@diister/quick-permission 0.9.0-beta.5

package/aggregation.ts

@@ -0,0 +1,114 @@
+/**
+ * Cross-grant aggregation primitives.
+ *
+ * The orchestrator runs each matching grant's rules independently, then folds
+ * the per-grant outputs through these functions to produce a single CanResult.
+ *
+ * Two axes:
+ *   - constraints: AND intra-grant, OR cross-grant. Used for DB pushdown
+ *     (`output.constraints` becomes a Mongo expression for `find()`).
+ *   - filter spec: union cross-grant ("most permissive grant wins"). A grant
+ *     with no filter exposes all fields and short-circuits the union.
+ */
+
+/**
+ * Intra-grant: AND-merge constraint contributions from multiple match rules
+ * within the same grant.
+ *
+ *  - 0 contributions → undefined (no match rule fired in this grant)
+ *  - All `{}` (= "any") → `{}` (no restriction)
+ *  - 1 concrete entry → that entry
+ *  - N concrete entries → `{ $and: [...] }`
+ */
+export function combineGrantConstraints(
+  parts: ReadonlyArray<Record<string, unknown>>,
+): Record<string, unknown> | undefined {
+  if (parts.length === 0) return undefined;
+  const nonEmpty = parts.filter((p) => Object.keys(p).length > 0);
+  if (nonEmpty.length === 0) return {};
+  if (nonEmpty.length === 1) return nonEmpty[0];
+  return { $and: [...nonEmpty] };
+}
+
+/**
+ * Cross-grant: OR-merge per-grant constraints with "any wins" semantics.
+ *
+ *  - 0 entries → undefined (no match rule active anywhere)
+ *  - any `undefined` entry → undefined (a grant without constraint trumps;
+ *    pushdown stays unrestricted)
+ *  - any `{}` entry → `{}` ("any" — grants exist but impose no restriction)
+ *  - 1 entry → that entry as-is
+ *  - N entries → `{ $or: [...] }`
+ */
+export function aggregateConstraints(
+  entries: ReadonlyArray<Record<string, unknown> | undefined>,
+): Record<string, unknown> | undefined {
+  if (entries.length === 0) return undefined;
+  if (entries.some((e) => e === undefined)) return undefined;
+  const concrete = entries as ReadonlyArray<Record<string, unknown>>;
+  if (concrete.some((e) => Object.keys(e).length === 0)) return {};
+  if (concrete.length === 1) return concrete[0];
+  return { $or: [...concrete] };
+}
+
+/**
+ * Project a source object through a field whitelist.
+ * Non-object sources pass through unchanged.
+ */
+export function projectFields(
+  source: unknown,
+  fields: Record<string, boolean>,
+): unknown {
+  if (source === null || typeof source !== "object" || Array.isArray(source)) {
+    return source;
+  }
+  const out: Record<string, unknown> = {};
+  const src = source as Record<string, unknown>;
+  for (const [k, v] of Object.entries(fields)) {
+    if (v === true && k in src) out[k] = src[k];
+  }
+  return out;
+}
+
+/**
+ * Cross-grant filter union state.
+ *
+ *  - `undefined` : no filter rule has fired (initial state)
+ *  - `null`      : at least one grant exposed all fields (union saturates;
+ *                  any further contributions are ignored)
+ *  - `Record`    : union of allowed fields across grants so far
+ */
+export type FilterUnion = Record<string, boolean> | null | undefined;
+
+/**
+ * Merge a filter contribution into the running union.
+ * `null` contribution means "this grant has no filter" (all fields allowed)
+ * and saturates the union. Once saturated, stays saturated.
+ */
+export function mergeFilterSpec(
+  current: FilterUnion,
+  contribution: Record<string, boolean> | null,
+): FilterUnion {
+  if (current === null) return null;
+  if (contribution === null) return null;
+  return { ...(current ?? {}), ...contribution };
+}
+
+/**
+ * Resolve final `data` from the filter union state and a reference source.
+ *
+ *  - union is `null`    → reference source as-is (most permissive grant won)
+ *  - union is `Record`  → project the source through the union
+ *  - union is `undefined` → fall back (no filter rule fired anywhere)
+ */
+export function resolveFilteredData(
+  union: FilterUnion,
+  referenceSource: unknown,
+  fallback: unknown,
+): unknown {
+  if (union === null) return referenceSource;
+  if (union !== undefined && referenceSource !== undefined) {
+    return projectFields(referenceSource, union);
+  }
+  return fallback;
+}

