@gasboost/auth 0.4.1 → 0.6.0

package/README.md

@@ -90,6 +90,49 @@ const repository: AppsScriptAuthRepository = {
 
 将来的に SheetORM 向け adapter は auth-core とは別 package として提供する想定です。
 
+## Authorization
+
+アプリケーション内部の認可には、GAS runtime に依存しない `AuthorizationPolicy` と、Backend service の `AppsScriptAuthorization` を利用できます。
+
+```ts
+import {
+  AppsScriptAuthorization,
+  createAuthorizationTables,
+} from "@gasboost/auth";
+import { AuthorizationPolicy } from "@gasboost/auth/authorization";
+
+export const authorizationPolicy = new AuthorizationPolicy({
+  project: ["read", "create", "update", "delete"],
+  authorization: ["manage"],
+} as const)
+  .linkRole("admin", {
+    project: ["read", "create", "update", "delete"],
+    authorization: ["manage"],
+  })
+  .linkRole("member", {
+    project: ["read"],
+  });
+
+const authorizationTables = createAuthorizationTables();
+
+const authorization = new AppsScriptAuthorization({
+  policy: authorizationPolicy,
+  repository: authorizationRepository,
+});
+```
+
+`@gasboost/auth/authorization` は pure な subpath export です。Frontend / shared code では `AuthorizationPolicy` だけを import し、Backend で取得した effective permissions の表示制御に同じ `can()` を使えます。
+
+```ts
+const permissions = await authorization.resolve(session.userId);
+
+authorizationPolicy.can(permissions, {
+  project: ["update"],
+});
+```
+
+Role definition と permission vocabulary は application code が source of truth です。Repository には assignment だけを保存し、未知の role / permission は grant せず fail closed になります。
+
 ## Initialize
 
 `AppsScriptAuth` に Repository、GAS runtime、Session 設定、認証方式の設定を渡します。
@@ -215,6 +258,51 @@ User 検索
 Session 発行
 ```
 
+## Registration (without Session)
+
+`auth.registration` は、Session を発行せずに
+User と Account を登録するサーバー内部APIです。
+
+管理者によるユーザー登録など、
+登録対象ユーザーとしてサインインする必要がない場合に使用します。
+
+### Email / Password
+
+```ts
+const user = await auth.registration.email({
+  name: "Taro",
+  email: "taro@example.com",
+  password: temporaryPassword,
+});
+```
+
+### Apps Script
+
+```ts
+const user = await auth.registration.appsScript({
+  name: "Taro",
+});
+```
+
+Apps Script方式では
+`Session.getActiveUser().getEmail()` を使用するため、
+任意の他ユーザーを指定して登録することはできません。
+
+### Sign Upとの違い
+
+| API                              | User + Account | Session発行 |
+| -------------------------------- | -------------- | ----------- |
+| `auth.registration.email()`      | 作成           | なし        |
+| `auth.registration.appsScript()` | 作成           | なし        |
+| `auth.signUp.email()`            | 作成           | あり        |
+| `auth.signUp.appsScript()`       | 作成           | あり        |
+
+`isSignupEnabled: false` でも、
+認証方式自体が `enabled: true` ならRegistrationは利用できます。
+
+Registrationはメール送信やRole付与を行いません。
+呼び出し元で認証・認可を実施してください。
+
 ## Apps Script Sign Up
 
 Apps Script 認証では `Session.getActiveUser().getEmail()` を Identity として利用します。

package/dist/AppsScriptAuth.d.ts

@@ -1,4 +1,5 @@
 import { AppsScriptAuthPassword } from "./api/AppsScriptAuthPassword";
+import { AppsScriptAuthRegistration } from "./api/AppsScriptAuthRegistration";
 import { AppsScriptAuthSession } from "./api/AppsScriptAuthSession";
 import { AppsScriptAuthSignIn } from "./api/AppsScriptAuthSignIn";
 import { AppsScriptAuthSignOut } from "./api/AppsScriptAuthSignOut";
@@ -35,6 +36,7 @@ export declare class AppsScriptAuth<TEmailPassword extends EmailPasswordAuthOpti
     readonly session: AppsScriptAuthSession;
     readonly signOut: AppsScriptAuthSignOut;
     readonly password: AppsScriptAuthPasswordApi<TEmailPassword>;
+    readonly registration: AppsScriptAuthRegistration;
     constructor({ repository, session, runtime, emailPassword, appsScript, hooks, }: AppsScriptAuthConfig<TEmailPassword, THookResult>);
 }
 export {};

package/dist/AppsScriptAuth.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppsScriptAuth = void 0;
 const AppsScriptAuthPassword_1 = require("./api/AppsScriptAuthPassword");
+const AppsScriptAuthRegistration_1 = require("./api/AppsScriptAuthRegistration");
 const AppsScriptAuthSession_1 = require("./api/AppsScriptAuthSession");
 const AppsScriptAuthSignIn_1 = require("./api/AppsScriptAuthSignIn");
 const AppsScriptAuthSignOut_1 = require("./api/AppsScriptAuthSignOut");
@@ -15,6 +16,7 @@ class AppsScriptAuth {
     session;
     signOut;
