@expressots/core 3.0.0 → 4.0.0-preview.3

package/lib/cjs/authorization/guards/attribute-based.guard.js

@@ -0,0 +1,109 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequirePolicy = exports.AttributeBasedGuard = void 0;
+const guard_decorators_js_1 = require("../guard-decorators.js");
+const inversify_js_1 = require("../../di/inversify.js");
+const guard_interface_js_1 = require("../guard.interface.js");
+const app_error_js_1 = require("../../error/app-error.js");
+/**
+ * Guard that uses ABAC (Attribute-Based Access Control)
+ * Evaluates policy based on user, resource, and environment attributes
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/resources")
+ * export class ResourceController {
+ *   @Get("/:id")
+ *   @UseGuards(
+ *     RequireAuth(),
+ *     RequirePolicy((attrs) => {
+ *       return attrs.user.roles.includes("admin") ||
+ *              attrs.resource.owner === attrs.user.id;
+ *     })
+ *   )
+ *   getResource(@param("id") id: string) {}
+ * }
+ * ```
+ */
+/**
+ * Note: Guards are instantiated dynamically by GuardRegistry, not via DI
+ */
+let AttributeBasedGuard = class AttributeBasedGuard {
+    constructor(policy) {
+        this.policy = policy;
+        if (!policy || typeof policy !== "function") {
+            throw new Error("AttributeBasedGuard requires a policy function");
+        }
+    }
+    async canActivate(context) {
+        const userDetails = context.principal.details;
+        // Get resource ID from route params or query params
+        const resourceId = context.route.params.id || context.route.query.id || "";
+        const attributes = {
+            user: {
+                id: userDetails?.id || "anonymous",
+                roles: await this.getUserRoles(context),
+                department: userDetails?.department,
+            },
+            resource: {
+                id: String(resourceId),
+                type: context.route.controller,
+                owner: await this.getResourceOwner(context),
+            },
+            environment: {
+                time: new Date(),
+                ip: context.request.ip || "unknown",
+                tenant: context.scope.tenant,
+            },
+        };
+        try {
+            const allowed = await this.policy(attributes);
+            return allowed
+                ? guard_interface_js_1.GuardResult.allow()
+                : guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden("Policy evaluation failed"));
+        }
+        catch (error) {
+            return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden(`Policy evaluation error: ${error}`));
+        }
+    }
+    async getUserRoles(context) {
+        // Extract roles from principal
+        // This is a simplified implementation - in practice, you'd load from database
+        const roles = [];
+        for (const role of ["admin", "moderator", "user"]) {
+            if (await context.principal.isInRole(role)) {
+                roles.push(role);
+            }
+        }
+        return roles;
+    }
+    async getResourceOwner(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _context) {
+        // Extract resource owner from context
+        // This is a simplified implementation - in practice, you'd load from database
+        // Future implementation would use: context.route.params.id, context.container, etc.
+        return undefined;
+    }
+};
+exports.AttributeBasedGuard = AttributeBasedGuard;
+exports.AttributeBasedGuard = AttributeBasedGuard = __decorate([
+    (0, guard_decorators_js_1.Guard)({ priority: 25 }),
+    (0, inversify_js_1.injectable)(),
+    __metadata("design:paramtypes", [Function])
+], AttributeBasedGuard);
+/**
+ * Factory function for convenience
+ * @param policy - Policy function that evaluates attributes
+ */
+const RequirePolicy = (policy) => new AttributeBasedGuard(policy);
+exports.RequirePolicy = RequirePolicy;

