@gasboost/auth 0.4.0 → 0.5.0

package/README.md

@@ -90,6 +90,49 @@ const repository: AppsScriptAuthRepository = {
 
 将来的に SheetORM 向け adapter は auth-core とは別 package として提供する想定です。
 
+## Authorization
+
+アプリケーション内部の認可には、GAS runtime に依存しない `AuthorizationPolicy` と、Backend service の `AppsScriptAuthorization` を利用できます。
+
+```ts
+import {
+  AppsScriptAuthorization,
+  createAuthorizationTables,
+} from "@gasboost/auth";
+import { AuthorizationPolicy } from "@gasboost/auth/authorization";
+
+export const authorizationPolicy = new AuthorizationPolicy({
+  project: ["read", "create", "update", "delete"],
+  authorization: ["manage"],
+} as const)
+  .linkRole("admin", {
+    project: ["read", "create", "update", "delete"],
+    authorization: ["manage"],
+  })
+  .linkRole("member", {
+    project: ["read"],
+  });
+
+const authorizationTables = createAuthorizationTables();
+
+const authorization = new AppsScriptAuthorization({
+  policy: authorizationPolicy,
+  repository: authorizationRepository,
+});
+```
+
+`@gasboost/auth/authorization` は pure な subpath export です。Frontend / shared code では `AuthorizationPolicy` だけを import し、Backend で取得した effective permissions の表示制御に同じ `can()` を使えます。
+
+```ts
+const permissions = await authorization.resolve(session.userId);
+
+authorizationPolicy.can(permissions, {
+  project: ["update"],
+});
+```
+
+Role definition と permission vocabulary は application code が source of truth です。Repository には assignment だけを保存し、未知の role / permission は grant せず fail closed になります。
+
 ## Initialize
 
