@ddd-ts-kit/openfga 0.0.0 → 0.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gary Bourgeat
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1 +1,106 @@
-Placeholder of @ddd-ts-kit/openfga. See https://github.com/gbourgeat/ddd-ts-kit.
+# @ddd-ts-kit/openfga
+
+The relationships of [`@ddd-ts-kit/auth`](../auth/README.md) on [OpenFGA](https://openfga.dev),
+the CNCF implementation of Zanzibar: the `RelationTupleStore` and the `Authorizer` ports answered
+by an OpenFGA server, and its authorization model generated from the relationship schema the
+project already declares with `defineSchema`. One source of truth: the schema; the model is
+derived from it and checked against what the server holds.
+
+```bash
+npm install @ddd-ts-kit/openfga @openfga/sdk
+```
+
+`@openfga/sdk` (0.9.7, the official client) is an optional peer, imported by the `/sdk` entry
+only. The main entry takes any client that fits `OpenFgaApi`, the subset of the official
+client the adapters call.
+
+## The model, from the schema
+
+```ts
+import { authorizationModelOf, ensureAuthorizationModel, modelDrift } from '@ddd-ts-kit/openfga';
+import { relationshipSchema } from '@/platform/auth/relationship-schema';
+
+authorizationModelOf(relationshipSchema); // the body of WriteAuthorizationModel, schema 1.1
+
+const { modelId, changes } = await ensureAuthorizationModel(client, relationshipSchema);
+```
+
+| Schema of `@ddd-ts-kit/auth/rebac` | OpenFGA |
+|---|---|
+| a relation and the subjects it lists: `editor: ['user', 'group#member']` | a directly assignable relation (`this`) with `directly_related_user_types` |
+| a name in a rewrite: `union('owner', 'editor')` | a computed userset |
+| `union(...)`, `intersection(...)` | `union`, `intersection` |
+| `exclusion(base, subtract)` | `difference` |
+| `from('parent', 'edit')` | a tuple to userset |
+
+`ensureAuthorizationModel(client, schema)` writes the generated model when the latest one of the
+store differs, and answers the id in force and the differences (OpenFGA keeps every model; checks
+use the latest unless a client pins one). Run it where the application is deployed or starts.
+`modelDrift(authorizationModelOf(schema), served)` only compares: one line per type or
+`type#relation` missing, extra or changed, empty when the two decide alike. A pipeline step reads
+the latest model of the store and fails on any line, so the model is never edited by hand next to
+the schema.
+
+## The store and the authorizer
+
+```ts
+import { OpenFgaAuthorizer, OpenFgaRelationTupleStore } from '@ddd-ts-kit/openfga';
+import { openFgaClient } from '@ddd-ts-kit/openfga/sdk';
+
+const client = openFgaClient({ apiUrl: config.openfga.url, storeId: config.openfga.storeId });
+
+const tuples = new OpenFgaRelationTupleStore(client, relationshipSchema);
+const authorizer = new OpenFgaAuthorizer({ client, mapping: permissionMapping() });
+```
+
+- `OpenFgaRelationTupleStore` passes `relationTupleStoreContract`, as the PostgreSQL store does:
+  writing a tuple twice and deleting one that is not there change nothing (the conflict options
+  of OpenFGA 1.10 and later), writes and deletes go by 100, reads follow every page. A read by
+  subject is one read per relation of the schema that accepts the kind of the subject, since
+  OpenFGA reads by user within one object type.
+- `OpenFgaAuthorizer` passes `authorizerContract`, with the mapping and the denial codes of
+  `RelationBasedAuthorizer` (`ANONYMOUS`, `RESOURCE_REQUIRED`, `UNMAPPED_PERMISSION`,
+  `NO_RELATION`): `Check` decides, `ListObjects` gives the scope of a search (`{ kind: 'ids' }`).
+  A project moves between the two by binding, nothing else changes.
+
+**The limits of `ListObjects`.** The server answers at most `OPENFGA_LIST_OBJECTS_MAX_RESULTS`
+objects (1000 by default) and stops at `OPENFGA_LIST_OBJECTS_DEADLINE` (3 seconds by default),
+and in both cases returns the objects found so far **without an error**. A search narrowed by a
+cut list would lose elements in silence, so `OpenFgaAuthorizer` refuses an answer as long as
+`listObjectsLimit` (default 1000: set it to the server's value) with
+`ReverseExpansionLimitError`, as the in-process authorizer does beyond its own limit. A list cut
+by the deadline cannot be told from a complete one by its answer: give the server a deadline
+above the slowest listing you expect, and watch its latency. When the lists are that long,
+narrow them first (a projection of the accessible ids, a coarser parent such as the clinic)
+rather than raising the limits.
+
+**A write is a call to a service.** It does not join the transaction of the unit of work: an
+aggregate can commit without its tuple, or a tuple be written for an aggregate whose transaction
+rolled back. Write tuples after the commit, from a domain event handler of phase `after-commit`
+or from the consumer of an integration event (both retried, and the store is idempotent), never
+from inside the transaction of the command; and decide what a request sees during the short
+window when the aggregate exists without its relationship.
+
+## Testing
+
+The specs of this package run the two contract suites against an in-memory double of the tuple
+endpoints, and against a real server when `DDD_TS_KIT_OPENFGA_URL` is set: the integration job
+of the repository starts `openfga/openfga` v1.22.0, pinned by digest. A project holds its own
+adapters to the same suites, each test on a store of its own (`createStore`, then
+`ensureAuthorizationModel`).
+
+## Limits
+
+- No consistency token is carried: a check uses the default preference of the server
+  (`MINIMIZE_LATENCY`), so a tuple just written may not be seen at once by every replica.
+- No conditional tuples (OpenFGA conditions): the schema of the kit has no caveats either.
+- The subject of an actor is `<type>:<id>`; an id holding a character OpenFGA refuses in an
+  object id needs `subjectOf`.
+- `expand` of `RelationBasedAuthorizer` has no equivalent here: use the `Expand` API of OpenFGA
+  for debugging.
+
+## See also
+
+- [Authorization engines](../../docs/tools/authorization-engines.md): the PostgreSQL tuple store
+  or OpenFGA, and when to choose which
+- [Choosing access control](../../docs/guides/choosing-access-control.md)

