@ddd-ts-kit/auth 0.0.0-stage → 0.1.1

package/dist/testing/actor-builder.js

@@ -0,0 +1,26 @@
+import { Builder, sequence } from '@ddd-ts-kit/testing';
+/** By default a user without tenant, role or attribute, with an id of its own: `actor-1`, `actor-2`... */
+export class ActorBuilder extends Builder {
+    named(id) {
+        return this.with('id', id);
+    }
+    ofTenant(tenantId) {
+        return this.with('tenantId', tenantId);
+    }
+    withRole(...roles) {
+        return this.adding('roles', ...roles);
+    }
+    withAttributes(attributes) {
+        return this.with('attributes', attributes);
+    }
+    asService() {
+        return this.with('type', 'service');
+    }
+    defaults() {
+        return { id: sequence('actor'), type: 'user', tenantId: undefined, roles: [], attributes: {} };
+    }
+    construct({ tenantId, ...actor }) {
+        return tenantId === undefined ? actor : { ...actor, tenantId };
+    }
+}
+//# sourceMappingURL=actor-builder.js.map

package/dist/testing/actor-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-builder.js","sourceRoot":"","sources":["../../src/testing/actor-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAiB,MAAM,qBAAqB,CAAC;AAUvE,0GAA0G;AAC1G,MAAM,OAAO,YAAa,SAAQ,OAA0B;IAC1D,KAAK,CAAC,EAAU;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,GAAG,KAAwB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,cAAc,CAAC,UAAoD;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAES,QAAQ;QAChB,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACjG,CAAC;IAES,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAc;QACpD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/testing/allow-all.d.ts

@@ -0,0 +1,9 @@
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import { type Decision } from '../authorization/decision.js';
+/** For the specs that are not about rights: everything is granted to everybody. */
+export declare class AllowAll implements Authorizer {
+    check(): Promise<Decision>;
+    listAccessible(): Promise<AccessScope>;
+}
+//# sourceMappingURL=allow-all.d.ts.map

package/dist/testing/allow-all.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-all.d.ts","sourceRoot":"","sources":["../../src/testing/allow-all.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAW,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEtE,mFAAmF;AACnF,qBAAa,QAAS,YAAW,UAAU;IACnC,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,CAE/B;IAEK,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAE3C;CACF"}

package/dist/testing/allow-all.js

@@ -0,0 +1,11 @@
+import { ALLOWED } from '../authorization/decision.js';
+/** For the specs that are not about rights: everything is granted to everybody. */
+export class AllowAll {
+    async check() {
+        return ALLOWED;
+    }
+    async listAccessible() {
+        return { kind: 'all' };
+    }
+}
+//# sourceMappingURL=allow-all.js.map

package/dist/testing/allow-all.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-all.js","sourceRoot":"","sources":["../../src/testing/allow-all.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAiB,MAAM,8BAA8B,CAAC;AAEtE,mFAAmF;AACnF,MAAM,OAAO,QAAQ;IACnB,KAAK,CAAC,KAAK;QACT,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/testing/an-actor.d.ts

@@ -0,0 +1,4 @@
+import { ActorBuilder } from './actor-builder.js';
+/** `anActor().named('ada').withRole('accountant').ofTenant('acme').build()` */
+export declare function anActor(): ActorBuilder;
+//# sourceMappingURL=an-actor.d.ts.map

package/dist/testing/an-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"an-actor.d.ts","sourceRoot":"","sources":["../../src/testing/an-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIlD,+EAA+E;AAC/E,wBAAgB,OAAO,IAAI,YAAY,CAEtC"}

package/dist/testing/an-actor.js

@@ -0,0 +1,7 @@
+import { ActorBuilder } from './actor-builder.js';
+const builder = new ActorBuilder();
+/** `anActor().named('ada').withRole('accountant').ofTenant('acme').build()` */
+export function anActor() {
+    return builder;
+}
+//# sourceMappingURL=an-actor.js.map

package/dist/testing/an-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"an-actor.js","sourceRoot":"","sources":["../../src/testing/an-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;AAEnC,+EAA+E;AAC/E,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/testing/authorizer-contract.d.ts

