@fonderie/permissions 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fonderie, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+# @fonderie/permissions
+
+Role-based access control: define roles, assign CRUD permissions per
+resource, and enforce them with middleware — the brick between "logged in"
+and "allowed to".
+
+## Install
+
+```sh
+npm install @fonderie/permissions
+```
+
+## Use
+
+```ts
+import { FonderieApp, defineConfig } from '@fonderie/core';
+import { PermissionsModule } from '@fonderie/permissions';
+
+const app = await new FonderieApp(defineConfig({}))
+  .register(new PermissionsModule())
+  .boot();
+```
+
+```ts
+import { requirePermission, requireRole, OPERATIONS } from '@fonderie/permissions';
+```
+
+`PermissionsEngine` evaluates keys like `projects:update`; denials raise a
+typed `PermissionDeniedError`.
+
+## Why this exists
+
+You've shipped this plumbing before — auth, teams, billing, messaging —
+and the next project will ask for it again. Fonderie packages it once:
+plain TypeScript modules for
+[`@fonderie/core`](https://github.com/fonderie-js/sdk/tree/main/packages/core),
+PostgreSQL-backed, self-hosted, MIT. No external control plane, no
+per-seat anything. Register the modules you need; skip the ones you don't.
+
+**This package owns** what the caller may do. Role and permission evaluation layered
+on auth and workspaces, enforced at the route with one middleware.
+
+Browse the whole set at
+[fonderie-js/sdk](https://github.com/fonderie-js/sdk) · follow
+[@fonderiejs](https://x.com/fonderiejs)
+
+## License
+
+MIT © Fonderie, Inc.

package/dist/config.cjs

@@ -0,0 +1,19 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/config.ts
+var config_exports = {};
+module.exports = __toCommonJS(config_exports);
+//# sourceMappingURL=config.cjs.map

package/dist/config.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export interface IPermissionsConfig {\n\t// When true, a permission of action='*' or resource='*' matches anything\n\t// Default: true\n\twildcards?: boolean;\n\n\t// Super-admin role name — members with this role bypass all checks\n\t// Default: 'owner'\n\tsuperRole?: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/config.d.cts

@@ -0,0 +1,6 @@
+interface IPermissionsConfig {
+    wildcards?: boolean;
+    superRole?: string;
+}
+
+export type { IPermissionsConfig };

package/dist/config.d.ts

@@ -0,0 +1,6 @@
+interface IPermissionsConfig {
+    wildcards?: boolean;
+    superRole?: string;
+}
+
+export type { IPermissionsConfig };

package/dist/config.js

@@ -0,0 +1 @@
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -0,0 +1,253 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  OPERATIONS: () => OPERATIONS,
+  PERMISSION_COLUMN: () => PERMISSION_COLUMN,
+  PermissionDeniedError: () => PermissionDeniedError,
+  PermissionsEngine: () => PermissionsEngine,
+  PermissionsModule: () => PermissionsModule,
+  requirePermission: () => requirePermission,
+  requireRole: () => requireRole
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/services/membership.ts
+async function getMembership(userId, workspaceId, store) {
+  const [row] = await store.query(
+    `SELECT ruw.user_id, ruw.workspace_id, ruw.role_id, r.name AS role_name
+		 FROM fonderie_role_user_workspaces ruw
+		 JOIN fonderie_roles r ON r.id = ruw.role_id
+		 WHERE ruw.user_id      = $1
+		   AND ruw.workspace_id = $2
+		   AND ruw.removed    = false
+		   AND ruw.suspended  = false
+		 LIMIT 1`,
+    [userId, workspaceId]
+  );
+  if (!row) return null;
+  return {
+    userId: row.user_id,
+    workspaceId: row.workspace_id,
+    roleId: row.role_id,
+    roleName: row.role_name
+  };
+}
+async function hasRole(userId, workspaceId, roleName, store) {
+  const [row] = await store.query(
+    `SELECT EXISTS (