package/dist/authorizer/open-fga-authorizer-options.d.ts

@@ -0,0 +1,18 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { PermissionMapping } from '@ddd-ts-kit/auth/rebac';
+import type { OpenFgaApi } from '../client/open-fga-api.js';
+export interface OpenFgaAuthorizerOptions {
+    readonly client: OpenFgaApi;
+    /** Per resource type, the relation of the model each permission of the kit stands for, as for `RelationBasedAuthorizer`. */
+    readonly mapping: PermissionMapping;
+    /** The subject an actor is in the tuples. Default `<actor type>:<actor id>`, such as `user:ada`. */
+    readonly subjectOf?: (actor: Actor) => string;
+    /**
+     * The most objects the server answers to one `ListObjects`: its `OPENFGA_LIST_OBJECTS_MAX_RESULTS`,
+     * 1000 by default. The server cuts a longer list without saying so, so an answer that reaches it
+     * is refused (`ReverseExpansionLimitError`) rather than taken as the whole scope. Set it to the
+     * value the server runs with.
+     */
+    readonly listObjectsLimit?: number;
+}
+//# sourceMappingURL=open-fga-authorizer-options.d.ts.map

package/dist/authorizer/open-fga-authorizer-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-authorizer-options.d.ts","sourceRoot":"","sources":["../../src/authorizer/open-fga-authorizer-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,4HAA4H;IAC5H,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC"}

package/dist/authorizer/open-fga-authorizer-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-fga-authorizer-options.js.map

package/dist/authorizer/open-fga-authorizer-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-authorizer-options.js","sourceRoot":"","sources":["../../src/authorizer/open-fga-authorizer-options.ts"],"names":[],"mappings":""}

package/dist/authorizer/open-fga-authorizer.d.ts

@@ -0,0 +1,17 @@
+import { type AccessScope, type Authorizer, type CheckRequest, type Decision, type ListRequest } from '@ddd-ts-kit/auth';
+import type { OpenFgaAuthorizerOptions } from './open-fga-authorizer-options.js';
+/**
+ * The `Authorizer` port of `@ddd-ts-kit/auth` answered by OpenFGA: `Check` for a decision,
+ * `ListObjects` for the scope of a search. The same permissions, mapping and denial codes as the
+ * in-process `RelationBasedAuthorizer`, so a project moves from one to the other by binding. Like
+ * it, a listing that may be incomplete is refused: an answer as long as `listObjectsLimit` may
+ * have been cut by the server, and a search narrowed by it would lose elements in silence.
+ */
+export declare class OpenFgaAuthorizer implements Authorizer {
+    private readonly options;
+    constructor(options: OpenFgaAuthorizerOptions);
+    check({ actor, permission, resource }: CheckRequest): Promise<Decision>;
+    listAccessible({ actor, permission, resourceType }: ListRequest): Promise<AccessScope>;
+    private subjectOf;
+}
+//# sourceMappingURL=open-fga-authorizer.d.ts.map

package/dist/authorizer/open-fga-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-authorizer.d.ts","sourceRoot":"","sources":["../../src/authorizer/open-fga-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAKjF;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,UAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,wBAAwB,EAAI;IAE5D,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmB5E;IAEK,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3F;IAED,OAAO,CAAC,SAAS;CAGlB"}

