@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/Permission.js

@@ -0,0 +1,827 @@
+import { Clock, Context, Data, Effect, Layer, Option } from "effect";
+import { AuditLog } from "./AuditLog.js";
+import { UnixMillis as makeUnixMillis, UserId as makeUserId, } from "./Identifiers.js";
+export { PermissionId, RoleId } from "./Identifiers.js";
+const globalScope = { type: "global" };
+export const PermissionScope = {
+    global: globalScope,
+    make: (type, id) => ({
+        type,
+        id,
+    }),
+};
+export const PermissionSubject = {
+    make: (type, id) => ({
+        type,
+        id,
+    }),
+    user: (userId) => ({
+        type: "user",
+        id: userId,
+    }),
+};
+export class CurrentPrincipal extends Context.Service()("auth/CurrentPrincipal") {
+}
+export const isActivePermissionDefinition = (definition) => definition.disabledAt === undefined && definition.deletedAt === undefined;
+export const isActiveRoleDefinition = (definition) => definition.disabledAt === undefined && definition.deletedAt === undefined;
+export class PermissionCheckError extends Data.TaggedError("PermissionCheckError") {
+}
+export class PermissionStoreError extends Data.TaggedError("PermissionStoreError") {
+}
+export class PermissionAdministrationError extends Data.TaggedError("PermissionAdministrationError") {
+}
+export class Permissions extends Context.Service()("auth/Permissions") {
+}
+export class PermissionStore extends Context.Service()("auth/PermissionStore") {
+}
+export class PermissionAdministration extends Context.Service()("auth/PermissionAdministration") {
+}
+export class PermissionAdministrationAuditContext extends Context.Service()("auth/PermissionAdministrationAuditContext") {
+}
+const nowUnixMillis = () => makeUnixMillis(Date.now());
+export const normalizePermissionDefinitionListLimit = (limit) => limit === undefined || !Number.isFinite(limit)
+    ? 50
+    : Math.max(1, Math.min(100, Math.floor(limit)));
+const permissionIdEncoder = new TextEncoder();
+const comparePermissionIds = (left, right) => {
+    const leftBytes = permissionIdEncoder.encode(left);
+    const rightBytes = permissionIdEncoder.encode(right);
+    const length = Math.min(leftBytes.length, rightBytes.length);
+    for (let index = 0; index < length; index += 1) {
+        const difference = (leftBytes[index] ?? 0) - (rightBytes[index] ?? 0);
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+    return leftBytes.length - rightBytes.length;
+};
+export const canonicalPermissionScope = (scope) => scope?.type === globalScope.type && scope.id === undefined
+    ? undefined
+    : scope;
+const normalizeScope = (scope) => scope ?? globalScope;
+const scopeTuple = (scope) => {
+    const normalized = normalizeScope(scope);
+    return normalized.id === undefined
+        ? [normalized.type]
+        : [normalized.type, normalized.id];
+};
+const scopeKey = (scope) => JSON.stringify(scopeTuple(scope));
+const permissionGrantKey = (input) => JSON.stringify([
+    input.subject.type,
+    input.subject.id,
+    input.permission,
+    scopeTuple(input.scope),
+]);
+const roleGrantKey = (input) => JSON.stringify([
+    input.subject.type,
+    input.subject.id,
+    input.role,
+    scopeTuple(input.scope),
+]);
+const rolePermissionKey = (input) => JSON.stringify([
+    input.role,
+    input.permission,
+    input.scopeType === undefined ? [] : [input.scopeType],
+]);
+const isGlobalScope = (scope) => {
+    const normalized = normalizeScope(scope);
+    return normalized.type === globalScope.type && normalized.id === undefined;
+};
+const scopeApplies = (grantScope, requestedScope) => isGlobalScope(grantScope) ||
+    scopeKey(grantScope) === scopeKey(requestedScope);
+const subjectMatches = (left, right) => left.type === right.type && left.id === right.id;
+const scopeMatchesExactly = (left, right) => scopeKey(left) === scopeKey(right);
+const compareText = (left, right) => left === right
+    ? 0
+    : left === undefined
+        ? -1
+        : right === undefined
+            ? 1
+            : left < right
+                ? -1
+                : 1;
+const compareScopes = (left, right) => {
+    if (left === undefined || right === undefined) {
+        return left === right ? 0 : left === undefined ? -1 : 1;
+    }
+    return compareText(left.type, right.type) || compareText(left.id, right.id);
+};
+const comparePermissionGrants = (left, right) => compareText(left.subject.type, right.subject.type) ||
+    compareText(left.subject.id, right.subject.id) ||
+    compareText(left.permission, right.permission) ||
+    compareScopes(left.scope, right.scope);
+const compareRoleGrants = (left, right) => compareText(left.subject.type, right.subject.type) ||
+    compareText(left.subject.id, right.subject.id) ||
+    compareText(left.role, right.role) ||
+    compareScopes(left.scope, right.scope);
+const compareRolePermissions = (left, right) => compareText(left.role, right.role) ||
+    compareText(left.permission, right.permission) ||
+    compareText(left.scopeType, right.scopeType);
+const orderBy = (values, compare) => {
+    const ordered = [];
+    for (const value of values) {
