@develit-services/rbac 0.0.2 → 0.1.1

package/dist/database/schema.d.cts

@@ -1,2 +1,2 @@
-export { r as role, a as roleScope, u as userRole, b as userScope } from '../shared/rbac.BmuK3PNh.cjs';
+export { a as role, r as roleScope, u as userRole, b as userScope } from '../shared/rbac.CqpxM3E5.cjs';
 import 'drizzle-orm/sqlite-core';

package/dist/database/schema.d.mts

@@ -1,2 +1,2 @@
-export { r as role, a as roleScope, u as userRole, b as userScope } from '../shared/rbac.BmuK3PNh.mjs';
+export { a as role, r as roleScope, u as userRole, b as userScope } from '../shared/rbac.CqpxM3E5.mjs';
 import 'drizzle-orm/sqlite-core';

package/dist/database/schema.d.ts

@@ -1,2 +1,2 @@
-export { r as role, a as roleScope, u as userRole, b as userScope } from '../shared/rbac.BmuK3PNh.js';
+export { a as role, r as roleScope, u as userRole, b as userScope } from '../shared/rbac.CqpxM3E5.js';
 import 'drizzle-orm/sqlite-core';

package/dist/database/schema.mjs

@@ -1,3 +1,3 @@
-export { r as role, a as roleScope, u as userRole, b as userScope } from '../shared/rbac.CJLU5iuV.mjs';
+export { a as role, r as roleScope, u as userRole, b as userScope } from '../shared/rbac.D5OV7UPA.mjs';
 import '@develit-io/backend-sdk';
 import 'drizzle-orm/sqlite-core';

package/dist/export/worker.cjs

@@ -2,12 +2,12 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-const cloudflare_workers = require('cloudflare:workers');
 const backendSdk = require('@develit-io/backend-sdk');
-const verifyScope = require('../shared/rbac.CtYOhFTw.cjs');
 const database_schema = require('../shared/rbac.Cra1T2nC.cjs');
 const drizzleOrm = require('drizzle-orm');
+const verifyScope = require('../shared/rbac.CS8i19gH.cjs');
 const zod = require('zod');
+const cloudflare_workers = require('cloudflare:workers');
 const d1 = require('drizzle-orm/d1');
 require('drizzle-orm/sqlite-core');
 
@@ -369,12 +369,20 @@ var __decorateClass = (decorators, target, key, kind) => {
   if (kind && result) __defProp(target, key, result);
   return result;
 };
-let RbacServiceBase = class extends backendSdk.develitWorker(
-  cloudflare_workers.WorkerEntrypoint
-) {
-  constructor(ctx, env) {
+let RbacServiceBase = class extends backendSdk.develitWorker(cloudflare_workers.WorkerEntrypoint) {
+  constructor(ctx, env, scopes) {
     super(ctx, env);
     this.db = d1.drizzle(this.env.RBAC_D1, { schema: tables });
+    this.SCOPES = scopes;
+  }
+  validateScope(scope) {
+    if (!this.SCOPES.some((s) => s.value === scope)) {
+      throw backendSdk.createInternalError(null, {
+        message: `Invalid scope: ${scope}. Available scopes: ${this.SCOPES.map((s) => s.value).join(", ")}`,
+        status: 400,
+        code: "INVALID_SCOPE"
+      });
+    }
   }
   async createRole(input) {
     return this.handleAction(
@@ -471,6 +479,7 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { data: input, schema: verifyScope.grantScopeToUserInputSchema },
       { successMessage: "Scope successfully granted to user." },
       async ({ userId, scope, resourceId }) => {
+        this.validateScope(scope);
         const userScope = await getScopesByUserQuery({ db: this.db, userId });
         if (userScope.some((s) => s.scope === scope)) {
           throw backendSdk.createInternalError(null, {
@@ -495,6 +504,7 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { successMessage: "Scopes successfully granted to user." },
       async ({ userId, scopes }) => {
         for (const scope of scopes) {
+          this.validateScope(scope.scope);
           const userScopes = await getScopesByUserQuery({ db: this.db, userId });
           if (userScopes.some((s) => s.scope === scope.scope)) {
             throw backendSdk.createInternalError(null, {
@@ -518,6 +528,7 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { data: input, schema: verifyScope.revokeScopeFromUserInputSchema },
       { successMessage: "Scope successfully revoked from user." },
       async ({ userId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await revokeScopeFromUserCommand({
           db: this.db,
           userId,
@@ -534,6 +545,7 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { data: input, schema: verifyScope.grantScopeToRoleInputSchema },
       { successMessage: "Scope successfully granted to role." },
       async ({ roleId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await grantScopeToRoleCommand({
           db: this.db,
           scope,
@@ -550,6 +562,7 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { data: input, schema: verifyScope.revokeScopeFromRoleInputSchema },
       { successMessage: "Scope successfully revoked from role." },
       async ({ roleId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await revokeScopeFromRoleCommand({
           db: this.db,
           roleId,
@@ -587,8 +600,9 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
         return {
           roles,
           rolesCount: roles.length,
-          scopes: [...verifyScope.SCOPES],
-          scopesCount: [...verifyScope.SCOPES].length,
+          scopes: [...this.SCOPES.map((s) => s.value)],
+          labeledScopes: this.SCOPES,
+          scopesCount: [...this.SCOPES].length,
           roleScopes,
           roleScopesCount: roleScopes.length
         };
@@ -637,6 +651,9 @@ let RbacServiceBase = class extends backendSdk.develitWorker(
       { data: input, schema: verifyScope.verifyAccessInputSchema },
       { successMessage: "Access verification completed." },
       async ({ userId, accessRequests, jwt }) => {
+        for (const request of accessRequests) {
+          this.validateScope(request.scope);
+        }
         const userPermissionsResponse = await this.getUserPermissions({
           userId
         });
@@ -762,10 +779,10 @@ __decorateClass([
 RbacServiceBase = __decorateClass([
   backendSdk.service("rbac")
 ], RbacServiceBase);
-function defineRbacService() {
+function defineRbacService(config = { scopes: [] }) {
   return class RbacService extends RbacServiceBase {
     constructor(ctx, env) {
-      super(ctx, env);
+      super(ctx, env, config.scopes);
     }
   };
 }

