@grantjs/server 1.0.0 → 1.1.0

package/dist/fastify.mjs

@@ -1,104 +1,131 @@
-import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from "./index.mjs";
-import { GrantServerError } from "./index.mjs";
-import { e as extractTokenFromRequest, G as GrantClient } from "./grant-client-D1LZI2f4.js";
-import { d as debugGrant } from "./debug-C8ibbrE5.js";
+import { i as extractTokenFromRequest, t as GrantClient } from "./grant-client-t3KadxFo.js";
+import { a as NotFoundError, i as GrantServerError, n as AuthorizationError, r as BadRequestError, t as AuthenticationError } from "./errors-CSC_Z_KP.js";
+import { t as debugGrant } from "./debug-DICR8lwQ.js";
+//#region src/fastify/plugin.ts
+/**
+* Create a Fastify preHandler hook to check if user is granted permission
+*
+* @example
+* ```ts
+* import { grant } from '@grantjs/server/fastify';
+* import { GrantClient } from '@grantjs/server';
+* import Fastify from 'fastify';
+*
+* const fastify = Fastify();
+* const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });
+*
+* fastify.get('/organizations', {
+*   preHandler: grant(grantClient, {
+*     resource: 'Organization',
+*     action: 'Query',
+*   }),
+* }, async (request, reply) => {
+*   return { organizations: [] };
+* });
+* ```
+*/
 function grant(client, options) {
-  return async (request, reply) => {
-    try {
-      debugGrant("Fastify", { resource: options.resource, action: options.action });
-      const token = await extractTokenFromRequest(request, client.config);
-      if (!token) {
-        reply.status(401).send({
-          error: "Unauthorized",
-          code: "UNAUTHENTICATED"
-        });
-        return;
-      }
-      let resolvedResource = null;
-      if (options.resourceResolver) {
-        resolvedResource = await options.resourceResolver({
-          resourceSlug: options.resource,
-          request
-        });
-        if (!resolvedResource) {
-          reply.status(404).send({
-            error: "Resource not found",
-            code: "NOT_FOUND"
-          });
-          return;
-        }
-      }
-      const result = await client.isAuthorized(
-        options.resource,
-        options.action,
-        {
-          context: {
-            resource: resolvedResource || void 0
-          }
-        },
-        request
-      );
-      debugGrant("Fastify", {
-        resource: options.resource,
-        action: options.action,
-        authorized: result.authorized,
-        ...result.authorized ? {} : { reason: result.reason }
-      });
-      if (!result.authorized) {
-        reply.status(403).send({
-          error: "Forbidden",
-          code: "FORBIDDEN",
-          reason: result.reason
-        });
-        return;
-      }
-      request.authorization = result;
-    } catch (error) {
-      if (error instanceof AuthenticationError) {
-        reply.status(401).send({
-          error: error.message,
-          code: error.code
-        });
-        return;
-      }
-      if (error instanceof AuthorizationError) {
-        reply.status(403).send({
-          error: error.message,
-          code: error.code,
-          reason: error.reason
-        });
-        return;
-      }
-      if (error instanceof BadRequestError) {
-        reply.status(400).send({
-          error: error.message,
-          code: error.code
-        });
-        return;
-      }
-      if (error instanceof NotFoundError) {
-        reply.status(404).send({
-          error: error.message,
-          code: error.code
-        });
-        return;
-      }
-      throw error;
-    }
-  };
+	return async (request, reply) => {
+		try {
+			debugGrant("Fastify", {
+				resource: options.resource,
+				action: options.action
+			});
+			if (!await extractTokenFromRequest(request, client.config)) {
+				reply.status(401).send({
+					error: "Unauthorized",
+					code: "UNAUTHENTICATED"
+				});
+				return;
+			}
+			let resolvedResource = null;
+			if (options.resourceResolver) {
+				resolvedResource = await options.resourceResolver({
+					resourceSlug: options.resource,
+					request
+				});
+				if (!resolvedResource) {
+					reply.status(404).send({
+						error: "Resource not found",
+						code: "NOT_FOUND"
+					});
+					return;
+				}
+			}
+			const result = await client.isAuthorized(options.resource, options.action, { context: { resource: resolvedResource || void 0 } }, request);