package/dist/authorizer/open-fga-authorizer.js

@@ -0,0 +1,53 @@
+import { ReverseExpansionLimitError } from '@ddd-ts-kit/auth/rebac';
+import { ALLOWED, DenialReason, deny, } from '@ddd-ts-kit/auth';
+import { isAnonymous } from '@ddd-ts-kit/kernel';
+/** `OPENFGA_LIST_OBJECTS_MAX_RESULTS` of a server that leaves it at its default. */
+const SERVER_LIST_OBJECTS_LIMIT = 1000;
+/**
+ * The `Authorizer` port of `@ddd-ts-kit/auth` answered by OpenFGA: `Check` for a decision,
+ * `ListObjects` for the scope of a search. The same permissions, mapping and denial codes as the
+ * in-process `RelationBasedAuthorizer`, so a project moves from one to the other by binding. Like
+ * it, a listing that may be incomplete is refused: an answer as long as `listObjectsLimit` may
+ * have been cut by the server, and a search narrowed by it would lose elements in silence.
+ */
+export class OpenFgaAuthorizer {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async check({ actor, permission, resource }) {
+        if (isAnonymous(actor)) {
+            return deny(DenialReason.anonymous);
+        }
+        if (resource === undefined) {
+            return deny(DenialReason.resourceRequired);
+        }
+        const relation = this.options.mapping[resource.type]?.[permission.id];
+        if (relation === undefined) {
+            return deny(DenialReason.unmappedPermission);
+        }
+        const object = `${resource.type}:${resource.id}`;
+        const { allowed } = await this.options.client.check({ user: this.subjectOf(actor), relation, object });
+        return allowed === true ? ALLOWED : deny(DenialReason.noRelation);
+    }
+    async listAccessible({ actor, permission, resourceType }) {
+        const relation = this.options.mapping[resourceType]?.[permission.id];
+        if (isAnonymous(actor) || relation === undefined) {
+            return { kind: 'none' };
+        }
+        const { objects } = await this.options.client.listObjects({
+            user: this.subjectOf(actor),
+            relation,
+            type: resourceType,
+        });
+        const limit = this.options.listObjectsLimit ?? SERVER_LIST_OBJECTS_LIMIT;
+        if (objects.length >= limit) {
+            throw new ReverseExpansionLimitError(limit);
+        }
+        return { kind: 'ids', ids: objects.map((object) => object.slice(resourceType.length + 1)).sort() };
+    }
+    subjectOf(actor) {
+        return this.options.subjectOf?.(actor) ?? `${actor.type}:${actor.id}`;
+    }
+}
+//# sourceMappingURL=open-fga-authorizer.js.map

package/dist/authorizer/open-fga-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-authorizer.js","sourceRoot":"","sources":["../../src/authorizer/open-fga-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,OAAO,EACP,YAAY,EACZ,IAAI,GAML,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAc,MAAM,oBAAoB,CAAC;AAG7D,oFAAoF;AACpF,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACC,OAAO;IAApC,YAA6B,OAAiC;uBAAjC,OAAO;IAA6B,CAAC;IAElE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAgB;QACvD,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvG,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAe;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAErE,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,QAAQ;YACR,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;QAEzE,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrG,CAAC;IAEO,SAAS,CAAC,KAAY;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC;CACF"}

package/dist/client/open-fga-api.d.ts

@@ -0,0 +1,56 @@
+/** One tuple as OpenFGA writes it: the subject is its `user`. */
+export interface OpenFgaTupleKey {
+    readonly user: string;
+    readonly relation: string;
+    readonly object: string;
+}
+/**
+ * What the adapters of this package ask of an OpenFGA client, bound to one store: the subset of
+ * the `OpenFgaClient` of `@openfga/sdk` they call, which that client fits as it is
+ * (`openFgaClient` of `@ddd-ts-kit/openfga/sdk` builds one). Kept structural, so that this entry
+ * imports nothing of the SDK and a test may give a double.
+ */
+export interface OpenFgaApi {
+    check(body: OpenFgaTupleKey): Promise<{
+        readonly allowed?: boolean;
+    }>;
+    listObjects(body: {
+        readonly user: string;
+        readonly relation: string;
+        readonly type: string;
+    }): Promise<{
+        readonly objects: readonly string[];
+    }>;
+    read(body: {
+        readonly user?: string;
+        readonly relation?: string;
+        readonly object?: string;
+    }, options?: {
+        readonly continuationToken?: string;
+        readonly pageSize?: number;
+    }): Promise<{
+        readonly tuples: readonly {
+            readonly key: OpenFgaTupleKey;
+        }[];
+        readonly continuation_token?: string;
+    }>;
+    write(body: {
+        readonly writes?: OpenFgaTupleKey[];
+        readonly deletes?: OpenFgaTupleKey[];
+    }, options?: {
+        readonly conflict?: {
+            readonly onDuplicateWrites?: string;
+            readonly onMissingDeletes?: string;
+        };
+        readonly transaction?: {
+            readonly maxPerChunk?: number;
+        };
+    }): Promise<unknown>;
+    readLatestAuthorizationModel(): Promise<{
+        readonly authorization_model?: unknown;
+    }>;
+    writeAuthorizationModel(body: unknown): Promise<{
+        readonly authorization_model_id: string;
+    }>;
+}
+//# sourceMappingURL=open-fga-api.d.ts.map

package/dist/client/open-fga-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-api.d.ts","sourceRoot":"","sources":["../../src/client/open-fga-api.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,WAAW,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACtG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CACF,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EACtF,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5E,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS;YAAE,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;SAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpH,KAAK,CACH,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;KAAE,EACnF,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAChG,QAAQ,CAAC,WAAW,CAAC,EAAE;YAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1D,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,4BAA4B,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F"}

package/dist/client/open-fga-api.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-fga-api.js.map

package/dist/client/open-fga-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-api.js","sourceRoot":"","sources":["../../src/client/open-fga-api.ts"],"names":[],"mappings":""}

package/dist/client/open-fga-client-options.d.ts

@@ -0,0 +1,10 @@
+export interface OpenFgaClientOptions {
+    /** `http://localhost:8080`. */
+    readonly apiUrl: string;
+    readonly storeId: string;
+    /** Pin a model; left out, every check uses the latest model of the store. */
+    readonly authorizationModelId?: string;
+    /** A preshared key, when the server asks for one. Read from configuration, never written in code. */
+    readonly apiToken?: string;
+}
+//# sourceMappingURL=open-fga-client-options.d.ts.map

package/dist/client/open-fga-client-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-client-options.d.ts","sourceRoot":"","sources":["../../src/client/open-fga-client-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/client/open-fga-client-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-fga-client-options.js.map