+        const index = ordered.findIndex((current) => compare(value, current) < 0);
+        ordered.splice(index === -1 ? ordered.length : index, 0, value);
+    }
+    return ordered;
+};
+const isActiveGrant = (grant, now) => grant.revokedAt === undefined &&
+    (grant.expiresAt === undefined || Number(grant.expiresAt) > Number(now));
+const rolePermissionApplies = (rolePermission, permission, scope) => rolePermission.permission === permission &&
+    (rolePermission.scopeType === undefined ||
+        rolePermission.scopeType === normalizeScope(scope).type);
+export const makePermissionStoreMemory = () => {
+    const permissionDefinitions = new Map();
+    const roleDefinitions = new Map();
+    const permissionGrants = new Map();
+    const roleGrants = new Map();
+    const rolePermissions = new Map();
+    return PermissionStore.of({
+        createPermissionDefinition: (definition) => Effect.sync(() => {
+            if (permissionDefinitions.has(definition.id)) {
+                return false;
+            }
+            permissionDefinitions.set(definition.id, definition);
+            return true;
+        }),
+        findPermissionDefinition: (id) => Effect.sync(() => {
+            const definition = permissionDefinitions.get(id);
+            return definition === undefined
+                ? Option.none()
+                : Option.some(definition);
+        }),
+        listPermissionDefinitions: (input) => Effect.sync(() => [...permissionDefinitions.values()]
+            .filter((definition) => (input?.includeDisabled === true ||
+            definition.disabledAt === undefined) &&
+            (input?.includeDeleted === true ||
+                definition.deletedAt === undefined))
+            .filter((definition) => input?.after === undefined ||
+            comparePermissionIds(definition.id, input.after) > 0)
+            // oxlint-disable-next-line unicorn/no-array-sort -- ES2023 toSorted is outside the supported target.
+            .sort((left, right) => comparePermissionIds(left.id, right.id))
+            .slice(0, normalizePermissionDefinitionListLimit(input?.limit))),
+        updatePermissionDefinition: (input) => Effect.sync(() => {
+            const current = permissionDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const { description: _description, scopeType: _scopeType, ...unchanged } = current;
+            const description = input.description === undefined
+                ? current.description
+                : (input.description ?? undefined);
+            const scopeType = input.scopeType === undefined
+                ? current.scopeType
+                : (input.scopeType ?? undefined);
+            const updated = {
+                ...unchanged,
+                ...(description === undefined ? {} : { description }),
+                ...(scopeType === undefined ? {} : { scopeType }),
+                updatedAt: input.updatedAt,
+            };
+            permissionDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        setPermissionDefinitionDisabled: (input) => Effect.sync(() => {
+            const current = permissionDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const { disabledAt: _disabledAt, ...unchanged } = current;
+            const updated = {
+                ...unchanged,
+                ...(input.disabledAt === undefined
+                    ? {}
+                    : { disabledAt: input.disabledAt }),
+                updatedAt: input.updatedAt,
+            };
+            permissionDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        deletePermissionDefinition: (input) => Effect.sync(() => {
+            const current = permissionDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const updated = {
+                ...current,
+                updatedAt: input.updatedAt,
+                deletedAt: input.deletedAt,
+            };
+            permissionDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        createRoleDefinition: (definition) => Effect.sync(() => {
+            if (roleDefinitions.has(definition.id)) {
+                return false;
+            }
+            roleDefinitions.set(definition.id, definition);
+            return true;
+        }),
+        findRoleDefinition: (id) => Effect.sync(() => {
+            const definition = roleDefinitions.get(id);
+            return definition === undefined
+                ? Option.none()
+                : Option.some(definition);
+        }),
+        listRoleDefinitions: (input) => Effect.sync(() => [...roleDefinitions.values()]
+            .filter((definition) => (input?.includeDisabled === true ||
+            definition.disabledAt === undefined) &&
+            (input?.includeDeleted === true ||
+                definition.deletedAt === undefined))
+            .sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
+        updateRoleDefinition: (input) => Effect.sync(() => {
+            const current = roleDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const { description: _description, ...unchanged } = current;
+            const description = input.description === undefined