+			debugGrant("Fastify", {
+				resource: options.resource,
+				action: options.action,
+				authorized: result.authorized,
+				...result.authorized ? {} : { reason: result.reason }
+			});
+			if (!result.authorized) {
+				reply.status(403).send({
+					error: "Forbidden",
+					code: "FORBIDDEN",
+					reason: result.reason
+				});
+				return;
+			}
+			request.authorization = result;
+		} catch (error) {
+			if (error instanceof AuthenticationError) {
+				reply.status(401).send({
+					error: error.message,
+					code: error.code
+				});
+				return;
+			}
+			if (error instanceof AuthorizationError) {
+				reply.status(403).send({
+					error: error.message,
+					code: error.code,
+					reason: error.reason
+				});
+				return;
+			}
+			if (error instanceof BadRequestError) {
+				reply.status(400).send({
+					error: error.message,
+					code: error.code
+				});
+				return;
+			}
+			if (error instanceof NotFoundError) {
+				reply.status(404).send({
+					error: error.message,
+					code: error.code
+				});
+				return;
+			}
+			throw error;
+		}
+	};
 }
-const grantPlugin = async (fastify, options) => {
-  const grant2 = new GrantClient(options);
-  fastify.decorate("grant", grant2);
+/**
+* Fastify plugin that decorates the instance with GrantClient
+*
+* @example
+* ```ts
+* import Fastify from 'fastify';
+* import { grantPlugin } from '@grantjs/server/fastify';
+*
+* const fastify = Fastify();
+*
+* await fastify.register(grantPlugin, {
+*   apiUrl: 'https://api.grant.com',
+*   cookieName: 'grant-access-token',
+* });
+*
+* // GrantClient is now available on fastify.grant
+* const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });
+* ```
+*/
+var grantPlugin = async (fastify, options) => {
+	const grant = new GrantClient(options);
+	fastify.decorate("grant", grant);
 };
-export {
-  AuthenticationError,
-  AuthorizationError,
-  BadRequestError,
-  GrantClient,
-  GrantServerError,
-  NotFoundError,
-  grant,
-  grantPlugin
-};
-//# sourceMappingURL=fastify.mjs.map
+//#endregion
+export { AuthenticationError, AuthorizationError, BadRequestError, GrantClient, GrantServerError, NotFoundError, grant, grantPlugin };
+
+//# sourceMappingURL=fastify.mjs.map

package/dist/fastify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.mjs","sources":["../src/fastify/plugin.ts"],"sourcesContent":["import { FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify';\n\nimport { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult, GrantServerConfig } from '../types';\n\n/**\n * Extended Fastify Request with authorization result\n */\nexport interface AuthorizedFastifyRequest extends FastifyRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Fastify preHandler hook\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create a Fastify preHandler hook to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/fastify';\n * import { GrantClient } from '@grantjs/server';\n * import Fastify from 'fastify';\n *\n * const fastify = Fastify();\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * fastify.get('/organizations', {\n *   preHandler: grant(grantClient, {\n *     resource: 'Organization',\n *     action: 'Query',\n *   }),\n * }, async (request, reply) => {\n *   return { organizations: [] };\n * });\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (request: AuthorizedFastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request: AuthorizedFastifyRequest, reply: FastifyReply): Promise<void> => {\n    try {\n      debugGrant('Fastify', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(request, client.config);\n      if (!token) {\n        reply.status(401).send({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: request,\n        });\n\n        if (!resolvedResource) {\n          reply.status(404).send({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        request\n      );\n\n      debugGrant('Fastify', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        reply.status(403).send({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      request.authorization = result;\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        reply.status(401).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        reply.status(403).send({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        reply.status(400).