package/dist/client/open-fga-client-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-client-options.js","sourceRoot":"","sources":["../../src/client/open-fga-client-options.ts"],"names":[],"mappings":""}

package/dist/client/open-fga-client.d.ts

@@ -0,0 +1,5 @@
+import type { OpenFgaApi } from './open-fga-api.js';
+import type { OpenFgaClientOptions } from './open-fga-client-options.js';
+/** The client of the official SDK, bound to one store, as the adapters of this package take it. */
+export declare function openFgaClient({ apiUrl, storeId, authorizationModelId, apiToken }: OpenFgaClientOptions): OpenFgaApi;
+//# sourceMappingURL=open-fga-client.d.ts.map

package/dist/client/open-fga-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-client.d.ts","sourceRoot":"","sources":["../../src/client/open-fga-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,oBAAoB,GAAG,UAAU,CASnH"}

package/dist/client/open-fga-client.js

@@ -0,0 +1,13 @@
+import { CredentialsMethod, OpenFgaClient } from '@openfga/sdk';
+/** The client of the official SDK, bound to one store, as the adapters of this package take it. */
+export function openFgaClient({ apiUrl, storeId, authorizationModelId, apiToken }) {
+    return new OpenFgaClient({
+        apiUrl,
+        storeId,
+        ...(authorizationModelId === undefined ? {} : { authorizationModelId }),
+        ...(apiToken === undefined
+            ? {}
+            : { credentials: { method: CredentialsMethod.ApiToken, config: { token: apiToken } } }),
+    });
+}
+//# sourceMappingURL=open-fga-client.js.map

package/dist/client/open-fga-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-client.js","sourceRoot":"","sources":["../../src/client/open-fga-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIhE,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAwB;IACrG,OAAO,IAAI,aAAa,CAAC;QACvB,MAAM;QACN,OAAO;QACP,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { OpenFgaAuthorizer } from './authorizer/open-fga-authorizer.js';
+export type { OpenFgaAuthorizerOptions } from './authorizer/open-fga-authorizer-options.js';
+export type { OpenFgaApi, OpenFgaTupleKey } from './client/open-fga-api.js';
+export { authorizationModelOf } from './model/authorization-model-of.js';
+export { ensureAuthorizationModel } from './model/ensure-authorization-model.js';
+export { modelDrift } from './model/model-drift.js';
+export type { OpenFgaModel, OpenFgaRelationReference, OpenFgaTypeDefinition, OpenFgaUserset, } from './model/open-fga-model.js';
+export { OpenFgaRelationTupleStore } from './store/open-fga-relation-tuple-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { OpenFgaAuthorizer } from './authorizer/open-fga-authorizer.js';
+export { authorizationModelOf } from './model/authorization-model-of.js';
+export { ensureAuthorizationModel } from './model/ensure-authorization-model.js';
+export { modelDrift } from './model/model-drift.js';
+export { OpenFgaRelationTupleStore } from './store/open-fga-relation-tuple-store.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/model/authorization-model-of.d.ts

@@ -0,0 +1,10 @@
+import type { Schema } from '@ddd-ts-kit/auth/rebac';
+import type { OpenFgaModel } from './open-fga-model.js';
+/**
+ * The authorization model of OpenFGA for a relationship schema: one source of truth, the schema
+ * the project declares with `defineSchema`, from which the model is generated and checked
+ * (`modelDrift`), never written by hand next to it. A relation of the schema is directly
+ * assignable to the subjects it lists; a permission is the rewrite that derives it.
+ */
+export declare function authorizationModelOf(schema: Schema): OpenFgaModel;
+//# sourceMappingURL=authorization-model-of.d.ts.map

package/dist/model/authorization-model-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-model-of.d.ts","sourceRoot":"","sources":["../../src/model/authorization-model-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EACV,YAAY,EAIb,MAAM,qBAAqB,CAAC;AAG7B;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAEjE"}

package/dist/model/authorization-model-of.js

@@ -0,0 +1,34 @@
+import { usersetOf } from './userset-of.js';
+/**
+ * The authorization model of OpenFGA for a relationship schema: one source of truth, the schema
+ * the project declares with `defineSchema`, from which the model is generated and checked
+ * (`modelDrift`), never written by hand next to it. A relation of the schema is directly
+ * assignable to the subjects it lists; a permission is the rewrite that derives it.
+ */
+export function authorizationModelOf(schema) {
+    return { schema_version: '1.1', type_definitions: schema.types().map((type) => typeDefinitionOf(schema, type)) };
+}
+function typeDefinitionOf(schema, type) {
+    const relations = Object.entries(schema.relations(type));
+    const permissions = Object.entries(schema.permissions(type));
+    if (relations.length === 0 && permissions.length === 0) {
+        return { type };
+    }
+    const direct = relations.map(([name]) => [name, { this: {} }]);
+    const derived = permissions.map(([name, rewrite]) => [name, usersetOf(rewrite)]);
+    const assignable = relations.map(([name, subjects]) => [
+        name,
+        { directly_related_user_types: subjects.map(referenceOf) },
+    ]);
+    return {
+        type,
+        relations: Object.fromEntries([...direct, ...derived]),
+        metadata: { relations: Object.fromEntries(assignable) },
+    };
+}
+/** `'group#member'` is the userset `{ type: 'group', relation: 'member' }`. */
+function referenceOf(subject) {
+    const [type = subject, relation] = subject.split('#');
+    return relation === undefined ? { type } : { type, relation };
+}
+//# sourceMappingURL=authorization-model-of.js.map