package/lib/cjs/authorization/guards/authenticated.guard.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireAuth = exports.AuthenticatedGuard = void 0;
+const guard_decorators_js_1 = require("../guard-decorators.js");
+const inversify_js_1 = require("../../di/inversify.js");
+const guard_interface_js_1 = require("../guard.interface.js");
+const app_error_js_1 = require("../../error/app-error.js");
+/**
+ * Guard that requires authentication
+ * Checks if principal is authenticated
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/users")
+ * export class UserController {
+ *   @Get("/profile")
+ *   @UseGuards(AuthenticatedGuard)
+ *   getProfile(@principal() principal: Principal) {
+ *     return principal.details;
+ *   }
+ * }
+ * ```
+ * Note: Guards are instantiated dynamically by GuardRegistry, not via DI
+ */
+let AuthenticatedGuard = class AuthenticatedGuard {
+    async canActivate(context) {
+        const isAuthenticated = await context.principal.isAuthenticated();
+        if (!isAuthenticated) {
+            return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.unauthorized("Authentication required"));
+        }
+        return guard_interface_js_1.GuardResult.allow();
+    }
+};
+exports.AuthenticatedGuard = AuthenticatedGuard;
+exports.AuthenticatedGuard = AuthenticatedGuard = __decorate([
+    (0, guard_decorators_js_1.Guard)({ priority: 1, cacheable: true }),
+    (0, inversify_js_1.injectable)()
+], AuthenticatedGuard);
+/**
+ * Factory function for convenience
+ */
+const RequireAuth = () => new AuthenticatedGuard();
+exports.RequireAuth = RequireAuth;

package/lib/cjs/authorization/guards/composition.guard.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.combineGuards = combineGuards;
+exports.sequenceGuards = sequenceGuards;
+const guard_interface_js_1 = require("../guard.interface.js");
+/**
+ * Combine multiple guards (all must pass)
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/sensitive")
+ * export class SensitiveController {
+ *   @Get("/")
+ *   @UseGuards(
+ *     combineGuards(
+ *       RequireAuth(),
+ *       RequireRoles("admin"),
+ *       RequirePermission("sensitive:read")
+ *     )
+ *   )
+ *   getSensitive() {}
+ * }
+ * ```
+ */
+function combineGuards(...guards) {
+    return {
+        async canActivate(context) {
+            for (const guard of guards) {
+                const guardInstance = typeof guard === "function" ? new guard() : guard;
+                const result = await guardInstance.canActivate(context);
+                const guardResult = result instanceof guard_interface_js_1.GuardResult
+                    ? result
+                    : result
+                        ? guard_interface_js_1.GuardResult.allow()
+                        : guard_interface_js_1.GuardResult.deny();
+                if (!guardResult.allowed) {
+                    return guardResult;
+                }
+            }
+            return guard_interface_js_1.GuardResult.allow();
+        },
+        priority: 100,
+    };
+}
+/**
+ * Sequence guards (sequential dependencies)
+ * Same implementation as combineGuards but different semantic meaning
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/data")
+ * export class DataController {
+ *   @Get("/")
+ *   @UseGuards(
+ *     sequenceGuards(
+ *       LoggingGuard,
+ *       AuditGuard,
+ *       RequireAuth()
+ *     )
+ *   )
+ *   getData() {}
+ * }
+ * ```
+ */
+function sequenceGuards(...guards) {
+    return combineGuards(...guards);
+}

package/lib/cjs/authorization/guards/conditional.guard.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whenGuard = whenGuard;
+const guard_interface_js_1 = require("../guard.interface.js");
+/**
+ * Guard that executes conditionally (integrates with existing when/unless pattern)
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/admin")
+ * export class AdminController {
+ *   @Get("/")
+ *   @UseGuards(
+ *     whenGuard(
+ *       (ctx) => ctx.request.method === "POST",
+ *       RequireRoles("super-admin")
+ *     ),
+ *     RequireRoles("admin")
+ *   )
+ *   adminAction() {}
+ * }
+ * ```
+ */
+function whenGuard(condition, guard) {
+    return {
+        async canActivate(context) {
+            const shouldExecute = await condition(context);
+            if (!shouldExecute) {
+                return guard_interface_js_1.GuardResult.allow(); // Skip guard
+            }
+            const guardInstance = typeof guard === "function" ? new guard() : guard;
+            const result = await guardInstance.canActivate(context);
+            return result instanceof guard_interface_js_1.GuardResult
+                ? result
+                : result
+                    ? guard_interface_js_1.GuardResult.allow()
+                    : guard_interface_js_1.GuardResult.deny();
+        },
+        priority: 50,
+    };
+}

