@frontmcp/auth 1.10.16 → 1.11.0-rc.1

package/browser/authorities/authorities.registry.mjs

@@ -0,0 +1,112 @@
+// libs/auth/src/authorities/authorities.registry.ts
+var AuthoritiesProfileRegistry = class {
+  profiles = /* @__PURE__ */ new Map();
+  /**
+   * Register a named profile.
+   * Overwrites any existing profile with the same name.
+   */
+  register(name, policy) {
+    this.profiles.set(name, policy);
+  }
+  /**
+   * Register multiple profiles at once.
+   */
+  registerAll(profiles) {
+    for (const [name, policy] of Object.entries(profiles)) {
+      this.profiles.set(name, policy);
+    }
+  }
+  /**
+   * Resolve a profile name to its policy.
+   * Returns `undefined` if the profile is not registered.
+   */
+  resolve(name) {
+    return this.profiles.get(name);
+  }
+  /**
+   * Check if a profile is registered.
+   */
+  has(name) {
+    return this.profiles.has(name);
+  }
+  /**
+   * Get all registered profiles.
+   */
+  getAll() {
+    const result = {};
+    for (const [name, policy] of this.profiles) {
+      result[name] = policy;
+    }
+    return result;
+  }
+  /**
+   * Get the number of registered profiles.
+   */
+  get size() {
+    return this.profiles.size;
+  }
+  /**
+   * Remove a profile by name.
+   */
+  remove(name) {
+    return this.profiles.delete(name);
+  }
+  /**
+   * Clear all profiles.
+   */
+  clear() {
+    this.profiles.clear();
+  }
+};
+var AuthoritiesEvaluatorRegistry = class {
+  evaluators = /* @__PURE__ */ new Map();
+  /**
+   * Register a custom evaluator.
+   * The evaluator's name must match the key used in `custom.*`.
+   */
+  register(name, evaluator) {
+    this.evaluators.set(name, evaluator);
+  }
+  /**
+   * Register multiple evaluators at once.
+   */
+  registerAll(evaluators) {
+    for (const [name, evaluator] of Object.entries(evaluators)) {
+      this.evaluators.set(name, evaluator);
+    }
+  }
+  /**
+   * Get an evaluator by name.
+   */
+  get(name) {
+    return this.evaluators.get(name);
+  }
+  /**
+   * Check if an evaluator is registered.
+   */
+  has(name) {
+    return this.evaluators.has(name);
+  }
+  /**
+   * Get the number of registered evaluators.
+   */
+  get size() {
+    return this.evaluators.size;
+  }
+  /**
+   * Remove an evaluator by name.
+   */
+  remove(name) {
+    return this.evaluators.delete(name);
+  }
+  /**
+   * Clear all evaluators.
+   */
+  clear() {
+    this.evaluators.clear();
+  }
+};
+export {
+  AuthoritiesEvaluatorRegistry,
+  AuthoritiesProfileRegistry
+};

package/browser/authorities/authorities.schema.mjs

@@ -0,0 +1,92 @@
+// libs/auth/src/authorities/authorities.schema.ts
+import { z } from "@frontmcp/lazy-zod";
+var rbacRolesPolicySchema = z.object({
+  all: z.array(z.string().min(1)).optional(),
+  any: z.array(z.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Roles policy must have at least "all" or "any"'
+});
+var rbacPermissionsPolicySchema = z.object({
+  all: z.array(z.string().min(1)).optional(),
+  any: z.array(z.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Permissions policy must have at least "all" or "any"'
+});
+var abacOperatorSchema = z.enum([
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "exists",
+  "matches"
+]);
+var abacConditionSchema = z.object({
+  path: z.string().min(1),
+  op: abacOperatorSchema,
+  value: z.unknown()
+});
+var abacPolicySchema = z.object({
+  match: z.record(z.string(), z.unknown()).optional(),
+  conditions: z.array(abacConditionSchema).optional()
+}).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
+  message: 'Attributes policy must have at least "match" or "conditions"'
+});
+var resourceIdRefSchema = z.union([
+  z.string().min(1),
+  z.object({ fromInput: z.string().min(1) }).strict(),
+  z.object({ fromClaims: z.string().min(1) }).strict()
+]);
+var rebacPolicySchema = z.object({
+  type: z.string().min(1),
+  resource: z.string().min(1),
+  resourceId: resourceIdRefSchema
+});
+var basePolicyShape = {
+  roles: rbacRolesPolicySchema.optional(),
+  permissions: rbacPermissionsPolicySchema.optional(),
+  attributes: abacPolicySchema.optional(),
+  relationships: z.union([rebacPolicySchema, z.array(rebacPolicySchema)]).optional(),
+  custom: z.record(z.string(), z.unknown()).optional(),
+  guards: z.array(z.instanceof(Function)).optional(),
+  operator: z.enum(["AND", "OR"]).optional()
+};
+var authoritiesPolicySchema = z.lazy(
+  () => z.object({
+    ...basePolicyShape,
+    not: authoritiesPolicySchema.optional(),
+    anyOf: z.array(authoritiesPolicySchema).optional(),
+    allOf: z.array(authoritiesPolicySchema).optional()
+  })
+);
+var authoritiesMetadataSchema = z.union([
+  z.string().min(1),
+  z.array(z.string().min(1)).min(1),
+  authoritiesPolicySchema
+]);
+var authoritiesClaimsMappingSchema = z.record(z.string(), z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+  message: "Claims mapping must have at least one mapping"
+});
+var authoritiesConfigSchema = z.object({
+  claimsMapping: authoritiesClaimsMappingSchema.optional(),
+  profiles: z.record(z.string().min(1), authoritiesPolicySchema).optional()
+});
+export {
+  abacConditionSchema,
+  abacOperatorSchema,
+  abacPolicySchema,
+  authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema,
+  authoritiesMetadataSchema,
+  authoritiesPolicySchema,
+  rbacPermissionsPolicySchema,
+  rbacRolesPolicySchema,
+  rebacPolicySchema,
+  resourceIdRefSchema
+};

package/browser/authorities/authorities.scope-mapping.mjs

@@ -0,0 +1,30 @@
+// libs/auth/src/authorities/authorities.scope-mapping.ts
+function resolveRequiredScopes(denial, mapping, authorities) {
+  const scopes = /* @__PURE__ */ new Set();
+  if (typeof authorities === "string" && mapping.profiles?.[authorities]) {
+    mapping.profiles[authorities].forEach((s) => scopes.add(s));
+  }
+  if (Array.isArray(authorities)) {
+    for (const profileName of authorities) {
+      if (typeof profileName === "string" && mapping.profiles?.[profileName]) {
+        mapping.profiles[profileName].forEach((s) => scopes.add(s));
+      }
+    }
+  }
+  if (denial.kind === "roles" && denial.missing && mapping.roles) {
+    for (const role of denial.missing) {
+      const mapped = mapping.roles[role];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  if (denial.kind === "permissions" && denial.missing && mapping.permissions) {
+    for (const perm of denial.missing) {
+      const mapped = mapping.permissions[perm];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  return scopes.size > 0 ? [...scopes].sort() : void 0;
+}
+export {
+  resolveRequiredScopes
+};

package/browser/authorities/authorities.validation.mjs

@@ -0,0 +1,208 @@
+// libs/auth/src/authorities/authorities.validation.ts
+var ABAC_OPERATORS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "exists",
+  "matches"
+]);
+var CHECK_FIELDS = [
+  "roles",
+  "permissions",
+  "attributes",
+  "relationships",
+  "custom",
+  "guards",
+  "allOf",
+  "anyOf",
+  "not"
+];
+var RULE_FIELDS = /* @__PURE__ */ new Set([...CHECK_FIELDS, "operator"]);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function unknownFields(value, known, path) {
+  const prefix = path ? `${path} has` : "has";
+  return Object.keys(value).filter((key) => !known.has(key)).map((key) => `${prefix} an unknown field "${key}"`);
+}
+function checkStringList(value, path) {
+  if (!Array.isArray(value)) return [`${path} must be a list of names`];
+  if (value.length === 0) return [`${path} is empty`];
+  return value.every(isNonEmptyString) ? [] : [`${path} must contain only non-empty names`];
+}
+var ALL_OR_ANY = /* @__PURE__ */ new Set(["all", "any"]);
+function checkAllOrAny(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "all" or "any"`];
+  const problems = unknownFields(value, ALL_OR_ANY, path);
+  if (value["all"] === void 0 && value["any"] === void 0) {
+    problems.push(`${path} needs "all" or "any"`);
+  }
+  if (value["all"] !== void 0) problems.push(...checkStringList(value["all"], `${path}.all`));
+  if (value["any"] !== void 0) problems.push(...checkStringList(value["any"], `${path}.any`));
+  return problems;
+}
+var ATTRIBUTE_FIELDS = /* @__PURE__ */ new Set(["match", "conditions"]);
+var CONDITION_FIELDS = /* @__PURE__ */ new Set(["path", "op", "value"]);
+function isValueReference(value) {
+  return isPlainObject(value) && ("fromInput" in value || "fromClaims" in value);
+}
+function checkValueReference(value, path) {
+  const ref = value["fromInput"] ?? value["fromClaims"];
+  return Object.keys(value).length === 1 && isNonEmptyString(ref) ? [] : [`${path} must be { fromInput: "<name>" } or { fromClaims: "<path>" }`];
+}
+var OPERATOR_VALUES = {
+  in: { accepts: Array.isArray, needs: "a list" },
+  notIn: { accepts: Array.isArray, needs: "a list" },
+  gt: { accepts: (value) => typeof value === "number", needs: "a number" },
+  gte: { accepts: (value) => typeof value === "number", needs: "a number" },
+  lt: { accepts: (value) => typeof value === "number", needs: "a number" },
+  lte: { accepts: (value) => typeof value === "number", needs: "a number" },
+  startsWith: { accepts: (value) => typeof value === "string", needs: "a string" },
+  endsWith: { accepts: (value) => typeof value === "string", needs: "a string" },
+  matches: { accepts: (value) => typeof value === "string", needs: "a string" }
+};
+function checkConditionValue(op, condition, path) {
+  const value = condition["value"];
+  if (value === void 0) return [`${path} is missing`];
+  if (op === "exists") {
+    return typeof value === "boolean" ? [] : [`${path} must be true or false for "exists"`];
+  }
+  if (isValueReference(value)) return checkValueReference(value, path);
+  const expected = OPERATOR_VALUES[op];
+  if (expected && !expected.accepts(value)) return [`${path} must be ${expected.needs} for "${op}"`];
+  if (Array.isArray(value) && value.length === 0 && (op === "in" || op === "notIn")) return [`${path} is empty`];
+  return [];
+}
+function checkAttributes(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "match" or "conditions"`];
+  const problems = unknownFields(value, ATTRIBUTE_FIELDS, path);
+  const { match, conditions } = value;
+  if (match === void 0 && conditions === void 0) {
+    problems.push(`${path} needs "match" or "conditions"`);
+  }
+  if (match !== void 0) {
+    if (!isPlainObject(match)) problems.push(`${path}.match must be an object`);
+    else if (Object.keys(match).length === 0) problems.push(`${path}.match is empty`);
+    else {
+      for (const [attribute, expected] of Object.entries(match)) {
+        const at = `${path}.match[${JSON.stringify(attribute)}]`;
+        if (expected === void 0) problems.push(`${at} has no value`);
+        else if (isValueReference(expected)) problems.push(...checkValueReference(expected, at));
+      }
+    }
+  }
+  if (conditions !== void 0) {
+    if (!Array.isArray(conditions)) problems.push(`${path}.conditions must be a list`);
+    else if (conditions.length === 0) problems.push(`${path}.conditions is empty`);
+    else {
+      conditions.forEach((condition, index) => {
+        const at = `${path}.conditions[${index}]`;
+        if (!isPlainObject(condition)) {
+          problems.push(`${at} must be an object with "path" and "op"`);
+          return;
+        }
+        problems.push(...unknownFields(condition, CONDITION_FIELDS, at));
+        if (!isNonEmptyString(condition["path"])) problems.push(`${at}.path must be a non-empty string`);
+        const op = condition["op"];
+        if (!ABAC_OPERATORS.has(op)) {
+          problems.push(`${at}.op "${String(condition["op"])}" is not an operator`);
+        } else {
+          problems.push(...checkConditionValue(op, condition, `${at}.value`));
+        }
+      });
+    }
+  }
+  return problems;
+}
+var RELATIONSHIP_FIELDS = /* @__PURE__ */ new Set(["type", "resource", "resourceId"]);
+function checkResourceId(value, path) {
+  if (isNonEmptyString(value)) return [];
+  if (isPlainObject(value) && Object.keys(value).length === 1) {
+    const ref = value["fromInput"] ?? value["fromClaims"];
+    if (isNonEmptyString(ref)) return [];
+  }
+  return [`${path} must be a string, { fromInput } or { fromClaims }`];
+}
+function checkRelationship(value, path) {
+  if (!isPlainObject(value)) return [`${path} must be an object with "type", "resource" and "resourceId"`];
+  const problems = unknownFields(value, RELATIONSHIP_FIELDS, path);
+  if (!isNonEmptyString(value["type"])) problems.push(`${path}.type must be a non-empty string`);
+  if (!isNonEmptyString(value["resource"])) problems.push(`${path}.resource must be a non-empty string`);
+  problems.push(...checkResourceId(value["resourceId"], `${path}.resourceId`));
+  return problems;
+}
+function checkRelationships(value, path) {
+  if (!Array.isArray(value)) return checkRelationship(value, path);
+  if (value.length === 0) return [`${path} is empty`];
+  return value.flatMap((relationship, index) => checkRelationship(relationship, `${path}[${index}]`));
+}
+function checkRuleList(value, path) {
+  if (!Array.isArray(value)) return [`${path} must be a list of rules`];
+  if (value.length === 0) return [`${path} is empty`];
+  return value.flatMap((rule, index) => checkRule(rule, `${path}[${index}]`));
+}
+function checkRule(rule, path) {
+  if (!isPlainObject(rule)) {
+    return [`${path || "the rule"} must be a rule object${typeof rule === "string" ? ", not a profile name" : ""}`];
+  }
+  const problems = unknownFields(rule, RULE_FIELDS, path);
+  if (!CHECK_FIELDS.some((field) => rule[field] !== void 0)) {
+    problems.push(`${path ? `${path} ` : ""}checks nothing`);
+  }
+  if (rule["operator"] !== void 0 && rule["operator"] !== "AND" && rule["operator"] !== "OR") {
+    problems.push(`${path}.operator must be "AND" or "OR"`);
+  }
+  if (rule["roles"] !== void 0) problems.push(...checkAllOrAny(rule["roles"], `${path}.roles`));
+  if (rule["permissions"] !== void 0) problems.push(...checkAllOrAny(rule["permissions"], `${path}.permissions`));
+  if (rule["attributes"] !== void 0) problems.push(...checkAttributes(rule["attributes"], `${path}.attributes`));
+  if (rule["relationships"] !== void 0) {
+    problems.push(...checkRelationships(rule["relationships"], `${path}.relationships`));
+  }
+  if (rule["custom"] !== void 0) {
+    if (!isPlainObject(rule["custom"])) problems.push(`${path}.custom must be an object`);
+    else if (Object.keys(rule["custom"]).length === 0) problems.push(`${path}.custom is empty`);
+  }
+  if (rule["guards"] !== void 0) {
+    const guards = rule["guards"];
+    if (!Array.isArray(guards)) problems.push(`${path}.guards must be a list of functions`);
+    else if (guards.length === 0) problems.push(`${path}.guards is empty`);
+    else if (!guards.every((guard) => typeof guard === "function")) {
+      problems.push(`${path}.guards must contain only functions`);
+    }
+  }
+  if (rule["allOf"] !== void 0) problems.push(...checkRuleList(rule["allOf"], `${path}.allOf`));
+  if (rule["anyOf"] !== void 0) problems.push(...checkRuleList(rule["anyOf"], `${path}.anyOf`));
+  if (rule["not"] !== void 0) problems.push(...checkRule(rule["not"], `${path}.not`));
+  return problems;
+}
+function findAuthoritiesRuleProblems(authorities) {
+  if (typeof authorities === "string") {
+    return authorities.length > 0 ? [] : ["the profile name is empty"];
+  }
+  if (Array.isArray(authorities)) {
+    if (authorities.length === 0) return ["the list of profiles is empty"];
+    return authorities.every(isNonEmptyString) ? [] : ["a list of profiles must contain only non-empty profile names"];
+  }
+  if (!isPlainObject(authorities)) {
+    return ["must be a profile name, a list of profile names, or a rule object"];
+  }
+  return checkRule(authorities, "");
+}
+function findAuthoritiesProfileProblems(name, policy) {
+  return checkRule(policy, "").map((problem) => `profile "${name}": ${problem.replace(/^\./, "")}`);
+}
+export {
+  findAuthoritiesProfileProblems,
+  findAuthoritiesRuleProblems
+};

package/browser/authorities/index.mjs

@@ -0,0 +1,43 @@
+// libs/auth/src/authorities/index.ts
+import "./authorities.metadata-augment.mjs";
+import { resolveRequiredScopes } from "./authorities.scope-mapping.mjs";
+import {
+  rbacRolesPolicySchema,
+  rbacPermissionsPolicySchema,
+  abacOperatorSchema,
+  abacConditionSchema,
+  abacPolicySchema,
+  resourceIdRefSchema,
+  rebacPolicySchema,
+  authoritiesPolicySchema,
+  authoritiesMetadataSchema,
+  authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema
+} from "./authorities.schema.mjs";
+import { AuthoritiesEngine } from "./authorities.engine.mjs";
+import { findAuthoritiesRuleProblems, findAuthoritiesProfileProblems } from "./authorities.validation.mjs";
+import { AuthoritiesContextBuilder, isAnonymousSubject } from "./authorities.context.mjs";
+import { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry } from "./authorities.registry.mjs";
+import { AuthorityDeniedError } from "./authorities.errors.mjs";
+export {
+  AuthoritiesContextBuilder,
+  AuthoritiesEngine,
+  AuthoritiesEvaluatorRegistry,
+  AuthoritiesProfileRegistry,
+  AuthorityDeniedError,
+  abacConditionSchema,
+  abacOperatorSchema,
+  abacPolicySchema,
+  authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema,
+  authoritiesMetadataSchema,
+  authoritiesPolicySchema,
+  findAuthoritiesProfileProblems,
+  findAuthoritiesRuleProblems,
+  isAnonymousSubject,
+  rbacPermissionsPolicySchema,
+  rbacRolesPolicySchema,
+  rebacPolicySchema,
+  resolveRequiredScopes,
+  resourceIdRefSchema
+};