package/dist/model/authorization-model-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-model-of.js","sourceRoot":"","sources":["../../src/model/authorization-model-of.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAA4B,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAA4B,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3G,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAA0B,EAAE,CAAC;QAC7E,IAAI;QACJ,EAAE,2BAA2B,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;KAC3D,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACtD,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC;AAMD,+EAA+E;AAC/E,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,IAAI,GAAG,OAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/model/canonical-model.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A model reduced to what decides a check: per `type#relation`, its rewrite and the subjects it
+ * accepts, as stable text. What a server adds (ids, source positions, empty fields) is left
+ * out, so a model read back compares equal to the one written.
+ */
+export declare function canonicalModel(model: unknown): ReadonlyMap<string, string>;
+//# sourceMappingURL=canonical-model.d.ts.map

package/dist/model/canonical-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-model.d.ts","sourceRoot":"","sources":["../../src/model/canonical-model.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB1E"}

package/dist/model/canonical-model.js

@@ -0,0 +1,57 @@
+/**
+ * A model reduced to what decides a check: per `type#relation`, its rewrite and the subjects it
+ * accepts, as stable text. What a server adds (ids, source positions, empty fields) is left
+ * out, so a model read back compares equal to the one written.
+ */
+export function canonicalModel(model) {
+    const entries = new Map();
+    for (const definition of listOf(fieldOf(model, 'type_definitions'))) {
+        const type = String(fieldOf(definition, 'type'));
+        const relations = recordOf(fieldOf(definition, 'relations'));
+        const metadata = recordOf(fieldOf(fieldOf(definition, 'metadata'), 'relations'));
+        entries.set(type, 'type');
+        for (const [relation, userset] of Object.entries(relations)) {
+            const accepted = listOf(fieldOf(metadata[relation], 'directly_related_user_types')).map(referenceText).sort();
+            entries.set(`${type}#${relation}`, `${usersetText(userset)} [${accepted.join(', ')}]`);
+        }
+    }
+    return entries;
+}
+function usersetText(userset) {
+    const union = fieldOf(userset, 'union');
+    const intersection = fieldOf(userset, 'intersection');
+    const difference = fieldOf(userset, 'difference');
+    const tupleToUserset = fieldOf(userset, 'tupleToUserset');
+    if (union !== undefined) {
+        return `union(${listOf(fieldOf(union, 'child')).map(usersetText).join(', ')})`;
+    }
+    if (intersection !== undefined) {
+        return `intersection(${listOf(fieldOf(intersection, 'child')).map(usersetText).join(', ')})`;
+    }
+    if (difference !== undefined) {
+        return `difference(${usersetText(fieldOf(difference, 'base'))}, ${usersetText(fieldOf(difference, 'subtract'))})`;
+    }
+    if (tupleToUserset !== undefined) {
+        const followed = relationOf(fieldOf(tupleToUserset, 'tupleset'));
+        return `from(${followed}, ${relationOf(fieldOf(tupleToUserset, 'computedUserset'))})`;
+    }
+    const computed = fieldOf(userset, 'computedUserset');
+    return computed === undefined ? 'this' : relationOf(computed);
+}
+function referenceText(reference) {
+    const relation = fieldOf(reference, 'relation');
+    return `${String(fieldOf(reference, 'type'))}${typeof relation === 'string' && relation !== '' ? `#${relation}` : ''}`;
+}
+function relationOf(value) {
+    return String(fieldOf(value, 'relation'));
+}
+function fieldOf(value, key) {
+    return typeof value === 'object' && value !== null ? Reflect.get(value, key) : undefined;
+}
+function listOf(value) {
+    return Array.isArray(value) ? value : [];
+}
+function recordOf(value) {
+    return typeof value === 'object' && value !== null ? { ...value } : {};
+}
+//# sourceMappingURL=canonical-model.js.map

package/dist/model/canonical-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-model.js","sourceRoot":"","sources":["../../src/model/canonical-model.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAEjF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE1B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9G,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAE1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACjF,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,gBAAgB,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/F,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,cAAc,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC;IACpH,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;QAEjE,OAAO,QAAQ,QAAQ,KAAK,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC;IACxF,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAErD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEhD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,GAAW;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC"}

package/dist/model/ensure-authorization-model.d.ts

@@ -0,0 +1,13 @@
+import type { Schema } from '@ddd-ts-kit/auth/rebac';
+import type { OpenFgaApi } from '../client/open-fga-api.js';
+/**
+ * Makes the latest model of the store the one the schema generates, writing a new one only when
+ * they differ (OpenFGA keeps every model it was given; a check uses the latest unless told
+ * otherwise). Answers the id of the model in force and what changed. For a deployment step or
+ * the start of the application; a pipeline checks without writing, with `modelDrift`.
+ */
+export declare function ensureAuthorizationModel(client: OpenFgaApi, schema: Schema): Promise<{
+    readonly modelId: string;
+    readonly changes: readonly string[];
+}>;
+//# sourceMappingURL=ensure-authorization-model.d.ts.map

package/dist/model/ensure-authorization-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-authorization-model.d.ts","sourceRoot":"","sources":["../../src/model/ensure-authorization-model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAI5D;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAY5E"}