package/lib/cjs/authorization/guards/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Built-in guards
+__exportStar(require("./authenticated.guard.js"), exports);
+__exportStar(require("./role.guard.js"), exports);
+__exportStar(require("./permission.guard.js"), exports);
+__exportStar(require("./resource-owner.guard.js"), exports);
+__exportStar(require("./attribute-based.guard.js"), exports);
+__exportStar(require("./conditional.guard.js"), exports);
+__exportStar(require("./composition.guard.js"), exports);

package/lib/cjs/authorization/guards/permission.guard.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequirePermission = exports.PermissionGuard = void 0;
+const guard_decorators_js_1 = require("../guard-decorators.js");
+const inversify_js_1 = require("../../di/inversify.js");
+const inject_js_1 = require("../../di/annotation/inject.js");
+const guard_interface_js_1 = require("../guard.interface.js");
+const app_error_js_1 = require("../../error/app-error.js");
+/**
+ * Guard that requires specific permission
+ * Uses SecurityContext for permission checking (request-scoped caching)
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/documents")
+ * export class DocumentController {
+ *   @Get("/")
+ *   @UseGuards(PermissionGuard("documents:read"))
+ *   listDocuments() {}
+ * }
+ * ```
+ * Note: Guards are instantiated dynamically by GuardRegistry, not via DI
+ */
+let PermissionGuard = class PermissionGuard {
+    constructor(permission) {
+        this.permission = permission;
+        if (!permission) {
+            throw new Error("PermissionGuard requires a permission string");
+        }
+    }
+    async canActivate(context) {
+        // Try to use SecurityContext if available (request-scoped caching)
+        if (this.securityContext) {
+            const hasPermission = await this.securityContext.hasPermission(this.permission);
+            if (!hasPermission) {
+                return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden(`Missing permission: ${this.permission}`));
+            }
+            return guard_interface_js_1.GuardResult.allow();
+        }
+        // Fallback: Check if principal has permission method
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const principal = context.principal;
+        if (typeof principal.hasPermission === "function") {
+            const hasPermission = await principal.hasPermission(this.permission);
+            if (!hasPermission) {
+                return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden(`Missing permission: ${this.permission}`));
+            }
+            return guard_interface_js_1.GuardResult.allow();
+        }
+        // No permission checking available
+        return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden(`Permission check not available: ${this.permission}`));
+    }
+    cacheKey(context) {
+        const details = context.principal.details;
+        return `permission:${this.permission}:${details?.id || "anonymous"}`;
+    }
+};
+exports.PermissionGuard = PermissionGuard;
+__decorate([
+    (0, inject_js_1.inject)("ISecurityContext"),
+    __metadata("design:type", Object)
+], PermissionGuard.prototype, "securityContext", void 0);
+exports.PermissionGuard = PermissionGuard = __decorate([
+    (0, guard_decorators_js_1.Guard)({ priority: 20, cacheable: true }),
+    (0, inversify_js_1.injectable)(),
+    __metadata("design:paramtypes", [String])
+], PermissionGuard);
+/**
+ * Factory function for convenience
+ * @param permission - Permission to require
+ */
+const RequirePermission = (permission) => new PermissionGuard(permission);
+exports.RequirePermission = RequirePermission;