package/dist/export/worker.d.cts

@@ -1,17 +1,19 @@
 import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
 import { IRPCResponse } from '@develit-io/backend-sdk';
+import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.CZnF-YgH.cjs';
 import { WorkerEntrypoint } from 'cloudflare:workers';
-import { t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.CaoDccv4.cjs';
 import { DrizzleD1Database } from 'drizzle-orm/d1';
 import 'zod';
 import 'drizzle-orm';
-import '../shared/rbac.BmuK3PNh.cjs';
+import '../shared/rbac.CqpxM3E5.cjs';
 import 'drizzle-orm/sqlite-core';
 
 declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
-declare class RbacServiceBase extends RbacServiceBase_base {
+declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
     readonly db: DrizzleD1Database<typeof tables>;
-    constructor(ctx: ExecutionContext, env: RbacEnv);
+    readonly SCOPES: TScopes;
+    constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
+    private validateScope;
     createRole(input: CreateRoleInput): Promise<IRPCResponse<CreateRoleOutput>>;
     assignRoleToUser(input: AssignRoleToUserInput): Promise<IRPCResponse<AssignRoleToUserOutput>>;
     assignRolesToUser(input: AssignRolesToUserInput): Promise<IRPCResponse<AssignRolesToUserOutput>>;
@@ -23,11 +25,19 @@ declare class RbacServiceBase extends RbacServiceBase_base {
     revokeScopeFromRole(input: RevokeScopeFromRoleInput): Promise<IRPCResponse<RevokeScopeFromRoleOutput>>;
     getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
     getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
-    verifyAccess(input: VerifyAccessInput): Promise<IRPCResponse<VerifyAccessOutput>>;
+    verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
+        accessRequests: Array<{
+            scope: TScopes[number]['value'];
+            resourceId?: string;
+            resourcePath?: string;
+        }>;
+    }): Promise<IRPCResponse<VerifyAccessOutput>>;
     deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
     updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
 }
-declare function defineRbacService(): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase;
+declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
+    scopes: TScopes;
+}): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
 
 declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
 

package/dist/export/worker.d.mts

@@ -1,17 +1,19 @@
 import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
 import { IRPCResponse } from '@develit-io/backend-sdk';
+import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DhS7RHC3.mjs';
 import { WorkerEntrypoint } from 'cloudflare:workers';
-import { t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DH5084jg.mjs';
 import { DrizzleD1Database } from 'drizzle-orm/d1';
 import 'zod';
 import 'drizzle-orm';
-import '../shared/rbac.BmuK3PNh.mjs';
+import '../shared/rbac.CqpxM3E5.mjs';
 import 'drizzle-orm/sqlite-core';
 
 declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
-declare class RbacServiceBase extends RbacServiceBase_base {
+declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
     readonly db: DrizzleD1Database<typeof tables>;
-    constructor(ctx: ExecutionContext, env: RbacEnv);
+    readonly SCOPES: TScopes;
+    constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
+    private validateScope;
     createRole(input: CreateRoleInput): Promise<IRPCResponse<CreateRoleOutput>>;
     assignRoleToUser(input: AssignRoleToUserInput): Promise<IRPCResponse<AssignRoleToUserOutput>>;
     assignRolesToUser(input: AssignRolesToUserInput): Promise<IRPCResponse<AssignRolesToUserOutput>>;
@@ -23,11 +25,19 @@ declare class RbacServiceBase extends RbacServiceBase_base {
     revokeScopeFromRole(input: RevokeScopeFromRoleInput): Promise<IRPCResponse<RevokeScopeFromRoleOutput>>;
     getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
     getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
-    verifyAccess(input: VerifyAccessInput): Promise<IRPCResponse<VerifyAccessOutput>>;
+    verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
+        accessRequests: Array<{
+            scope: TScopes[number]['value'];
+            resourceId?: string;
+            resourcePath?: string;
+        }>;
+    }): Promise<IRPCResponse<VerifyAccessOutput>>;
     deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
     updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
 }
-declare function defineRbacService(): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase;
+declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
+    scopes: TScopes;
+}): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
 
 declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
 

package/dist/export/worker.d.ts

@@ -1,17 +1,19 @@
 import * as _develit_io_backend_sdk from '@develit-io/backend-sdk';
 import { IRPCResponse } from '@develit-io/backend-sdk';
+import { L as LabeledScope, t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.DqMMROM3.js';
 import { WorkerEntrypoint } from 'cloudflare:workers';
-import { t as tables, C as CreateRoleInput, a as CreateRoleOutput, A as AssignRoleToUserInput, b as AssignRoleToUserOutput, c as AssignRolesToUserInput, d as AssignRolesToUserOutput, R as RevokeRoleFromUserInput, e as RevokeRoleFromUserOutput, G as GrantScopeToUserInput, f as GrantScopeToUserOutput, g as GrantScopesToUserInput, h as GrantScopesToUserOutput, i as RevokeScopeFromUserInput, j as RevokeScopeFromUserOutput, k as GrantScopeToRoleInput, l as GrantScopeToRoleOutput, m as RevokeScopeFromRoleInput, n as RevokeScopeFromRoleOutput, o as GetPermissionsOutput, p as GetUserPermissionsInput, q as GetUserPermissionsOutput, V as VerifyAccessInput, r as VerifyAccessOutput, D as DeleteRoleInput, s as DeleteRoleOutput, U as UpdateRoleInput, u as UpdateRoleOutput } from '../shared/rbac.CHxy3VJb.js';
 import { DrizzleD1Database } from 'drizzle-orm/d1';
 import 'zod';
 import 'drizzle-orm';
-import '../shared/rbac.BmuK3PNh.js';
+import '../shared/rbac.CqpxM3E5.js';
 import 'drizzle-orm/sqlite-core';
 
 declare const RbacServiceBase_base: (abstract new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv, {}>) & (abstract new (...args: any[]) => _develit_io_backend_sdk.DevelitWorkerMethods);
-declare class RbacServiceBase extends RbacServiceBase_base {
+declare class RbacServiceBase<TScopes extends readonly LabeledScope[] = LabeledScope[]> extends RbacServiceBase_base {
     readonly db: DrizzleD1Database<typeof tables>;
-    constructor(ctx: ExecutionContext, env: RbacEnv);
+    readonly SCOPES: TScopes;
+    constructor(ctx: ExecutionContext, env: RbacEnv, scopes: TScopes);
+    private validateScope;
     createRole(input: CreateRoleInput): Promise<IRPCResponse<CreateRoleOutput>>;
     assignRoleToUser(input: AssignRoleToUserInput): Promise<IRPCResponse<AssignRoleToUserOutput>>;
     assignRolesToUser(input: AssignRolesToUserInput): Promise<IRPCResponse<AssignRolesToUserOutput>>;
@@ -23,11 +25,19 @@ declare class RbacServiceBase extends RbacServiceBase_base {
     revokeScopeFromRole(input: RevokeScopeFromRoleInput): Promise<IRPCResponse<RevokeScopeFromRoleOutput>>;
     getPermissions(): Promise<IRPCResponse<GetPermissionsOutput>>;
     getUserPermissions(input: GetUserPermissionsInput): Promise<IRPCResponse<GetUserPermissionsOutput>>;
-    verifyAccess(input: VerifyAccessInput): Promise<IRPCResponse<VerifyAccessOutput>>;
+    verifyAccess(input: Omit<VerifyAccessInput, 'accessRequests'> & {
+        accessRequests: Array<{
+            scope: TScopes[number]['value'];
+            resourceId?: string;
+            resourcePath?: string;
+        }>;
+    }): Promise<IRPCResponse<VerifyAccessOutput>>;
     deleteRole(input: DeleteRoleInput): Promise<IRPCResponse<DeleteRoleOutput>>;
     updateRole(input: UpdateRoleInput): Promise<IRPCResponse<UpdateRoleOutput>>;
 }
-declare function defineRbacService(): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase;
+declare function defineRbacService<const TScopes extends readonly LabeledScope[]>(config?: {
+    scopes: TScopes;
+}): new (ctx: ExecutionContext, env: RbacEnv) => RbacServiceBase<TScopes>;
 