+		   SELECT 1
+		   FROM fonderie_role_user_workspaces ruw
+		   JOIN fonderie_roles r ON r.id = ruw.role_id
+		   WHERE ruw.user_id      = $1
+		     AND ruw.workspace_id = $2
+		     AND r.name           = $3
+		     AND ruw.removed    = false
+		     AND ruw.suspended  = false
+		 ) AS exists`,
+    [userId, workspaceId, roleName]
+  );
+  return row?.exists ?? false;
+}
+
+// src/constants.ts
+var OPERATIONS = {
+  CREATE: "create",
+  READ: "read",
+  UPDATE: "update",
+  DELETE: "delete"
+};
+var PERMISSION_COLUMN = {
+  create: "can_create",
+  read: "can_read",
+  update: "can_update",
+  delete: "can_delete"
+};
+
+// src/services/permissions.ts
+async function checkPermission(userId, workspaceId, permissionKey, operation, store) {
+  const col = PERMISSION_COLUMN[operation];
+  const [row] = await store.query(
+    `SELECT BOOL_OR(rp.${col}) AS has_permission
+		 FROM fonderie_role_user_workspaces ruw
+		 JOIN fonderie_roles r ON ruw.role_id = r.id
+		 JOIN fonderie_role_permissions rp ON r.id = rp.role_id
+		 WHERE ruw.user_id      = $1
+		   AND ruw.workspace_id = $2
+		   AND rp.workspace_id  = $2
+		   AND rp.permission_key = $3
+		   AND ruw.removed    = false
+		   AND ruw.suspended  = false
+		   AND (r.workspace_id = $2 OR r.is_system = true)
+		 GROUP BY ruw.user_id, ruw.workspace_id`,
+    [userId, workspaceId, permissionKey]
+  );
+  return row?.has_permission ?? false;
+}
+
+// src/engine.ts
+var PermissionsEngine = class {
+  constructor(store, config = {}) {
+    this.store = store;
+    this.superRole = config.superRole ?? "owner";
+  }
+  store;
+  superRole;
+  async getMembership(userId, workspaceId) {
+    return getMembership(userId, workspaceId, this.store);
+  }
+  async can(userId, operation, permissionKey, workspaceId) {
+    const isMember = await getMembership(userId, workspaceId, this.store);
+    if (!isMember) return false;
+    if (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;
+    return checkPermission(userId, workspaceId, permissionKey, operation, this.store);
+  }
+  async assert(userId, operation, permissionKey, workspaceId) {
+    const allowed = await this.can(userId, operation, permissionKey, workspaceId);
+    if (!allowed) {
+      throw new PermissionDeniedError(operation, permissionKey);
+    }
+  }
+  async canAll(userId, checks, workspaceId) {
+    const isMember = await getMembership(userId, workspaceId, this.store);
+    if (!isMember) return false;
+    if (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;
+    const results = await Promise.all(
+      checks.map(
+        (c) => checkPermission(userId, workspaceId, c.permissionKey, c.operation, this.store)
+      )
+    );
+    return results.every(Boolean);
+  }
+  async canAny(userId, checks, workspaceId) {
+    const isMember = await getMembership(userId, workspaceId, this.store);
+    if (!isMember) return false;
+    if (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;
+    const results = await Promise.all(
+      checks.map(
+        (c) => checkPermission(userId, workspaceId, c.permissionKey, c.operation, this.store)
+      )
+    );
+    return results.some(Boolean);
+  }
+};
+var PermissionDeniedError = class extends Error {
+  status = 403;
+  constructor(operation, permissionKey) {
+    super(`Permission denied: ${operation}:${permissionKey}`);
+    this.name = "PermissionDeniedError";
+  }
+};
+
+// src/module.ts
+var PERMISSIONS_ENGINE_KEY = "fonderie.permissions.engine";
+var PermissionsModule = class {
+  engine;
+  name = "@fonderie/permissions";
+  deps = ["@fonderie/auth"];
+  constructor(store, config = {}) {
+    this.engine = new PermissionsEngine(store, config);
+  }
+  install(app) {
+    const engine = this.engine;
+    app.use(async (ctx, next) => {
+      ctx.meta[PERMISSIONS_ENGINE_KEY] = engine;