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        reply.status(404).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - rethrow to let Fastify handle it\n      throw error;\n    }\n  };\n}\n\n/**\n * Fastify plugin options\n * Extends GrantServerConfig - plugin-specific options can be added here in the future\n */\nexport type GrantPluginOptions = GrantServerConfig;\n\n/**\n * Fastify plugin that decorates the instance with GrantClient\n *\n * @example\n * ```ts\n * import Fastify from 'fastify';\n * import { grantPlugin } from '@grantjs/server/fastify';\n *\n * const fastify = Fastify();\n *\n * await fastify.register(grantPlugin, {\n *   apiUrl: 'https://api.grant.com',\n *   cookieName: 'grant-access-token',\n * });\n *\n * // GrantClient is now available on fastify.grant\n * const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });\n * ```\n */\nexport const grantPlugin: FastifyPluginAsync<GrantPluginOptions> = async (fastify, options) => {\n  const grant = new GrantClient(options);\n\n  // Decorate Fastify instance with GrantClient\n  fastify.decorate('grant', grant);\n};\n\n// Type declaration for TypeScript\n// This will work once Fastify is installed (it's a peer dependency)\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    grant: GrantClient;\n  }\n}\n"],"names":["grant"],"mappings":";;;;AAkDO,SAAS,MACd,QACA,SAC2E;AAC3E,SAAO,OAAO,SAAmC,UAAuC;AACtF,QAAI;AACF,iBAAW,WAAW,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAG5E,YAAM,QAAQ,MAAM,wBAAwB,SAAS,OAAO,MAAM;AAClE,UAAI,CAAC,OAAO;AACV,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,QAAA,CACP;AACD;AAAA,MACF;AAGA,UAAI,mBAAmD;AAEvD,UAAI,QAAQ,kBAAkB;AAC5B,2BAAmB,MAAM,QAAQ,iBAAiB;AAAA,UAChD,cAAc,QAAQ;AAAA,UACtB;AAAA,QAAA,CACD;AAED,YAAI,CAAC,kBAAkB;AACrB,gBAAM,OAAO,GAAG,EAAE,KAAK;AAAA,YACrB,OAAO;AAAA,YACP,MAAM;AAAA,UAAA,CACP;AACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,UACE,SAAS;AAAA,YACP,UAAU,oBAAoB;AAAA,UAAA;AAAA,QAChC;AAAA,QAEF;AAAA,MAAA;AAGF,iBAAW,WAAW;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MAAO,CACtD;AAED,UAAI,CAAC,OAAO,YAAY;AACtB,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA,CAChB;AACD;AAAA,MACF;AAGA,cAAQ,gBAAgB;AAAA,IAC1B,SAAS,OAAO;AAEd,UAAI,iBAAiB,qBAAqB;AACxC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,oBAAoB;AACvC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,QAAA,CACf;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,iBAAiB;AACpC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,eAAe;AAClC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AA2BO,MAAM,cAAsD,OAAO,SAAS,YAAY;AAC7F,QAAMA,SAAQ,IAAI,YAAY,OAAO;AAGrC,UAAQ,SAAS,SAASA,MAAK;AACjC;"}
+{"version":3,"file":"fastify.mjs","names":[],"sources":["../src/fastify/plugin.ts"],"sourcesContent":["import { FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify';\n\nimport { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport type { AuthorizationResult, GrantServerConfig, ResourceResolver } from '../types';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\n/**\n * Extended Fastify Request with authorization result\n */\nexport interface AuthorizedFastifyRequest extends FastifyRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Fastify preHandler hook\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create a Fastify preHandler hook to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/fastify';\n * import { GrantClient } from '@grantjs/server';\n * import Fastify from 'fastify';\n *\n * const fastify = Fastify();\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * fastify.get('/organizations', {\n *   preHandler: grant(grantClient, {\n *     resource: 'Organization',\n *     action: 'Query',\n *   }),\n * }, async (request, reply) => {\n *   return { organizations: [] };\n * });\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (request: AuthorizedFastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request: AuthorizedFastifyRequest, reply: FastifyReply): Promise<void> => {\n    try {\n      debugGrant('Fastify', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(request, client.config);\n      if (!token) {\n        reply.status(401).send({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: request,\n        });\n\n        if (!resolvedResource) {\n          reply.status(404).send({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        request\n      );\n\n      debugGrant('Fastify', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        reply.status(403).send({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      request.authorization = result;\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        reply.status(401).