package/dist/model/ensure-authorization-model.js

@@ -0,0 +1,19 @@
+import { authorizationModelOf } from './authorization-model-of.js';
+import { modelDrift } from './model-drift.js';
+/**
+ * Makes the latest model of the store the one the schema generates, writing a new one only when
+ * they differ (OpenFGA keeps every model it was given; a check uses the latest unless told
+ * otherwise). Answers the id of the model in force and what changed. For a deployment step or
+ * the start of the application; a pipeline checks without writing, with `modelDrift`.
+ */
+export async function ensureAuthorizationModel(client, schema) {
+    const expected = authorizationModelOf(schema);
+    const { authorization_model: held } = await client.readLatestAuthorizationModel();
+    const changes = modelDrift(expected, held);
+    if (changes.length === 0) {
+        return { modelId: String(Reflect.get(Object(held), 'id')), changes };
+    }
+    const { authorization_model_id: modelId } = await client.writeAuthorizationModel(expected);
+    return { modelId, changes };
+}
+//# sourceMappingURL=ensure-authorization-model.js.map

package/dist/model/ensure-authorization-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-authorization-model.js","sourceRoot":"","sources":["../../src/model/ensure-authorization-model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAkB,EAClB,MAAc;IAEd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAE3F,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/model/model-drift.d.ts

@@ -0,0 +1,8 @@
+import type { OpenFgaModel } from './open-fga-model.js';
+/**
+ * What differs between the model the schema generates and the one a store holds: one line per
+ * type or `type#relation` missing, extra or changed. Empty when they decide alike. The store
+ * holds none at all: one line says so.
+ */
+export declare function modelDrift(expected: OpenFgaModel, actual: unknown): readonly string[];
+//# sourceMappingURL=model-drift.d.ts.map

package/dist/model/model-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-drift.d.ts","sourceRoot":"","sources":["../../src/model/model-drift.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAUrF"}

package/dist/model/model-drift.js

@@ -0,0 +1,28 @@
+import { canonicalModel } from './canonical-model.js';
+/**
+ * What differs between the model the schema generates and the one a store holds: one line per
+ * type or `type#relation` missing, extra or changed. Empty when they decide alike. The store
+ * holds none at all: one line says so.
+ */
+export function modelDrift(expected, actual) {
+    if (actual === undefined || actual === null) {
+        return ['the store holds no authorization model'];
+    }
+    const wanted = canonicalModel(expected);
+    const held = canonicalModel(actual);
+    const names = [...new Set([...wanted.keys(), ...held.keys()])].sort();
+    return names.flatMap((name) => differenceAt(name, wanted.get(name), held.get(name)));
+}
+function differenceAt(name, wanted, held) {
+    if (wanted === held) {
+        return [];
+    }
+    if (held === undefined) {
+        return [`${name} is in the schema, not in the store: ${String(wanted)}`];
+    }
+    if (wanted === undefined) {
+        return [`${name} is in the store, not in the schema: ${held}`];
+    }
+    return [`${name} differs: the schema says ${wanted}, the store ${held}`];
+}
+//# sourceMappingURL=model-drift.js.map

package/dist/model/model-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-drift.js","sourceRoot":"","sources":["../../src/model/model-drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAAsB,EAAE,MAAe;IAChE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAA0B,EAAE,IAAwB;IACtF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,wCAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,IAAI,wCAAwC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,6BAA6B,MAAM,eAAe,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/model/open-fga-model.d.ts

@@ -0,0 +1,45 @@
+/** A userset rewrite of OpenFGA, as its API writes it (schema 1.1). */
+export interface OpenFgaUserset {
+    readonly this?: Record<string, never>;
+    readonly computedUserset?: {
+        readonly relation: string;
+    };
+    readonly tupleToUserset?: {
+        readonly tupleset: {
+            readonly relation: string;
+        };
+        readonly computedUserset: {
+            readonly relation: string;
+        };
+    };
+    readonly union?: {
+        readonly child: readonly OpenFgaUserset[];
+    };
+    readonly intersection?: {
+        readonly child: readonly OpenFgaUserset[];
+    };
+    readonly difference?: {
+        readonly base: OpenFgaUserset;
+        readonly subtract: OpenFgaUserset;
+    };
+}
+/** Who may be the subject of a directly assignable relation: a type, or the userset `<type>#<relation>`. */
+export interface OpenFgaRelationReference {
+    readonly type: string;
+    readonly relation?: string;
+}
+export interface OpenFgaTypeDefinition {
+    readonly type: string;
+    readonly relations?: Readonly<Record<string, OpenFgaUserset>>;
+    readonly metadata?: {
+        readonly relations?: Readonly<Record<string, {
+            readonly directly_related_user_types?: readonly OpenFgaRelationReference[];
+        }>>;
+    };
+}
+/** The body of `WriteAuthorizationModel`: what `authorizationModelOf` generates from a relationship schema. */
+export interface OpenFgaModel {
+    readonly schema_version: '1.1';
+    readonly type_definitions: readonly OpenFgaTypeDefinition[];
+}
+//# sourceMappingURL=open-fga-model.d.ts.map

package/dist/model/open-fga-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-model.d.ts","sourceRoot":"","sources":["../../src/model/open-fga-model.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACjD,QAAQ,CAAC,eAAe,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;KAAE,CAAC;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;KAAE,CAAC;CAC5F;AAED,4GAA4G;AAC5G,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAC3B,MAAM,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;SAAE,CAAC,CAC/F,CAAC;KACH,CAAC;CACH;AAED,+GAA+G;AAC/G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC7D"}

