Use cases still get it in the message.
+ * Not needed when the adapter of @ddd-ts-kit/http is given an `executionScope` and the actor
+ * context is a `ScopedActorContext` over it, as `kernelModule()` binds them.
+ */
+export function inActorContext(actorContext, handle) {
+    return (input) => actorContext.run(actorOf(input.context.principal), () => handle(input));
+}
+//# sourceMappingURL=in-actor-context.js.map

package/dist/authentication/in-actor-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-actor-context.js","sourceRoot":"","sources":["../../src/authentication/in-actor-context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAMxC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,YAA0B,EAC1B,MAAgC;IAEhC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC"}

package/dist/authentication/principal-resolver.d.ts

@@ -0,0 +1,10 @@
+import type { Session } from '@ddd-ts-kit/kernel';
+import type { Authenticator } from './authenticator.js';
+import type { SessionAuthenticator } from './session-authenticator.js';
+/**
+ * The `resolvePrincipal` option of @ddd-ts-kit/http: takes the framework request, answers the
+ * session. The pipeline puts it, with its actor, in the execution context of the request;
+ * routes read `actorOf(context.principal)` and `sessionOf(context)`.
+ */
+export declare function principalResolver(authenticator: Authenticator | SessionAuthenticator): (raw: unknown) => Promise<Session>;
+//# sourceMappingURL=principal-resolver.d.ts.map

package/dist/authentication/principal-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/principal-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,aAAa,GAAG,oBAAoB,GAClD,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAEpC"}

package/dist/authentication/principal-resolver.js

@@ -0,0 +1,25 @@
+import { bearerCredential } from './bearer-credential.js';
+import { resolveSession } from './resolve-session.js';
+/**
+ * The `resolvePrincipal` option of @ddd-ts-kit/http: takes the framework request, answers the
+ * session. The pipeline puts it, with its actor, in the execution context of the request;
+ * routes read `actorOf(context.principal)` and `sessionOf(context)`.
+ */
+export function principalResolver(authenticator) {
+    return (raw) => resolveSession(authenticator, bearerCredential(headersOf(raw)));
+}
+function headersOf(raw) {
+    if (typeof raw !== 'object' || raw === null || !('headers' in raw)) {
+        return {};
+    }
+    const { headers } = raw;
+    if (typeof headers !== 'object' || headers === null) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(headers).filter(isHeader));
+}
+function isHeader(entry) {
+    const [, value] = entry;
+    return typeof value === 'string' || (Array.isArray(value) && value.every((item) => typeof item === 'string'));
+}
+//# sourceMappingURL=principal-resolver.js.map

package/dist/authentication/principal-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-resolver.js","sourceRoot":"","sources":["../../src/authentication/principal-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAmD;IAEnD,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAExB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IAExB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAChH,CAAC"}

package/dist/authentication/resolve-session.d.ts

@@ -0,0 +1,9 @@
+import type { Session } from '@ddd-ts-kit/kernel';
+import type { Authenticator } from './authenticator.js';
+import type { SessionAuthenticator } from './session-authenticator.js';
+/**
+ * The session of a credential, whatever the authenticator: its own when it is a
+ * `SessionAuthenticator`, otherwise one derived from the actor (see `sessionOf`).
+ */
+export declare function resolveSession(authenticator: Authenticator | SessionAuthenticator, credential: string | undefined): Promise<Session>;
+//# sourceMappingURL=resolve-session.d.ts.map

package/dist/authentication/resolve-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-session.d.ts","sourceRoot":"","sources":["../../src/authentication/resolve-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGvE;;;GAGG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,aAAa,GAAG,oBAAoB,EACnD,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/authentication/resolve-session.js

@@ -0,0 +1,12 @@
+import { sessionOf } from './session-of.js';
+/**
+ * The session of a credential, whatever the authenticator: its own when it is a
+ * `SessionAuthenticator`, otherwise one derived from the actor (see `sessionOf`).
+ */
+export async function resolveSession(authenticator, credential) {
+    if ('authenticateSession' in authenticator) {
+        return authenticator.authenticateSession(credential);
+    }
+    return sessionOf(await authenticator.authenticate(credential));
+}
+//# sourceMappingURL=resolve-session.js.map

package/dist/authentication/resolve-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-session.js","sourceRoot":"","sources":["../../src/authentication/resolve-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAmD,EACnD,UAA8B;IAE9B,IAAI,qBAAqB,IAAI,aAAa,EAAE,CAAC;QAC3C,OAAO,aAAa,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,aAAa,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/authentication/session-authenticator.d.ts

@@ -0,0 +1,13 @@
+import type { Session } from '@ddd-ts-kit/kernel';
+import { Authenticator } from './authenticator.js';
+/**
+ * An authenticator that also knows the session the credential stands for: since when, until
+ * when, how it was authenticated, on whose behalf. Answers the anonymous session without
+ * credential. `resolveSession` works with either port, so an adapter implements this one only
+ * when its credential carries that knowledge.
+ */
+export declare abstract class SessionAuthenticator extends Authenticator {
+    static readonly tokenKey = "auth.SessionAuthenticator";
+    abstract authenticateSession(credential: string | undefined): Promise<Session>;
+}
+//# sourceMappingURL=session-authenticator.d.ts.map

package/dist/authentication/session-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-authenticator.d.ts","sourceRoot":"","sources":["../../src/authentication/session-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AACH,8BAAsB,oBAAqB,SAAQ,aAAa;IAC9D,gBAAyB,QAAQ,+BAA+B;IAEhE,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF"}