+                ? current.description
+                : (input.description ?? undefined);
+            const updated = {
+                ...unchanged,
+                ...(description === undefined ? {} : { description }),
+                updatedAt: input.updatedAt,
+            };
+            roleDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        setRoleDefinitionDisabled: (input) => Effect.sync(() => {
+            const current = roleDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const { disabledAt: _disabledAt, ...unchanged } = current;
+            const updated = {
+                ...unchanged,
+                ...(input.disabledAt === undefined
+                    ? {}
+                    : { disabledAt: input.disabledAt }),
+                updatedAt: input.updatedAt,
+            };
+            roleDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        deleteRoleDefinition: (input) => Effect.sync(() => {
+            const current = roleDefinitions.get(input.id);
+            if (current === undefined ||
+                current.deletedAt !== undefined ||
+                Number(current.updatedAt) !== Number(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const updated = {
+                ...current,
+                updatedAt: input.updatedAt,
+                deletedAt: input.deletedAt,
+            };
+            roleDefinitions.set(input.id, updated);
+            return Option.some(updated);
+        }),
+        grantPermission: (input) => Effect.sync(() => {
+            const { scope: _scope, ...withoutScope } = input;
+            const scope = canonicalPermissionScope(input.scope);
+            const grant = {
+                ...withoutScope,
+                ...(scope === undefined ? {} : { scope }),
+            };
+            permissionGrants.set(permissionGrantKey(grant), grant);
+        }),
+        revokePermission: (input) => Effect.sync(() => {
+            const key = permissionGrantKey(input);
+            const grant = permissionGrants.get(key);
+            if (grant !== undefined) {
+                permissionGrants.set(key, {
+                    ...grant,
+                    revokedAt: input.revokedAt ?? nowUnixMillis(),
+                });
+            }
+        }),
+        listPermissionGrants: (input) => Effect.sync(() => {
+            const at = input?.at ?? nowUnixMillis();
+            const activity = input?.activity ?? "active";
+            return orderBy([...permissionGrants.values()].filter((grant) => (input?.subject === undefined ||
+                subjectMatches(grant.subject, input.subject)) &&
+                (input?.permission === undefined ||
+                    grant.permission === input.permission) &&
+                (input?.scope === undefined ||
+                    scopeMatchesExactly(grant.scope, input.scope)) &&
+                (activity === "all" ||
+                    isActiveGrant(grant, at) === (activity === "active"))), comparePermissionGrants);
+        }),
+        grantRole: (input) => Effect.sync(() => {
+            const { scope: _scope, ...withoutScope } = input;
+            const scope = canonicalPermissionScope(input.scope);
+            const grant = {
+                ...withoutScope,
+                ...(scope === undefined ? {} : { scope }),
+            };
+            roleGrants.set(roleGrantKey(grant), grant);
+        }),
+        revokeRole: (input) => Effect.sync(() => {
+            const key = roleGrantKey(input);
+            const grant = roleGrants.get(key);
+            if (grant !== undefined) {
+                roleGrants.set(key, {
+                    ...grant,
+                    revokedAt: input.revokedAt ?? nowUnixMillis(),
+                });
+            }
+        }),
+        listRoleGrants: (input) => Effect.sync(() => {
+            const at = input?.at ?? nowUnixMillis();
+            const activity = input?.activity ?? "active";
+            return orderBy([...roleGrants.values()].filter((grant) => (input?.subject === undefined ||
+                subjectMatches(grant.subject, input.subject)) &&
+                (input?.role === undefined || grant.role === input.role) &&
+                (input?.scope === undefined ||
+                    scopeMatchesExactly(grant.scope, input.scope)) &&
+                (activity === "all" ||
+                    isActiveGrant(grant, at) === (activity === "active"))), compareRoleGrants);
+        }),
+        assignRolePermission: (input) => Effect.sync(() => {
+            rolePermissions.set(rolePermissionKey(input), input);
+        }),
+        removeRolePermission: (input) => Effect.sync(() => {
+            rolePermissions.delete(rolePermissionKey(input));
+        }),
+        listRolePermissions: (input) => Effect.sync(() => orderBy([...rolePermissions.values()].filter((rolePermission) => (input?.role === undefined ||
+            rolePermission.role === input.role) &&
+            (input?.permission === undefined ||
+                rolePermission.permission === input.permission) &&
+            (input?.scopeType === undefined ||
+                (input.scopeType === null