     password;
+    registration;
     constructor({ repository, session, runtime, emailPassword, appsScript, hooks, }) {
         const sessionStorage = (0, sessionStorageFactory_1.sessionStorageFactory)(session.storageType, {
             cacheService: runtime.cacheService,
@@ -61,6 +63,13 @@ class AppsScriptAuth {
                 emailPassword: emailPasswordConfig,
             })
             : undefined);
+        this.registration = new AppsScriptAuthRegistration_1.AppsScriptAuthRegistration({
+            emailPassword: emailPasswordConfig,
+            appsScript: appsScriptConfig,
+            repository,
+            utilities: runtime.utilities,
+            session: runtime.session,
+        });
     }
 }
 exports.AppsScriptAuth = AppsScriptAuth;

package/dist/api/AppsScriptAuthRegistration.d.ts

@@ -0,0 +1,19 @@
+import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
+import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
+import type { User } from "../domain/User";
+import { type AppsScriptRegistrationInput } from "../registration/AppsScriptRegistration";
+import { type EmailPasswordRegistrationInput } from "../registration/EmailPasswordRegistration";
+import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+export declare class AppsScriptAuthRegistration {
+    private readonly emailPasswordRegistration?;
+    private readonly appsScriptRegistration?;
+    constructor({ emailPassword, appsScript, repository, utilities, session, }: {
+        emailPassword?: EmailPasswordAuthConfig;
+        appsScript?: AppsScriptAuthenticationConfig;
+        repository: AppsScriptAuthRepository;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        session: GoogleAppsScript.Base.Session;
+    });
+    email(input: EmailPasswordRegistrationInput): Promise<User>;
+    appsScript(input: AppsScriptRegistrationInput): Promise<User>;
+}

package/dist/api/AppsScriptAuthRegistration.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthRegistration = void 0;
+const AppsScriptRegistration_1 = require("../registration/AppsScriptRegistration");
+const EmailPasswordRegistration_1 = require("../registration/EmailPasswordRegistration");
+class AppsScriptAuthRegistration {
+    emailPasswordRegistration;
+    appsScriptRegistration;
+    constructor({ emailPassword, appsScript, repository, utilities, session, }) {
+        if (emailPassword?.enabled) {
+            this.emailPasswordRegistration = new EmailPasswordRegistration_1.EmailPasswordRegistration(repository, utilities, emailPassword);
+        }
+        if (appsScript?.enabled) {
+            this.appsScriptRegistration = new AppsScriptRegistration_1.AppsScriptRegistration(utilities, session, repository);
+        }
+    }
+    async email(input) {
+        if (!this.emailPasswordRegistration) {
+            throw new Error("Email and password authentication is disabled");
+        }
+        return this.emailPasswordRegistration.register(input);
+    }
+    async appsScript(input) {
+        if (!this.appsScriptRegistration) {
+            throw new Error("Apps Script authentication is disabled");
+        }
+        return this.appsScriptRegistration.register(input);
+    }
+}
+exports.AppsScriptAuthRegistration = AppsScriptAuthRegistration;

package/dist/authorization/AppsScriptAuthorization.d.ts

@@ -0,0 +1,33 @@
+import type { AuthorizationPolicy, EffectivePermissions, PermissionOf, PermissionRequirement, PermissionStatement } from "./AuthorizationPolicy";
+import type { AuthorizationRepository } from "./AuthorizationRepository";
+type PolicyStatement<TPolicy> = TPolicy extends AuthorizationPolicy<infer TStatement, string> ? TStatement : never;
+type PolicyRole<TPolicy> = TPolicy extends {
+    readonly $types: {
+        readonly role: infer TRole;
+    };
+} ? Extract<TRole, string> : never;
+type PolicyPermission<TPolicy> = TPolicy extends {
+    readonly $types: {
+        readonly permission: infer TPermission;
+    };
+} ? Extract<TPermission, string> : never;
+export declare class AppsScriptAuthorization<TPolicy extends AuthorizationPolicy<PermissionStatement, string>> {
+    readonly role: {
+        assign(userId: string, role: PolicyRole<TPolicy>): Promise<void>;
+        revoke(userId: string, role: PolicyRole<TPolicy>): Promise<void>;
