@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/authorities/authorities.context.mjs

@@ -0,0 +1,115 @@
+// libs/auth/src/authorities/authorities.context.ts
+import { getEnv } from "@frontmcp/utils";
+function resolveDotPath(obj, path) {
+  if (path in obj) {
+    return obj[path];
+  }
+  const segments = path.split(".");
+  let current = obj;
+  for (const segment of segments) {
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var noopRelationshipResolver = {
+  async check() {
+    return false;
+  }
+};
+function resolveAuthUser(authInfo) {
+  const extraUser = authInfo?.extra?.["user"];
+  if (authInfo?.user) return authInfo.user;
+  return typeof extraUser === "object" && extraUser !== null ? extraUser : {};
+}
+function isAnonymousSubject(sub) {
+  return typeof sub !== "string" || sub === "" || sub.startsWith("anon:");
+}
+function signedInSubject(rawSub, mappedSub) {
+  if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
+  return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
+}
+var runtimeEnv = new Proxy(
+  {},
+  { get: (_target, name) => typeof name === "string" ? getEnv(name) : void 0 }
+);
+var AuthoritiesContextBuilder = class {
+  claimsMapping;
+  claimsResolver;
+  relationshipResolver;
+  constructor(options = {}) {
+    this.claimsMapping = options.claimsMapping;
+    this.claimsResolver = options.claimsResolver;
+    this.relationshipResolver = options.relationshipResolver ?? noopRelationshipResolver;
+  }
+  /**
+   * Build an evaluation context from AuthInfo and tool input.
+   */
+  build(authInfo, input = {}, env = runtimeEnv) {
+    if (this.claimsResolver) {
+      const resolved = this.claimsResolver(authInfo);
+      return {
+        user: {
+          sub: signedInSubject(resolveAuthUser(authInfo).sub),
+          roles: resolved.roles,
+          permissions: resolved.permissions,
+          claims: resolved.claims
+        },
+        input,
+        env,
+        relationships: this.relationshipResolver
+      };
+    }
+    const user = resolveAuthUser(authInfo);
+    const authorization = authInfo?.extra?.["authorization"];
+    const authorizationClaims = authorization?.["claims"] ?? {};
+    const rawClaims = {
+      ...authorizationClaims,
+      ...user
+    };
+    let roles;
+    if (this.claimsMapping?.roles) {
+      roles = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.roles));
+    } else {
+      roles = toStringArray(
+        user["roles"] ?? authorization?.["scopes"] ?? []
+      );
+    }
+    let permissions;
+    if (this.claimsMapping?.permissions) {
+      permissions = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.permissions));
+    } else {
+      permissions = toStringArray(user["permissions"] ?? []);
+    }
+    const mappedSub = this.claimsMapping?.userId ? resolveDotPath(rawClaims, this.claimsMapping.userId) : void 0;
+    return {
+      user: {
+        sub: signedInSubject(user.sub, mappedSub),
+        roles,
+        permissions,
+        claims: rawClaims
+      },
+      input,
+      env,
+      relationships: this.relationshipResolver
+    };
+  }
+};
+export {
+  AuthoritiesContextBuilder,
+  isAnonymousSubject,
+  resolveAuthUser,
+  resolveDotPath,
+  signedInSubject
+};