@@ -0,0 +1,18 @@
+import { type Awaitable, type ContractRunner } from '@ddd-ts-kit/testing/contracts';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { CheckRequest } from '../authorization/check-request.js';
+export interface AuthorizerFixture {
+    readonly authorizer: Authorizer;
+    /** A request the authorizer was set up to allow, by a specific grant rather than a wildcard. */
+    readonly granted: CheckRequest;
+    /** A request about the same kind of thing that it was set up to refuse. */
+    readonly refused: CheckRequest;
+}
+export interface AuthorizerContractOptions {
+    readonly name: string;
+    /** A fresh authorizer with its two requests; called before each test. */
+    create(): Awaitable<AuthorizerFixture>;
+}
+/** What every authorization model guarantees to the middleware and the handlers. */
+export declare function authorizerContract(runner: ContractRunner, options: AuthorizerContractOptions): void;
+//# sourceMappingURL=authorizer-contract.d.ts.map

package/dist/testing/authorizer-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer-contract.d.ts","sourceRoot":"","sources":["../../src/testing/authorizer-contract.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEnG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAItE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC;CACxC;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAEnG"}

package/dist/testing/authorizer-contract.js

@@ -0,0 +1,102 @@
+import { anonymousActor } from '@ddd-ts-kit/kernel';
+import { ContractSuite } from '@ddd-ts-kit/testing/contracts';
+/** What every authorization model guarantees to the middleware and the handlers. */
+export function authorizerContract(runner, options) {
+    new AuthorizerSuite(runner, () => options.create()).describe(`${options.name} (authorizer contract)`);
+}
+const NEVER_GRANTED = {
+    id: 'contract:never.granted',
+    context: 'contract',
+    name: 'never.granted',
+    description: 'A permission no fixture grants',
+};
+const REASON_CODE = /^[A-Za-z][A-Za-z0-9_.:-]*$/;
+class AuthorizerSuite extends ContractSuite {
+    tests() {
+        this.allowsWhatWasGranted();
+        this.refusesWithAStableReason();
+        this.deniesByDefault();
+        this.listsWhatItAllows();
+    }
+    allowsWhatWasGranted() {
+        this.it('allows what was granted, each time it is asked', async () => {
+            const { authorizer, granted } = this.subject;
+            this.expect(await authorizer.check(granted)).toEqual({ allowed: true });
+            this.expect(await authorizer.check(granted)).toEqual({ allowed: true });
+        });
+    }
+    refusesWithAStableReason() {
+        this.it('refuses what was not granted with a machine code, the same each time', async () => {
+            const { authorizer, refused } = this.subject;
+            const first = await authorizer.check(refused);
+            const second = await authorizer.check(refused);
+            this.expect(first.allowed).toBe(false);
+            this.expect(REASON_CODE.test(reasonOf(first))).toBe(true);
+            this.expect(second).toEqual(first);
+        });
+        this.it('never quotes the actor or the resource in the reason', async () => {
+            const { authorizer, refused } = this.subject;
+            const reason = reasonOf(await authorizer.check(refused));
+            this.expect(reason.includes(refused.actor.id)).toBe(false);
+            this.expect(refused.resource !== undefined && reason.includes(refused.resource.id)).toBe(false);
+        });
+    }
+    deniesByDefault() {
+        this.it('refuses the anonymous actor, even what somebody else was granted', async () => {
+            const { authorizer, granted } = this.subject;
+            const decision = await authorizer.check({ ...granted, actor: anonymousActor() });
+            this.expect(decision.allowed).toBe(false);
+        });
+        this.it('refuses a permission nobody was granted', async () => {
+            const { authorizer, granted } = this.subject;
+            const decision = await authorizer.check({ ...granted, permission: NEVER_GRANTED });
+            this.expect(decision.allowed).toBe(false);
+        });
+        this.it('leaves the request as it was', async () => {
+            const { authorizer, granted } = this.subject;
+            const before = structuredClone(granted);
+            await authorizer.check(granted);
+            this.expect(granted).toEqual(before);
+        });
+    }
+    listsWhatItAllows() {
+        this.it('lists nothing for the anonymous actor', async () => {
+            const { granted } = this.subject;
+            const scope = await this.scopeOf({ ...granted, actor: anonymousActor() });
+            this.expect(scope === undefined || covers(scope, granted.resource?.id ?? 'any') === 'no').toBe(true);
+        });
+        this.it('lists what a check allows and not what it refuses', async () => {
+            const { granted, refused } = this.subject;
+            const allowed = await this.scopeOf(granted);
+            const denied = await this.scopeOf(refused);
+            this.expect(allowed === undefined || covers(allowed, granted.resource?.id) !== 'no').toBe(true);
+            this.expect(denied === undefined || covers(denied, refused.resource?.id) !== 'yes').toBe(true);
+        });
+    }
+    /** `undefined` when the model cannot enumerate or the request names no resource type. */
+    async scopeOf({ actor, permission, resource }) {
+        const { authorizer } = this.subject;
+        const resourceType = resource?.type ?? this.subject.granted.resource?.type;
+        if (resourceType === undefined) {
+            return undefined;
+        }
+        return authorizer.listAccessible?.({ actor, permission, resourceType });
+    }
+}
+function reasonOf(decision) {
+    return decision.allowed ? '' : decision.reason;
+}
+/** A filter is for the read port to apply: nothing here can tell what it covers. */
+function covers(scope, id) {
+    if (scope.kind === 'all') {
+        return 'yes';
+    }
+    if (scope.kind === 'none') {
+        return 'no';
+    }
+    if (scope.kind === 'filter' || id === undefined) {
+        return 'unknown';
+    }
+    return scope.ids.includes(id) ? 'yes' : 'no';
+}
+//# sourceMappingURL=authorizer-contract.js.map

