@generazioneai/authz 0.0.1

package/dist/resource-registry.module.js

@@ -0,0 +1,67 @@
+"use strict";
+// Step 1 DEC-17/18: NestJS DI module for explicit manifest registration.
+//
+// Wiring (in each owning service):
+//   @Module({
+//     imports: [
+//       ResourceRegistryModule.forRoot(),                          // once, app root
+//       ResourceRegistryModule.forFeature([JuridicalIndividualResource]),  // per feature module
+//     ],
+//   })
+//
+// DEC-17: registration is EXPLICIT (no glob magic) — a manifest not passed to
+// forFeature is never registered, and TypeScript flags a missing import.
+// DEC-3: the registry throws on a duplicate subject/prismaModel.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceRegistryModule = exports.RESOURCE_REGISTRY = void 0;
+const resource_registry_1 = require("./resource-registry");
+/** DI token for the per-process ResourceRegistry (alias of the class token). */
+exports.RESOURCE_REGISTRY = Symbol('skillera:resource-registry');
+class ResourceRegistryModule {
+    /**
+     * Provides the singleton `ResourceRegistry` for the process. Global, so
+     * `forFeature(...)` in any feature module can inject it. Call once at app root.
+     */
+    static forRoot(options = {}) {
+        const registry = options.registry ?? new resource_registry_1.ResourceRegistry();
+        for (const m of options.manifests ?? [])
+            registry.register(m);
+        const providers = [
+            { provide: resource_registry_1.ResourceRegistry, useValue: registry },
+            { provide: exports.RESOURCE_REGISTRY, useValue: registry },
+        ];
+        return {
+            module: ResourceRegistryModule,
+            global: true,
+            providers,
+            exports: [resource_registry_1.ResourceRegistry, exports.RESOURCE_REGISTRY],
+        };
+    }
+    /**
+     * Registers a feature module's manifests into the root registry. The factory
+     * runs at bootstrap (eager, non-request-scoped) and registers each manifest;
+     * a duplicate subject/prismaModel surfaces as a startup error (DEC-3).
+     */
+    static forFeature(manifests) {
+        const token = `skillera:resource-feature:${manifests
+            .map((m) => m.subject)
+            .sort()
+            .join(',')}`;
+        const provider = {
+            provide: token,
+            useFactory: (registry) => {
+                for (const m of manifests)
+                    registry.register(m);
+                return manifests;
+            },
+            inject: [resource_registry_1.ResourceRegistry],
+        };
+        return {
+            module: ResourceRegistryModule,
+            providers: [provider],
+            exports: [provider],
+        };
+    }
+}
+exports.ResourceRegistryModule = ResourceRegistryModule;
+//# sourceMappingURL=resource-registry.module.js.map

package/dist/resource-registry.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-registry.module.js","sourceRoot":"","sources":["../src/resource-registry.module.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,EAAE;AACF,mCAAmC;AACnC,cAAc;AACd,iBAAiB;AACjB,qFAAqF;AACrF,iGAAiG;AACjG,SAAS;AACT,OAAO;AACP,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,iEAAiE;;;AAQjE,2DAAuD;AAEvD,gFAAgF;AACnE,QAAA,iBAAiB,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAStE,MAAa,sBAAsB;IACjC;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAuC,EAAE;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,oCAAgB,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;YAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,oCAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACjD,EAAE,OAAO,EAAE,yBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACnD,CAAC;QACF,OAAO;YACL,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,OAAO,EAAE,CAAC,oCAAgB,EAAE,yBAAiB,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,SAA6B;QAC7C,MAAM,KAAK,GAAG,6BAA6B,SAAS;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrB,IAAI,EAAE;aACN,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,QAAQ,GAAa;YACzB,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,CAAC,QAA0B,EAAE,EAAE;gBACzC,KAAK,MAAM,CAAC,IAAI,SAAS;oBAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAChD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,EAAE,CAAC,oCAAgB,CAAC;SAC3B,CAAC;QACF,OAAO;YACL,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC;IACJ,CAAC;CACF;AA7CD,wDA6CC"}

package/dist/scope-substitute.d.ts

@@ -0,0 +1,20 @@
+import type { AuthzContext } from './context/authz-context';
+/**
+ * Sostituisce ricorsivamente `{ $ctx: 'path' }` con `getPath(ctx, path)`.
+ * Preserva tipi primitivi e shape oggetto/array.
+ *
+ * Esempio:
+ *   substituteContext(
+ *     { juridicalId: { $ctx: 'tenantId' } },
+ *     { tenantId: 'abc', ... }
+ *   )
+ *   → { juridicalId: 'abc' }
+ *
+ *   substituteContext(
+ *     { enrolledLearnerIds: { hasSome: { $ctx: 'connected.studentsOfTeacher' } } },
+ *     ctx
+ *   )
+ *   → { enrolledLearnerIds: { hasSome: ['student1', 'student2'] } }
+ */
+export declare function substituteContext<T = any>(template: any, ctx: AuthzContext): T;
+//# sourceMappingURL=scope-substitute.d.ts.map

package/dist/scope-substitute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-substitute.d.ts","sourceRoot":"","sources":["../src/scope-substitute.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAc5D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,GAAG,GAAG,EACvC,QAAQ,EAAE,GAAG,EACb,GAAG,EAAE,YAAY,GAChB,CAAC,CAkBH"}

package/dist/scope-substitute.js

@@ -0,0 +1,58 @@
+"use strict";
+// Step 1 + Step 4 DEC-S4.1: substituteContext()
+// Sostituisce ricorsivamente i placeholder `{ $ctx: 'path.to.value' }`
+// con i valori effettivi presi da `AuthzContext`.
+//
+// Usato da skillID snapshot builder per trasformare i template manifest in
+// rules CASL pronte (post-substitution) che viaggiano nello snapshot envelope.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.substituteContext = substituteContext;
+/** Risolve una path "a.b.c" in un oggetto profondo. Ritorna undefined su miss. */
+function getPath(obj, path) {
+    if (!path)
+        return obj;
+    const parts = path.split('.');
+    let current = obj;
+    for (const part of parts) {
+        if (current == null)
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Sostituisce ricorsivamente `{ $ctx: 'path' }` con `getPath(ctx, path)`.
+ * Preserva tipi primitivi e shape oggetto/array.
+ *
+ * Esempio:
+ *   substituteContext(
+ *     { juridicalId: { $ctx: 'tenantId' } },
+ *     { tenantId: 'abc', ... }
+ *   )
+ *   → { juridicalId: 'abc' }
+ *
+ *   substituteContext(
+ *     { enrolledLearnerIds: { hasSome: { $ctx: 'connected.studentsOfTeacher' } } },
+ *     ctx
+ *   )
+ *   → { enrolledLearnerIds: { hasSome: ['student1', 'student2'] } }
+ */
+function substituteContext(template, ctx) {
+    if (template === null || template === undefined)
+        return template;
+    if (typeof template !== 'object')
+        return template;
+    // Placeholder $ctx
+    if ('$ctx' in template && typeof template.$ctx === 'string') {
+        return getPath(ctx, template.$ctx);
+    }
+    if (Array.isArray(template)) {
+        return template.map((item) => substituteContext(item, ctx));
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(template)) {
+        out[key] = substituteContext(value, ctx);
+    }
+    return out;
+}
+//# sourceMappingURL=scope-substitute.js.map

package/dist/scope-substitute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-substitute.js","sourceRoot":"","sources":["../src/scope-substitute.ts"],"names":[],"mappings":";AAAA,gDAAgD;AAChD,uEAAuE;AACvE,kDAAkD;AAClD,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;;AAiC/E,8CAqBC;AAlDD,kFAAkF;AAClF,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,iBAAiB,CAC/B,QAAa,EACb,GAAiB;IAEjB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAElD,mBAAmB;IACnB,IAAI,MAAM,IAAI,QAAQ,IAAI,OAAQ,QAAgB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,GAAG,EAAG,QAAgB,CAAC,IAAI,CAAM,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAiB,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@generazioneai/authz",
+  "version": "0.0.1",
+  "description": "Runtime authz + autoquery for Skillera microservices",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "authz-check": "dist/codegen/authz-check.js",
+    "authz-codegen": "dist/codegen/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:GenerazioneAI-SRL/SKILLERA-AUTHZ-PACKAGES.git",
+    "directory": "packages/authz"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "rm -rf dist",
+    "test": "jest",
+    "test:cov": "jest --coverage",
+    "lint": "echo 'TODO: lint' && exit 0",
+    "authz:genkey": "ts-node scripts/generate-key.ts"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./internal": {
+      "types": "./dist/internal/index.d.ts",
+      "default": "./dist/internal/index.js"
+    },
+    "./nats": {
+      "types": "./dist/nats/index.d.ts",
+      "default": "./dist/nats/index.js"
+    },
+    "./nest": {
+      "types": "./dist/nest/index.d.ts",
+      "default": "./dist/nest/index.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "nats": [
+        "dist/nats/index.d.ts"
+      ],
+      "nest": [
+        "dist/nest/index.d.ts"
+      ],
+      "internal": [
+        "dist/internal/index.d.ts"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@casl/ability": "^6.7.0",
+    "@casl/prisma": "^1.5.0 || ^2.0.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/microservices": "^11.0.0",
+    "@prisma/client": "^6.0.0 || ^7.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@prisma/client": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.4.0",
+    "ioredis": "^5.4.0",
+    "jose": "^6.0.10",
+    "json-stable-stringify": "^1.1.1",
+    "lru-cache": "^10.4.0",
+    "lz4-napi": "^2.7.0"
+  },
+  "devDependencies": {
+    "@casl/ability": "^6.7.3",
+    "@casl/prisma": "^1.5.0",
+    "@nestjs/core": "^11.1.24",
+    "@nestjs/microservices": "^11.1.24",
+    "@types/json-stable-stringify": "^1.0.36",
+    "@types/node": "^22.0.0",
+    "rxjs": "^7.8.2",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.1.3"
+  }
+}