package/core/filtering.ts

@@ -0,0 +1,70 @@
+/**
+ * Filtering utilities for applying field-level permissions
+ */
+
+import type { FilterSpec } from "./merging.ts";
+
+/**
+ * Apply a filter specification to an object
+ *
+ * @param obj The object to filter
+ * @param filterSpec The filter specification (field: true/false)
+ * @returns The filtered object
+ *
+ * @example
+ * applyFilter(
+ *   { _id: 1, name: "John", email: "john@example.com", password: "secret" },
+ *   { _id: true, name: true, email: true }
+ * )
+ * // → { _id: 1, name: "John", email: "john@example.com" }
+ *
+ * // Nested filtering
+ * applyFilter(
+ *   { user: { name: "John", password: "secret" } },
+ *   { user: { name: true } }
+ * )
+ * // → { user: { name: "John" } }
+ */
+export function applyFilter(obj: any, filterSpec: FilterSpec): any {
+  if (!obj || typeof obj !== "object") {
+    return obj;
+  }
+
+  // Handle arrays
+  if (Array.isArray(obj)) {
+    return obj.map((item) => applyFilter(item, filterSpec));
+  }
+
+  const result: any = {};
+
+  for (const [key, spec] of Object.entries(filterSpec)) {
+    if (!(key in obj)) continue;
+
+    if (spec === true) {
+      // Include field as-is
+      result[key] = obj[key];
+    } else if (spec === false) {
+      // Exclude field
+      continue;
+    } else if (typeof spec === "object") {
+      // Nested filter
+      result[key] = applyFilter(obj[key], spec);
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Pick specific fields from an object
+ *
+ * @param obj The source object
+ * @param fields The fields to pick
+ * @returns A new object with only the specified fields
+ */
+export function pickFields<T extends Record<string, any>>(
+  obj: T,
+  fields: Record<string, boolean>,
+): Partial<T> {
+  return applyFilter(obj, fields);
+}

package/core/matching.ts

@@ -0,0 +1,82 @@
+type TargetPath = readonly unknown[];
+
+/**
+ * Match a requested target path against a pattern path.
+ *
+ * Targets are always arrays of segments. Each segment is matched against the
+ * corresponding pattern segment.
+ *
+ * Segment-level wildcards:
+ * - `"*"` matches any value in that segment.
+ * - `"prefix:*"` matches any string segment that starts with `prefix:`.
+ *
+ * For "any target" semantics, leave the permission's `target` undefined at the
+ * call site rather than passing a wildcard here.
+ *
+ * @example
+ * matchPath(["article:123"], ["article:*"]) // true
+ * matchPath(["article:123", "comment:4"], ["article:*", "*"]) // true
+ * matchPath(["a"], ["a", "b"]) // false (different arity)
+ */
+export function matchPath(requested: TargetPath, pattern: TargetPath): boolean {
+  if (requested.length !== pattern.length) return false;
+  return requested.every((segment, i) => matchSegment(segment, pattern[i]));
+}
+
+function matchSegment(requested: unknown, pattern: unknown): boolean {
+  // Full-segment wildcard
+  if (pattern === "*") return true;
+
+  // Prefix wildcard on string segments: "article:*"
+  if (
+    typeof pattern === "string" &&
+    typeof requested === "string" &&
+    pattern.endsWith("*")
+  ) {
+    return requested.startsWith(pattern.slice(0, -1));
+  }
+
+  // Nested array segments (rare, but supported)
+  if (Array.isArray(pattern) && Array.isArray(requested)) {
+    return matchPath(requested, pattern);
+  }
+
+  return requested === pattern;
+}
+
+/**
+ * Symmetric "overlap" match: returns true if there's any concrete value that
+ * could satisfy both `a` and `b` simultaneously (treating both as patterns).
+ *
+ * Used by broad-match checks where the request target itself may carry
+ * wildcards — e.g. "do I have any badge access in this expo?" with the request
+ * `["expo:1", "*"]` overlapping a grant on `["expo:1", "badge:*"]`.
+ */
+export function overlapPath(a: TargetPath, b: TargetPath): boolean {
+  if (a.length !== b.length) return false;
+  return a.every((segment, i) => overlapSegment(segment, b[i]));
+}
+
+function overlapSegment(a: unknown, b: unknown): boolean {
+  // Full wildcards on either side → overlap
+  if (a === "*" || b === "*") return true;
+
+  if (typeof a === "string" && typeof b === "string") {
+    const aPrefix = a.endsWith("*") ? a.slice(0, -1) : null;
+    const bPrefix = b.endsWith("*") ? b.slice(0, -1) : null;
+
+    if (aPrefix !== null && bPrefix !== null) {
+      // Two prefix wildcards: overlap iff one prefix extends the other
+      return aPrefix.startsWith(bPrefix) || bPrefix.startsWith(aPrefix);
+    }
+    if (aPrefix !== null) return b.startsWith(aPrefix);
+    if (bPrefix !== null) return a.startsWith(bPrefix);
+  }
+
+  // Nested arrays
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return overlapPath(a, b);
+  }
+
+  return a === b;
+}