 declare const _default: new (ctx: ExecutionContext, env: RbacEnv) => WorkerEntrypoint<RbacEnv>;
 

package/dist/export/worker.mjs

@@ -1,9 +1,9 @@
-import { WorkerEntrypoint } from 'cloudflare:workers';
 import { uuidv4, first, createInternalError, develitWorker, action, service } from '@develit-io/backend-sdk';
-import { c as createRoleInputSchema, a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, r as revokeRoleFromUserInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, j as revokeScopeFromUserInputSchema, e as grantScopeToRoleInputSchema, i as revokeScopeFromRoleInputSchema, S as SCOPES, g as getUserPermissionsInputSchema, v as verifyAccessInputSchema, d as deleteRoleInputSchema, u as updateRoleInputSchema } from '../shared/rbac.CY8-sBAP.mjs';
-import { s as schema } from '../shared/rbac.CJLU5iuV.mjs';
+import { s as schema } from '../shared/rbac.D5OV7UPA.mjs';
 import { eq, and, count, inArray } from 'drizzle-orm';
+import { c as createRoleInputSchema, a as assignRoleToUserInputSchema, b as assignRolesToUserInputSchema, r as revokeRoleFromUserInputSchema, f as grantScopeToUserInputSchema, h as grantScopesToUserInputSchema, j as revokeScopeFromUserInputSchema, e as grantScopeToRoleInputSchema, i as revokeScopeFromRoleInputSchema, g as getUserPermissionsInputSchema, v as verifyAccessInputSchema, d as deleteRoleInputSchema, u as updateRoleInputSchema } from '../shared/rbac.wzMQF48s.mjs';
 import { z } from 'zod';
+import { WorkerEntrypoint } from 'cloudflare:workers';
 import { drizzle } from 'drizzle-orm/d1';
 import 'drizzle-orm/sqlite-core';
 