+    };
+    readonly permission: {
+        allow(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+        deny(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+        revoke(userId: string, permission: PolicyPermission<TPolicy>): Promise<void>;
+    };
+    private readonly policy;
+    private readonly repository;
+    constructor({ policy, repository, }: {
+        policy: TPolicy;
+        repository: AuthorizationRepository;
+    });
+    resolve(userId: string): Promise<EffectivePermissions<PermissionOf<PolicyStatement<TPolicy>>>>;
+    can(userId: string, requirement: PermissionRequirement<PolicyStatement<TPolicy>>): Promise<boolean>;
+}
+export {};

package/dist/authorization/AppsScriptAuthorization.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsScriptAuthorization = void 0;
+class AppsScriptAuthorization {
+    role;
+    permission;
+    policy;
+    repository;
+    constructor({ policy, repository, }) {
+        this.policy = policy;
+        this.repository = repository;
+        this.role = {
+            assign: (userId, role) => this.repository.role.assign(userId, role),
+            revoke: (userId, role) => this.repository.role.revoke(userId, role),
+        };
+        this.permission = {
+            allow: (userId, permission) => this.repository.permission.set(userId, permission, "allow"),
+            deny: (userId, permission) => this.repository.permission.set(userId, permission, "deny"),
+            revoke: (userId, permission) => this.repository.permission.revoke(userId, permission),
+        };
+    }
+    async resolve(userId) {
+        const [roles, permissions] = await Promise.all([
+            this.repository.role.findByUserId(userId),
+            this.repository.permission.findByUserId(userId),
+        ]);
+        return this.policy.resolve({
+            roles,
+            permissions,
+        });
+    }
+    async can(userId, requirement) {
+        return this.policy.can(await this.resolve(userId), requirement);
+    }
+}
+exports.AppsScriptAuthorization = AppsScriptAuthorization;

package/dist/authorization/AuthorizationPolicy.d.ts

@@ -0,0 +1,32 @@
+export type PermissionStatement = Record<string, readonly string[]>;
+export type PermissionOf<TStatement extends PermissionStatement> = {
+    [TResource in Extract<keyof TStatement, string>]: `${TResource}:${Extract<TStatement[TResource][number], string>}`;
+}[Extract<keyof TStatement, string>];
+export type PermissionRequirement<TStatement extends PermissionStatement> = {
+    readonly [TResource in keyof TStatement]?: readonly TStatement[TResource][number][];
+};
+export type EffectivePermissions<TPermission extends string> = readonly TPermission[];
+export type PermissionEffect = "allow" | "deny";
+export type StoredPermissionOverride = {
+    readonly permission: string;
+    readonly effect: PermissionEffect;
+};
+export type AuthorizationResolutionInput = {
+    readonly roles: readonly string[];
+    readonly permissions: readonly StoredPermissionOverride[];
+};
+type RoleGrantMap = ReadonlyMap<string, readonly string[]>;
+export declare class AuthorizationPolicy<const TStatement extends PermissionStatement, TRole extends string = never> {
+    readonly statement: TStatement;
+    readonly $types: {
+        readonly role: TRole;
+        readonly permission: PermissionOf<TStatement>;
+    };
+    private readonly permissions;
+    private readonly roleGrants;
+    constructor(statement: TStatement, roleGrants?: RoleGrantMap);
+    linkRole<const TName extends string, const TRequirement extends PermissionRequirement<TStatement>>(name: TName, requirement: TRequirement): AuthorizationPolicy<TStatement, TRole | TName>;
+    resolve(input: AuthorizationResolutionInput): EffectivePermissions<PermissionOf<TStatement>>;
+    can(permissions: EffectivePermissions<PermissionOf<TStatement>>, requirement: PermissionRequirement<TStatement>): boolean;
+}
+export {};

package/dist/authorization/AuthorizationPolicy.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationPolicy = void 0;
+function flattenRequirement(requirement) {
+    const permissions = [];
+    for (const [resource, actions] of Object.entries(requirement)) {
+        for (const action of actions ?? []) {