package/dist/testing/authorizer-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer-contract.js","sourceRoot":"","sources":["../../src/testing/authorizer-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAuC,MAAM,+BAA+B,CAAC;AAqBnG,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,OAAkC;IAC3F,IAAI,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,wBAAwB,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,aAAa,GAAe;IAChC,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,gCAAgC;CAC9C,CAAC;AAEF,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD,MAAM,eAAgB,SAAQ,aAAgC;IAClD,KAAK;QACb,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE7C,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE7C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE7C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAEzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE7C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAEjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE7C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;YAEnF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAExC,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEhC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAgB;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACpC,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QAE3E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,SAAS,MAAM,CAAC,KAAkB,EAAE,EAAsB;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}

package/dist/testing/deny-all.d.ts

@@ -0,0 +1,10 @@
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import { type Decision } from '../authorization/decision.js';
+export declare class DenyAll implements Authorizer {
+    private readonly reason;
+    constructor(reason?: string);
+    check(): Promise<Decision>;
+    listAccessible(): Promise<AccessScope>;
+}
+//# sourceMappingURL=deny-all.d.ts.map

package/dist/testing/deny-all.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-all.d.ts","sourceRoot":"","sources":["../../src/testing/deny-all.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAEnE,qBAAa,OAAQ,YAAW,UAAU;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,SAAmB,EAAI;IAEpD,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,CAE/B;IAEK,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAE3C;CACF"}

package/dist/testing/deny-all.js

@@ -0,0 +1,14 @@
+import { deny } from '../authorization/decision.js';
+export class DenyAll {
+    reason;
+    constructor(reason = 'DENIED_BY_TEST') {
+        this.reason = reason;
+    }
+    async check() {
+        return deny(this.reason);
+    }
+    async listAccessible() {
+        return { kind: 'none' };
+    }
+}
+//# sourceMappingURL=deny-all.js.map

package/dist/testing/deny-all.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-all.js","sourceRoot":"","sources":["../../src/testing/deny-all.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAiB,MAAM,8BAA8B,CAAC;AAEnE,MAAM,OAAO,OAAO;IACW,MAAM;IAAnC,YAA6B,MAAM,GAAG,gBAAgB;sBAAzB,MAAM;IAAsB,CAAC;IAE1D,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/testing/fake-authenticator.d.ts