+      return next();
+    });
+  }
+};
+
+// src/middlewares/require-role.ts
+var import_core = require("@fonderie/core");
+function makeHandler(roleName, store) {
+  const allowed = Array.isArray(roleName) ? roleName : [roleName];
+  return async (ctx, next) => {
+    if (!ctx.user) {
+      return (0, import_core.setApiResponse)(import_core.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+    }
+    const engine = ctx.meta[PERMISSIONS_ENGINE_KEY];
+    if (!(engine instanceof PermissionsEngine)) {
+      return (0, import_core.setApiResponse)(import_core.HTTP.SERVER_ERROR, "SERVER_ERROR", "Permissions module not installed");
+    }
+    const workspaceId = ctx.workspace?.id ?? ctx.meta["params"]?.["workspaceId"];
+    if (!workspaceId) {
+      return (0, import_core.setApiResponse)(import_core.HTTP.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
+    }
+    const membership = await getMembership(ctx.user.id, workspaceId, store);
+    if (!membership || !allowed.includes(membership.roleName)) {
+      return (0, import_core.setApiResponse)(import_core.HTTP.FORBIDDEN, "FORBIDDEN", "Insufficient role");
+    }
+    return next();
+  };
+}
+function requireRole(roleName, store, ctx, next) {
+  const handler = makeHandler(roleName, store);
+  if (ctx !== void 0 && next !== void 0) return handler(ctx, next);
+  return handler;
+}
+
+// src/middlewares/require-permission.ts
+var import_core2 = require("@fonderie/core");
+function makeHandler2(operation, permissionKey) {
+  return async (ctx, next) => {
+    if (!ctx.user) {
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+    }
+    const engine = ctx.meta[PERMISSIONS_ENGINE_KEY];
+    if (!(engine instanceof PermissionsEngine)) {
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.SERVER_ERROR, "SERVER_ERROR", "Permissions module not installed");
+    }
+    const workspaceId = resolveWorkspaceId(ctx);
+    if (!workspaceId) {
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
+    }
+    const allowed = await engine.can(ctx.user.id, operation, permissionKey, workspaceId);
+    if (!allowed) {
+      return (0, import_core2.setApiResponse)(
+        import_core2.HTTP.FORBIDDEN,
+        "FORBIDDEN",
+        `Permission denied: ${operation}:${permissionKey}`
+      );
+    }
+    return next();
+  };
+}
+function requirePermission(operation, permissionKey, ctx, next) {
+  const handler = makeHandler2(operation, permissionKey);
+  if (ctx !== void 0 && next !== void 0) return handler(ctx, next);
+  return handler;
+}
+function resolveWorkspaceId(ctx) {
+  if (ctx.workspace?.id) return ctx.workspace.id;
+  const params = ctx.meta["params"];
+  return params?.["workspaceId"] ?? null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OPERATIONS,
+  PERMISSION_COLUMN,
+  PermissionDeniedError,
+  PermissionsEngine,
+  PermissionsModule,
+  requirePermission,
+  requireRole
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/services/membership.ts","../src/constants.ts","../src/services/permissions.ts","../src/engine.ts","../src/module.ts","../src/middlewares/require-role.ts","../src/middlewares/require-permission.ts"],"sourcesContent":["export type {\n\tOperation,\n\tPermissionKey,\n\tIRole,\n\tIPermission,\n\tIMembership,\n\tIRoleWithPermissions,\n} from './types';\nexport { PermissionsModule } from './module';\nexport { PermissionsEngine, PermissionDeniedError } from './engine';\nexport type { IPermissionsConfig } from './config';\n\nexport { OPERATIONS, PERMISSION_COLUMN } from './constants';\nexport { requireRole } from './middlewares/require-role';\nexport { requirePermission } from './middlewares/require-permission';\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IMembership } from '../types';\n\nexport async function getMembership(\n\tuserId: string,\n\tworkspaceId: string,\n\tstore: IStoreAdapter,\n): Promise<IMembership | null> {\n\tconst [row] = await store.query<{\n\t\tuser_id: string;\n\t\tworkspace_id: string;\n\t\trole_id: string;\n\t\trole_name: string;\n\t}>(\n\t\t`SELECT ruw.user_id, ruw.workspace_id, ruw.role_id, r.name AS role_name\n\t\t FROM fonderie_role_user_workspaces ruw\n\t\t JOIN fonderie_roles r ON r.id = ruw.role_id\n\t\t WHERE ruw.user_id      = $1\n\t\t   AND ruw.workspace_id = $2\n\t\t   AND ruw.removed    = false\n\t\t   AND ruw.suspended  = false\n\t\t LIMIT 1`,\n\t\t[userId, workspaceId],\n\t);\n\n\tif (!row) return null;\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tworkspaceId: row.workspace_id,\n\t\troleId: row.role_id,\n\t\troleName: row.role_name,\n\t};\n}\n\nexport async function hasRole(\n\tuserId: string,\n\tworkspaceId: string,\n\troleName: string,\n\tstore: IStoreAdapter,\n): Promise<boolean> {\n\tconst [row] = await store.query<{ exists: boolean }>(\n\t\t`SELECT EXISTS (\n\t\t   SELECT 1\n\t\t   FROM fonderie_role_user_workspaces ruw\n\t\t   JOIN fonderie_roles r ON r.id = ruw.role_id\n\t\t   WHERE ruw.user_id      = $1\n\t\t     AND ruw.workspace_id = $2\n\t\t     AND r.name           = $3\n\t\t     AND ruw.removed    = false\n\t\t     AND ruw.suspended  = false\n\t\t ) AS exists`,\n\t\t[userId, workspaceId, roleName],\n\t);\n\n\treturn row?.exists ?? false;\n}\n","import type { Operation } from './types';\n\nexport const OPERATIONS = {\n\tCREATE: 'create',\n\tREAD: 'read',\n\tUPDATE: 'update',\n\tDELETE: 'delete',\n} as const satisfies Record<string, Operation>;\n\nexport const PERMISSION_COLUMN: Record<Operation, string> = {\n\tcreate: 'can_create',\n\tread: 'can_read',\n\tupdate: 'can_update',\n\tdelete: 'can_delete',\n};\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { Operation } from '../types';\nimport { PERMISSION_COLUMN } from '../constants';\n\nexport async function checkPermission(\n\tuserId: string,\n\tworkspaceId: string,\n\tpermissionKey: string,\n\toperation: Operation,\n\tstore: IStoreAdapter,\n): Promise<boolean> {\n\tconst col = PERMISSION_COLUMN[operation];\n\n\tconst [row] = await store.query<{ has_permission: boolean }>(\n\t\t`SELECT BOOL_OR(rp.${col}) AS has_permission\n\t\t FROM fonderie_role_user_workspaces ruw\n\t\t JOIN fonderie_roles r ON ruw.role_id = r.id\n\t\t JOIN fonderie_role_permissions rp ON r.id = rp.role_id\n\t\t WHERE ruw.user_id      = $1\n\t\t   AND ruw.workspace_id = $2\n\t\t   AND rp.workspace_id  = $2\n\t\t   AND rp.permission_key = $3\n\t\t   AND ruw.removed    = false\n\t\t   AND ruw.suspended  = false\n\t\t   AND (r.workspace_id = $2 OR r.is_system = true)\n\t\t GROUP BY ruw.user_id, ruw.workspace_id`,\n\t\t[userId, workspaceId, permissionKey],\n\t);\n\n\treturn row?.has_permission ?? false;\n}\n","import type { IStoreAdapter } from '@fonderie/store';\n\nimport type { Operation } from './types';\nimport type { IPermissionsConfig } from './config';\nimport { getMembership, hasRole } from './services/membership';\nimport { checkPermission } from './services/permissions';\n\nexport class PermissionsEngine {\n\tprivate superRole: string;\n\n\tconstructor(\n\t\tprivate store: IStoreAdapter,\n\t\tconfig: IPermissionsConfig = {},\n\t) {\n\t\tthis.superRole = config.superRole ?? 