 `AppsScriptAuth` に Repository、GAS runtime、Session 設定、認証方式の設定を渡します。

package/dist/AppsScriptAuth.js

@@ -1,30 +1,33 @@
-import { AppsScriptAuthPassword } from "./api/AppsScriptAuthPassword";
-import { AppsScriptAuthSession } from "./api/AppsScriptAuthSession";
-import { AppsScriptAuthSignIn } from "./api/AppsScriptAuthSignIn";
-import { AppsScriptAuthSignOut } from "./api/AppsScriptAuthSignOut";
-import { AppsScriptAuthSignUp } from "./api/AppsScriptAuthSignUp";
-import { AppsScriptAuthenticationConfig, } from "./authentication/AppsScriptAuthentication";
-import { EmailPasswordAuthConfig, } from "./authentication/EmailPasswordAuthentication";
-import { sessionStorageFactory } from "./factory/sessionStorageFactory";
-export class AppsScriptAuth {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuth = void 0;
+const AppsScriptAuthPassword_1 = require("./api/AppsScriptAuthPassword");
+const AppsScriptAuthSession_1 = require("./api/AppsScriptAuthSession");
+const AppsScriptAuthSignIn_1 = require("./api/AppsScriptAuthSignIn");
+const AppsScriptAuthSignOut_1 = require("./api/AppsScriptAuthSignOut");
+const AppsScriptAuthSignUp_1 = require("./api/AppsScriptAuthSignUp");
+const AppsScriptAuthentication_1 = require("./authentication/AppsScriptAuthentication");
+const EmailPasswordAuthentication_1 = require("./authentication/EmailPasswordAuthentication");
+const sessionStorageFactory_1 = require("./factory/sessionStorageFactory");
+class AppsScriptAuth {
     signIn;
     signUp;
     session;
     signOut;
     password;
     constructor({ repository, session, runtime, emailPassword, appsScript, hooks, }) {
-        const sessionStorage = sessionStorageFactory(session.storageType, {
+        const sessionStorage = (0, sessionStorageFactory_1.sessionStorageFactory)(session.storageType, {
             cacheService: runtime.cacheService,
             propertiesService: runtime.propertiesService,
         });
         const expiresIn = session.expiresIn ?? 60 * 20;
         const emailPasswordConfig = emailPassword
-            ? new EmailPasswordAuthConfig(emailPassword)
+            ? new EmailPasswordAuthentication_1.EmailPasswordAuthConfig(emailPassword)
             : undefined;
         const appsScriptConfig = appsScript
-            ? new AppsScriptAuthenticationConfig(appsScript)
+            ? new AppsScriptAuthentication_1.AppsScriptAuthenticationConfig(appsScript)
             : undefined;
-        this.signIn = new AppsScriptAuthSignIn({
+        this.signIn = new AppsScriptAuthSignIn_1.AppsScriptAuthSignIn({
             sessionStorage,
             repository,
             emailPassword: emailPasswordConfig,
@@ -38,7 +41,7 @@ export class AppsScriptAuth {
                 }
                 : {}),
         });
-        this.signUp = new AppsScriptAuthSignUp({
+        this.signUp = new AppsScriptAuthSignUp_1.AppsScriptAuthSignUp({
             sessionStorage,
             expiresIn,
             repository,
@@ -47,12 +50,12 @@ export class AppsScriptAuth {
             utilities: runtime.utilities,
             session: runtime.session,
         });
-        this.session = new AppsScriptAuthSession({
+        this.session = new AppsScriptAuthSession_1.AppsScriptAuthSession({
             sessionStorage,
         });
-        this.signOut = new AppsScriptAuthSignOut(sessionStorage);
+        this.signOut = new AppsScriptAuthSignOut_1.AppsScriptAuthSignOut(sessionStorage);
         this.password = (emailPasswordConfig?.passwordReset
-            ? new AppsScriptAuthPassword({
+            ? new AppsScriptAuthPassword_1.AppsScriptAuthPassword({
                 repository,
                 utilities: runtime.utilities,
                 emailPassword: emailPasswordConfig,
@@ -60,3 +63,4 @@ export class AppsScriptAuth {
             : undefined);
     }
 }
+exports.AppsScriptAuth = AppsScriptAuth;

package/dist/AuthPattern.js

@@ -1,4 +1,7 @@
-export const authPattern = {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authPattern = void 0;
+exports.authPattern = {
     emailPassword: "emailPassword",
     appsScript: "appsScript",
 };

package/dist/api/AppsScriptAuthPassword.js

@@ -1,10 +1,13 @@
-import { authPattern } from "../AuthPattern";
-import { InvalidPasswordResetError } from "../domain/Errors";
-import { Password } from "../domain/Password";
-import { PasswordCredential } from "../domain/PasswordCredential";
-import { PasswordResetToken } from "../domain/PasswordResetToken";
-import { EmailPasswordIdentity } from "../identity/EmailPasswordIdentity";
-export class AppsScriptAuthPassword {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthPassword = void 0;
+const AuthPattern_1 = require("../AuthPattern");
+const Errors_1 = require("../domain/Errors");
+const Password_1 = require("../domain/Password");
+const PasswordCredential_1 = require("../domain/PasswordCredential");
+const PasswordResetToken_1 = require("../domain/PasswordResetToken");
+const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
+class AppsScriptAuthPassword {
     repository;
     utilities;
     emailPassword;
@@ -24,16 +27,16 @@ export class AppsScriptAuthPassword {
         };
     }
     async forgot({ email }) {
-        const account = await this.repository.account.findByIdentity(authPattern.emailPassword, email);
+        const account = await this.repository.account.findByIdentity(AuthPattern_1.authPattern.emailPassword, email);
         if (account === null) {
             return;
         }
-        if (!(account.identity instanceof EmailPasswordIdentity)) {
+        if (!(account.identity instanceof EmailPasswordIdentity_1.EmailPasswordIdentity)) {
             throw new Error("Invalid account identity");
         }
         const now = new Date();
         const expiresAt = new Date(now.getTime() + this.config.expiresIn * 1000);
-        const { credential, token } = PasswordCredential.generate({
+        const { credential, token } = PasswordCredential_1.PasswordCredential.generate({
             account,
             utilities: this.utilities,
             expiresAt,
@@ -46,12 +49,12 @@ export class AppsScriptAuthPassword {
         });
     }
     async reset({ token, newPassword, }) {
-        const passwordResetToken = new PasswordResetToken(token);
+        const passwordResetToken = new PasswordResetToken_1.PasswordResetToken(token);
         const credential = await this.repository.passwordCredential.findByResetTokenHash(passwordResetToken.hash(this.utilities));
         if (credential === null) {
-            throw new InvalidPasswordResetError();
+            throw new Errors_1.InvalidPasswordResetError();
         }
-        const password = new Password(newPassword, this.utilities, this.emailPassword.pepper, this.emailPassword.iterations);
+        const password = new Password_1.Password(newPassword, this.utilities, this.emailPassword.pepper, this.emailPassword.iterations);
         const hashedPassword = await password.hash(credential.account.id);
         const updatedCredential = credential.resetPassword({
             token,
@@ -62,3 +65,4 @@ export class AppsScriptAuthPassword {
         await this.repository.passwordCredential.save(updatedCredential);
     }
 }
+exports.AppsScriptAuthPassword = AppsScriptAuthPassword;

package/dist/api/AppsScriptAuthSession.js

@@ -1,4 +1,7 @@
-export class AppsScriptAuthSession {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthSession = void 0;
+class AppsScriptAuthSession {
     sessionStorage;
     constructor({ sessionStorage, }) {
         this.sessionStorage = sessionStorage;
@@ -15,3 +18,4 @@ export class AppsScriptAuthSession {
         await this.sessionStorage.cleanupExpired();
     }
 }
+exports.AppsScriptAuthSession = AppsScriptAuthSession;

package/dist/api/AppsScriptAuthSignIn.js

@@ -1,7 +1,10 @@
-import { AppsScriptAuthentication, } from "../authentication/AppsScriptAuthentication";
-import { EmailPasswordAuthentication, } from "../authentication/EmailPasswordAuthentication";
-import { SignIn } from "./SignIn";
-export class AppsScriptAuthSignIn {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthSignIn = void 0;
+const AppsScriptAuthentication_1 = require("../authentication/AppsScriptAuthentication");
+const EmailPasswordAuthentication_1 = require("../authentication/EmailPasswordAuthentication");
+const SignIn_1 = require("./SignIn");
+class AppsScriptAuthSignIn {
     email;
     appsScript;
     constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, session, utilities, afterSignIn, }) {
@@ -10,9 +13,9 @@ export class AppsScriptAuthSignIn {
                 throw new Error("Email and password authentication is disabled");
             }
             emailPassword.ensureSignInEnabled();
-            const emailSignIn = new SignIn({
+            const emailSignIn = new SignIn_1.SignIn({
                 sessionStorage,
-                authentication: new EmailPasswordAuthentication(repository, utilities, emailPassword),
+                authentication: new EmailPasswordAuthentication_1.EmailPasswordAuthentication(repository, utilities, emailPassword),
                 utilities,
                 expiresIn,
                 ...(afterSignIn
@@ -28,9 +31,9 @@ export class AppsScriptAuthSignIn {
                 throw new Error("Apps Script authentication is disabled");
             }
             appsScript.ensureSignInEnabled();
-            return new SignIn({
+            return new SignIn_1.SignIn({
                 sessionStorage,
-                authentication: new AppsScriptAuthentication(repository, session),
+                authentication: new AppsScriptAuthentication_1.AppsScriptAuthentication(repository, session),
                 utilities,
                 expiresIn,
                 ...(afterSignIn
@@ -42,3 +45,4 @@ export class AppsScriptAuthSignIn {
         };
     }
 }
+exports.AppsScriptAuthSignIn = AppsScriptAuthSignIn;

package/dist/api/AppsScriptAuthSignOut.js

@@ -1,4 +1,7 @@
-export class AppsScriptAuthSignOut {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthSignOut = void 0;
+class AppsScriptAuthSignOut {
     sessionStorage;
     constructor(sessionStorage) {
         this.sessionStorage = sessionStorage;
@@ -7,3 +10,4 @@ export class AppsScriptAuthSignOut {
         await this.sessionStorage.delete(sessionId);
     }
 }
+exports.AppsScriptAuthSignOut = AppsScriptAuthSignOut;

package/dist/api/AppsScriptAuthSignUp.js

@@ -1,7 +1,10 @@
-import { AppsScriptRegistration, } from "../registration/AppsScriptRegistration";
-import { EmailPasswordRegistration, } from "../registration/EmailPasswordRegistration";
-import { SignUp } from "./SignUp";
-export class AppsScriptAuthSignUp {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthSignUp = void 0;
+const AppsScriptRegistration_1 = require("../registration/AppsScriptRegistration");
+const EmailPasswordRegistration_1 = require("../registration/EmailPasswordRegistration");
+const SignUp_1 = require("./SignUp");
+class AppsScriptAuthSignUp {
     email;
     appsScript;
     constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, utilities, session, }) {
@@ -10,10 +13,10 @@ export class AppsScriptAuthSignUp {
                 throw new Error("Email and password authentication is disabled");
             }
             emailPassword.ensureSignUpEnabled();
-            const emailSignUp = new SignUp({
+            const emailSignUp = new SignUp_1.SignUp({
                 sessionStorage,
                 expiresIn,
-                registration: new EmailPasswordRegistration(repository, utilities, emailPassword),
+                registration: new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword),
                 utilities,
             });
             return emailSignUp.execute(input);
@@ -23,13 +26,14 @@ export class AppsScriptAuthSignUp {
                 throw new Error("Apps Script authentication is disabled");
             }
             appsScript.ensureSignUpEnabled();
-            const appsScriptSignUp = new SignUp({
+            const appsScriptSignUp = new SignUp_1.SignUp({
                 sessionStorage,
                 expiresIn,
-                registration: new AppsScriptRegistration(utilities, session, repository),
+                registration: new AppsScriptRegistration_1.AppsScriptRegistration(utilities, session, repository),
                 utilities,
             });
             return appsScriptSignUp.execute(input);
         };
     }
 }
+exports.AppsScriptAuthSignUp = AppsScriptAuthSignUp;

package/dist/api/SignIn.js

@@ -1,5 +1,8 @@
-import { Session } from "../domain/Session";
-export class SignIn {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignIn = void 0;
+const Session_1 = require("../domain/Session");
+class SignIn {
     sessionStorage;
     expiresIn;
     utilities;
@@ -14,7 +17,7 @@ export class SignIn {
     }
     async execute(credential) {
         const user = await this.authentication.verify(credential);
-        const session = new Session({
+        const session = new Session_1.Session({
             id: this.utilities.getUuid(),
             userId: user.id,
             createdAt: new Date(),
@@ -50,3 +53,4 @@ export class SignIn {
         }
     }
 }
+exports.SignIn = SignIn;

package/dist/api/SignUp.js

@@ -1,5 +1,8 @@
-import { Session } from "../domain/Session";
-export class SignUp {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignUp = void 0;
+const Session_1 = require("../domain/Session");
+class SignUp {
     sessionStorage;
     registration;
     utilities;
@@ -13,7 +16,7 @@ export class SignUp {
     async execute(input) {
         const user = await this.registration.register(input);
         const now = new Date();
-        const session = new Session({
+        const session = new Session_1.Session({
             id: this.utilities.getUuid(),
             userId: user.id,
             createdAt: now,
@@ -23,3 +26,4 @@ export class SignUp {
         return { user, session };
     }
 }
+exports.SignUp = SignUp;

package/dist/authentication/AppsScriptAuthentication.js

@@ -1,6 +1,9 @@
-import { authPattern } from "../AuthPattern";
-import { AppsScriptIdentity } from "../identity/AppsScriptIdentity";
-export class AppsScriptAuthenticationConfig {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthentication = exports.AppsScriptAuthenticationConfig = void 0;
+const AuthPattern_1 = require("../AuthPattern");
+const AppsScriptIdentity_1 = require("../identity/AppsScriptIdentity");
+class AppsScriptAuthenticationConfig {
     enabled;
     isSignupEnabled;
     constructor({ enabled = false, isSignupEnabled = true, }) {
@@ -19,7 +22,8 @@ export class AppsScriptAuthenticationConfig {
         }
     }
 }
-export class AppsScriptAuthentication {
+exports.AppsScriptAuthenticationConfig = AppsScriptAuthenticationConfig;
+class AppsScriptAuthentication {
     repository;
     session;
     constructor(repository, session) {
@@ -31,11 +35,11 @@ export class AppsScriptAuthentication {
         if (!email) {
             throw new Error("No active user found");
         }
-        const account = await this.repository.account.findByIdentity(authPattern.appsScript, email);
+        const account = await this.repository.account.findByIdentity(AuthPattern_1.authPattern.appsScript, email);
         if (!account) {
             throw new Error("Account not found");
         }
-        if (!(account.identity instanceof AppsScriptIdentity)) {
+        if (!(account.identity instanceof AppsScriptIdentity_1.AppsScriptIdentity)) {
             throw new Error("Invalid identity");
         }
         const user = await this.repository.user.find(account.userId);
@@ -45,3 +49,4 @@ export class AppsScriptAuthentication {
         return user;
     }
 }
+exports.AppsScriptAuthentication = AppsScriptAuthentication;

package/dist/authentication/Authentication.js

@@ -1 +1,2 @@
-export {};
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/authentication/EmailPasswordAuthentication.js

@@ -1,7 +1,10 @@
-import { authPattern } from "../AuthPattern";
-import { Password } from "../domain/Password";
-import { EmailPasswordIdentity } from "../identity/EmailPasswordIdentity";
-export class EmailPasswordAuthConfig {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailPasswordAuthentication = exports.EmailPasswordAuthConfig = void 0;
+const AuthPattern_1 = require("../AuthPattern");
+const Password_1 = require("../domain/Password");
+const EmailPasswordIdentity_1 = require("../identity/EmailPasswordIdentity");
+class EmailPasswordAuthConfig {
     static DEFAULT_ITERATIONS = 300;
     static MAX_ITERATIONS = 1000;
     enabled;
@@ -45,7 +48,8 @@ export class EmailPasswordAuthConfig {
         }
     }
 }
-export class EmailPasswordAuthentication {
+exports.EmailPasswordAuthConfig = EmailPasswordAuthConfig;
+class EmailPasswordAuthentication {
     repository;
     utilities;
     config;
@@ -55,14 +59,14 @@ export class EmailPasswordAuthentication {
         this.config = config;
     }
     async verify(credential) {
-        const account = await this.repository.account.findByIdentity(authPattern.emailPassword, credential.email);
+        const account = await this.repository.account.findByIdentity(AuthPattern_1.authPattern.emailPassword, credential.email);
         if (!account) {
             throw new Error("Account not found");
         }
-        if (!(account.identity instanceof EmailPasswordIdentity)) {
+        if (!(account.identity instanceof EmailPasswordIdentity_1.EmailPasswordIdentity)) {
             throw new Error("Invalid identity");
         }
-        const password = new Password(credential.password, this.utilities, this.config.pepper, this.config.iterations);
+        const password = new Password_1.Password(credential.password, this.utilities, this.config.pepper, this.config.iterations);
         if (!(await account.identity.verify(password, account.id))) {
             throw new Error("Invalid password");
         }
@@ -73,3 +77,4 @@ export class EmailPasswordAuthentication {
         return user;
     }
 }
+exports.EmailPasswordAuthentication = EmailPasswordAuthentication;

package/dist/authorization/AppsScriptAuthorization.d.ts

@@ -0,0 +1,33 @@
+import type { AuthorizationPolicy, EffectivePermissions, PermissionOf, PermissionRequirement, PermissionStatement } from "./AuthorizationPolicy";
+import type { AuthorizationRepository } from "./AuthorizationRepository";
+type PolicyStatement<TPolicy> = TPolicy extends AuthorizationPolicy<infer TStatement, string> ? TStatement : never;
+type PolicyRole<TPolicy> = TPolicy extends {
+    readonly $types: {
+        readonly role: infer TRole;
+    };
+} ? Extract<TRole, string> : never;
+type PolicyPermission<TPolicy> = TPolicy extends {
+    readonly $types: {
+        readonly permission: infer TPermission;
+    };
+} ? Extract<TPermission, string> : never;
+export declare class AppsScriptAuthorization<TPolicy extends AuthorizationPolicy<PermissionStatement, string>> {
+    readonly role: {
+        assign(userId: string, role: PolicyRole<TPolicy>): Promise<void>;
+        revoke(userId: string, role: PolicyRole<TPolicy>): Promise<void>;
+    };
+    readonly permission: {
+        allow(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+        deny(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+        revoke(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+    };
+    private readonly policy;
+    private readonly repository;
+    constructor({ policy, repository, }: {
+        policy: TPolicy;
+        repository: AuthorizationRepository;
+    });
+    resolve(userId: string): Promise<EffectivePermissions<PermissionOf<PolicyStatement<TPolicy>>>>;
+    can(userId: string, requirement: PermissionRequirement<PolicyStatement<TPolicy>>): Promise<boolean>;
+}
+export {};

package/dist/authorization/AppsScriptAuthorization.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthorization = void 0;
+class AppsScriptAuthorization {
+    role;
+    permission;
+    policy;
+    repository;
+    constructor({ policy, repository, }) {
+        this.policy = policy;
+        this.repository = repository;
+        this.role = {
+            assign: (userId, role) => this.repository.role.assign(userId, role),
+            revoke: (userId, role) => this.repository.role.revoke(userId, role),
+        };
+        this.permission = {
+            allow: (userId, permission) => this.repository.permission.set(userId, permission, "allow"),
+            deny: (userId, permission) => this.repository.permission.set(userId, permission, "deny"),
+            revoke: (userId, permission) => this.repository.permission.revoke(userId, permission),
+        };
+    }
+    async resolve(userId) {
+        const [roles, permissions] = await Promise.all([
+            this.repository.role.findByUserId(userId),
+            this.repository.permission.findByUserId(userId),
+        ]);
+        return this.policy.resolve({
+            roles,
+            permissions,
+        });
+    }
+    async can(userId, requirement) {
+        return this.policy.can(await this.resolve(userId), requirement);
+    }
+}
+exports.AppsScriptAuthorization = AppsScriptAuthorization;

package/dist/authorization/AuthorizationPolicy.d.ts

@@ -0,0 +1,32 @@
+export type PermissionStatement = Record<string, readonly string[]>;
+export type PermissionOf<TStatement extends PermissionStatement> = {
+    [TResource in Extract<keyof TStatement, string>]: `${TResource}:${Extract<TStatement[TResource][number], string>}`;
+}[Extract<keyof TStatement, string>];
+export type PermissionRequirement<TStatement extends PermissionStatement> = {
+    readonly [TResource in keyof TStatement]?: readonly TStatement[TResource][number][];
+};
+export type EffectivePermissions<TPermission extends string> = readonly TPermission[];
+export type PermissionEffect = "allow" | "deny";
+export type StoredPermissionOverride = {
+    readonly permission: string;
+    readonly effect: PermissionEffect;
+};
+export type AuthorizationResolutionInput = {
+    readonly roles: readonly string[];
+    readonly permissions: readonly StoredPermissionOverride[];
+};
+type RoleGrantMap = ReadonlyMap<string, readonly string[]>;
+export declare class AuthorizationPolicy<const TStatement extends PermissionStatement, TRole extends string = never> {
+    readonly statement: TStatement;
+    readonly $types: {
+        readonly role: TRole;
+        readonly permission: PermissionOf<TStatement>;
+    };
+    private readonly permissions;
+    private readonly roleGrants;
+    constructor(statement: TStatement, roleGrants?: RoleGrantMap);
+    linkRole<const TName extends string, const TRequirement extends PermissionRequirement<TStatement>>(name: TName, requirement: TRequirement): AuthorizationPolicy<TStatement, TRole | TName>;
+    resolve(input: AuthorizationResolutionInput): EffectivePermissions<PermissionOf<TStatement>>;
+    can(permissions: EffectivePermissions<PermissionOf<TStatement>>, requirement: PermissionRequirement<TStatement>): boolean;
+}
+export {};

package/dist/authorization/AuthorizationPolicy.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationPolicy = void 0;
+function flattenRequirement(requirement) {
+    const permissions = [];
+    for (const [resource, actions] of Object.entries(requirement)) {
+        for (const action of actions ?? []) {
+            permissions.push(`${resource}:${action}`);
+        }
+    }
+    return permissions;
+}
+function unique(values) {
+    return [...new Set(values)];
+}
+class AuthorizationPolicy {
+    statement;
+    $types;
+    permissions;
+    roleGrants;
+    constructor(statement, roleGrants = new Map()) {
+        this.statement = statement;
+        this.permissions = new Set(flattenRequirement(statement));
+        this.roleGrants = roleGrants;
+    }
+    linkRole(name, requirement) {
+        return new AuthorizationPolicy(this.statement, new Map([
+            ...this.roleGrants,
+            [name, unique(flattenRequirement(requirement))],
+        ]));
+    }
+    resolve(input) {
+        const deniedPermissions = new Set(input.permissions
+            .filter(({ effect }) => effect === "deny")
+            .map(({ permission }) => permission)
+            .filter((permission) => this.permissions.has(permission)));
+        const resolved = new Set();
+        for (const { effect, permission } of input.permissions) {
+            if (effect === "allow" &&
+                this.permissions.has(permission) &&
+                !deniedPermissions.has(permission)) {
+                resolved.add(permission);
+            }
+        }
+        for (const role of input.roles) {
+            const permissions = this.roleGrants.get(role);
+            if (permissions === undefined) {
+                continue;
+            }
+            for (const permission of permissions) {
+                if (!deniedPermissions.has(permission)) {
+                    resolved.add(permission);
+                }
+            }
+        }
+        return [...resolved];
+    }
+    can(permissions, requirement) {
+        const granted = new Set(permissions);
+        return flattenRequirement(requirement).every((permission) => granted.has(permission));
+    }
+}
+exports.AuthorizationPolicy = AuthorizationPolicy;

package/dist/authorization/AuthorizationRepository.d.ts

@@ -0,0 +1,13 @@
+import type { StoredPermissionOverride } from "./AuthorizationPolicy";
+export interface AuthorizationRepository {
+    readonly role: {
+        findByUserId(userId: string): Promise<readonly string[]>;
+        assign(userId: string, role: string): Promise<void>;
+        revoke(userId: string, role: string): Promise<void>;
+    };
+    readonly permission: {
+        findByUserId(userId: string): Promise<readonly StoredPermissionOverride[]>;
+        set(userId: string, permission: string, effect: StoredPermissionOverride["effect"]): Promise<void>;
+        revoke(userId: string, permission: string): Promise<void>;
+    };
+}

package/dist/authorization/AuthorizationRepository.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/authorization/index.d.ts

@@ -0,0 +1 @@
+export { AuthorizationPolicy, type AuthorizationResolutionInput, type EffectivePermissions, type PermissionEffect, type PermissionOf, type PermissionRequirement, type PermissionStatement, type StoredPermissionOverride, } from "./AuthorizationPolicy";