@@ -0,0 +1,13 @@
+import type { Actor, Session } from '@ddd-ts-kit/kernel';
+import type { SessionAuthenticator } from '../authentication/session-authenticator.js';
+/**
+ * Knows a few credentials by heart, each standing for an actor or for a whole session:
+ * `new FakeAuthenticator({ 'token-of-ada': ada, 'token-of-support': aSession().of(bob).build() })`.
+ */
+export declare class FakeAuthenticator implements SessionAuthenticator {
+    private readonly principals;
+    constructor(principals: Readonly<Record<string, Actor | Session>>);
+    authenticate(credential: string | undefined): Promise<Actor>;
+    authenticateSession(credential: string | undefined): Promise<Session>;
+}
+//# sourceMappingURL=fake-authenticator.d.ts.map

package/dist/testing/fake-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-authenticator.d.ts","sourceRoot":"","sources":["../../src/testing/fake-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAIvF;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,EAAI;IAEhF,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAEjE;IAEK,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAY1E;CACF"}

package/dist/testing/fake-authenticator.js

@@ -0,0 +1,26 @@
+import { sessionOf } from '../authentication/session-of.js';
+import { InvalidCredentialError } from '../errors/invalid-credential-error.js';
+/**
+ * Knows a few credentials by heart, each standing for an actor or for a whole session:
+ * `new FakeAuthenticator({ 'token-of-ada': ada, 'token-of-support': aSession().of(bob).build() })`.
+ */
+export class FakeAuthenticator {
+    principals;
+    constructor(principals) {
+        this.principals = principals;
+    }
+    async authenticate(credential) {
+        return (await this.authenticateSession(credential)).actor;
+    }
+    async authenticateSession(credential) {
+        if (credential === undefined) {
+            return sessionOf(undefined);
+        }
+        const principal = this.principals[credential];
+        if (principal === undefined) {
+            throw new InvalidCredentialError('UNKNOWN_CREDENTIAL');
+        }
+        return sessionOf(principal);
+    }
+}
+//# sourceMappingURL=fake-authenticator.js.map

package/dist/testing/fake-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-authenticator.js","sourceRoot":"","sources":["../../src/testing/fake-authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACC,UAAU;IAAvC,YAA6B,UAAqD;0BAArD,UAAU;IAA8C,CAAC;IAEtF,KAAK,CAAC,YAAY,CAAC,UAA8B;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAA8B;QACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/testing/recording-authorizer.d.ts

@@ -0,0 +1,15 @@
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { CheckRequest } from '../authorization/check-request.js';
+import type { Decision } from '../authorization/decision.js';
+import type { ListRequest } from '../authorization/list-request.js';
+/** Keeps what it was asked, as data, and answers what the wrapped authorizer answers. */
+export declare class RecordingAuthorizer implements Authorizer {
+    private readonly answering;
+    readonly checks: CheckRequest[];
+    readonly listings: ListRequest[];
+    constructor(answering?: Authorizer);
+    check(request: CheckRequest): Promise<Decision>;
+    listAccessible(request: ListRequest): Promise<AccessScope>;
+}
+//# sourceMappingURL=recording-authorizer.d.ts.map