'owner';\n\t}\n\n\tasync getMembership(userId: string, workspaceId: string) {\n\t\treturn getMembership(userId, workspaceId, this.store);\n\t}\n\n\tasync can(\n\t\tuserId: string,\n\t\toperation: Operation,\n\t\tpermissionKey: string,\n\t\tworkspaceId: string,\n\t): Promise<boolean> {\n\t\tconst isMember = await getMembership(userId, workspaceId, this.store);\n\t\tif (!isMember) return false;\n\n\t\tif (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;\n\n\t\treturn checkPermission(userId, workspaceId, permissionKey, operation, this.store);\n\t}\n\n\tasync assert(\n\t\tuserId: string,\n\t\toperation: Operation,\n\t\tpermissionKey: string,\n\t\tworkspaceId: string,\n\t): Promise<void> {\n\t\tconst allowed = await this.can(userId, operation, permissionKey, workspaceId);\n\t\tif (!allowed) {\n\t\t\tthrow new PermissionDeniedError(operation, permissionKey);\n\t\t}\n\t}\n\n\tasync canAll(\n\t\tuserId: string,\n\t\tchecks: Array<{ operation: Operation; permissionKey: string }>,\n\t\tworkspaceId: string,\n\t): Promise<boolean> {\n\t\tconst isMember = await getMembership(userId, workspaceId, this.store);\n\t\tif (!isMember) return false;\n\n\t\tif (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;\n\n\t\tconst results = await Promise.all(\n\t\t\tchecks.map((c) =>\n\t\t\t\tcheckPermission(userId, workspaceId, c.permissionKey, c.operation, this.store),\n\t\t\t),\n\t\t);\n\t\treturn results.every(Boolean);\n\t}\n\n\tasync canAny(\n\t\tuserId: string,\n\t\tchecks: Array<{ operation: Operation; permissionKey: string }>,\n\t\tworkspaceId: string,\n\t): Promise<boolean> {\n\t\tconst isMember = await getMembership(userId, workspaceId, this.store);\n\t\tif (!isMember) return false;\n\n\t\tif (await hasRole(userId, workspaceId, this.superRole, this.store)) return true;\n\n\t\tconst results = await Promise.all(\n\t\t\tchecks.map((c) =>\n\t\t\t\tcheckPermission(userId, workspaceId, c.permissionKey, c.operation, this.store),\n\t\t\t),\n\t\t);\n\t\treturn results.some(Boolean);\n\t}\n}\n\nexport class PermissionDeniedError extends Error {\n\treadonly status = 403;\n\n\tconstructor(operation: string, permissionKey: string) {\n\t\tsuper(`Permission denied: ${operation}:${permissionKey}`);\n\t\tthis.name = 'PermissionDeniedError';\n\t}\n}\n","import type { IFonderieModule, IFonderieApp } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport type { IPermissionsConfig } from './config';\nimport { PermissionsEngine } from './engine';\n\nexport const PERMISSIONS_ENGINE_KEY = 'fonderie.permissions.engine';\n\nexport class PermissionsModule implements IFonderieModule {\n\treadonly engine: PermissionsEngine;\n\treadonly name = '@fonderie/permissions';\n\treadonly deps = ['@fonderie/auth'];\n\n\tconstructor(store: IStoreAdapter, config: IPermissionsConfig = {}) {\n\t\tthis.engine = new PermissionsEngine(store, config);\n\t}\n\n\tinstall(app: IFonderieApp): void {\n\t\tconst engine = this.engine;\n\n\t\t// Inject engine into every request context\n\t\t// requirePermission() reads it from here — no manual passing needed\n\t\tapp.use(async (ctx, next) => {\n\t\t\tctx.meta[PERMISSIONS_ENGINE_KEY] = engine;\n\t\t\treturn next();\n\t\t});\n\t}\n}\n","import { setApiResponse, HTTP } from '@fonderie/core';\nimport type { Middleware } from '@fonderie/core';\nimport type { IFonderieContext } from '@fonderie/core';\nimport type { IStoreAdapter } from '@fonderie/store';\n\nimport { PermissionsEngine } from '../engine';\nimport { PERMISSIONS_ENGINE_KEY } from '../module';\nimport { getMembership } from '../services/membership';\n\nfunction makeHandler(roleName: string | string[], store: IStoreAdapter): Middleware {\n\tconst allowed = Array.isArray(roleName) ? roleName : [roleName];\n\n\treturn async (ctx, next) => {\n\t\tif (!ctx.user) {\n\t\t\treturn setApiResponse(HTTP.UNAUTHORIZED, 'UNAUTHORIZED', 'Unauthorized');\n\t\t}\n\n\t\tconst engine = ctx.meta[PERMISSIONS_ENGINE_KEY];\n\t\tif (!(engine instanceof PermissionsEngine)) {\n\t\t\treturn setApiResponse(HTTP.SERVER_ERROR, 'SERVER_ERROR', 'Permissions module not installed');\n\t\t}\n\n\t\tconst workspaceId =\n\t\t\tctx.workspace?.id ??\n\t\t\t(ctx.meta['params'] as Record<string, string> | undefined)?.['workspaceId'];\n\n\t\tif (!workspaceId) {\n\t\t\treturn setApiResponse(HTTP.BAD_REQUEST, 'WORKSPACE_REQUIRED', 'Workspace context required');\n\t\t}\n\n\t\tconst membership = await getMembership(ctx.user.id, workspaceId, store);\n\t\tif (!membership || !allowed.includes(membership.roleName)) {\n\t\t\treturn setApiResponse(HTTP.FORBIDDEN, 'FORBIDDEN', 'Insufficient role');\n\t\t}\n\n\t\treturn next();\n\t};\n}\n\nexport function requireRole(roleName: string | string[], store: IStoreAdapter): Middleware;\nexport function requireRole(\n\troleName: string | string[],\n\tstore: IStoreAdapter,\n\tctx: IFonderieContext,\n\tnext: () => Promise<Response>,\n): Promise<Response>;\nexport function requireRole(\n\troleName: string | string[],\n\tstore: IStoreAdapter,\n\tctx?: IFonderieContext,\n\tnext?: () => Promise<Response>,\n): Middleware | Promise<Response> {\n\tconst handler = makeHandler(roleName, store);\n\tif (ctx !== undefined && next !== undefined) return handler(ctx, next);\n\treturn handler;\n}\n","import { setApiResponse, HTTP } from '@fonderie/core';\nimport type { Middleware } from '@fonderie/core';\nimport type { IFonderieContext } from '@fonderie/core';\n\nimport type { Operation } from '../types';\nimport { PermissionsEngine } from '../engine';\nimport { PERMISSIONS_ENGINE_KEY } from '../module';\n\nfunction makeHandler(operation: Operation, permissionKey: string): Middleware {\n\treturn async (ctx, next) => {\n\t\tif (!ctx.user) {\n\t\t\treturn setApiResponse(HTTP.UNAUTHORIZED, 'UNAUTHORIZED', 'Unauthorized');\n\t\t}\n\n\t\tconst engine = ctx.meta[PERMISSIONS_ENGINE_KEY];\n\t\tif (!(engine instanceof PermissionsEngine)) {\n\t\t\treturn setApiResponse(HTTP.SERVER_ERROR, 'SERVER_ERROR', 'Permissions module not installed');\n\t\t}\n\n\t\tconst workspaceId = resolveWorkspaceId(ctx);\n\t\tif (!workspaceId) {\n\t\t\treturn setApiResponse(HTTP.BAD_REQUEST, 'WORKSPACE_REQUIRED', 'Workspace context required');\n\t\t}\n\n\t\tconst allowed = await engine.can(ctx.user.id, operation, permissionKey, workspaceId);\n\t\tif (!allowed) {\n\t\t\treturn setApiResponse(\n\t\t\t\tHTTP.FORBIDDEN,\n\t\t\t\t'FORBIDDEN',\n\t\t\t\t`Permission denied: ${operation}:${permissionKey}`,\n\t\t\t);\n\t\t}\n\n\t\treturn next();\n\t};\n}\n\nexport function requirePermission(operation: Operation, permissionKey: string): Middleware;\nexport function requirePermission(\n\toperation: Operation,\n\tpermissionKey: string,\n\tctx: IFonderieContext,\n\tnext: () => Promise<Response>,\n): Promise<Response>;\nexport function requirePermission(\n\toperation: Operation,\n\tpermissionKey: string,\n\tctx?: IFonderieContext,\n\tnext?: () => Promise<Response>,\n): Middleware | Promise<Response> {\n\tconst handler = makeHandler(operation, permissionKey);\n\tif (ctx !== undefined && next !== undefined) return handler(ctx, next);\n\treturn handler;\n}\n\nfunction resolveWorkspaceId(ctx: {\n\tworkspace?: { id: string } | null;\n\tmeta: Record<string, unknown>;\n}): string | null {\n\tif (ctx.workspace?.id) return ctx.workspace.id;\n\n\tconst params = ctx.meta['params'] as Record<string, string> | undefined;\n\treturn params?.['workspaceId'] ?? null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIA,eAAsB,cACrB,QACA,aACA,OAC8B;AAC9B,QAAM,CAAC,GAAG,IAAI,MAAM,MAAM;AAAA,IAMzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,CAAC,QAAQ,WAAW;AAAA,EACrB;AAEA,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO;AAAA,IACN,QAAQ,IAAI;AAAA,IACZ,aAAa,IAAI;AAAA,IACjB,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,EACf;AACD;AAEA,eAAsB,QACrB,QACA,aACA,UACA,OACmB;AACnB,QAAM,CAAC,GAAG,IAAI,MAAM,MAAM;AAAA,IACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,CAAC,QAAQ,aAAa,QAAQ;AAAA,EAC/B;AAEA,SAAO,KAAK,UAAU;AACvB;;;ACvDO,IAAM,aAAa;AAAA,EACzB,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;AAEO,IAAM,oBAA+C;AAAA,EAC3D,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACT;;;ACTA,eAAsB,gBACrB,QACA,aACA,eACA,WACA,OACmB;AACnB,QAAM,MAAM,kBAAkB,SAAS;AAEvC,QAAM,CAAC,GAAG,IAAI,MAAM,MAAM;AAAA,IACzB,qBAAqB,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxB,CAAC,QAAQ,aAAa,aAAa;AAAA,EACpC;AAEA,SAAO,KAAK,kBAAkB;AAC/B;;;ACxBO,IAAM,oBAAN,MAAwB;AAAA,EAG9B,YACS,OACR,SAA6B,CAAC,GAC7B;AAFO;AAGR,SAAK,YAAY,OAAO,aAAa;AAAA,EACtC;AAAA,EAJS;AAAA,EAHD;AAAA,EASR,MAAM,cAAc,QAAgB,aAAqB;AACxD,WAAO,cAAc,QAAQ,aAAa,KAAK,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,IACL,QACA,WACA,eACA,aACmB;AACnB,UAAM,WAAW,MAAM,cAAc,QAAQ,aAAa,KAAK,KAAK;AACpE,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,MAAM,QAAQ,QAAQ,aAAa,KAAK,WAAW,KAAK,KAAK,EAAG,QAAO;AAE3E,WAAO,gBAAgB,QAAQ,aAAa,eAAe,WAAW,KAAK,KAAK;AAAA,EACjF;AAAA,EAEA,MAAM,OACL,QACA,WACA,eACA,aACgB;AAChB,UAAM,UAAU,MAAM,KAAK,IAAI,QAAQ,WAAW,eAAe,WAAW;AAC5E,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,sBAAsB,WAAW,aAAa;AAAA,IACzD;AAAA,EACD;AAAA,EAEA,MAAM,OACL,QACA,QACA,aACmB;AACnB,UAAM,WAAW,MAAM,cAAc,QAAQ,aAAa,KAAK,KAAK;AACpE,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,MAAM,QAAQ,QAAQ,aAAa,KAAK,WAAW,KAAK,KAAK,EAAG,QAAO;AAE3E,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC7B,OAAO;AAAA,QAAI,CAAC,MACX,gBAAgB,QAAQ,aAAa,EAAE,eAAe,EAAE,WAAW,KAAK,KAAK;AAAA,MAC9E;AAAA,IACD;AACA,WAAO,QAAQ,MAAM,OAAO;AAAA,EAC7B;AAAA,EAEA,MAAM,OACL,QACA,QACA,aACmB;AACnB,UAAM,WAAW,MAAM,cAAc,QAAQ,aAAa,KAAK,KAAK;AACpE,QAAI,CAAC,SAAU,QAAO;AAEtB,QAAI,MAAM,QAAQ,QAAQ,aAAa,KAAK,WAAW,KAAK,KAAK,EAAG,QAAO;AAE3E,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC7B,OAAO;AAAA,QAAI,CAAC,MACX,gBAAgB,QAAQ,aAAa,EAAE,eAAe,EAAE,WAAW,KAAK,KAAK;AAAA,MAC9E;AAAA,IACD;AACA,WAAO,QAAQ,KAAK,OAAO;AAAA,EAC5B;AACD;AAEO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EACvC,SAAS;AAAA,EAElB,YAAY,WAAmB,eAAuB;AACrD,UAAM,sBAAsB,SAAS,IAAI,aAAa,EAAE;AACxD,SAAK,OAAO;AAAA,EACb;AACD;;;ACrFO,IAAM,yBAAyB;AAE/B,IAAM,oBAAN,MAAmD;AAAA,EAChD;AAAA,EACA,OAAO;AAAA,EACP,OAAO,CAAC,gBAAgB;AAAA,EAEjC,YAAY,OAAsB,SAA6B,CAAC,GAAG;AAClE,SAAK,SAAS,IAAI,kBAAkB,OAAO,MAAM;AAAA,EAClD;AAAA,EAEA,QAAQ,KAAyB;AAChC,UAAM,SAAS,KAAK;AAIpB,QAAI,IAAI,OAAO,KAAK,SAAS;AAC5B,UAAI,KAAK,sBAAsB,IAAI;AACnC,aAAO,KAAK;AAAA,IACb,CAAC;AAAA,EACF;AACD;;;AC3BA,kBAAqC;AASrC,SAAS,YAAY,UAA6B,OAAkC;AACnF,QAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAE9D,SAAO,OAAO,KAAK,SAAS;AAC3B,QAAI,CAAC,IAAI,MAAM;AACd,iBAAO,4BAAe,iBAAK,cAAc,gBAAgB,cAAc;AAAA,IACxE;AAEA,UAAM,SAAS,IAAI,KAAK,sBAAsB;AAC9C,QAAI,EAAE,kBAAkB,oBAAoB;AAC3C,iBAAO,4BAAe,iBAAK,cAAc,gBAAgB,kCAAkC;AAAA,IAC5F;AAEA,UAAM,cACL,IAAI,WAAW,MACd,IAAI,KAAK,QAAQ,IAA2C,aAAa;AAE3E,QAAI,CAAC,aAAa;AACjB,iBAAO,4BAAe,iBAAK,aAAa,sBAAsB,4BAA4B;AAAA,IAC3F;AAEA,UAAM,aAAa,MAAM,cAAc,IAAI,KAAK,IAAI,aAAa,KAAK;AACtE,QAAI,CAAC,cAAc,CAAC,QAAQ,SAAS,WAAW,QAAQ,GAAG;AAC1D,iBAAO,4BAAe,iBAAK,WAAW,aAAa,mBAAmB;AAAA,IACvE;AAEA,WAAO,KAAK;AAAA,EACb;AACD;AASO,SAAS,YACf,UACA,OACA,KACA,MACiC;AACjC,QAAM,UAAU,YAAY,UAAU,KAAK;AAC3C,MAAI,QAAQ,UAAa,SAAS,OAAW,QAAO,QAAQ,KAAK,IAAI;AACrE,SAAO;AACR;;;ACvDA,IAAAA,eAAqC;AAQrC,SAASC,aAAY,WAAsB,eAAmC;AAC7E,SAAO,OAAO,KAAK,SAAS;AAC3B,QAAI,CAAC,IAAI,MAAM;AACd,iBAAO,6BAAe,kBAAK,cAAc,gBAAgB,cAAc;AAAA,IACxE;AAEA,UAAM,SAAS,IAAI,KAAK,sBAAsB;AAC9C,QAAI,EAAE,kBAAkB,oBAAoB;AAC3C,iBAAO,6BAAe,kBAAK,cAAc,gBAAgB,kCAAkC;AAAA,IAC5F;AAEA,UAAM,cAAc,mBAAmB,GAAG;AAC1C,QAAI,CAAC,aAAa;AACjB,iBAAO,6BAAe,kBAAK,aAAa,sBAAsB,4BAA4B;AAAA,IAC3F;AAEA,UAAM,UAAU,MAAM,OAAO,IAAI,IAAI,KAAK,IAAI,WAAW,eAAe,WAAW;AACnF,QAAI,CAAC,SAAS;AACb,iBAAO;AAAA,QACN,kBAAK;AAAA,QACL;AAAA,QACA,sBAAsB,SAAS,IAAI,aAAa;AAAA,MACjD;AAAA,IACD;AAEA,WAAO,KAAK;AAAA,EACb;AACD;AASO,SAAS,kBACf,WACA,eACA,KACA,MACiC;AACjC,QAAM,UAAUA,aAAY,WAAW,aAAa;AACpD,MAAI,QAAQ,UAAa,SAAS,OAAW,QAAO,QAAQ,KAAK,IAAI;AACrE,SAAO;AACR;AAEA,SAAS,mBAAmB,KAGV;AACjB,MAAI,IAAI,WAAW,GAAI,QAAO,IAAI,UAAU;AAE5C,QAAM,SAAS,IAAI,KAAK,QAAQ;AAChC,SAAO,SAAS,aAAa,KAAK;AACnC;","names":["import_core","makeHandler"]}

package/dist/index.d.cts

@@ -0,0 +1,45 @@
+import { IMembership, Operation } from './types.cjs';
+export { IPermission, IRole, IRoleWithPermissions, PermissionKey } from './types.cjs';
+import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IStoreAdapter } from '@fonderie/store';
+import { IPermissionsConfig } from './config.cjs';
+export { requirePermission, requireRole } from './middlewares/index.cjs';
+
+declare class PermissionsEngine {
+    private store;
+    private superRole;
+    constructor(store: IStoreAdapter, config?: IPermissionsConfig);
+    getMembership(userId: string, workspaceId: string): Promise<IMembership | null>;
+    can(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<boolean>;
+    assert(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<void>;
+    canAll(userId: string, checks: Array<{
+        operation: Operation;
+        permissionKey: string;
+    }>, workspaceId: string): Promise<boolean>;
+    canAny(userId: string, checks: Array<{
+        operation: Operation;
+        permissionKey: string;
+    }>, workspaceId: string): Promise<boolean>;
+}
+declare class PermissionDeniedError extends Error {
+    readonly status = 403;
+    constructor(operation: string, permissionKey: string);
+}
+
+declare class PermissionsModule implements IFonderieModule {
+    readonly engine: PermissionsEngine;
+    readonly name = "@fonderie/permissions";
+    readonly deps: string[];
+    constructor(store: IStoreAdapter, config?: IPermissionsConfig);
+    install(app: IFonderieApp): void;
+}
+
+declare const OPERATIONS: {
+    readonly CREATE: "create";
+    readonly READ: "read";
+    readonly UPDATE: "update";
+    readonly DELETE: "delete";
+};
+declare const PERMISSION_COLUMN: Record<Operation, string>;
+
+export { IMembership, IPermissionsConfig, OPERATIONS, Operation, PERMISSION_COLUMN, PermissionDeniedError, PermissionsEngine, PermissionsModule };

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+import { IMembership, Operation } from './types.js';
+export { IPermission, IRole, IRoleWithPermissions, PermissionKey } from './types.js';
+import { IFonderieModule, IFonderieApp } from '@fonderie/core';
+import { IStoreAdapter } from '@fonderie/store';
+import { IPermissionsConfig } from './config.js';
+export { requirePermission, requireRole } from './middlewares/index.js';
+
+declare class PermissionsEngine {
+    private store;
+    private superRole;
+    constructor(store: IStoreAdapter, config?: IPermissionsConfig);
+    getMembership(userId: string, workspaceId: string): Promise<IMembership | null>;
+    can(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<boolean>;
+    assert(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<void>;
+    canAll(userId: string, checks: Array<{
+        operation: Operation;
+        permissionKey: string;
+    }>, workspaceId: string): Promise<boolean>;
+    canAny(userId: string, checks: Array<{
+        operation: Operation;
+        permissionKey: string;
+    }>, workspaceId: string): Promise<boolean>;
+}
+declare class PermissionDeniedError extends Error {
+    readonly status = 403;
+    constructor(operation: string, permissionKey: string);
+}
+
+declare class PermissionsModule implements IFonderieModule {
+    readonly engine: PermissionsEngine;
+    readonly name = "@fonderie/permissions";
+    readonly deps: string[];
+    constructor(store: IStoreAdapter, config?: IPermissionsConfig);
+    install(app: IFonderieApp): void;
+}
+
+declare const OPERATIONS: {
+    readonly CREATE: "create";
+    readonly READ: "read";
+    readonly UPDATE: "update";
+    readonly DELETE: "delete";
+};
+declare const PERMISSION_COLUMN: Record<Operation, string>;
+
+export { IMembership, IPermissionsConfig, OPERATIONS, Operation, PERMISSION_COLUMN, PermissionDeniedError, PermissionsEngine, PermissionsModule };