package/browser/authorities/authorities.engine.mjs

@@ -0,0 +1,272 @@
+// libs/auth/src/authorities/authorities.engine.ts
+import { evaluateAbac, evaluateRbacPermissions, evaluateRbacRoles, evaluateRebac } from "./authorities.evaluator.mjs";
+import { findAuthoritiesProfileProblems, findAuthoritiesRuleProblems } from "./authorities.validation.mjs";
+function mergeResult(base, ...others) {
+  const evaluatedPolicies = [...base.evaluatedPolicies];
+  for (const other of others) {
+    evaluatedPolicies.push(...other.evaluatedPolicies);
+  }
+  return { ...base, evaluatedPolicies };
+}
+function invalidRule(problems, policies = []) {
+  return {
+    granted: false,
+    deniedBy: `invalid authorities rule: ${problems.join("; ")}`,
+    evaluatedPolicies: policies
+  };
+}
+var AuthoritiesEngine = class {
+  constructor(profiles, evaluators) {
+    this.profiles = profiles;
+    this.evaluators = evaluators;
+  }
+  profiles;
+  evaluators;
+  /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
+  ruleProblems = /* @__PURE__ */ new WeakMap();
+  /**
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '\u2026' is not registered`).
+   */
+  findRuleProblems(authorities) {
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
+  }
+  /**
+   * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
+   * The server reports them when it starts.
+   */
+  findProfileProblems() {
+    return Object.entries(this.profiles.getAll()).flatMap(
+      ([name, policy]) => findAuthoritiesProfileProblems(name, policy)
+    );
+  }
+  /**
+   * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+   *
+   * A value that is malformed or checks nothing (see {@link findAuthoritiesRuleProblems}) is denied.
+   */
+  async evaluate(authorities, ctx) {
+    const problems = this.problemsOf(authorities, findAuthoritiesRuleProblems);
+    if (problems.length > 0) return invalidRule(problems);
+    if (typeof authorities === "string") {
+      return this.evaluateProfile(authorities, ctx);
+    }
+    if (Array.isArray(authorities)) {
+      return this.evaluateProfileArray(authorities, ctx);
+    }
+    return this.evaluatePolicy(authorities, ctx);
+  }
+  /**
+   * Resolve and evaluate a single named profile.
+   */
+  async evaluateProfile(name, ctx) {
+    const policy = this.profiles.resolve(name);
+    if (!policy) {
+      return {
+        granted: false,
+        deniedBy: `profile '${name}' is not registered`,
+        evaluatedPolicies: [`profile:${name}`]
+      };
+    }
+    const problems = this.problemsOf(policy, (rule) => findAuthoritiesProfileProblems(name, rule));
+    if (problems.length > 0) return invalidRule(problems, [`profile:${name}`]);
+    const result = await this.evaluatePolicy(policy, ctx);
+    if (!result.granted) {
+      return {
+        ...result,
+        deniedBy: `profile:${name}: ${result.deniedBy}`,
+        evaluatedPolicies: [`profile:${name}`, ...result.evaluatedPolicies]
+      };
+    }
+    return mergeResult(result, { granted: true, evaluatedPolicies: [`profile:${name}`] });
+  }
+  /** Validate a rule, reusing the result for a rule object seen before. */
+  problemsOf(rule, find) {
+    if (typeof rule !== "object" || rule === null) return find(rule);
+    let problems = this.ruleProblems.get(rule);
+    if (!problems) {
+      problems = find(rule);
+      this.ruleProblems.set(rule, problems);
+    }
+    return problems;
+  }
+  /**
+   * Evaluate an array of profile names (AND semantics).
+   */
+  async evaluateProfileArray(names, ctx) {
+    const allPolicies = [];
+    for (const name of names) {
+      const result = await this.evaluateProfile(name, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate an inline policy object.
+   */
+  async evaluatePolicy(policy, ctx) {
+    const operator = policy.operator ?? "AND";
+    const results = [];
+    if (policy.roles) {
+      results.push(evaluateRbacRoles(policy.roles, ctx));
+    }
+    if (policy.permissions) {
+      results.push(evaluateRbacPermissions(policy.permissions, ctx));
+    }
+    if (policy.attributes) {
+      results.push(evaluateAbac(policy.attributes, ctx));
+    }
+    if (policy.relationships) {
+      results.push(await evaluateRebac(policy.relationships, ctx));
+    }
+    if (policy.custom) {
+      results.push(await this.evaluateCustom(policy.custom, ctx));
+    }