+            permissions.push(`${resource}:${action}`);
+        }
+    }
+    return permissions;
+}
+function unique(values) {
+    return [...new Set(values)];
+}
+class AuthorizationPolicy {
+    statement;
+    $types;
+    permissions;
+    roleGrants;
+    constructor(statement, roleGrants = new Map()) {
+        this.statement = statement;
+        this.permissions = new Set(flattenRequirement(statement));
+        this.roleGrants = roleGrants;
+    }
+    linkRole(name, requirement) {
+        return new AuthorizationPolicy(this.statement, new Map([
+            ...this.roleGrants,
+            [name, unique(flattenRequirement(requirement))],
+        ]));
+    }
+    resolve(input) {
+        const deniedPermissions = new Set(input.permissions
+            .filter(({ effect }) => effect === "deny")
+            .map(({ permission }) => permission)
+            .filter((permission) => this.permissions.has(permission)));
+        const resolved = new Set();
+        for (const { effect, permission } of input.permissions) {
+            if (effect === "allow" &&
+                this.permissions.has(permission) &&
+                !deniedPermissions.has(permission)) {
+                resolved.add(permission);
+            }
+        }
+        for (const role of input.roles) {
+            const permissions = this.roleGrants.get(role);
+            if (permissions === undefined) {
+                continue;
+            }
+            for (const permission of permissions) {
+                if (!deniedPermissions.has(permission)) {
+                    resolved.add(permission);
+                }
+            }
+        }
+        return [...resolved];
+    }
+    can(permissions, requirement) {
+        const granted = new Set(permissions);
+        return flattenRequirement(requirement).every((permission) => granted.has(permission));
+    }
+}
+exports.AuthorizationPolicy = AuthorizationPolicy;

package/dist/authorization/AuthorizationRepository.d.ts

@@ -0,0 +1,13 @@
+import type { StoredPermissionOverride } from "./AuthorizationPolicy";
+export interface AuthorizationRepository {
+    readonly role: {
+        findByUserId(userId: string): Promise<readonly string[]>;
+        assign(userId: string, role: string): Promise<void>;
+        revoke(userId: string, role: string): Promise<void>;
+    };
+    readonly permission: {
+        findByUserId(userId: string): Promise<readonly StoredPermissionOverride[]>;
+        set(userId: string, permission: string, effect: StoredPermissionOverride["effect"]): Promise<void>;
+        revoke(userId: string, permission: string): Promise<void>;
+    };
+}

package/dist/authorization/AuthorizationRepository.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/authorization/index.d.ts

@@ -0,0 +1 @@
+export { AuthorizationPolicy, type AuthorizationResolutionInput, type EffectivePermissions, type PermissionEffect, type PermissionOf, type PermissionRequirement, type PermissionStatement, type StoredPermissionOverride, } from "./AuthorizationPolicy";

package/dist/authorization/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationPolicy = void 0;
+var AuthorizationPolicy_1 = require("./AuthorizationPolicy");
+Object.defineProperty(exports, "AuthorizationPolicy", { enumerable: true, get: function () { return AuthorizationPolicy_1.AuthorizationPolicy; } });

package/dist/index.d.ts

@@ -1,7 +1,12 @@
 export { AppsScriptAuth } from "./AppsScriptAuth";
+export { AppsScriptAuthorization } from "./authorization/AppsScriptAuthorization";
 export type { AppsScriptAuthRepository } from "./storage/AppsScriptAuthRepository";
+export type { AuthorizationRepository } from "./authorization/AuthorizationRepository";
+export type { EffectivePermissions, PermissionEffect, PermissionOf, PermissionRequirement, PermissionStatement, StoredPermissionOverride, } from "./authorization/AuthorizationPolicy";
 export type { AuthSchema, AuthSchemaOptions } from "./schema/AuthSchema";
 export { createAuthTables } from "./schema/createAuthTables";
+export type { AuthorizationSchema, AuthorizationSchemaOptions, } from "./schema/AuthorizationSchema";
+export { createAuthorizationTables } from "./schema/createAuthorizationTables";
 export { authPattern, type AuthPattern } from "./AuthPattern";