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        reply.status(403).send({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        reply.status(400).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        reply.status(404).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - rethrow to let Fastify handle it\n      throw error;\n    }\n  };\n}\n\n/**\n * Fastify plugin options\n * Extends GrantServerConfig - plugin-specific options can be added here in the future\n */\nexport type GrantPluginOptions = GrantServerConfig;\n\n/**\n * Fastify plugin that decorates the instance with GrantClient\n *\n * @example\n * ```ts\n * import Fastify from 'fastify';\n * import { grantPlugin } from '@grantjs/server/fastify';\n *\n * const fastify = Fastify();\n *\n * await fastify.register(grantPlugin, {\n *   apiUrl: 'https://api.grant.com',\n *   cookieName: 'grant-access-token',\n * });\n *\n * // GrantClient is now available on fastify.grant\n * const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });\n * ```\n */\nexport const grantPlugin: FastifyPluginAsync<GrantPluginOptions> = async (fastify, options) => {\n  const grant = new GrantClient(options);\n\n  // Decorate Fastify instance with GrantClient\n  fastify.decorate('grant', grant);\n};\n\n// Type declaration for TypeScript\n// This will work once Fastify is installed (it's a peer dependency)\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    grant: GrantClient;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,MACd,QACA,SAC2E;AAC3E,QAAO,OAAO,SAAmC,UAAuC;AACtF,MAAI;AACF,cAAW,WAAW;IAAE,UAAU,QAAQ;IAAU,QAAQ,QAAQ;IAAQ,CAAC;AAI7E,OAAI,CAAC,MADe,wBAAwB,SAAS,OAAO,OAAO,EACvD;AACV,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO;KACP,MAAM;KACP,CAAC;AACF;;GAIF,IAAI,mBAAmD;AAEvD,OAAI,QAAQ,kBAAkB;AAC5B,uBAAmB,MAAM,QAAQ,iBAAiB;KAChD,cAAc,QAAQ;KACb;KACV,CAAC;AAEF,QAAI,CAAC,kBAAkB;AACrB,WAAM,OAAO,IAAI,CAAC,KAAK;MACrB,OAAO;MACP,MAAM;MACP,CAAC;AACF;;;GAKJ,MAAM,SAAS,MAAM,OAAO,aAC1B,QAAQ,UACR,QAAQ,QACR,EACE,SAAS,EACP,UAAU,oBAAoB,KAAA,GAC/B,EACF,EACD,QACD;AAED,cAAW,WAAW;IACpB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IAChB,YAAY,OAAO;IACnB,GAAI,OAAO,aAAa,EAAE,GAAG,EAAE,QAAQ,OAAO,QAAQ;IACvD,CAAC;AAEF,OAAI,CAAC,OAAO,YAAY;AACtB,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO;KACP,MAAM;KACN,QAAQ,OAAO;KAChB,CAAC;AACF;;AAIF,WAAQ,gBAAgB;WACjB,OAAO;AAEd,OAAI,iBAAiB,qBAAqB;AACxC,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO,MAAM;KACb,MAAM,MAAM;KACb,CAAC;AACF;;AAGF,OAAI,iBAAiB,oBAAoB;AACvC,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO,MAAM;KACb,MAAM,MAAM;KACZ,QAAQ,MAAM;KACf,CAAC;AACF;;AAGF,OAAI,iBAAiB,iBAAiB;AACpC,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO,MAAM;KACb,MAAM,MAAM;KACb,CAAC;AACF;;AAGF,OAAI,iBAAiB,eAAe;AAClC,UAAM,OAAO,IAAI,CAAC,KAAK;KACrB,OAAO,MAAM;KACb,MAAM,MAAM;KACb,CAAC;AACF;;AAIF,SAAM;;;;;;;;;;;;;;;;;;;;;;;AA8BZ,IAAa,cAAsD,OAAO,SAAS,YAAY;CAC7F,MAAM,QAAQ,IAAI,YAAY,QAAQ;AAGtC,SAAQ,SAAS,SAAS,MAAM"}

package/dist/grant-client-f6IKMyk5.cjs

@@ -0,0 +1,228 @@
+//#region src/utils/token-extractor.ts
+/**
+* Extract Bearer token from Authorization header
+*/
+function extractBearerToken(authHeader) {
+	if (!authHeader) return null;
+	const parts = authHeader.trim().split(/\s+/);
+	if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") return null;
+	return parts[1];
+}
+/**
+* Parse cookie header string into key-value pairs
+*/
+function parseCookieHeader(cookieHeader) {
+	const cookies = {};
+	cookieHeader.split(";").forEach((cookie) => {
+		const [name, ...rest] = cookie.trim().split("=");
+		if (name && rest.length > 0) cookies[name.trim()] = rest.join("=").trim();
+	});
+	return cookies;
+}
+/**
+* Extract token from cookies
+*/
+function extractTokenFromCookies(cookieHeader, cookieName) {
+	if (!cookieHeader) return null;
+	return parseCookieHeader(cookieHeader)[cookieName] || null;
+}
+/**
+* Extract token from Express request
+*/
+async function extractTokenFromRequest(request, config) {
+	if (config.getToken) {