package/dist/model/open-fga-model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-fga-model.js.map

package/dist/model/open-fga-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-model.js","sourceRoot":"","sources":["../../src/model/open-fga-model.ts"],"names":[],"mappings":""}

package/dist/model/userset-of.d.ts

@@ -0,0 +1,8 @@
+import type { Rewrite } from '@ddd-ts-kit/auth/rebac';
+import type { OpenFgaUserset } from './open-fga-model.js';
+/**
+ * A rewrite of the relationship schema in the words of OpenFGA: a name is a computed userset,
+ * `from` a tuple to userset, `exclusion` a difference; union and intersection keep their name.
+ */
+export declare function usersetOf(rewrite: Rewrite): OpenFgaUserset;
+//# sourceMappingURL=userset-of.d.ts.map

package/dist/model/userset-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userset-of.d.ts","sourceRoot":"","sources":["../../src/model/userset-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAoB1D"}

package/dist/model/userset-of.js

@@ -0,0 +1,25 @@
+/**
+ * A rewrite of the relationship schema in the words of OpenFGA: a name is a computed userset,
+ * `from` a tuple to userset, `exclusion` a difference; union and intersection keep their name.
+ */
+export function usersetOf(rewrite) {
+    if (typeof rewrite === 'string') {
+        return { computedUserset: { relation: rewrite } };
+    }
+    switch (rewrite.kind) {
+        case 'from':
+            return {
+                tupleToUserset: {
+                    tupleset: { relation: rewrite.relation },
+                    computedUserset: { relation: rewrite.permission },
+                },
+            };
+        case 'exclusion':
+            return { difference: { base: usersetOf(rewrite.base), subtract: usersetOf(rewrite.subtract) } };
+        case 'union':
+            return { union: { child: rewrite.children.map(usersetOf) } };
+        case 'intersection':
+            return { intersection: { child: rewrite.children.map(usersetOf) } };
+    }
+}
+//# sourceMappingURL=userset-of.js.map

package/dist/model/userset-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userset-of.js","sourceRoot":"","sources":["../../src/model/userset-of.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO;gBACL,cAAc,EAAE;oBACd,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACxC,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE;iBAClD;aACF,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClG,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAC/D,KAAK,cAAc;YACjB,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/sdk.d.ts

@@ -0,0 +1,3 @@
+export { openFgaClient } from './client/open-fga-client.js';
+export type { OpenFgaClientOptions } from './client/open-fga-client-options.js';
+//# sourceMappingURL=sdk.d.ts.map

package/dist/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/sdk.js

@@ -0,0 +1,2 @@
+export { openFgaClient } from './client/open-fga-client.js';
+//# sourceMappingURL=sdk.js.map

package/dist/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/store/open-fga-relation-tuple-store.d.ts

@@ -0,0 +1,25 @@
+import { type RelationTuple, type RelationTupleStore, type Schema } from '@ddd-ts-kit/auth/rebac';
+import type { OpenFgaApi } from '../client/open-fga-api.js';
+/**
+ * The relation tuples of `@ddd-ts-kit/auth` in an OpenFGA store, held to the same contract as the
+ * tuple store of PostgreSQL. Writing a tuple twice and deleting one that is not there change
+ * nothing (the conflict options of OpenFGA 1.10 and later). A write is a call to a service: it
+ * does not join the transaction of the unit of work, so a tuple written with an aggregate goes
+ * through the outbox or is retried, and must be idempotent, as it is here.
+ */
+export declare class OpenFgaRelationTupleStore implements RelationTupleStore {
+    private readonly client;
+    private readonly schema;
+    constructor(client: OpenFgaApi, schema: Schema);
+    write(tuples: readonly RelationTuple[]): Promise<void>;
+    delete(tuples: readonly RelationTuple[]): Promise<void>;
+    readByObject(object: string, relation: string): Promise<readonly RelationTuple[]>;
+    /**
+     * OpenFGA reads by subject only within one object type: one read per relation of the schema
+     * that accepts the kind of the subject (`user`, or the userset `group#member`).
+     */
+    readBySubject(subject: string): Promise<readonly RelationTuple[]>;
+    private relationsAccepting;
+    private readAll;
+}
+//# sourceMappingURL=open-fga-relation-tuple-store.d.ts.map

package/dist/store/open-fga-relation-tuple-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-relation-tuple-store.d.ts","sourceRoot":"","sources":["../../src/store/open-fga-relation-tuple-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,2BAA2B,CAAC;AAQ7E;;;;;;GAMG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAEhE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EAC7B;IAEE,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3D;IAEK,MAAM,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5D;IAED,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAEhF;IAED;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAMtE;IAED,OAAO,CAAC,kBAAkB;YAWZ,OAAO;CAgBtB"}