package/dist/testing/recording-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recording-authorizer.d.ts","sourceRoot":"","sources":["../../src/testing/recording-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,yFAAyF;AACzF,qBAAa,mBAAoB,YAAW,UAAU;IAKxC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJtC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAM;IAErC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAM;IAEtC,YAA6B,SAAS,GAAE,UAA2B,EAAI;IAEjE,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIpD;IAEK,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAI/D;CACF"}

package/dist/testing/recording-authorizer.js

@@ -0,0 +1,19 @@
+import { AllowAll } from './allow-all.js';
+/** Keeps what it was asked, as data, and answers what the wrapped authorizer answers. */
+export class RecordingAuthorizer {
+    answering;
+    checks = [];
+    listings = [];
+    constructor(answering = new AllowAll()) {
+        this.answering = answering;
+    }
+    async check(request) {
+        this.checks.push(request);
+        return this.answering.check(request);
+    }
+    async listAccessible(request) {
+        this.listings.push(request);
+        return (await this.answering.listAccessible?.(request)) ?? { kind: 'none' };
+    }
+}
+//# sourceMappingURL=recording-authorizer.js.map

package/dist/testing/recording-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recording-authorizer.js","sourceRoot":"","sources":["../../src/testing/recording-authorizer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,yFAAyF;AACzF,MAAM,OAAO,mBAAmB;IAKD,SAAS;IAJ7B,MAAM,GAAmB,EAAE,CAAC;IAE5B,QAAQ,GAAkB,EAAE,CAAC;IAEtC,YAA6B,SAAS,GAAe,IAAI,QAAQ,EAAE;yBAAtC,SAAS;IAAgC,CAAC;IAEvE,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAoB;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5B,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/testing/relation-tuple-store-contract.d.ts

@@ -0,0 +1,10 @@
+import { type Awaitable, type ContractRunner } from '@ddd-ts-kit/testing/contracts';
+import type { RelationTupleStore } from '../rebac/relation-tuple-store.js';
+export interface RelationTupleStoreContractOptions {
+    readonly name: string;
+    /** A fresh, empty store; called before each test. */
+    create(): Awaitable<RelationTupleStore>;
+}
+/** What every relation tuple store, in memory or in a database, guarantees to the authorizer. */
+export declare function relationTupleStoreContract(runner: ContractRunner, options: RelationTupleStoreContractOptions): void;
+//# sourceMappingURL=relation-tuple-store-contract.d.ts.map

package/dist/testing/relation-tuple-store-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple-store-contract.d.ts","sourceRoot":"","sources":["../../src/testing/relation-tuple-store-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEnG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAG3E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;CACzC;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,GAAG,IAAI,CAEnH"}

package/dist/testing/relation-tuple-store-contract.js

@@ -0,0 +1,68 @@
+import { ContractSuite } from '@ddd-ts-kit/testing/contracts';
+import { tupleKey } from '../rebac/tuple-key.js';
+/** What every relation tuple store, in memory or in a database, guarantees to the authorizer. */
+export function relationTupleStoreContract(runner, options) {
+    new TupleStoreSuite(runner, () => options.create()).describe(`${options.name} (relation tuple store contract)`);
+}
+const adaEdits = { object: 'document:1', relation: 'editor', subject: 'user:ada' };
+const adaViews = { object: 'document:1', relation: 'viewer', subject: 'user:ada' };
+const adamEdits = { object: 'document:1', relation: 'editor', subject: 'user:adam' };
+const teamEdits = { object: 'document:1', relation: 'editor', subject: 'group:eng#member' };
+const adaEditsAnother = { object: 'document:10', relation: 'editor', subject: 'user:ada' };
+const filedUnderTeam = { object: 'document:1', relation: 'parent', subject: 'group:eng' };
+class TupleStoreSuite extends ContractSuite {
+    tests() {
+        this.readsByObjectAndRelation();
+        this.readsBySubject();
+        this.writesOnce();
+        this.deletes();
+    }
+    readsByObjectAndRelation() {
+        this.it('reads what was written, by object and relation', async () => {
+            await this.subject.write([adaEdits, teamEdits]);
+            this.expect(sorted(await this.subject.readByObject('document:1', 'editor'))).toEqual(sorted([adaEdits, teamEdits]));
+        });
+        this.it('keeps objects and relations apart', async () => {
+            await this.subject.write([adaEdits, adaViews, adaEditsAnother]);
+            this.expect(await this.subject.readByObject('document:1', 'viewer')).toEqual([adaViews]);
+            this.expect(await this.subject.readByObject('document:10', 'editor')).toEqual([adaEditsAnother]);
+            this.expect(await this.subject.readByObject('document:2', 'editor')).toEqual([]);
+        });
+    }
+    readsBySubject() {
+        this.it('reads by subject across objects and relations', async () => {
+            await this.subject.write([adaEdits, adaViews, adaEditsAnother, adamEdits]);
+            this.expect(sorted(await this.subject.readBySubject('user:ada'))).toEqual(sorted([adaEdits, adaViews, adaEditsAnother]));
+        });
+        this.it('matches the subject exactly, a userset being another subject than its object', async () => {
+            await this.subject.write([adamEdits, teamEdits, filedUnderTeam]);
+            this.expect(await this.subject.readBySubject('user:ada')).toEqual([]);
+            this.expect(await this.subject.readBySubject('group:eng#member')).toEqual([teamEdits]);
+            this.expect(await this.subject.readBySubject('group:eng')).toEqual([filedUnderTeam]);
+        });
+    }
+    writesOnce() {
+        this.it('stores a tuple written twice once', async () => {
+            await this.subject.write([adaEdits]);
+            await this.subject.write([adaEdits, adaEdits]);
+            this.expect(await this.subject.readByObject('document:1', 'editor')).toEqual([adaEdits]);
+        });
+    }
+    deletes() {
+        this.it('deletes the given tuples and no other', async () => {
+            await this.subject.write([adaEdits, adamEdits, adaViews]);
+            await this.subject.delete([adaEdits]);
+            this.expect(await this.subject.readByObject('document:1', 'editor')).toEqual([adamEdits]);
+            this.expect(await this.subject.readBySubject('user:ada')).toEqual([adaViews]);
+        });
+        this.it('accepts the deletion of a tuple that is not there', async () => {
+            await this.subject.write([adaEdits]);
+            await this.subject.delete([adamEdits]);
+            this.expect(await this.subject.readByObject('document:1', 'editor')).toEqual([adaEdits]);
+        });
+    }
+}
+function sorted(tuples) {
+    return [...tuples].sort((left, right) => tupleKey(left).localeCompare(tupleKey(right)));
+}
+//# sourceMappingURL=relation-tuple-store-contract.js.map

package/dist/testing/relation-tuple-store-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-tuple-store-contract.js","sourceRoot":"","sources":["../../src/testing/relation-tuple-store-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAuC,MAAM,+BAA+B,CAAC;AAGnG,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAQjD,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,MAAsB,EAAE,OAA0C;IAC3G,IAAI,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,kCAAkC,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,QAAQ,GAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAClG,MAAM,QAAQ,GAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAClG,MAAM,SAAS,GAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACpG,MAAM,SAAS,GAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC3G,MAAM,eAAe,GAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1G,MAAM,cAAc,GAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAEzG,MAAM,eAAgB,SAAQ,aAAiC;IACnD,KAAK;QACb,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAClF,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;YAEhE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACjG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;YAE3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CACvE,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;YACjG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAEjE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAE/C,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAE1D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEtC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAErC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAEvC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,MAAM,CAAC,MAAgC;IAC9C,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,9 @@
+export { ActorBuilder } from './testing/actor-builder.js';
+export { AllowAll } from './testing/allow-all.js';
+export { anActor } from './testing/an-actor.js';
+export { authorizerContract, type AuthorizerContractOptions, type AuthorizerFixture, } from './testing/authorizer-contract.js';
+export { DenyAll } from './testing/deny-all.js';
+export { FakeAuthenticator } from './testing/fake-authenticator.js';
+export { RecordingAuthorizer } from './testing/recording-authorizer.js';
+export { relationTupleStoreContract, type RelationTupleStoreContractOptions, } from './testing/relation-tuple-store-contract.js';
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,4CAA4C,CAAC"}