+                    ? rolePermission.scopeType === undefined
+                    : rolePermission.scopeType === input.scopeType))), compareRolePermissions)),
+        hasPermission: (input) => Effect.sync(() => {
+            const now = nowUnixMillis();
+            const hasDirectGrant = [...permissionGrants.values()].some((grant) => subjectMatches(grant.subject, input.subject) &&
+                grant.permission === input.permission &&
+                scopeApplies(grant.scope, input.scope) &&
+                isActiveGrant(grant, now));
+            if (hasDirectGrant) {
+                return true;
+            }
+            return [...roleGrants.values()].some((grant) => subjectMatches(grant.subject, input.subject) &&
+                scopeApplies(grant.scope, input.scope) &&
+                isActiveGrant(grant, now) &&
+                [...rolePermissions.values()].some((rolePermission) => rolePermission.role === grant.role &&
+                    rolePermissionApplies(rolePermission, input.permission, input.scope)));
+        }),
+        hasRole: (input) => Effect.sync(() => {
+            const now = nowUnixMillis();
+            return [...roleGrants.values()].some((grant) => subjectMatches(grant.subject, input.subject) &&
+                grant.role === input.role &&
+                scopeApplies(grant.scope, input.scope) &&
+                isActiveGrant(grant, now));
+        }),
+    });
+};
+export const PermissionStoreMemoryLive = Layer.sync(PermissionStore)(makePermissionStoreMemory);
+const administrationError = (operation, reason, resource, message, options) => new PermissionAdministrationError({
+    operation,
+    reason,
+    resource,
+    message,
+    ...(options?.cause === undefined ? {} : { cause: options.cause }),
+    ...(options?.expectedUpdatedAt === undefined
+        ? {}
+        : { expectedUpdatedAt: options.expectedUpdatedAt }),
+    ...(options?.actualUpdatedAt === undefined
+        ? {}
+        : { actualUpdatedAt: options.actualUpdatedAt }),
+});
+const nextAdministrationTimestamp = (operation, resource, expectedUpdatedAt) => Effect.gen(function* () {
+    const expected = Number(expectedUpdatedAt);
+    const now = yield* Clock.currentTimeMillis;
+    const updatedAt = Math.max(now, expected + 1);
+    if (!Number.isSafeInteger(expected) ||
+        expected < 0 ||
+        !Number.isSafeInteger(now) ||
+        now < 0 ||
+        !Number.isSafeInteger(updatedAt)) {
+        return yield* administrationError(operation, "invalid_input", resource, "Cannot produce a valid monotonic updatedAt timestamp", { expectedUpdatedAt });
+    }
+    return makeUnixMillis(updatedAt);
+});
+const validateDefinitionId = (operation, resource, id) => id.trim().length === 0
+    ? Effect.fail(administrationError(operation, "invalid_input", resource, "Definition id must not be empty"))
+    : Effect.void;
+const permissionAdministrationFromStore = (store) => {
+    const withStorageError = (operation, resource, effect) => effect.pipe(Effect.mapError((cause) => administrationError(operation, "storage", resource, cause.message, {
+        cause,
+    })));
+    const resolvePermissionCas = (operation, id, expectedUpdatedAt, result) => Option.isSome(result)
+        ? Effect.succeed(result.value)
+        : withStorageError(operation, "permission_definition", store.findPermissionDefinition(id)).pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current)) {
+                return Effect.fail(administrationError(operation, "not_found", "permission_definition", `Permission definition '${id}' was not found`));
+            }
+            if (current.value.deletedAt !== undefined) {
+                return Effect.fail(administrationError(operation, "deleted", "permission_definition", `Permission definition '${id}' is deleted`, {
+                    expectedUpdatedAt,
+                    actualUpdatedAt: current.value.updatedAt,
+                }));
+            }
+            if (Number(current.value.updatedAt) !== Number(expectedUpdatedAt)) {
+                return Effect.fail(administrationError(operation, "concurrent_modification", "permission_definition", `Permission definition '${id}' was modified concurrently`, {
+                    expectedUpdatedAt,
+                    actualUpdatedAt: current.value.updatedAt,
+                }));
+            }
+            return Effect.fail(administrationError(operation, "storage", "permission_definition", `Permission definition '${id}' could not be mutated`));
+        }));
+    const resolveRoleCas = (operation, id, expectedUpdatedAt, result) => Option.isSome(result)
+        ? Effect.succeed(result.value)
+        : withStorageError(operation, "role_definition", store.findRoleDefinition(id)).pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current)) {
+                return Effect.fail(administrationError(operation, "not_found", "role_definition", `Role definition '${id}' was not found`));
+            }
+            if (current.value.deletedAt !== undefined) {
+                return Effect.fail(administrationError(operation, "deleted", "role_definition", `Role definition '${id}' is deleted`, {