+    if (policy.guards && policy.guards.length > 0) {
+      results.push(await this.evaluateGuards(policy.guards, ctx));
+    }
+    if (policy.allOf) {
+      results.push(await this.evaluateAllOf(policy.allOf, ctx));
+    }
+    if (policy.anyOf) {
+      results.push(await this.evaluateAnyOf(policy.anyOf, ctx));
+    }
+    if (policy.not) {
+      results.push(await this.evaluateNot(policy.not, ctx));
+    }
+    if (results.length === 0) {
+      return invalidRule(["checks nothing"]);
+    }
+    return this.combineResults(results, operator);
+  }
+  /**
+   * Combine results with AND or OR semantics.
+   */
+  combineResults(results, operator) {
+    const allPolicies = results.flatMap((r) => r.evaluatedPolicies);
+    if (operator === "AND") {
+      const denied = results.find((r) => !r.granted);
+      if (denied) {
+        return { ...denied, evaluatedPolicies: allPolicies };
+      }
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const anyGranted = results.some((r) => r.granted);
+    if (anyGranted) {
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const firstDenied = results.find((r) => !r.granted);
+    return {
+      granted: false,
+      deniedBy: firstDenied?.deniedBy ?? "all policies denied (OR)",
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * Evaluate custom evaluators.
+   */
+  async evaluateCustom(custom, ctx) {
+    const allPolicies = [];
+    for (const [name, config] of Object.entries(custom)) {
+      const evaluator = this.evaluators.get(name);
+      if (!evaluator) {
+        return {
+          granted: false,
+          deniedBy: `custom evaluator '${name}' is not registered`,
+          evaluatedPolicies: [...allPolicies, `custom.${name}`]
+        };
+      }
+      const result = await evaluator.evaluate(config, ctx);
+      allPolicies.push(`custom.${name}`, ...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate async guard functions in sequence.
+   * Only `true` grants. A string is the denial message; anything else (`false`, but also
+   * `undefined` from a guard that forgot to return, `null`, `0` or an object) denies.
+   */
+  async evaluateGuards(guards, ctx) {
+    for (let i = 0; i < guards.length; i++) {
+      const guard = guards[i];
+      const result = await guard(ctx);
+      if (result !== true) {
+        const denialMessage = typeof result === "string" ? result : result === false ? `guard[${i}] denied` : `guard[${i}] did not return true (returned ${result === null ? "null" : typeof result})`;
+        return {
+          granted: false,
+          deniedBy: `guards[${i}]: ${denialMessage}`,
+          denial: { kind: "custom", path: `guards[${i}]` },
+          evaluatedPolicies: ["guards"]
+        };
+      }
+    }
+    return { granted: true, evaluatedPolicies: ["guards"] };
+  }
+  /**
+   * allOf combinator \u2014 all nested policies must pass.
+   */
+  async evaluateAllOf(policies, ctx) {
+    const allPolicies = ["allOf"];
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * anyOf combinator \u2014 at least one nested policy must pass.
+   */
+  async evaluateAnyOf(policies, ctx) {
+    const allPolicies = ["anyOf"];
+    let lastDenied;
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (result.granted) {
+        return { granted: true, evaluatedPolicies: allPolicies };
+      }
+      lastDenied = result;
+    }
+    return {
+      granted: false,
+      deniedBy: lastDenied?.deniedBy ?? "no policies in anyOf",
+      denial: lastDenied?.denial ?? { kind: "anyOf", path: "anyOf" },
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * not combinator \u2014 inverts the nested policy result.
+   */
+  async evaluateNot(policy, ctx) {
+    const result = await this.evaluatePolicy(policy, ctx);
+    return {
+      granted: !result.granted,
+      deniedBy: result.granted ? "not: inner policy was granted (negated to denied)" : void 0,
+      denial: result.granted ? { kind: "not", path: "not" } : void 0,
+      evaluatedPolicies: ["not", ...result.evaluatedPolicies]
+    };
+  }
+  /**
+   * The policy a profile name stands for when `evaluate()` is given that name, or `undefined`
+   * when no such profile is registered. Lets callers inspect a named rule without evaluating it.
+   */
+  resolveProfile(name) {
+    return this.profiles.resolve(name);
+  }
+};
+export {
+  AuthoritiesEngine
+};