@@ -365,12 +365,20 @@ var __decorateClass = (decorators, target, key, kind) => {
   if (kind && result) __defProp(target, key, result);
   return result;
 };
-let RbacServiceBase = class extends develitWorker(
-  WorkerEntrypoint
-) {
-  constructor(ctx, env) {
+let RbacServiceBase = class extends develitWorker(WorkerEntrypoint) {
+  constructor(ctx, env, scopes) {
     super(ctx, env);
     this.db = drizzle(this.env.RBAC_D1, { schema: tables });
+    this.SCOPES = scopes;
+  }
+  validateScope(scope) {
+    if (!this.SCOPES.some((s) => s.value === scope)) {
+      throw createInternalError(null, {
+        message: `Invalid scope: ${scope}. Available scopes: ${this.SCOPES.map((s) => s.value).join(", ")}`,
+        status: 400,
+        code: "INVALID_SCOPE"
+      });
+    }
   }
   async createRole(input) {
     return this.handleAction(
@@ -467,6 +475,7 @@ let RbacServiceBase = class extends develitWorker(
       { data: input, schema: grantScopeToUserInputSchema },
       { successMessage: "Scope successfully granted to user." },
       async ({ userId, scope, resourceId }) => {
+        this.validateScope(scope);
         const userScope = await getScopesByUserQuery({ db: this.db, userId });
         if (userScope.some((s) => s.scope === scope)) {
           throw createInternalError(null, {
@@ -491,6 +500,7 @@ let RbacServiceBase = class extends develitWorker(
       { successMessage: "Scopes successfully granted to user." },
       async ({ userId, scopes }) => {
         for (const scope of scopes) {
+          this.validateScope(scope.scope);
           const userScopes = await getScopesByUserQuery({ db: this.db, userId });
           if (userScopes.some((s) => s.scope === scope.scope)) {
             throw createInternalError(null, {
@@ -514,6 +524,7 @@ let RbacServiceBase = class extends develitWorker(
       { data: input, schema: revokeScopeFromUserInputSchema },
       { successMessage: "Scope successfully revoked from user." },
       async ({ userId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await revokeScopeFromUserCommand({
           db: this.db,
           userId,
@@ -530,6 +541,7 @@ let RbacServiceBase = class extends develitWorker(
       { data: input, schema: grantScopeToRoleInputSchema },
       { successMessage: "Scope successfully granted to role." },
       async ({ roleId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await grantScopeToRoleCommand({
           db: this.db,
           scope,
@@ -546,6 +558,7 @@ let RbacServiceBase = class extends develitWorker(
       { data: input, schema: revokeScopeFromRoleInputSchema },
       { successMessage: "Scope successfully revoked from role." },
       async ({ roleId, scope, resourceId }) => {
+        this.validateScope(scope);
         const { command } = await revokeScopeFromRoleCommand({
           db: this.db,
           roleId,
@@ -583,8 +596,9 @@ let RbacServiceBase = class extends develitWorker(
         return {
           roles,
           rolesCount: roles.length,
-          scopes: [...SCOPES],
-          scopesCount: [...SCOPES].length,
+          scopes: [...this.SCOPES.map((s) => s.value)],
+          labeledScopes: this.SCOPES,
+          scopesCount: [...this.SCOPES].length,
           roleScopes,
           roleScopesCount: roleScopes.length
         };
@@ -633,6 +647,9 @@ let RbacServiceBase = class extends develitWorker(
       { data: input, schema: verifyAccessInputSchema },
       { successMessage: "Access verification completed." },
       async ({ userId, accessRequests, jwt }) => {
+        for (const request of accessRequests) {
+          this.validateScope(request.scope);
+        }
         const userPermissionsResponse = await this.getUserPermissions({
           userId
         });
@@ -758,10 +775,10 @@ __decorateClass([
 RbacServiceBase = __decorateClass([
   service("rbac")
 ], RbacServiceBase);
-function defineRbacService() {
+function defineRbacService(config = { scopes: [] }) {
   return class RbacService extends RbacServiceBase {
     constructor(ctx, env) {
-      super(ctx, env);
+      super(ctx, env, config.scopes);
     }
   };
 }