+                    expectedUpdatedAt,
+                    actualUpdatedAt: current.value.updatedAt,
+                }));
+            }
+            if (Number(current.value.updatedAt) !== Number(expectedUpdatedAt)) {
+                return Effect.fail(administrationError(operation, "concurrent_modification", "role_definition", `Role definition '${id}' was modified concurrently`, {
+                    expectedUpdatedAt,
+                    actualUpdatedAt: current.value.updatedAt,
+                }));
+            }
+            return Effect.fail(administrationError(operation, "storage", "role_definition", `Role definition '${id}' could not be mutated`));
+        }));
+    const requireActivePermissionDefinition = (operation, id) => withStorageError(operation, "permission_definition", store.findPermissionDefinition(id)).pipe(Effect.flatMap((definition) => {
+        if (Option.isNone(definition)) {
+            return Effect.fail(administrationError(operation, "not_found", "permission_definition", `Permission definition '${id}' was not found`));
+        }
+        if (definition.value.deletedAt !== undefined) {
+            return Effect.fail(administrationError(operation, "deleted", "permission_definition", `Permission definition '${id}' is deleted`));
+        }
+        if (definition.value.disabledAt !== undefined) {
+            return Effect.fail(administrationError(operation, "inactive", "permission_definition", `Permission definition '${id}' is inactive`));
+        }
+        return Effect.succeed(definition.value);
+    }));
+    const requireActiveRoleDefinition = (operation, id) => withStorageError(operation, "role_definition", store.findRoleDefinition(id)).pipe(Effect.flatMap((definition) => {
+        if (Option.isNone(definition)) {
+            return Effect.fail(administrationError(operation, "not_found", "role_definition", `Role definition '${id}' was not found`));
+        }
+        if (definition.value.deletedAt !== undefined) {
+            return Effect.fail(administrationError(operation, "deleted", "role_definition", `Role definition '${id}' is deleted`));
+        }
+        if (definition.value.disabledAt !== undefined) {
+            return Effect.fail(administrationError(operation, "inactive", "role_definition", `Role definition '${id}' is inactive`));
+        }
+        return Effect.succeed(definition.value);
+    }));
+    return PermissionAdministration.of({
+        createPermissionDefinition: (definition) => Effect.gen(function* () {
+            const operation = "create_permission_definition";
+            yield* validateDefinitionId(operation, "permission_definition", definition.id);
+            const now = makeUnixMillis(yield* Clock.currentTimeMillis);
+            const record = {
+                ...definition,
+                createdAt: now,
+                updatedAt: now,
+            };
+            const created = yield* withStorageError(operation, "permission_definition", store.createPermissionDefinition(record));
+            if (!created) {
+                return yield* administrationError(operation, "already_exists", "permission_definition", `Permission definition '${definition.id}' already exists`);
+            }
+            return record;
+        }),
+        getPermissionDefinition: (id) => withStorageError("get_permission_definition", "permission_definition", store.findPermissionDefinition(id)),
+        listPermissionDefinitions: (input) => withStorageError("list_permission_definitions", "permission_definition", store.listPermissionDefinitions(input)),
+        updatePermissionDefinition: (input) => Effect.gen(function* () {
+            const operation = "update_permission_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "permission_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "permission_definition", store.updatePermissionDefinition({ ...input, updatedAt }));
+            return yield* resolvePermissionCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        disablePermissionDefinition: (input) => Effect.gen(function* () {
+            const operation = "disable_permission_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "permission_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "permission_definition", store.setPermissionDefinitionDisabled({
+                ...input,
+                updatedAt,
+                disabledAt: updatedAt,
+            }));
+            return yield* resolvePermissionCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        enablePermissionDefinition: (input) => Effect.gen(function* () {
+            const operation = "enable_permission_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "permission_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "permission_definition", store.setPermissionDefinitionDisabled({ ...input, updatedAt }));
+            return yield* resolvePermissionCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        deletePermissionDefinition: (input) => Effect.gen(function* () {
+            const operation = "delete_permission_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "permission_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "permission_definition", store.deletePermissionDefinition({