package/browser/authorities/authorities.errors.mjs

@@ -0,0 +1,59 @@
+// libs/auth/src/authorities/authorities.errors.ts
+import { brandClass, isBrandedInstance } from "@frontmcp/utils";
+var FORBIDDEN_CODE = -32003;
+var AuthorityDeniedError = class extends Error {
+  /**
+   * `instanceof AuthorityDeniedError` also recognises a denial from another copy of this package in the
+   * process, so every copy of `@frontmcp/sdk` answers it as a FORBIDDEN error (#802).
+   */
+  static [Symbol.hasInstance](value) {
+    return isBrandedInstance(this, value);
+  }
+  /** MCP error code for JSON-RPC responses */
+  mcpErrorCode = FORBIDDEN_CODE;
+  /** HTTP status code equivalent */
+  statusCode = 403;
+  /** Error classification code */
+  code = "AUTHORITY_DENIED";
+  /** Entry type that was denied */
+  entryType;
+  /** Entry name that was denied */
+  entryName;
+  /** Policy that caused the denial */
+  deniedBy;
+  /** Structured denial data (machine-parsable) */
+  denial;
+  /** Required scopes for scope challenges */
+  requiredScopes;
+  constructor(params) {
+    const msg = params.message ?? `Access denied to ${params.entryType} "${params.entryName}": ${params.deniedBy}`;
+    super(msg);
+    this.name = "AuthorityDeniedError";
+    this.entryType = params.entryType;
+    this.entryName = params.entryName;
+    this.deniedBy = params.deniedBy;
+    this.denial = params.denial;
+    this.requiredScopes = params.requiredScopes;
+  }
+  /**
+   * Convert to JSON-RPC error format.
+   */
+  toJsonRpcError() {
+    const data = {
+      entryType: this.entryType,
+      entryName: this.entryName,
+      deniedBy: this.deniedBy
+    };
+    if (this.denial !== void 0) data["denial"] = this.denial;
+    if (this.requiredScopes !== void 0) data["requiredScopes"] = this.requiredScopes;
+    return {
+      code: this.mcpErrorCode,
+      message: this.message,
+      data
+    };
+  }
+};
+brandClass(AuthorityDeniedError, "@frontmcp/auth:AuthorityDeniedError");
+export {
+  AuthorityDeniedError
+};