package/dist/shared/rbac.CS8i19gH.cjs

@@ -0,0 +1,161 @@
+'use strict';
+
+const zod = require('zod');
+
+const assignRoleToUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  roleId: zod.z.uuid()
+});
+
+const assignRolesToUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  roles: zod.z.array(zod.z.uuid())
+});
+
+const createRoleInputSchema = zod.z.object({
+  name: zod.z.string()
+});
+
+const deleteRoleInputSchema = zod.z.object({
+  id: zod.z.uuid()
+});
+
+const getUserPermissionsInputSchema = zod.z.object({
+  userId: zod.z.uuid()
+});
+
+const grantScopeToRoleInputSchema = zod.z.object({
+  roleId: zod.z.uuid(),
+  scope: zod.z.string(),
+  resourceId: zod.z.string().optional()
+});
+
+const grantScopeToUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  scope: zod.z.string(),
+  resourceId: zod.z.string().optional()
+});
+
+const grantScopesToUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  scopes: zod.z.array(
+    zod.z.object({
+      scope: zod.z.string(),
+      resourceId: zod.z.string().optional()
+    })
+  )
+});
+
+const revokeRoleFromUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  roleId: zod.z.uuid()
+});
+
+const revokeScopeFromRoleInputSchema = zod.z.object({
+  roleId: zod.z.uuid(),
+  scope: zod.z.string(),
+  resourceId: zod.z.string().optional()
+});
+
+const revokeScopeFromUserInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  scope: zod.z.string(),
+  resourceId: zod.z.string().optional()
+});
+
+const updateRoleInputSchema = zod.z.object({
+  id: zod.z.uuid(),
+  name: zod.z.string()
+});
+
+const userDataSchema = zod.z.object({
+  referenceId: zod.z.string(),
+  email: zod.z.string().optional(),
+  role: zod.z.string().optional()
+});
+const jwtPayloadSchema = zod.z.object({
+  sub: zod.z.string(),
+  user: zod.z.object({
+    id: zod.z.uuid(),
+    createdAt: zod.z.date().nullable(),
+    updatedAt: zod.z.date().nullable(),
+    deletedAt: zod.z.date().nullable(),
+    role: zod.z.string(),
+    email: zod.z.email(),
+    rawAppMetaData: zod.z.any(),
+    rawUserMetaData: zod.z.any(),
+    isSuperAdmin: zod.z.boolean().default(false),
+    isSsoUser: zod.z.boolean().default(false),
+    lastSignInAt: zod.z.date().nullable().optional(),
+    emailConfirmedAt: zod.z.date().nullable().optional(),
+    confirmationSentAt: zod.z.date().nullable().optional(),
+    recoverySentAt: zod.z.date().nullable().optional(),
+    emailChangeToken: zod.z.string().nullable().optional(),
+    emailChangeSentAt: zod.z.date().nullable().optional(),
+    isBanned: zod.z.boolean().default(false).nullable().optional()
+  }),
+  iat: zod.z.number(),
+  exp: zod.z.number(),
+  userData: userDataSchema.optional()
+});
+
+const verifyAccessInputSchema = zod.z.object({
+  userId: zod.z.uuid(),
+  accessRequests: zod.z.array(
+    zod.z.object({
+      scope: zod.z.string(),
+      resourceId: zod.z.string().optional(),
+      resourcePath: zod.z.string().optional()
+    })
+  ),
+  jwt: jwtPayloadSchema.extend({
+    createdAt: zod.z.coerce.date().nullable().optional(),
+    updatedAt: zod.z.coerce.date().nullable().optional(),
+    deletedAt: zod.z.coerce.date().nullable().optional(),
+    lastSignInAt: zod.z.coerce.date().nullable().optional(),
+    emailConfirmedAt: zod.z.coerce.date().nullable().optional(),
+    confirmationSentAt: zod.z.coerce.date().nullable().optional(),
+    recoverySentAt: zod.z.coerce.date().nullable().optional(),
+    emailChangeSentAt: zod.z.coerce.date().nullable().optional(),
+    user: jwtPayloadSchema.shape.user.extend({
+      createdAt: zod.z.coerce.date().nullable().optional(),
+      updatedAt: zod.z.coerce.date().nullable().optional(),
+      deletedAt: zod.z.coerce.date().nullable().optional(),
+      lastSignInAt: zod.z.coerce.date().nullable().optional(),
+      emailConfirmedAt: zod.z.coerce.date().nullable().optional(),
+      confirmationSentAt: zod.z.coerce.date().nullable().optional(),
+      recoverySentAt: zod.z.coerce.date().nullable().optional(),
+      emailChangeSentAt: zod.z.coerce.date().nullable().optional()
+    })
+  }).optional()
+});
+
+const verifyScopeInputSchema = zod.z.object({
+  scopes: zod.z.array(zod.z.string()),
+  resourceId: zod.z.string().optional(),
+  jwt: zod.z.object({
+    sub: zod.z.uuid(),
+    rbac: zod.z.object({
+      roles: zod.z.array(zod.z.string()).optional()
+    })
+  })
+});
+const verifyScopeOutputSchema = zod.z.object({
+  isVerified: zod.z.boolean().default(false)
+});
+
+exports.assignRoleToUserInputSchema = assignRoleToUserInputSchema;
+exports.assignRolesToUserInputSchema = assignRolesToUserInputSchema;
+exports.createRoleInputSchema = createRoleInputSchema;
+exports.deleteRoleInputSchema = deleteRoleInputSchema;
+exports.getUserPermissionsInputSchema = getUserPermissionsInputSchema;
+exports.grantScopeToRoleInputSchema = grantScopeToRoleInputSchema;
+exports.grantScopeToUserInputSchema = grantScopeToUserInputSchema;
+exports.grantScopesToUserInputSchema = grantScopesToUserInputSchema;
+exports.revokeRoleFromUserInputSchema = revokeRoleFromUserInputSchema;
+exports.revokeScopeFromRoleInputSchema = revokeScopeFromRoleInputSchema;
+exports.revokeScopeFromUserInputSchema = revokeScopeFromUserInputSchema;
+exports.updateRoleInputSchema = updateRoleInputSchema;
+exports.verifyAccessInputSchema = verifyAccessInputSchema;
+exports.verifyScopeInputSchema = verifyScopeInputSchema;
+exports.verifyScopeOutputSchema = verifyScopeOutputSchema;