 export { Account } from "./domain/Account";
 export { User } from "./domain/User";

package/dist/index.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EmailPasswordIdentity = exports.AppsScriptIdentity = exports.PasswordReset = exports.PasswordCredential = exports.Password = exports.HashedPassword = exports.User = exports.Account = exports.authPattern = exports.createAuthTables = exports.AppsScriptAuth = void 0;
+exports.EmailPasswordIdentity = exports.AppsScriptIdentity = exports.PasswordReset = exports.PasswordCredential = exports.Password = exports.HashedPassword = exports.User = exports.Account = exports.authPattern = exports.createAuthorizationTables = exports.createAuthTables = exports.AppsScriptAuthorization = exports.AppsScriptAuth = void 0;
 var AppsScriptAuth_1 = require("./AppsScriptAuth");
 Object.defineProperty(exports, "AppsScriptAuth", { enumerable: true, get: function () { return AppsScriptAuth_1.AppsScriptAuth; } });
+var AppsScriptAuthorization_1 = require("./authorization/AppsScriptAuthorization");
+Object.defineProperty(exports, "AppsScriptAuthorization", { enumerable: true, get: function () { return AppsScriptAuthorization_1.AppsScriptAuthorization; } });
 var createAuthTables_1 = require("./schema/createAuthTables");
 Object.defineProperty(exports, "createAuthTables", { enumerable: true, get: function () { return createAuthTables_1.createAuthTables; } });
+var createAuthorizationTables_1 = require("./schema/createAuthorizationTables");
+Object.defineProperty(exports, "createAuthorizationTables", { enumerable: true, get: function () { return createAuthorizationTables_1.createAuthorizationTables; } });
 var AuthPattern_1 = require("./AuthPattern");
 Object.defineProperty(exports, "authPattern", { enumerable: true, get: function () { return AuthPattern_1.authPattern; } });
 var Account_1 = require("./domain/Account");

package/dist/schema/AuthorizationSchema.d.ts

@@ -0,0 +1,64 @@
+export type AuthorizationSchemaOptions = {
+    role?: {
+        modelName?: string;
+        fields?: {
+            id?: string;
+            userId?: string;
+            role?: string;
+        };
+    };
+    permission?: {
+        modelName?: string;
+        fields?: {
+            id?: string;
+            userId?: string;
+            permission?: string;
+            effect?: string;
+        };
+    };
+};
+export type AuthorizationSchema = {
+    role: {
+        modelName: string;
+        fields: {
+            id: string;
+            userId: string;
+            role: string;
+        };
+    };
+    permission: {
+        modelName: string;
+        fields: {
+            id: string;
+            userId: string;
+            permission: string;
+            effect: string;
+        };
+    };
+};
+type Section<O, K extends PropertyKey> = K extends keyof O ? O[K] : undefined;
+type Fields<T> = [T] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<T> ? NonNullable<T>["fields"] : undefined;
+type PropertyOrDefault<T, K extends PropertyKey, Default extends string> = [
+    T
+] extends [null | undefined] ? Default : K extends keyof NonNullable<T> ? Exclude<NonNullable<T>[K], undefined> extends infer Value ? [Value] extends [never] ? Default : Value extends string ? Value : Default : Default : Default;
+export type ResolveAuthorizationSchema<O extends AuthorizationSchemaOptions> = {
+    role: {
+        modelName: PropertyOrDefault<Section<O, "role">, "modelName", "authorizationRole">;
+        fields: {
+            id: PropertyOrDefault<Fields<Section<O, "role">>, "id", "id">;
+            userId: PropertyOrDefault<Fields<Section<O, "role">>, "userId", "userId">;
+            role: PropertyOrDefault<Fields<Section<O, "role">>, "role", "role">;
+        };
+    };
+    permission: {
+        modelName: PropertyOrDefault<Section<O, "permission">, "modelName", "authorizationPermission">;
+        fields: {
+            id: PropertyOrDefault<Fields<Section<O, "permission">>, "id", "id">;
+            userId: PropertyOrDefault<Fields<Section<O, "permission">>, "userId", "userId">;
+            permission: PropertyOrDefault<Fields<Section<O, "permission">>, "permission", "permission">;
+            effect: PropertyOrDefault<Fields<Section<O, "permission">>, "effect", "effect">;