+		const token = await config.getToken(request);
+		if (token) return token;
+	}
+	const req = request;
+	if (!req?.headers) return null;
+	const headersGet = req.headers.get;
+	if (typeof headersGet === "function") {
+		const bearerToken = extractBearerToken(headersGet.call(req.headers, "authorization") ?? void 0);
+		if (bearerToken) return bearerToken;
+		const cookieName = config.cookieName || "grant-access-token";
+		const cookieHeader = headersGet.call(req.headers, "cookie");
+		if (cookieHeader) {
+			const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
+			if (cookieToken) return cookieToken;
+		}
+		return null;
+	}
+	const plainHeaders = req.headers;
+	const authHeader = plainHeaders.authorization;
+	const bearerToken = extractBearerToken(authHeader);
+	if (bearerToken) return bearerToken;
+	const cookieName = config.cookieName || "grant-access-token";
+	if (req.cookies?.[cookieName]) return req.cookies[cookieName];
+	const cookieHeader = plainHeaders.cookie;
+	if (cookieHeader) {
+		const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
+		if (cookieToken) return cookieToken;
+	}
+	return null;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/typeof.js
+function _typeof(o) {
+	"@babel/helpers - typeof";
+	return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
+		return typeof o;
+	} : function(o) {
+		return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+	}, _typeof(o);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/toPrimitive.js
+function toPrimitive(t, r) {
+	if ("object" != _typeof(t) || !t) return t;
+	var e = t[Symbol.toPrimitive];
+	if (void 0 !== e) {
+		var i = e.call(t, r || "default");
+		if ("object" != _typeof(i)) return i;
+		throw new TypeError("@@toPrimitive must return a primitive value.");
+	}
+	return ("string" === r ? String : Number)(t);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/toPropertyKey.js
+function toPropertyKey(t) {
+	var i = toPrimitive(t, "string");
+	return "symbol" == _typeof(i) ? i : i + "";
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/defineProperty.js
+function _defineProperty(e, r, t) {
+	return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
+		value: t,
+		enumerable: !0,
+		configurable: !0,
+		writable: !0
+	}) : e[r] = t, e;
+}
+//#endregion
+//#region src/grant-client.ts
+/**
+* Grant Client for server-side applications
+*
+* Makes HTTP requests to the Grant API to check permissions.
+* Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.
+* No caching - server-side caching is handled by grant-api.
+*/
+var GrantClient = class {
+	constructor(config) {
+		_defineProperty(this, "config", void 0);
+		this.config = config;
+	}
+	/**
+	* Check if the current user has a specific permission
+	*
+	* @example
+	* ```ts
+	* const canEdit = await grant.isGranted('document', 'update', { scope });
+	* if (canEdit) {
+	*   // Proceed with operation
+	* }
+	* ```
+	*/
+	async isGranted(resource, action, options, request) {
+		return (await this.isAuthorized(resource, action, options, request)).authorized;
+	}
+	/**
+	* Check authorization with full result details
+	*
+	* @example
+	* ```ts
+	* const result = await grant.isAuthorized('document', 'update', { scope }, request);
+	* if (!result.authorized) {
+	*   console.log('Denied:', result.reason);
+	* }
+	* ```
+	*/
+	async isAuthorized(resource, action, options, request) {
+		try {
+			const response = await this.fetchWithAuth("/api/auth/is-authorized", {
+				method: "POST",
+				body: JSON.stringify({
+					permission: {
+						resource,
+						action
+					},
+					context: { resource: options?.context?.resource || null }
+				})
+			}, request);
+			if (!response.ok) return {
+				authorized: false,
+				reason: (await response.json().catch(() => ({}))).message || `API error: ${response.status}`
+			};
+			const json = await response.json();
+			return json.data ?? json;
+		} catch (error) {
+			return {
+				authorized: false,
+				reason: error instanceof Error ? error.message : "Unknown error"
+			};
+		}
+	}
+	/**
+	* Extract token from a request object
+	* Useful for middleware that needs to extract token before making authorization calls
+	*/
+	async getTokenFromRequest(request) {
+		return extractTokenFromRequest(request, this.config);
+	}
+	/**
+	* Make an authenticated fetch request (token from request; no refresh).
+	*/
+	async fetchWithAuth(url, init, request) {
+		return this.doFetch(url, init, request);
+	}
+	/**
+	* Perform the actual fetch request
+	*/
+	async doFetch(url, init, request) {
+		const fetchFn = this.config.fetch ?? globalThis.fetch;
+		const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
+		const headers = {
+			"Content-Type": "application/json",
+			...init?.headers
+		};
+		if (request) {
+			const token = await extractTokenFromRequest(request, this.config);
+			if (token) headers["Authorization"] = `Bearer ${token}`;
+			const req = request;
+			if (req.headers?.cookie) headers["Cookie"] = req.headers.cookie;
+		}
+		return fetchFn(fullUrl, {
+			...init,
+			headers,
+			credentials: this.config.credentials ?? "include"
+		});
+	}
+};
+//#endregion
+Object.defineProperty(exports, "GrantClient", {
+	enumerable: true,
+	get: function() {
+		return GrantClient;
+	}
+});
+Object.defineProperty(exports, "_defineProperty", {
+	enumerable: true,
+	get: function() {
+		return _defineProperty;
+	}
+});
+Object.defineProperty(exports, "extractBearerToken", {
+	enumerable: true,
+	get: function() {
+		return extractBearerToken;
+	}
+});
+Object.defineProperty(exports, "extractTokenFromRequest", {
+	enumerable: true,
+	get: function() {
+		return extractTokenFromRequest;
+	}
+});
+
+//# sourceMappingURL=grant-client-f6IKMyk5.cjs.map

package/dist/grant-client-f6IKMyk5.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-client-f6IKMyk5.cjs","names":[],"sources":["../src/utils/token-extractor.ts","../src/grant-client.ts"],"sourcesContent":["import type { GrantServerConfig } from '../types';\n\n/**\n * Extract Bearer token from Authorization header\n */\nexport function extractBearerToken(authHeader: string | undefined): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.trim().split(/\\s+/);\n  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n    return null;\n  }\n\n  return parts[1];\n}\n\n/**\n * Parse cookie header string into key-value pairs\n */\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n\n  cookieHeader.split(';').forEach((cookie) => {\n    const [name, ...rest] = cookie.trim().split('=');\n    if (name && rest.length > 0) {\n      cookies[name.trim()] = rest.join('=').trim();\n    }\n  });\n\n  return cookies;\n}\n\n/**\n * Extract token from cookies\n */\nexport function extractTokenFromCookies(\n  cookieHeader: string | undefined,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const cookies = parseCookieHeader(cookieHeader);\n  return cookies[cookieName] || null;\n}\n\n/**\n * Extract token from Express request\n */\nexport async function extractTokenFromRequest(\n  request: unknown,\n  config: GrantServerConfig\n): Promise<string | null> {\n  // Use custom token resolver if provided\n  if (config.getToken) {\n    const token = await config.getToken(request);\n    if (token) return token;\n  }\n\n  // Try to extract from request (Express-style or Web API / NextRequest)\n  const req = request as {\n    headers?:\n      | { authorization?: string; cookie?: string }\n      | { get: (name: string) => string | null };\n    cookies?: Record<string, string>;\n  };\n\n  if (!req?.headers) return null;\n\n  // Web API Headers (NextRequest, Request): headers.get(name)\n  const headersGet = (req.headers as { get?: (name: string) => string | null }).get;\n  if (typeof headersGet === 'function') {\n    const authHeader = headersGet.call(req.headers, 'authorization');\n    const bearerToken = extractBearerToken(authHeader ?? undefined);\n    if (bearerToken) return bearerToken;\n    const cookieName = config.cookieName || 'grant-access-token';\n    const cookieHeader = headersGet.call(req.headers, 'cookie');\n    if (cookieHeader) {\n      const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n      if (cookieToken) return cookieToken;\n    }\n    return null;\n  }\n\n  // Express-style: headers.authorization, headers.cookie\n  const plainHeaders = req.headers as { authorization?: string; cookie?: string };\n  const authHeader = plainHeaders.authorization;\n  const bearerToken = extractBearerToken(authHeader);\n  if (bearerToken) return bearerToken;\n\n  const cookieName = config.cookieName || 'grant-access-token';\n\n  if (req.cookies?.[cookieName]) {\n    return req.cookies[cookieName];\n  }\n\n  const cookieHeader = plainHeaders.cookie;\n  if (cookieHeader) {\n    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n    if (cookieToken) return cookieToken;\n  }\n\n  return null;\n}\n","import type { AuthorizationResult, GrantServerConfig, PermissionCheckOptions } from './types';\nimport { extractTokenFromRequest } from './utils/token-extractor';\n\n/**\n * Grant Client for server-side applications\n *\n * Makes HTTP requests to the Grant API to check permissions.\n * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.\n * No caching - server-side caching is handled by grant-api.\n */\nexport class GrantClient {\n  public readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;\n\n  constructor(config: GrantServerConfig) {\n    this.config = config;\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.isGranted('document', 'update', { scope });\n   * if (canEdit) {\n   *   // Proceed with operation\n   * }\n   * ```\n   */\n  async isGranted(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options, request);\n    return result.authorized;\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update', { scope }, request);\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<AuthorizationResult> {\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      const response = await this.fetchWithAuth(\n        '/api/auth/is-authorized',\n        {\n          method: 'POST',\n          body: JSON.stringify({\n            permission: {\n              resource,\n              action,\n            },\n            context: {\n              resource: options?.context?.resource || null,\n            },\n          }),\n        },\n        request\n      );\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Extract token from a request object\n   * Useful for middleware that needs to extract token before making authorization calls\n   */\n  async getTokenFromRequest(request: unknown): Promise<string | null> {\n    return extractTokenFromRequest(request, this.config);\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request (token from request; no refresh).