package/dist/store/open-fga-relation-tuple-store.js

@@ -0,0 +1,77 @@
+import { parseSubject, tupleKey, } from '@ddd-ts-kit/auth/rebac';
+/** OpenFGA answers a page of tuples at a time; this many, at most, per read. */
+const PAGE_SIZE = 100;
+/** How many tuples one write sends: the limit of a write of the OpenFGA API. */
+const CHUNK = 100;
+/**
+ * The relation tuples of `@ddd-ts-kit/auth` in an OpenFGA store, held to the same contract as the
+ * tuple store of PostgreSQL. Writing a tuple twice and deleting one that is not there change
+ * nothing (the conflict options of OpenFGA 1.10 and later). A write is a call to a service: it
+ * does not join the transaction of the unit of work, so a tuple written with an aggregate goes
+ * through the outbox or is retried, and must be idempotent, as it is here.
+ */
+export class OpenFgaRelationTupleStore {
+    client;
+    schema;
+    constructor(client, schema) {
+        this.client = client;
+        this.schema = schema;
+    }
+    async write(tuples) {
+        for (const chunk of chunksOf(distinct(tuples))) {
+            await this.client.write({ writes: chunk }, { conflict: { onDuplicateWrites: 'ignore' } });
+        }
+    }
+    async delete(tuples) {
+        for (const chunk of chunksOf(distinct(tuples))) {
+            await this.client.write({ deletes: chunk }, { conflict: { onMissingDeletes: 'ignore' } });
+        }
+    }
+    readByObject(object, relation) {
+        return this.readAll({ object, relation });
+    }
+    /**
+     * OpenFGA reads by subject only within one object type: one read per relation of the schema
+     * that accepts the kind of the subject (`user`, or the userset `group#member`).
+     */
+    async readBySubject(subject) {
+        const read = this.relationsAccepting(subject).map(([type, relation]) => this.readAll({ user: subject, relation, object: `${type}:` }));
+        return (await Promise.all(read)).flat();
+    }
+    relationsAccepting(subject) {
+        const { type, relation } = parseSubject(subject);
+        const kind = relation === undefined ? type : `${type}#${relation}`;
+        return this.schema.types().flatMap((object) => Object.entries(this.schema.relations(object))
+            .filter(([, subjects]) => subjects.includes(kind))
+            .map(([name]) => [object, name]));
+    }
+    async readAll(filter) {
+        const tuples = [];
+        let continuationToken;
+        do {
+            const page = await this.client.read(filter, {
+                pageSize: PAGE_SIZE,
+                ...(continuationToken === undefined ? {} : { continuationToken }),
+            });
+            tuples.push(...page.tuples.map(({ key }) => ({ object: key.object, relation: key.relation, subject: key.user })));
+            continuationToken = page.continuation_token === '' ? undefined : page.continuation_token;
+        } while (continuationToken !== undefined);
+        return tuples;
+    }
+}
+/** Each tuple once: OpenFGA refuses a request that names one tuple twice, whatever its conflict options. */
+function distinct(tuples) {
+    const keys = new Map(tuples.map(({ object, relation, subject }) => [
+        tupleKey({ object, relation, subject }),
+        { object, relation, user: subject },
+    ]));
+    return [...keys.values()];
+}
+function chunksOf(keys) {
+    const chunks = [];
+    for (let start = 0; start < keys.length; start += CHUNK) {
+        chunks.push(keys.slice(start, start + CHUNK));
+    }
+    return chunks;
+}
+//# sourceMappingURL=open-fga-relation-tuple-store.js.map

package/dist/store/open-fga-relation-tuple-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-fga-relation-tuple-store.js","sourceRoot":"","sources":["../../src/store/open-fga-relation-tuple-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,QAAQ,GAIT,MAAM,wBAAwB,CAAC;AAGhC,gFAAgF;AAChF,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,gFAAgF;AAChF,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAEjB,MAAM;IACN,MAAM;IAFzB,YACmB,MAAkB,EAClB,MAAc;sBADd,MAAM;sBACN,MAAM;IACtB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,MAAgC;QAC1C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAgC;QAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,QAAgB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,CAC9D,CAAC;QAEF,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEO,kBAAkB,CAAC,OAAe;QACxC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;QAEnE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAU,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAsF;QAC1G,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,IAAI,iBAAqC,CAAC;QAE1C,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC1C,QAAQ,EAAE,SAAS;gBACnB,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;aAClE,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClH,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAC3F,CAAC,QAAQ,iBAAiB,KAAK,SAAS,EAAE;QAE1C,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,4GAA4G;AAC5G,SAAS,QAAQ,CAAC,MAAgC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5C,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;KACpC,CAAC,CACH,CAAC;IAEF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgC;IAChD,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,7 +1,48 @@
 {
   "name": "@ddd-ts-kit/openfga",
-  "version": "0.0.0",
-  "description": "Placeholder that reserves the name; the real versions are published by the release workflow of gbourgeat/ddd-ts-kit.",
+  "version": "0.9.0",
+  "description": "The relation tuple store and the authorizer of @ddd-ts-kit/auth on OpenFGA, with the authorization model generated from the relationship schema.",
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/gbourgeat/ddd-ts-kit.git" }
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gbourgeat/ddd-ts-kit.git",
+    "directory": "packages/openfga"
+  },
+  "homepage": "https://github.com/gbourgeat/ddd-ts-kit/tree/main/packages/openfga#readme",
+  "bugs": "https://github.com/gbourgeat/ddd-ts-kit/issues",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./sdk": {
+      "types": "./dist/sdk.d.ts",
+      "default": "./dist/sdk.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@ddd-ts-kit/auth": "0.9.0",
+    "@ddd-ts-kit/kernel": "0.9.0"
+  },
+  "peerDependencies": {
+    "@openfga/sdk": "^0.9.7"
+  },
+  "peerDependenciesMeta": {
+    "@openfga/sdk": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@ddd-ts-kit/testing": "0.9.0",
+    "@openfga/sdk": "0.9.7"
+  }
 }