+        };
+    };
+};
+export declare function resolveAuthorizationSchema<const O extends AuthorizationSchemaOptions>(options: O): ResolveAuthorizationSchema<O>;
+export {};

package/dist/schema/AuthorizationSchema.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAuthorizationSchema = resolveAuthorizationSchema;
+function resolveAuthorizationSchema(options) {
+    return {
+        role: {
+            modelName: options.role?.modelName ?? "authorizationRole",
+            fields: {
+                id: options.role?.fields?.id ?? "id",
+                userId: options.role?.fields?.userId ?? "userId",
+                role: options.role?.fields?.role ?? "role",
+            },
+        },
+        permission: {
+            modelName: options.permission?.modelName ?? "authorizationPermission",
+            fields: {
+                id: options.permission?.fields?.id ?? "id",
+                userId: options.permission?.fields?.userId ?? "userId",
+                permission: options.permission?.fields?.permission ?? "permission",
+                effect: options.permission?.fields?.effect ?? "effect",
+            },
+        },
+    };
+}

package/dist/schema/createAuthorizationTables.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { type AuthorizationSchema, type AuthorizationSchemaOptions } from "./AuthorizationSchema";
+type RoleShape<S extends AuthorizationSchema> = {
+    [K in S["role"]["fields"]["id"] | S["role"]["fields"]["userId"] | S["role"]["fields"]["role"]]: z.ZodString;
+};
+type PermissionShape<S extends AuthorizationSchema> = {
+    [K in S["permission"]["fields"]["id"] | S["permission"]["fields"]["userId"] | S["permission"]["fields"]["permission"] | S["permission"]["fields"]["effect"]]: K extends S["permission"]["fields"]["effect"] ? z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }> : z.ZodString;
+};
+export declare function createAuthorizationTables<const O extends AuthorizationSchemaOptions = Record<never, never>>(options?: O): {
+    readonly schema: import("./AuthorizationSchema").ResolveAuthorizationSchema<O>;
+    readonly role: import("@gasboost/table").TableDefinition<["role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never] extends [null | undefined] ? "authorizationRole" : "modelName" extends infer T_1 ? T_1 extends "modelName" ? T_1 extends keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> ? Exclude<NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never>[T_1], undefined> extends infer Value ? [Value] extends [never] ? "authorizationRole" : Value extends string ? Value : "authorizationRole" : "authorizationRole" : "authorizationRole" : never : never, z.ZodObject<RoleShape<import("./AuthorizationSchema").ResolveAuthorizationSchema<O>> extends infer T_2 ? { -readonly [P in keyof T_2]: T_2[P]; } : never, z.core.$strip>> & {
+        readonly primaryKey: Extract<keyof z.core.$InferObjectOutput<RoleShape<import("./AuthorizationSchema").ResolveAuthorizationSchema<O>> extends infer T_2 ? { -readonly [P in keyof T_2]: T_2[P]; } : never, {}>, string>;
+    } & {
+        readonly primaryKey: [["role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> ? NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never>[keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> & "fields"] : undefined] extends [null | undefined] ? "id" : "id" extends infer T_3 ? T_3 extends "id" ? T_3 extends keyof NonNullable<["role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> ? NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never>[keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> & "fields"] : undefined> ? Exclude<NonNullable<["role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> ? NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never>[keyof NonNullable<"role" extends infer T ? T extends "role" ? T extends keyof O ? O[T] : undefined : never : never> & "fields"] : undefined>[T_3], undefined> extends infer Value ? [Value] extends [never] ? "id" : Value extends string ? Value : "id" : "id" : "id" : never : never;
+    };