package/dist/testing.js

@@ -0,0 +1,9 @@
+export { ActorBuilder } from './testing/actor-builder.js';
+export { AllowAll } from './testing/allow-all.js';
+export { anActor } from './testing/an-actor.js';
+export { authorizerContract, } from './testing/authorizer-contract.js';
+export { DenyAll } from './testing/deny-all.js';
+export { FakeAuthenticator } from './testing/fake-authenticator.js';
+export { RecordingAuthorizer } from './testing/recording-authorizer.js';
+export { relationTupleStoreContract, } from './testing/relation-tuple-store-contract.js';
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EACL,kBAAkB,GAGnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,0BAA0B,GAE3B,MAAM,4CAA4C,CAAC"}

package/dist/use-cases/authorization-map.d.ts

@@ -0,0 +1,18 @@
+import type { Message } from '@ddd-ts-kit/kernel';
+import type { UseCaseDeclaration } from './use-case-declaration.js';
+/**
+ * What each command and query requires. A message absent from it is refused: deny by default.
+ * A value, not a port: the authorization module builds it from what the use cases declared
+ * and binds it under this class.
+ */
+export declare class AuthorizationMap {
+    static readonly tokenKey = "auth.AuthorizationMap";
+    private readonly byType;
+    static of(...declarations: readonly UseCaseDeclaration[]): AuthorizationMap;
+    constructor(declarations?: readonly UseCaseDeclaration[]);
+    find(message: Message): UseCaseDeclaration | undefined;
+    declarations(): readonly UseCaseDeclaration[];
+    /** The maps of several contexts as one, for the composition root. */
+    merge(...others: readonly AuthorizationMap[]): AuthorizationMap;
+}
+//# sourceMappingURL=authorization-map.d.ts.map

package/dist/use-cases/authorization-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.d.ts","sourceRoot":"","sources":["../../src/use-cases/authorization-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,QAAQ,CAAC,QAAQ,2BAA2B;IAEnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,EAAE,SAAS,kBAAkB,EAAE,GAAG,gBAAgB,CAE1E;IAED,YAAY,YAAY,GAAE,SAAS,kBAAkB,EAAO,EAQ3D;IAED,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAErD;IAED,YAAY,IAAI,SAAS,kBAAkB,EAAE,CAE5C;IAED,qEAAqE;IACrE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,gBAAgB,CAE9D;CACF"}

package/dist/use-cases/authorization-map.js

@@ -0,0 +1,32 @@
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+/**
+ * What each command and query requires. A message absent from it is refused: deny by default.
+ * A value, not a port: the authorization module builds it from what the use cases declared
+ * and binds it under this class.
+ */
+export class AuthorizationMap {
+    static tokenKey = 'auth.AuthorizationMap';
+    byType = new Map();
+    static of(...declarations) {
+        return new AuthorizationMap(declarations);
+    }
+    constructor(declarations = []) {
+        for (const declaration of declarations) {
+            if (this.byType.has(declaration.type)) {
+                throw new AuthorizationSetupError(`The access to ${declaration.type.name} is declared twice.`);
+            }
+            this.byType.set(declaration.type, declaration);
+        }
+    }
+    find(message) {
+        return this.byType.get(message.constructor);
+    }
+    declarations() {
+        return [...this.byType.values()];
+    }
+    /** The maps of several contexts as one, for the composition root. */
+    merge(...others) {
+        return new AuthorizationMap([this, ...others].flatMap((map) => map.declarations()));
+    }
+}
+//# sourceMappingURL=authorization-map.js.map

package/dist/use-cases/authorization-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-map.js","sourceRoot":"","sources":["../../src/use-cases/authorization-map.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAU,QAAQ,GAAG,uBAAuB,CAAC;IAElC,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEjE,MAAM,CAAC,EAAE,CAAC,GAAG,YAA2C;QACtD,OAAO,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,YAAY,GAAkC,EAAE;QAC1D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACjG,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAgB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,GAAG,MAAmC;QAC1C,OAAO,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/use-cases/authorization-middleware.d.ts

@@ -0,0 +1,17 @@
+import { type BusMiddleware } from '@ddd-ts-kit/kernel';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { OnDecision } from '../authorization/on-decision.js';
+import type { AuthorizationMap } from './authorization-map.js';
+export interface AuthorizationMiddlewareOptions {
+    readonly authorizer: Authorizer;
+    readonly map: AuthorizationMap;
+    /** The audit hook: called once per protected message, whether allowed or refused. */
+    readonly onDecision?: OnDecision;
+}
+/**
+ * Asks the authorizer before any handler runs. Deny by default: a message the map does not
+ * know is refused with `UndeclaredUseCaseError`. Install it before the unit of work, so a
+ * refused command opens no transaction.
+ */
+export declare function authorizationMiddleware(options: AuthorizationMiddlewareOptions): BusMiddleware;
+//# sourceMappingURL=authorization-middleware.d.ts.map

package/dist/use-cases/authorization-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-middleware.d.ts","sourceRoot":"","sources":["../../src/use-cases/authorization-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,aAAa,EAAkC,MAAM,oBAAoB,CAAC;AAChH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAKjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAKlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,aAAa,CAc9F"}

package/dist/use-cases/authorization-middleware.js

@@ -0,0 +1,49 @@
+import { isActored, isAnonymous } from '@ddd-ts-kit/kernel';
+import { deny } from '../authorization/decision.js';
+import { decisionRecordOf } from '../authorization/decision-record-of.js';
+import { DenialReason } from '../authorization/denial-reason.js';
+import { ForbiddenError } from '../errors/forbidden-error.js';
+import { MissingActorError } from '../errors/missing-actor-error.js';
+import { UnauthenticatedError } from '../errors/unauthenticated-error.js';
+import { UndeclaredUseCaseError } from '../errors/undeclared-use-case-error.js';
+/**
+ * Asks the authorizer before any handler runs. Deny by default: a message the map does not
+ * know is refused with `UndeclaredUseCaseError`. Install it before the unit of work, so a
+ * refused command opens no transaction.
+ */
+export function authorizationMiddleware(options) {
+    return async (message, next, info) => {
+        const declaration = options.map.find(message);
+        if (declaration === undefined) {
+            throw new UndeclaredUseCaseError(info);
+        }
+        if (declaration.access === 'protected') {
+            await assertAllowed(options, declaration, { message, info });
+        }
+        return next();
+    };
+}
+async function assertAllowed({ authorizer, onDecision }, declaration, { message, info }) {
+    const request = requestOf(declaration, message, info);
+    const anonymous = isAnonymous(request.actor);
+    const decision = anonymous ? deny(DenialReason.anonymous) : await authorizer.check(request);
+    await onDecision?.(decisionRecordOf(request, decision, info));
+    if (decision.allowed) {
+        return;
+    }
+    throw anonymous ? new UnauthenticatedError() : new ForbiddenError(request.permission.id, decision.reason);
+}
+function requestOf(declaration, message, info) {
+    if (!isActored(message)) {
+        throw new MissingActorError(info);
+    }
+    const resource = declaration.resourceOf(message);
+    const context = declaration.contextOf(message);
+    return {
+        actor: message.actor,
+        permission: declaration.permission,
+        ...(resource === undefined ? {} : { resource }),
+        ...(context === undefined ? {} : { context }),
+    };
+}
+//# sourceMappingURL=authorization-middleware.js.map