package/core/merging.ts

@@ -0,0 +1,143 @@
+/**
+ * Merging utilities for combining outputs from multiple permissions
+ */
+
+// Use interface instead of type alias to avoid circular reference error
+export interface FilterSpec {
+  [key: string]: boolean | FilterSpec;
+}
+
+/**
+ * Merge two filter specs using union strategy (more permissive)
+ *
+ * @example
+ * mergeFilters(
+ *   { _id: true, name: true },
+ *   { name: true, email: true }
+ * )
+ * // → { _id: true, name: true, email: true }
+ */
+export function mergeFilters(
+  current: FilterSpec | undefined,
+  incoming: FilterSpec | undefined,
+): FilterSpec {
+  if (!current) return incoming || {};
+  if (!incoming) return current;
+
+  const result: FilterSpec = { ...current };
+
+  for (const [key, value] of Object.entries(incoming)) {
+    if (typeof value === "boolean" && typeof result[key] === "boolean") {
+      // Union: if either says true, it's true
+      result[key] = result[key] || value;
+    } else if (typeof value === "object" && typeof result[key] === "object") {
+      // Recursive merge for nested filters
+      result[key] = mergeFilters(
+        result[key] as FilterSpec,
+        value as FilterSpec,
+      );
+    } else if (!(key in result)) {
+      // New key, add it
+      result[key] = value;
+    } else {
+      // Type mismatch or other case: incoming wins
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Merge two values using the "most permissive" strategy, recursing down to
+ * the leaves of nested structures.
+ *
+ * Strategies (applied at each leaf):
+ * - filter / updateFilter / writeFilter: union via mergeFilters
+ * - arrays: concat + dedup (set union)
+ * - numbers: Math.max (largest grant wins)
+ * - booleans: OR (true wins)
+ * - Date: latest wins
+ * - plain objects: recurse field-by-field with the same strategy
+ * - everything else (string, mismatched types, null): incoming wins
+ *
+ * Recursive object handling fixes the previous `{ ...current, ...incoming }`
+ * shortcut which made nested merges depend on insertion order rather than
+ * value semantics.
+ */
+function mergeValue(key: string, current: any, incoming: any): any {
+  // Filter-style fields are unions of allowed fields, regardless of nesting depth
+  if (key === "filter" || key === "updateFilter" || key === "writeFilter") {
+    return mergeFilters(current, incoming);
+  }
+
+  // Arrays: union with dedup
+  if (Array.isArray(current) && Array.isArray(incoming)) {
+    return [...new Set([...current, ...incoming])];
+  }
+
+  // Numbers: most permissive = largest
+  if (typeof current === "number" && typeof incoming === "number") {
+    return Math.max(current, incoming);
+  }
+
+  // Booleans: most permissive = OR
+  if (typeof current === "boolean" && typeof incoming === "boolean") {
+    return current || incoming;
+  }
+
+  // Dates: most permissive = latest
+  if (current instanceof Date && incoming instanceof Date) {
+    return new Date(Math.max(current.getTime(), incoming.getTime()));
+  }
+
+  // Plain objects: recurse field-by-field
+  if (
+    typeof current === "object" &&
+    typeof incoming === "object" &&
+    current !== null &&
+    incoming !== null &&
+    !Array.isArray(current) &&
+    !Array.isArray(incoming) &&
+    !(current instanceof Date) &&
+    !(incoming instanceof Date)
+  ) {
+    const result: Record<string, any> = { ...current };
+    for (const [k, v] of Object.entries(incoming)) {
+      result[k] = k in current ? mergeValue(k, current[k], v) : v;
+    }
+    return result;
+  }
+
+  // Type mismatch or primitive: incoming wins
+  return incoming;
+}
+
+/**
+ * Merge two outputs intelligently based on the key
+ *
+ * @example
+ * mergeOutputs(
+ *   { filter: { _id: true }, data: { _id: 1 } },
+ *   { filter: { name: true }, data: { name: "John" } }
+ * )
+ * // → { filter: { _id: true, name: true }, data: { _id: 1, name: "John" } }
+ */
+export function mergeOutputs(current: any, incoming: any): any {
+  if (!current) return incoming;
+  if (!incoming) return current;
+
+  const result = { ...current };
+
+  for (const [key, value] of Object.entries(incoming)) {
+    if (!(key in result)) {
+      // New key, add it
+      result[key] = value;
+    } else {
+      // Existing key, merge intelligently
+      result[key] = mergeValue(key, result[key], value);
+    }
+  }
+
+  return result;
+}