package/dist/authentication/session-authenticator.js

@@ -0,0 +1,11 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * An authenticator that also knows the session the credential stands for: since when, until
+ * when, how it was authenticated, on whose behalf. Answers the anonymous session without
+ * credential. `resolveSession` works with either port, so an adapter implements this one only
+ * when its credential carries that knowledge.
+ */
+export class SessionAuthenticator extends Authenticator {
+    static tokenKey = 'auth.SessionAuthenticator';
+}
+//# sourceMappingURL=session-authenticator.js.map

package/dist/authentication/session-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-authenticator.js","sourceRoot":"","sources":["../../src/authentication/session-authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,OAAgB,oBAAqB,SAAQ,aAAa;IAC9D,MAAM,CAAmB,QAAQ,GAAG,2BAA2B,CAAC;CAGjE"}

package/dist/authentication/session-of.d.ts

@@ -0,0 +1,9 @@
+import { type Session } from '@ddd-ts-kit/kernel';
+/**
+ * The session a boundary received, anonymous when there is none. Takes the request context
+ * (`sessionOf(context)`), or a principal: a session is answered as it is, and an actor alone
+ * gets a session that says only what is known, its id as session id, no issue instant, no
+ * expiry, authenticated by `token`.
+ */
+export declare function sessionOf(source: unknown): Session;
+//# sourceMappingURL=session-of.d.ts.map

package/dist/authentication/session-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-of.d.ts","sourceRoot":"","sources":["../../src/authentication/session-of.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIjH;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAUlD"}

package/dist/authentication/session-of.js

@@ -0,0 +1,27 @@
+import { anonymousSession, isActor, isAnonymous, isSession } from '@ddd-ts-kit/kernel';
+const NEVER_ISSUED = new Date(0);
+/**
+ * The session a boundary received, anonymous when there is none. Takes the request context
+ * (`sessionOf(context)`), or a principal: a session is answered as it is, and an actor alone
+ * gets a session that says only what is known, its id as session id, no issue instant, no
+ * expiry, authenticated by `token`.
+ */
+export function sessionOf(source) {
+    if (isSession(source)) {
+        return source;
+    }
+    if (isActor(source)) {
+        return sessionOfActor(source);
+    }
+    return hasPrincipal(source) ? sessionOf(source.principal) : anonymousSession();
+}
+function sessionOfActor(actor) {
+    if (isAnonymous(actor)) {
+        return anonymousSession();
+    }
+    return { id: actor.id, actor, issuedAt: NEVER_ISSUED, authenticationMethod: 'token', extensions: {} };
+}
+function hasPrincipal(source) {
+    return typeof source === 'object' && source !== null && 'principal' in source;
+}
+//# sourceMappingURL=session-of.js.map

package/dist/authentication/session-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-of.js","sourceRoot":"","sources":["../../src/authentication/session-of.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAA4B,MAAM,oBAAoB,CAAC;AAEjH,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe;IACvC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,IAAI,MAAM,CAAC;AAChF,CAAC"}

package/dist/authorization/access-scope.d.ts

@@ -0,0 +1,16 @@
+/**
+ * What an actor may read of one resource type, in a form a read port turns into a `WHERE`
+ * clause. A list is filtered by the query, never in memory after loading.
+ */
+export type AccessScope = {
+    readonly kind: 'all';
+} | {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'ids';
+    readonly ids: readonly string[];
+} | {
+    readonly kind: 'filter';
+    readonly filter: Readonly<Record<string, string | number | boolean>>;
+};
+//# sourceMappingURL=access-scope.d.ts.map

package/dist/authorization/access-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/access-scope.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC"}

package/dist/authorization/access-scope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-scope.js.map

package/dist/authorization/access-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-scope.js","sourceRoot":"","sources":["../../src/authorization/access-scope.ts"],"names":[],"mappings":""}

package/dist/authorization/access.d.ts

@@ -0,0 +1,17 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { Permission } from '../permissions/permission.js';
+import type { AccessScope } from './access-scope.js';
+import type { Decision } from './decision.js';
+/**
+ * What a handler asks once it has loaded the element:
+ * `await this.access.authorize(command.actor, permissions.edit, article)`.
+ */
+export declare abstract class Access {
+    static readonly tokenKey = "auth.Access";
+    /** Raises `ForbiddenError`, or `UnauthenticatedError` for the anonymous actor. */
+    abstract authorize(actor: Actor, permission: Permission, subject: unknown): Promise<void>;
+    abstract decide(actor: Actor, permission: Permission, subject: unknown): Promise<Decision>;
+    /** What the actor may list of one resource type, to hand to a read port. */
+    abstract scope(actor: Actor, permission: Permission, resourceType: string): Promise<AccessScope>;
+}
+//# sourceMappingURL=access.d.ts.map

package/dist/authorization/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/authorization/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;GAGG;AACH,8BAAsB,MAAM;IAC1B,MAAM,CAAC,QAAQ,CAAC,QAAQ,iBAAiB;IAEzC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3F,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAClG"}

package/dist/authorization/access.js

@@ -0,0 +1,8 @@
+/**
+ * What a handler asks once it has loaded the element:
+ * `await this.access.authorize(command.actor, permissions.edit, article)`.
+ */
+export class Access {
+    static tokenKey = 'auth.Access';
+}
+//# sourceMappingURL=access.js.map

package/dist/authorization/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/authorization/access.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,OAAgB,MAAM;IAC1B,MAAM,CAAU,QAAQ,GAAG,aAAa,CAAC;CAS1C"}

package/dist/authorization/authorization-context.d.ts

@@ -0,0 +1,3 @@
+/** Facts about the request that are neither the actor nor the resource. */
+export type AuthorizationContext = Readonly<Record<string, unknown>>;
+//# sourceMappingURL=authorization-context.d.ts.map

package/dist/authorization/authorization-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-context.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization-context.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC"}