package/lib/cjs/authorization/guards/resource-owner.guard.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireResourceOwner = exports.ResourceOwnerGuard = void 0;
+const guard_decorators_js_1 = require("../guard-decorators.js");
+const inversify_js_1 = require("../../di/inversify.js");
+const guard_interface_js_1 = require("../guard.interface.js");
+const app_error_js_1 = require("../../error/app-error.js");
+/**
+ * Guard that requires resource ownership
+ * Checks if principal owns the resource specified by route parameter
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/documents")
+ * export class DocumentController {
+ *   @Delete("/:id")
+ *   @UseGuards(ResourceOwnerGuard("id"))
+ *   deleteDocument(@param("id") id: string) {
+ *     // Only resource owner can delete
+ *   }
+ * }
+ * ```
+ * Note: Guards are instantiated dynamically by GuardRegistry, not via DI
+ */
+let ResourceOwnerGuard = class ResourceOwnerGuard {
+    constructor(resourceIdParam = "id") {
+        this.resourceIdParam = resourceIdParam;
+    }
+    async canActivate(context) {
+        const resourceId = context.route.params[this.resourceIdParam];
+        if (!resourceId) {
+            return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.badRequest(`Resource ID parameter '${this.resourceIdParam}' is required`));
+        }
+        const isOwner = await context.principal.isResourceOwner(resourceId);
+        if (!isOwner) {
+            return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden("Not resource owner"));
+        }
+        return guard_interface_js_1.GuardResult.allow();
+    }
+};
+exports.ResourceOwnerGuard = ResourceOwnerGuard;
+exports.ResourceOwnerGuard = ResourceOwnerGuard = __decorate([
+    (0, guard_decorators_js_1.Guard)({ priority: 30 }),
+    (0, inversify_js_1.injectable)(),
+    __metadata("design:paramtypes", [String])
+], ResourceOwnerGuard);
+/**
+ * Factory function for convenience
+ * @param paramName - Route parameter name containing resource ID (default: "id")
+ */
+const RequireResourceOwner = (paramName = "id") => new ResourceOwnerGuard(paramName);
+exports.RequireResourceOwner = RequireResourceOwner;

package/lib/cjs/authorization/guards/role.guard.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireRole = exports.RoleGuard = void 0;
+const guard_decorators_js_1 = require("../guard-decorators.js");
+const inversify_js_1 = require("../../di/inversify.js");
+const guard_interface_js_1 = require("../guard.interface.js");
+const app_error_js_1 = require("../../error/app-error.js");
+/**
+ * Guard that requires specific roles
+ * Checks if principal has any of the required roles
+ *
+ * @example
+ * ```typescript
+ * @controller("/api/admin")
+ * export class AdminController {
+ *   @Get("/users")
+ *   @UseGuards(RoleGuard(["admin"]))
+ *   getUsers() {}
+ * }
+ * ```
+ * Note: Guards are instantiated dynamically by GuardRegistry, not via DI
+ */
+let RoleGuard = class RoleGuard {
+    constructor(roles) {
+        this.roles = roles;
+        if (!roles || roles.length === 0) {
+            throw new Error("RoleGuard requires at least one role");
+        }
+    }
+    async canActivate(context) {
+        // Check if user has any of the required roles
+        const roleChecks = await Promise.all(this.roles.map((role) => context.principal.isInRole(role)));
+        const hasRole = roleChecks.some(Boolean);
+        if (!hasRole) {
+            return guard_interface_js_1.GuardResult.deny(app_error_js_1.AppError.forbidden(`Requires one of: ${this.roles.join(", ")}`));
+        }
+        return guard_interface_js_1.GuardResult.allow();
+    }
+    cacheKey(context) {
+        const details = context.principal.details;
+        return `role:${this.roles.join(",")}:${details?.id || "anonymous"}`;
+    }
+};
+exports.RoleGuard = RoleGuard;
+exports.RoleGuard = RoleGuard = __decorate([
+    (0, guard_decorators_js_1.Guard)({ priority: 10, cacheable: true }),
+    (0, inversify_js_1.injectable)(),
+    __metadata("design:paramtypes", [Array])
+], RoleGuard);
+/**
+ * Factory function for convenience
+ * @param roles - Roles to require
+ */
+const RequireRole = (...roles) => new RoleGuard(roles);
+exports.RequireRole = RequireRole;