package/dist/aggregation.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Cross-grant aggregation primitives.
+ *
+ * The orchestrator runs each matching grant's rules independently, then folds
+ * the per-grant outputs through these functions to produce a single CanResult.
+ *
+ * Two axes:
+ *   - constraints: AND intra-grant, OR cross-grant. Used for DB pushdown
+ *     (`output.constraints` becomes a Mongo expression for `find()`).
+ *   - filter spec: union cross-grant ("most permissive grant wins"). A grant
+ *     with no filter exposes all fields and short-circuits the union.
+ */
+/**
+ * Intra-grant: AND-merge constraint contributions from multiple match rules
+ * within the same grant.
+ *
+ *  - 0 contributions → undefined (no match rule fired in this grant)
+ *  - All `{}` (= "any") → `{}` (no restriction)
+ *  - 1 concrete entry → that entry
+ *  - N concrete entries → `{ $and: [...] }`
+ */
+export declare function combineGrantConstraints(parts: ReadonlyArray<Record<string, unknown>>): Record<string, unknown> | undefined;
+/**
+ * Cross-grant: OR-merge per-grant constraints with "any wins" semantics.
+ *
+ *  - 0 entries → undefined (no match rule active anywhere)
+ *  - any `undefined` entry → undefined (a grant without constraint trumps;
+ *    pushdown stays unrestricted)
+ *  - any `{}` entry → `{}` ("any" — grants exist but impose no restriction)
+ *  - 1 entry → that entry as-is
+ *  - N entries → `{ $or: [...] }`
+ */
+export declare function aggregateConstraints(entries: ReadonlyArray<Record<string, unknown> | undefined>): Record<string, unknown> | undefined;
+/**
+ * Project a source object through a field whitelist.
+ * Non-object sources pass through unchanged.
+ */
+export declare function projectFields(source: unknown, fields: Record<string, boolean>): unknown;
+/**
+ * Cross-grant filter union state.
+ *
+ *  - `undefined` : no filter rule has fired (initial state)
+ *  - `null`      : at least one grant exposed all fields (union saturates;
+ *                  any further contributions are ignored)
+ *  - `Record`    : union of allowed fields across grants so far
+ */
+export type FilterUnion = Record<string, boolean> | null | undefined;
+/**
+ * Merge a filter contribution into the running union.
+ * `null` contribution means "this grant has no filter" (all fields allowed)
+ * and saturates the union. Once saturated, stays saturated.
+ */
+export declare function mergeFilterSpec(current: FilterUnion, contribution: Record<string, boolean> | null): FilterUnion;
+/**
+ * Resolve final `data` from the filter union state and a reference source.
+ *
+ *  - union is `null`    → reference source as-is (most permissive grant won)
+ *  - union is `Record`  → project the source through the union
+ *  - union is `undefined` → fall back (no filter rule fired anywhere)
+ */
+export declare function resolveFilteredData(union: FilterUnion, referenceSource: unknown, fallback: unknown): unknown;
+//# sourceMappingURL=aggregation.d.ts.map

package/dist/aggregation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregation.d.ts","sourceRoot":"","sources":["../aggregation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAMrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GAC1D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAOrC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAUT;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAErE;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAC3C,WAAW,CAIb;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,eAAe,EAAE,OAAO,EACxB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAMT"}

package/dist/aggregation.js

@@ -0,0 +1,97 @@
+/**
+ * Cross-grant aggregation primitives.
+ *
+ * The orchestrator runs each matching grant's rules independently, then folds
+ * the per-grant outputs through these functions to produce a single CanResult.
+ *
+ * Two axes:
+ *   - constraints: AND intra-grant, OR cross-grant. Used for DB pushdown
+ *     (`output.constraints` becomes a Mongo expression for `find()`).
+ *   - filter spec: union cross-grant ("most permissive grant wins"). A grant
+ *     with no filter exposes all fields and short-circuits the union.
+ */
+/**
+ * Intra-grant: AND-merge constraint contributions from multiple match rules
+ * within the same grant.
+ *
+ *  - 0 contributions → undefined (no match rule fired in this grant)
+ *  - All `{}` (= "any") → `{}` (no restriction)
+ *  - 1 concrete entry → that entry
+ *  - N concrete entries → `{ $and: [...] }`
+ */
+export function combineGrantConstraints(parts) {
+    if (parts.length === 0)
+        return undefined;
+    const nonEmpty = parts.filter((p) => Object.keys(p).length > 0);
+    if (nonEmpty.length === 0)
+        return {};
+    if (nonEmpty.length === 1)
+        return nonEmpty[0];
+    return { $and: [...nonEmpty] };
+}
+/**
+ * Cross-grant: OR-merge per-grant constraints with "any wins" semantics.
+ *
+ *  - 0 entries → undefined (no match rule active anywhere)
+ *  - any `undefined` entry → undefined (a grant without constraint trumps;
+ *    pushdown stays unrestricted)
+ *  - any `{}` entry → `{}` ("any" — grants exist but impose no restriction)
+ *  - 1 entry → that entry as-is
+ *  - N entries → `{ $or: [...] }`
+ */
+export function aggregateConstraints(entries) {
+    if (entries.length === 0)
+        return undefined;
+    if (entries.some((e) => e === undefined))
+        return undefined;
+    const concrete = entries;
+    if (concrete.some((e) => Object.keys(e).length === 0))
+        return {};
+    if (concrete.length === 1)
+        return concrete[0];
+    return { $or: [...concrete] };
+}
+/**
+ * Project a source object through a field whitelist.
+ * Non-object sources pass through unchanged.
+ */
+export function projectFields(source, fields) {
+    if (source === null || typeof source !== "object" || Array.isArray(source)) {
+        return source;
+    }
+    const out = {};
+    const src = source;
+    for (const [k, v] of Object.entries(fields)) {
+        if (v === true && k in src)
+            out[k] = src[k];
+    }
+    return out;
+}
+/**
+ * Merge a filter contribution into the running union.
+ * `null` contribution means "this grant has no filter" (all fields allowed)
+ * and saturates the union. Once saturated, stays saturated.
+ */
+export function mergeFilterSpec(current, contribution) {
+    if (current === null)
+        return null;
+    if (contribution === null)
+        return null;
+    return { ...(current ?? {}), ...contribution };
+}
+/**
+ * Resolve final `data` from the filter union state and a reference source.
+ *
+ *  - union is `null`    → reference source as-is (most permissive grant won)
+ *  - union is `Record`  → project the source through the union
+ *  - union is `undefined` → fall back (no filter rule fired anywhere)
+ */
+export function resolveFilteredData(union, referenceSource, fallback) {
+    if (union === null)
+        return referenceSource;
+    if (union !== undefined && referenceSource !== undefined) {
+        return projectFields(referenceSource, union);
+    }
+    return fallback;
+}
+//# sourceMappingURL=aggregation.js.map