package/browser/authorities/authorities.evaluator.mjs

@@ -0,0 +1,225 @@
+// libs/auth/src/authorities/authorities.evaluator.ts
+import { isAnonymousSubject, resolveDotPath } from "./authorities.context.mjs";
+function evaluateRbacRoles(policy, ctx) {
+  const userRoles = ctx.user.roles;
+  if (policy.all) {
+    const missing = policy.all.filter((r) => !userRoles.includes(r));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `roles.all: missing ${missing.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.all", missing },
+        evaluatedPolicies: ["roles.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((r) => userRoles.includes(r));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `roles.any: user has none of ${policy.any.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.any", missing: policy.any },
+        evaluatedPolicies: ["roles.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["roles"] };
+}
+function evaluateRbacPermissions(policy, ctx) {
+  const userPerms = ctx.user.permissions;
+  if (policy.all) {
+    const missing = policy.all.filter((p) => !userPerms.includes(p));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `permissions.all: missing ${missing.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.all", missing },
+        evaluatedPolicies: ["permissions.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((p) => userPerms.includes(p));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `permissions.any: user has none of ${policy.any.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.any", missing: policy.any },
+        evaluatedPolicies: ["permissions.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["permissions"] };
+}
+function buildContextEnvelope(ctx) {
+  return {
+    user: ctx.user,
+    claims: ctx.user.claims,
+    input: ctx.input,
+    env: ctx.env
+  };
+}
+function resolveValue(value, ctx) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if ("fromInput" in obj && typeof obj["fromInput"] === "string") {
+      return ctx.input[obj["fromInput"]];
+    }
+    if ("fromClaims" in obj && typeof obj["fromClaims"] === "string") {
+      return resolveDotPath(ctx.user.claims, obj["fromClaims"]);
+    }
+  }
+  return value;
+}
+function applyOperator(actual, op, expected) {
+  switch (op) {
+    // A missing expected value (e.g. an absent fromInput) never matches, even an absent actual value
+    case "eq":
+      return expected !== void 0 && actual === expected;
+    case "neq":
+      return actual !== expected;
+    case "in":
+      return Array.isArray(expected) && expected.includes(actual);
+    case "notIn":
+      return Array.isArray(expected) && !expected.includes(actual);
+    case "gt":
+      return typeof actual === "number" && typeof expected === "number" && actual > expected;
+    case "gte":
+      return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+    case "lt":
+      return typeof actual === "number" && typeof expected === "number" && actual < expected;
+    case "lte":
+      return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+    case "contains":
+      if (typeof actual === "string" && typeof expected === "string") return actual.includes(expected);
+      if (Array.isArray(actual)) return actual.includes(expected);
+      return false;
+    case "startsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.startsWith(expected);
+    case "endsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.endsWith(expected);
+    case "exists":
+      return expected ? actual !== void 0 && actual !== null : actual === void 0 || actual === null;
+    case "matches":
+      if (typeof actual !== "string" || typeof expected !== "string") return false;
+      if (expected.length > 256) return false;
+      if (/(\+\+|\*\*|\{\d+,\d*\}\{)/.test(expected)) return false;
+      try {
+        return new RegExp(expected).test(actual);
+      } catch {
+        return false;
+      }
+    default:
+      return false;
+  }
+}
+function evaluateCondition(condition, envelope, ctx) {
+  const actual = resolveDotPath(envelope, condition.path);
+  const expected = resolveValue(condition.value, ctx);
+  return applyOperator(actual, condition.op, expected);
+}
+var REDACTED_ENV_VALUE = "[redacted]";
+function reportableActual(path, actual) {
+  return path === "env" || path.startsWith("env.") ? REDACTED_ENV_VALUE : actual;
+}
+function evaluateAbac(policy, ctx) {
+  const envelope = buildContextEnvelope(ctx);
+  if (policy.match) {
+    for (const [path, expectedRaw] of Object.entries(policy.match)) {
+      const actual = resolveDotPath(envelope, path);
+      const expected = resolveValue(expectedRaw, ctx);
+      if (expected === void 0 || actual !== expected) {
+        const reported = reportableActual(path, actual);
+        return {
+          granted: false,
+          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(reported)}'`,
+          denial: { kind: "attributes", path: "attributes.match", expected, actual: reported },
+          evaluatedPolicies: ["attributes.match"]
+        };
+      }
+    }
+  }
+  if (policy.conditions) {
+    for (let i = 0; i < policy.conditions.length; i++) {
+      const condition = policy.conditions[i];
+      if (!evaluateCondition(condition, envelope, ctx)) {
+        const expected = resolveValue(condition.value, ctx);
+        const actual = reportableActual(condition.path, resolveDotPath(envelope, condition.path));
+        return {
+          granted: false,
+          deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
+          denial: { kind: "attributes", path: `attributes.conditions[${i}]`, expected, actual },
+          evaluatedPolicies: ["attributes.conditions"]
+        };
+      }
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["attributes"] };
+}
+function resolveResourceId(ref, ctx) {
+  if (typeof ref === "string") return ref;
+  if ("fromInput" in ref) {
+    const val = ctx.input[ref.fromInput];
+    return typeof val === "string" ? val : void 0;
+  }
+  if ("fromClaims" in ref) {
+    const val = resolveDotPath(ctx.user.claims, ref.fromClaims);
+    return typeof val === "string" ? val : void 0;
+  }
+  return void 0;
+}
+async function evaluateSingleRebac(policy, ctx) {
+  const userSub = ctx.user.sub;
+  if (userSub === void 0 || isAnonymousSubject(userSub)) {
+    return {
+      granted: false,
+      deniedBy: `relationships: an anonymous caller cannot be '${policy.type}' of ${policy.resource}`,
+      denial: { kind: "relationships", path: "user.sub", expected: "a signed-in caller", actual: void 0 },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  const resourceId = resolveResourceId(policy.resourceId, ctx);
+  if (resourceId === void 0) {
+    return {
+      granted: false,
+      deniedBy: `relationships: could not resolve resourceId for ${policy.resource}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.resource}:resourceId`,
+        actual: void 0
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, userSub, ctx);
+  if (!hasRelationship) {
+    return {
+      granted: false,
+      deniedBy: `relationships: user '${userSub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.type}:${policy.resource}:${resourceId}`
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+async function evaluateRebac(policy, ctx) {
+  const policies = Array.isArray(policy) ? policy : [policy];
+  for (const p of policies) {
+    const result = await evaluateSingleRebac(p, ctx);
+    if (!result.granted) return result;
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+export {
+  evaluateAbac,
+  evaluateRbacPermissions,
+  evaluateRbacRoles,
+  evaluateRebac,
+  resolveResourceId
+};

package/browser/authorities/authorities.metadata-augment.mjs

@@ -0,0 +1,18 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+
+// libs/auth/src/authorities/authorities.metadata-augment.ts
+var require_authorities_metadata_augment = __commonJS({
+  "libs/auth/src/authorities/authorities.metadata-augment.ts"() {
+  }
+});
+export default require_authorities_metadata_augment();