+                ...input,
+                updatedAt,
+                deletedAt: updatedAt,
+            }));
+            return yield* resolvePermissionCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        createRoleDefinition: (definition) => Effect.gen(function* () {
+            const operation = "create_role_definition";
+            yield* validateDefinitionId(operation, "role_definition", definition.id);
+            const now = makeUnixMillis(yield* Clock.currentTimeMillis);
+            const record = {
+                ...definition,
+                createdAt: now,
+                updatedAt: now,
+            };
+            const created = yield* withStorageError(operation, "role_definition", store.createRoleDefinition(record));
+            if (!created) {
+                return yield* administrationError(operation, "already_exists", "role_definition", `Role definition '${definition.id}' already exists`);
+            }
+            return record;
+        }),
+        getRoleDefinition: (id) => withStorageError("get_role_definition", "role_definition", store.findRoleDefinition(id)),
+        listRoleDefinitions: (input) => withStorageError("list_role_definitions", "role_definition", store.listRoleDefinitions(input)),
+        updateRoleDefinition: (input) => Effect.gen(function* () {
+            const operation = "update_role_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "role_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "role_definition", store.updateRoleDefinition({ ...input, updatedAt }));
+            return yield* resolveRoleCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        disableRoleDefinition: (input) => Effect.gen(function* () {
+            const operation = "disable_role_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "role_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "role_definition", store.setRoleDefinitionDisabled({
+                ...input,
+                updatedAt,
+                disabledAt: updatedAt,
+            }));
+            return yield* resolveRoleCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        enableRoleDefinition: (input) => Effect.gen(function* () {
+            const operation = "enable_role_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "role_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "role_definition", store.setRoleDefinitionDisabled({ ...input, updatedAt }));
+            return yield* resolveRoleCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        deleteRoleDefinition: (input) => Effect.gen(function* () {
+            const operation = "delete_role_definition";
+            const updatedAt = yield* nextAdministrationTimestamp(operation, "role_definition", input.expectedUpdatedAt);
+            const result = yield* withStorageError(operation, "role_definition", store.deleteRoleDefinition({
+                ...input,
+                updatedAt,
+                deletedAt: updatedAt,
+            }));
+            return yield* resolveRoleCas(operation, input.id, input.expectedUpdatedAt, result);
+        }),
+        grantPermission: (input) => Effect.gen(function* () {
+            const operation = "grant_permission";
+            const definition = yield* requireActivePermissionDefinition(operation, input.permission);
+            if (!isGlobalScope(input.scope) &&
+                (definition.scopeType === undefined ||
+                    input.scope?.type !== definition.scopeType)) {
+                return yield* administrationError(operation, "invalid_input", "permission_grant", `Scope does not match permission definition '${input.permission}'`);
+            }
+            yield* withStorageError(operation, "permission_grant", store.grantPermission(input));
+        }),
+        revokePermission: (input) => withStorageError("revoke_permission", "permission_grant", store.revokePermission(input)),
+        listPermissionGrants: (input) => withStorageError("list_permission_grants", "permission_grant", store.listPermissionGrants(input)),
+        grantRole: (input) => Effect.gen(function* () {
+            const operation = "grant_role";
+            yield* requireActiveRoleDefinition(operation, input.role);
+            yield* withStorageError(operation, "role_grant", store.grantRole(input));
+        }),
+        revokeRole: (input) => withStorageError("revoke_role", "role_grant", store.revokeRole(input)),
+        listRoleGrants: (input) => withStorageError("list_role_grants", "role_grant", store.listRoleGrants(input)),
+        assignRolePermission: (input) => Effect.gen(function* () {
+            const operation = "assign_role_permission";
+            yield* requireActiveRoleDefinition(operation, input.role);
+            const permission = yield* requireActivePermissionDefinition(operation, input.permission);
+            if (input.scopeType !== permission.scopeType) {
+                return yield* administrationError(operation, "invalid_input", "role_permission", `Scope type does not match permission definition '${input.permission}'`);
+            }
+            yield* withStorageError(operation, "role_permission", store.assignRolePermission(input));
+        }),
+        removeRolePermission: (input) => withStorageError("remove_role_permission", "role_permission", store.removeRolePermission(input)),
+        listRolePermissions: (input) => withStorageError("list_role_permissions", "role_permission", store.listRolePermissions(input)),
+    });
+};
+const permissionAdministration = PermissionStore.use((store) => Effect.succeed(permissionAdministrationFromStore(store)));
+export const PermissionAdministrationLive = Layer.effect(PermissionAdministration, permissionAdministration);
+const permissionAdministrationAuditSubject = (context, subject) => {
+    if (subject.type === "user") {
+        return { type: "user", userId: makeUserId(subject.id) };
+    }
+    const subjectReference = context.subjectReference?.(subject);
+    return {
+        type: "custom",
+        subjectType: subject.type,
+        ...(subjectReference === undefined ? {} : { subjectReference }),
+    };
+};
+const permissionAdministrationAuditScope = (context, scope) => {
+    if (isGlobalScope(scope)) {
+        return undefined;
+    }
+    const reference = scope?.id === undefined ? undefined : context.scopeReference?.(scope);
+    return {
+        type: scope?.type ?? globalScope.type,
+        ...(reference === undefined ? {} : { reference }),
+    };
+};
+const permissionAdministrationAuditScopeField = (context, scope) => {
+    const projected = permissionAdministrationAuditScope(context, scope);
+    return projected === undefined ? {} : { scope: projected };
+};
+const permissionDefinitionChangedFields = (input) => [
+    ...(input.description === undefined ? [] : ["description"]),
+    ...(input.scopeType === undefined ? [] : ["scopeType"]),
+];
+const roleDefinitionChangedFields = (input) => input.description === undefined ? [] : ["description"];
+export const PermissionAdministrationAuditLive = Layer.effect(PermissionAdministration, Effect.gen(function* () {
+    const administration = yield* PermissionAdministration;
+    const auditLog = yield* AuditLog;
+    const context = yield* PermissionAdministrationAuditContext;
+    const common = {
+        actor: context.actor,
+        ...(context.request === undefined ? {} : { request: context.request }),
+    };
+    const emit = (event) => {
+        const id = context.eventId?.(event);
+        return auditLog
+            .emit(id === undefined ? event : { ...event, id })
+            .pipe(Effect.ignore);
+    };
+    const observed = (run, event) => run.pipe(Effect.tap((result) => emit(event(result))));
+    const observedNow = (run, event) => run.pipe(Effect.tap((result) => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => emit(event(result, makeUnixMillis(now)))))));
+    return PermissionAdministration.of({
+        ...administration,
+        createPermissionDefinition: (input) => observed(administration.createPermissionDefinition(input), (result) => ({
+            type: "auth.permission_definition.created",
+            ...common,
+            permissionId: result.id,
+            ...(result.scopeType === undefined
+                ? {}
+                : { scopeType: result.scopeType }),
+            occurredAt: result.updatedAt,
+        })),
+        updatePermissionDefinition: (input) => observed(administration.updatePermissionDefinition(input), (result) => ({
+            type: "auth.permission_definition.updated",
+            ...common,
+            permissionId: result.id,
+            ...(result.scopeType === undefined
+                ? {}
+                : { scopeType: result.scopeType }),
+            changedFields: permissionDefinitionChangedFields(input),
+            occurredAt: result.updatedAt,
+        })),
+        disablePermissionDefinition: (input) => observed(administration.disablePermissionDefinition(input), (result) => ({
+            type: "auth.permission_definition.disabled",
+            ...common,
+            permissionId: result.id,
+            ...(result.scopeType === undefined
+                ? {}
+                : { scopeType: result.scopeType }),
+            occurredAt: result.updatedAt,
+        })),
+        enablePermissionDefinition: (input) => observed(administration.enablePermissionDefinition(input), (result) => ({
+            type: "auth.permission_definition.enabled",
+            ...common,
+            permissionId: result.id,
+            ...(result.scopeType === undefined
+                ? {}
+                : { scopeType: result.scopeType }),
+            occurredAt: result.updatedAt,
+        })),
+        deletePermissionDefinition: (input) => observed(administration.deletePermissionDefinition(input), (result) => ({
+            type: "auth.permission_definition.deleted",
+            ...common,
+            permissionId: result.id,
+            ...(result.scopeType === undefined
+                ? {}
+                : { scopeType: result.scopeType }),
+            occurredAt: result.updatedAt,
+        })),
+        createRoleDefinition: (input) => observed(administration.createRoleDefinition(input), (result) => ({
+            type: "auth.role_definition.created",
+            ...common,
+            roleId: result.id,
+            occurredAt: result.updatedAt,
+        })),
+        updateRoleDefinition: (input) => observed(administration.updateRoleDefinition(input), (result) => ({
+            type: "auth.role_definition.updated",
+            ...common,
+            roleId: result.id,
+            changedFields: roleDefinitionChangedFields(input),
+            occurredAt: result.updatedAt,
+        })),
+        disableRoleDefinition: (input) => observed(administration.disableRoleDefinition(input), (result) => ({
+            type: "auth.role_definition.disabled",
+            ...common,
+            roleId: result.id,
+            occurredAt: result.updatedAt,
+        })),
+        enableRoleDefinition: (input) => observed(administration.enableRoleDefinition(input), (result) => ({
+            type: "auth.role_definition.enabled",
+            ...common,
+            roleId: result.id,
+            occurredAt: result.updatedAt,
+        })),
+        deleteRoleDefinition: (input) => observed(administration.deleteRoleDefinition(input), (result) => ({
+            type: "auth.role_definition.deleted",
+            ...common,
+            roleId: result.id,
+            occurredAt: result.updatedAt,
+        })),
+        grantPermission: (input) => observedNow(administration.grantPermission(input), (_, occurredAt) => ({
+            type: "auth.permission.granted",
+            ...common,
+            subject: permissionAdministrationAuditSubject(context, input.subject),
+            permissionId: input.permission,
+            ...permissionAdministrationAuditScopeField(context, input.scope),
+            ...(input.expiresAt === undefined
+                ? {}
+                : { expiresAt: input.expiresAt }),
+            occurredAt,
+        })),
+        revokePermission: (input) => observedNow(administration.revokePermission(input), (_, occurredAt) => ({
+            type: "auth.permission.revoked",
+            ...common,
+            subject: permissionAdministrationAuditSubject(context, input.subject),
+            permissionId: input.permission,
+            ...permissionAdministrationAuditScopeField(context, input.scope),
+            occurredAt: input.revokedAt ?? occurredAt,
+        })),
+        grantRole: (input) => observedNow(administration.grantRole(input), (_, occurredAt) => ({
+            type: "auth.role.granted",
+            ...common,
+            subject: permissionAdministrationAuditSubject(context, input.subject),
+            roleId: input.role,
+            ...permissionAdministrationAuditScopeField(context, input.scope),
+            ...(input.expiresAt === undefined
+                ? {}
+                : { expiresAt: input.expiresAt }),
+            occurredAt,
+        })),
+        revokeRole: (input) => observedNow(administration.revokeRole(input), (_, occurredAt) => ({
+            type: "auth.role.revoked",
+            ...common,
+            subject: permissionAdministrationAuditSubject(context, input.subject),
+            roleId: input.role,
+            ...permissionAdministrationAuditScopeField(context, input.scope),
+            occurredAt: input.revokedAt ?? occurredAt,
+        })),
+        assignRolePermission: (input) => observedNow(administration.assignRolePermission(input), (_, occurredAt) => ({
+            type: "auth.role_permission.assigned",
+            ...common,
+            roleId: input.role,
+            permissionId: input.permission,
+            ...(input.scopeType === undefined
+                ? {}
+                : { scopeType: input.scopeType }),
+            occurredAt,
+        })),
+        removeRolePermission: (input) => observedNow(administration.removeRolePermission(input), (_, occurredAt) => ({
+            type: "auth.role_permission.removed",
+            ...common,
+            roleId: input.role,
+            permissionId: input.permission,
+            ...(input.scopeType === undefined
+                ? {}
+                : { scopeType: input.scopeType }),
+            occurredAt,
+        })),
+    });
+}));
+const permissionStoreErrorToCheckError = (operation, cause) => new PermissionCheckError({
+    operation,
+    message: cause.message,
+    cause,
+});
+const permissionsFromStore = PermissionStore.use((store) => Effect.succeed(Permissions.of({
+    hasPermission: (input) => store
+        .hasPermission({
+        subject: input.subject,
+        permission: input.permission,
+        ...(input.scope === undefined ? {} : { scope: input.scope }),
+    })
+        .pipe(Effect.mapError((cause) => permissionStoreErrorToCheckError("has_permission", cause))),
+    hasRole: (input) => store
+        .hasRole({
+        subject: input.subject,
+        role: input.role,
+        ...(input.scope === undefined ? {} : { scope: input.scope }),
+    })
+        .pipe(Effect.mapError((cause) => permissionStoreErrorToCheckError("has_role", cause))),
+})));
+export const PermissionsFromStoreLive = Layer.effect(Permissions, permissionsFromStore);
+//# sourceMappingURL=Permission.js.map