package/lib/cjs/authorization/index.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Core interfaces and types
+__exportStar(require("./guard.interface.js"), exports);
+__exportStar(require("./guard-constants.js"), exports);
+// Decorators
+__exportStar(require("./guard-decorators.js"), exports);
+// Registry and executor
+__exportStar(require("./guard-registry.js"), exports);
+__exportStar(require("./guard-executor.js"), exports);
+// Services
+__exportStar(require("./services/guard-cache.interface.js"), exports);
+__exportStar(require("./services/guard-cache.js"), exports);
+__exportStar(require("./services/security-context.interface.js"), exports);
+__exportStar(require("./services/security-context.js"), exports);
+__exportStar(require("./services/permission-service.interface.js"), exports);
+__exportStar(require("./services/permission-service.js"), exports);
+__exportStar(require("./services/permission-hierarchy.interface.js"), exports);
+__exportStar(require("./services/permission-hierarchy.js"), exports);
+// Built-in guards
+__exportStar(require("./guards/index.js"), exports);
+// Convenience decorators
+__exportStar(require("./decorators/convenience.js"), exports);
+// Configuration
+__exportStar(require("./authorization-config.interface.js"), exports);
+__exportStar(require("./setup.js"), exports);

package/lib/cjs/authorization/services/guard-cache.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/authorization/services/guard-cache.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardCache = void 0;
+const inversify_js_1 = require("../../di/inversify.js");
+/**
+ * Implementation of guard result caching
+ * Caches results per scope (request, tenant, etc.)
+ * Note: This is bound manually in setupAuthorization() to allow user overrides
+ */
+let GuardCache = class GuardCache {
+    constructor() {
+        // Scope -> Cache Key -> Result
+        this.cache = new Map();
+    }
+    /**
+     * Get cached guard result
+     */
+    get(scope, key) {
+        const scopeCache = this.cache.get(scope);
+        if (!scopeCache) {
+            return null;
+        }
+        return scopeCache.get(key) || null;
+    }
+    /**
+     * Set cached guard result
+     */
+    set(scope, key, result) {
+        if (!this.cache.has(scope)) {
+            this.cache.set(scope, new Map());
+        }
+        this.cache.get(scope).set(key, result);
+    }
+    /**
+     * Clear all cached results for a scope
+     */
+    clearScope(scope) {
+        this.cache.delete(scope);
+    }
+    /**
+     * Clear all cached results
+     */
+    clear() {
+        this.cache.clear();
+    }
+};
+exports.GuardCache = GuardCache;
+exports.GuardCache = GuardCache = __decorate([
+    (0, inversify_js_1.injectable)()
+], GuardCache);

package/lib/cjs/authorization/services/permission-hierarchy.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/cjs/authorization/services/permission-hierarchy.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionHierarchy = void 0;
+const inversify_js_1 = require("../../di/inversify.js");
+/**
+ * Permission hierarchy service for role/permission inheritance
+ * Handles hierarchical permissions (e.g., admin inherits user permissions)
+ * Note: This is bound manually in setupAuthorization() to allow user overrides
+ */
+let PermissionHierarchy = class PermissionHierarchy {
+    constructor() {
+        this.hierarchy = {
+            "super-admin": ["admin", "moderator", "user"],
+            admin: ["moderator", "user"],
+            moderator: ["user"],
+        };
+    }
+    /**
+     * Resolve all roles including inherited ones
+     */
+    async resolveRoles(roles) {
+        const allRoles = new Set();
+        for (const role of roles) {
+            allRoles.add(role);
+            const inherited = this.hierarchy[role] || [];
+            inherited.forEach((r) => allRoles.add(r));
+        }
+        return Array.from(allRoles);
+    }
+    /**
+     * Check if role inherits from another role
+     */
+    inheritsFrom(role, parentRole) {
+        const inherited = this.hierarchy[role] || [];
+        return (inherited.includes(parentRole) ||
+            inherited.some((r) => this.inheritsFrom(r, parentRole)));
+    }
+    /**
+     * Configure hierarchy
+     */
+    configure(hierarchy) {
+        this.hierarchy = { ...this.hierarchy, ...hierarchy };
+    }
+};
+exports.PermissionHierarchy = PermissionHierarchy;
+exports.PermissionHierarchy = PermissionHierarchy = __decorate([
+    (0, inversify_js_1.injectable)()
+], PermissionHierarchy);

package/lib/cjs/authorization/services/permission-service.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });