@frigear-nu/authorization 0.0.5 → 0.0.7

package/README.md

@@ -8,4 +8,4 @@ current user is injected by a client/server resolver, and check with `authorize`
 - Route rules as keys on Nuxt's native `routeRules` (`roles`, `ability`, `guest`, `authenticated`) and per page (`definePageMeta({ authorize })`).
 - Overridable user resolvers (`authorization.resolvers.server` / `.client`).
 
-See the [documentation](../../apps/docs/content/4.modules/11.authorization.md) for usage.
+See the [documentation](../../apps/docs/content/4.modules/04.authorization.md) for usage.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@frigear-nu/authorization",
   "configKey": "authorization",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { defineNuxtModule, createResolver, addServerTemplate, addTemplate, addTypeTemplate, addImports, addServerImports, addComponentsDir, addServerImportsDir, addRouteMiddleware, addServerHandler } from '@nuxt/kit';
-import { registerModule, extendDatabaseTable } from '@frigear-nu/module-kit/utils';
+import { registerModule, extendDatabaseTable, inlineModuleRuntime } from '@frigear-nu/module-kit/utils';
 import { ROUTE_RULE_KEYS } from '../dist/runtime/utils/types.js';
 
 const module$1 = defineNuxtModule({
@@ -16,6 +16,9 @@ const module$1 = defineNuxtModule({
     "@frigear-nu/module-kit": {
       version: ">=0.0.1"
     },
+    "@frigear-nu/auth": {
+      version: ">=0.0.1"
+    },
     "@frigear-nu/users": {
       version: ">=0.0.1"
     }
@@ -106,6 +109,7 @@ export {}
     })));
     addComponentsDir({ path: resolver.resolve("./runtime/app/components") });
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
+    inlineModuleRuntime(nuxt, resolver);
     addRouteMiddleware({
       name: "authorization",
       path: resolver.resolve("./runtime/app/middleware/authorization.global"),

package/dist/runtime/server/resolver.js

@@ -1,4 +1,4 @@
 export default async function resolveServerUser(event) {
-  const session = await getUserSession(event);
-  return session.user ?? null;
+  const auth = await getAuth(event);
+  return auth?.user ?? null;
 }

package/dist/runtime/utils/index.d.ts

@@ -3,3 +3,4 @@ export * from './error.js';
 export * from './ability.js';
 export * from './bouncer.js';
 export * from './rules.js';
+export * from './roles.js';

package/dist/runtime/utils/index.js

@@ -3,3 +3,4 @@ export * from "./error.js";
 export * from "./ability.js";
 export * from "./bouncer.js";
 export * from "./rules.js";
+export * from "./roles.js";

package/dist/runtime/utils/roles.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Role hierarchy helpers. A hierarchy is an array of role names **from highest to lowest** rank, e.g.
+ * `['admin', 'manager', 'member', 'user']`. Unknown roles never outrank (or equal) anything.
+ */
+export type RoleHierarchy = readonly string[];
+/** Whether `source` ranks strictly above `target`. */
+export declare function roleIsHigher(roles: RoleHierarchy, source: string | null | undefined, target: string | null | undefined): boolean;
+/** Whether `source` ranks above or equal to `target`. */
+export declare function roleIsHigherOrEqual(roles: RoleHierarchy, source: string | null | undefined, target: string | null | undefined): boolean;
+/**
+ * Whether `actor` may assign (or change) the role `target`: only roles strictly below their own, unless the actor's
+ * own role is listed in `equalAllowedFor` (e.g. `['admin']`, so admins can create other admins).
+ */
+export declare function canManageRole(roles: RoleHierarchy, actor: string | null | undefined, target: string | null | undefined, { equalAllowedFor }?: {
+    equalAllowedFor?: readonly string[];
+}): boolean;

package/dist/runtime/utils/roles.js

@@ -0,0 +1,12 @@
+export function roleIsHigher(roles, source, target) {
+  if (!source || !target || !roles.includes(source) || !roles.includes(target)) return false;
+  return roles.indexOf(source) < roles.indexOf(target);
+}
+export function roleIsHigherOrEqual(roles, source, target) {
+  if (!source || !target || !roles.includes(source) || !roles.includes(target)) return false;
+  return roles.indexOf(source) <= roles.indexOf(target);
+}
+export function canManageRole(roles, actor, target, { equalAllowedFor = [] } = {}) {
+  if (roleIsHigher(roles, actor, target)) return true;
+  return !!actor && actor === target && equalAllowedFor.includes(actor) && roles.includes(actor);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frigear-nu/authorization",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Policy-based authorization (abilities, resolvers, route rules, <Can>) for the frigear ecosystem, built on @frigear-nu/users.",
   "homepage": "https://docs.frigear.dev/modules/authorization",
   "repository": {
@@ -30,8 +30,9 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/module-kit": "0.1.6",
-    "@frigear-nu/users": "1.0.8",
+    "@frigear-nu/module-kit": "1.0.0",
+    "@frigear-nu/auth": "0.0.4",
+    "@frigear-nu/users": "1.0.10",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.0",
     "drizzle-kit": "^0.31.11",