+    readonly permission: import("@gasboost/table").TableDefinition<["permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never] extends [null | undefined] ? "authorizationPermission" : "modelName" extends infer T_5 ? T_5 extends "modelName" ? T_5 extends keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> ? Exclude<NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never>[T_5], undefined> extends infer Value ? [Value] extends [never] ? "authorizationPermission" : Value extends string ? Value : "authorizationPermission" : "authorizationPermission" : "authorizationPermission" : never : never, z.ZodObject<PermissionShape<import("./AuthorizationSchema").ResolveAuthorizationSchema<O>> extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P]; } : never, z.core.$strip>> & {
+        readonly primaryKey: Extract<keyof z.core.$InferObjectOutput<PermissionShape<import("./AuthorizationSchema").ResolveAuthorizationSchema<O>> extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P]; } : never, {}>, string>;
+    } & {
+        readonly primaryKey: [["permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> ? NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never>[keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> & "fields"] : undefined] extends [null | undefined] ? "id" : "id" extends infer T_7 ? T_7 extends "id" ? T_7 extends keyof NonNullable<["permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> ? NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never>[keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> & "fields"] : undefined> ? Exclude<NonNullable<["permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never] extends [null | undefined] ? undefined : "fields" extends keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> ? NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never>[keyof NonNullable<"permission" extends infer T_4 ? T_4 extends "permission" ? T_4 extends keyof O ? O[T_4] : undefined : never : never> & "fields"] : undefined>[T_7], undefined> extends infer Value ? [Value] extends [never] ? "id" : Value extends string ? Value : "id" : "id" : "id" : never : never;
+    };
+};
+export {};

package/dist/schema/createAuthorizationTables.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorizationTables = createAuthorizationTables;
+const zod_1 = require("zod");
+const AuthorizationSchema_1 = require("./AuthorizationSchema");
+function ensureUniqueFieldNames(modelName, fields) {
+    const fieldNames = Object.values(fields);
+    if (new Set(fieldNames).size !== fieldNames.length) {
+        throw new Error(`Field names for '${modelName}' must be unique.`);
+    }
+}
+function keyedTable(definition) {
+    return definition;
+}
+function createAuthorizationTables(options = {}) {
+    const schema = (0, AuthorizationSchema_1.resolveAuthorizationSchema)(options);
+    ensureUniqueFieldNames(schema.role.modelName, schema.role.fields);
+    ensureUniqueFieldNames(schema.permission.modelName, schema.permission.fields);
+    const roleSchema = zod_1.z.object({
+        [schema.role.fields.id]: zod_1.z.string(),
+        [schema.role.fields.userId]: zod_1.z.string(),
+        [schema.role.fields.role]: zod_1.z.string(),
+    });
+    const permissionSchema = zod_1.z.object({
+        [schema.permission.fields.id]: zod_1.z.string(),
+        [schema.permission.fields.userId]: zod_1.z.string(),
+        [schema.permission.fields.permission]: zod_1.z.string(),
+        [schema.permission.fields.effect]: zod_1.z.enum(["allow", "deny"]),
+    });
+    return {
+        schema,
+        role: keyedTable({
+            name: schema.role.modelName,
+            schema: roleSchema,
+            primaryKey: schema.role.fields.id,
+        }),
+        permission: keyedTable({
+            name: schema.permission.modelName,
+            schema: permissionSchema,
+            primaryKey: schema.permission.fields.id,
+        }),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gasboost/auth",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Modern authentication for Google Apps Script with email/password, Apps Script authentication, sessions, and password reset.",
   "keywords": [
     "google-apps-script",
@@ -25,6 +25,10 @@
     ".": {
       "default": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./authorization": {
+      "default": "./dist/authorization/index.js",
+      "types": "./dist/authorization/index.d.ts"
     }
   },
   "repository": {