\n   */\n  private async fetchWithAuth(\n    url: string,\n    init?: RequestInit,\n    request?: unknown\n  ): Promise<Response> {\n    return this.doFetch(url, init, request);\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit, request?: unknown): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    if (request) {\n      const token = await extractTokenFromRequest(request, this.config);\n      if (token) {\n        headers['Authorization'] = `Bearer ${token}`;\n      }\n\n      // Forward cookies if using cookie-based auth\n      const req = request as { headers?: { cookie?: string } };\n      if (req.headers?.cookie) {\n        headers['Cookie'] = req.headers.cookie;\n      }\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n}\n"],"mappings":";;;;AAKA,SAAgB,mBAAmB,YAA+C;AAChF,KAAI,CAAC,WAAY,QAAO;CAExB,MAAM,QAAQ,WAAW,MAAM,CAAC,MAAM,MAAM;AAC5C,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SACnD,QAAO;AAGT,QAAO,MAAM;;;;;AAMf,SAAS,kBAAkB,cAA8C;CACvE,MAAM,UAAkC,EAAE;AAE1C,cAAa,MAAM,IAAI,CAAC,SAAS,WAAW;EAC1C,MAAM,CAAC,MAAM,GAAG,QAAQ,OAAO,MAAM,CAAC,MAAM,IAAI;AAChD,MAAI,QAAQ,KAAK,SAAS,EACxB,SAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM;GAE9C;AAEF,QAAO;;;;;AAMT,SAAgB,wBACd,cACA,YACe;AACf,KAAI,CAAC,aAAc,QAAO;AAG1B,QADgB,kBAAkB,aAC3B,CAAQ,eAAe;;;;;AAMhC,eAAsB,wBACpB,SACA,QACwB;AAExB,KAAI,OAAO,UAAU;EACnB,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ;AAC5C,MAAI,MAAO,QAAO;;CAIpB,MAAM,MAAM;AAOZ,KAAI,CAAC,KAAK,QAAS,QAAO;CAG1B,MAAM,aAAc,IAAI,QAAsD;AAC9E,KAAI,OAAO,eAAe,YAAY;EAEpC,MAAM,cAAc,mBADD,WAAW,KAAK,IAAI,SAAS,gBACT,IAAc,KAAA,EAAU;AAC/D,MAAI,YAAa,QAAO;EACxB,MAAM,aAAa,OAAO,cAAc;EACxC,MAAM,eAAe,WAAW,KAAK,IAAI,SAAS,SAAS;AAC3D,MAAI,cAAc;GAChB,MAAM,cAAc,wBAAwB,cAAc,WAAW;AACrE,OAAI,YAAa,QAAO;;AAE1B,SAAO;;CAIT,MAAM,eAAe,IAAI;CACzB,MAAM,aAAa,aAAa;CAChC,MAAM,cAAc,mBAAmB,WAAW;AAClD,KAAI,YAAa,QAAO;CAExB,MAAM,aAAa,OAAO,cAAc;AAExC,KAAI,IAAI,UAAU,YAChB,QAAO,IAAI,QAAQ;CAGrB,MAAM,eAAe,aAAa;AAClC,KAAI,cAAc;EAChB,MAAM,cAAc,wBAAwB,cAAc,WAAW;AACrE,MAAI,YAAa,QAAO;;AAG1B,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3FT,IAAa,cAAb,MAAyB;CAGvB,YAAY,QAA2B;wBAFvC,UAAA,KAAA,EAAgB;AAGd,OAAK,SAAS;;;;;;;;;;;;;CAkBhB,MAAM,UACJ,UACA,QACA,SACA,SACkB;AAElB,UAAO,MADc,KAAK,aAAa,UAAU,QAAQ,SAAS,QAAQ,EAC5D;;;;;;;;;;;;;CAchB,MAAM,aACJ,UACA,QACA,SACA,SAC8B;AAC9B,MAAI;GAEF,MAAM,WAAW,MAAM,KAAK,cAC1B,2BACA;IACE,QAAQ;IACR,MAAM,KAAK,UAAU;KACnB,YAAY;MACV;MACA;MACD;KACD,SAAS,EACP,UAAU,SAAS,SAAS,YAAY,MACzC;KACF,CAAC;IACH,EACD,QACD;AAED,OAAI,CAAC,SAAS,GAEZ,QAAO;IACL,YAAY;IACZ,SAAQ,MAHU,SAAS,MAAM,CAAC,aAAa,EAAE,EAAE,EAGrC,WAAW,cAAc,SAAS;IACjD;GAGH,MAAM,OAAO,MAAM,SAAS,MAAM;AAGlC,UADoC,KAAK,QAAQ;WAE1C,OAAO;AACd,UAAO;IACL,YAAY;IACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;IAClD;;;;;;;CAQL,MAAM,oBAAoB,SAA0C;AAClE,SAAO,wBAAwB,SAAS,KAAK,OAAO;;;;;CAUtD,MAAc,cACZ,KACA,MACA,SACmB;AACnB,SAAO,KAAK,QAAQ,KAAK,MAAM,QAAQ;;;;;CAMzC,MAAc,QAAQ,KAAa,MAAoB,SAAsC;EAC3F,MAAM,UAAU,KAAK,OAAO,SAAS,WAAW;EAChD,MAAM,UAAU,IAAI,WAAW,OAAO,GAAG,MAAM,GAAG,KAAK,OAAO,SAAS;EAEvE,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAI,MAAM;GACX;AAGD,MAAI,SAAS;GACX,MAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,OAAO;AACjE,OAAI,MACF,SAAQ,mBAAmB,UAAU;GAIvC,MAAM,MAAM;AACZ,OAAI,IAAI,SAAS,OACf,SAAQ,YAAY,IAAI,QAAQ;;AAIpC,SAAO,QAAQ,SAAS;GACtB,GAAG;GACH;GAEA,aAAa,KAAK,OAAO,eAAe;GACzC,CAAC"}