package/dist/aggregation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregation.js","sourceRoot":"","sources":["../aggregation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA6C;IAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA2D;IAE3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAiD,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAe,EACf,MAA+B;IAE/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,YAA4C;IAE5C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,eAAwB,EACxB,QAAiB;IAEjB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/filtering.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Filtering utilities for applying field-level permissions
+ */
+import type { FilterSpec } from "./merging.ts";
+/**
+ * Apply a filter specification to an object
+ *
+ * @param obj The object to filter
+ * @param filterSpec The filter specification (field: true/false)
+ * @returns The filtered object
+ *
+ * @example
+ * applyFilter(
+ *   { _id: 1, name: "John", email: "john@example.com", password: "secret" },
+ *   { _id: true, name: true, email: true }
+ * )
+ * // → { _id: 1, name: "John", email: "john@example.com" }
+ *
+ * // Nested filtering
+ * applyFilter(
+ *   { user: { name: "John", password: "secret" } },
+ *   { user: { name: true } }
+ * )
+ * // → { user: { name: "John" } }
+ */
+export declare function applyFilter(obj: any, filterSpec: FilterSpec): any;
+/**
+ * Pick specific fields from an object
+ *
+ * @param obj The source object
+ * @param fields The fields to pick
+ * @returns A new object with only the specified fields
+ */
+export declare function pickFields<T extends Record<string, any>>(obj: T, fields: Record<string, boolean>): Partial<T>;
+//# sourceMappingURL=filtering.d.ts.map

package/dist/core/filtering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filtering.d.ts","sourceRoot":"","sources":["../../core/filtering.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,GAAG,GAAG,CA4BjE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtD,GAAG,EAAE,CAAC,EACN,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAEZ"}

package/dist/core/filtering.js

@@ -0,0 +1,62 @@
+/**
+ * Filtering utilities for applying field-level permissions
+ */
+/**
+ * Apply a filter specification to an object
+ *
+ * @param obj The object to filter
+ * @param filterSpec The filter specification (field: true/false)
+ * @returns The filtered object
+ *
+ * @example
+ * applyFilter(
+ *   { _id: 1, name: "John", email: "john@example.com", password: "secret" },
+ *   { _id: true, name: true, email: true }
+ * )
+ * // → { _id: 1, name: "John", email: "john@example.com" }
+ *
+ * // Nested filtering
+ * applyFilter(
+ *   { user: { name: "John", password: "secret" } },
+ *   { user: { name: true } }
+ * )
+ * // → { user: { name: "John" } }
+ */
+export function applyFilter(obj, filterSpec) {
+    if (!obj || typeof obj !== "object") {
+        return obj;
+    }
+    // Handle arrays
+    if (Array.isArray(obj)) {
+        return obj.map((item) => applyFilter(item, filterSpec));
+    }
+    const result = {};
+    for (const [key, spec] of Object.entries(filterSpec)) {
+        if (!(key in obj))
+            continue;
+        if (spec === true) {
+            // Include field as-is
+            result[key] = obj[key];
+        }
+        else if (spec === false) {
+            // Exclude field
+            continue;
+        }
+        else if (typeof spec === "object") {
+            // Nested filter
+            result[key] = applyFilter(obj[key], spec);
+        }
+    }
+    return result;
+}
+/**
+ * Pick specific fields from an object
+ *
+ * @param obj The source object
+ * @param fields The fields to pick
+ * @returns A new object with only the specified fields
+ */
+export function pickFields(obj, fields) {
+    return applyFilter(obj, fields);
+}
+//# sourceMappingURL=filtering.js.map

package/dist/core/filtering.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filtering.js","sourceRoot":"","sources":["../../core/filtering.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAQ,EAAE,UAAsB;IAC1D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gBAAgB;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAQ,EAAE,CAAC;IAEvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAS;QAE5B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,sBAAsB;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,gBAAgB;YAChB,SAAS;QACX,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,gBAAgB;YAChB,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAM,EACN,MAA+B;IAE/B,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC"}