@grantjs/server 1.0.0

package/dist/express.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.cjs","sources":["../src/express/middleware.ts"],"sourcesContent":["import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { Request, Response, NextFunction } from 'express';\n\n/**\n * Extended Express Request with authorization result\n */\nexport interface AuthorizedRequest extends Request {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Express middleware\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create Express middleware to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/express';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * router.get('/organizations', grant(grantClient, {\n *   resource: 'Organization',\n *   action: 'Query',\n * }), handler);\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (req: AuthorizedRequest, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: AuthorizedRequest, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      debugGrant('Express', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(req, client.config);\n      if (!token) {\n        res.status(401).json({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: req,\n        });\n\n        if (!resolvedResource) {\n          res.status(404).json({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        req\n      );\n\n      debugGrant('Express', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        res.status(403).json({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      (req as AuthorizedRequest).authorization = result;\n\n      // 5. Proceed to next middleware/handler\n      next();\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        res.status(401).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        res.status(403).json({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        res.status(400).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        res.status(404).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - pass to Express error handler\n      next(error);\n    }\n  };\n}\n"],"names":["debugGrant","extractTokenFromRequest","AuthenticationError","AuthorizationError","BadRequestError","NotFoundError"],"mappings":";;;;;AA2CO,SAAS,MACd,QACA,SAC8E;AAC9E,SAAO,OAAO,KAAwB,KAAe,SAAsC;AACzF,QAAI;AACFA,uBAAW,WAAW,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAG5E,YAAM,QAAQ,MAAMC,YAAAA,wBAAwB,KAAK,OAAO,MAAM;AAC9D,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,QAAA,CACP;AACD;AAAA,MACF;AAGA,UAAI,mBAAmD;AAEvD,UAAI,QAAQ,kBAAkB;AAC5B,2BAAmB,MAAM,QAAQ,iBAAiB;AAAA,UAChD,cAAc,QAAQ;AAAA,UACtB,SAAS;AAAA,QAAA,CACV;AAED,YAAI,CAAC,kBAAkB;AACrB,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UAAA,CACP;AACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,UACE,SAAS;AAAA,YACP,UAAU,oBAAoB;AAAA,UAAA;AAAA,QAChC;AAAA,QAEF;AAAA,MAAA;AAGFD,YAAAA,WAAW,WAAW;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MAAO,CACtD;AAED,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA,CAChB;AACD;AAAA,MACF;AAGC,UAA0B,gBAAgB;AAG3C,WAAA;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,iBAAiBE,MAAAA,qBAAqB;AACxC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,oBAAoB;AACvC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,QAAA,CACf;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,iBAAiB;AACpC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,eAAe;AAClC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAGA,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;;;;;;;;"}

package/dist/express.mjs

@@ -0,0 +1,101 @@
+import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from "./index.mjs";
+import { GrantServerError } from "./index.mjs";
+import { d as debugGrant } from "./debug-C8ibbrE5.js";
+import { e as extractTokenFromRequest } from "./grant-client-D1LZI2f4.js";
+import { G } from "./grant-client-D1LZI2f4.js";
+function grant(client, options) {
+  return async (req, res, next) => {
+    try {
+      debugGrant("Express", { resource: options.resource, action: options.action });
+      const token = await extractTokenFromRequest(req, client.config);
+      if (!token) {
+        res.status(401).json({
+          error: "Unauthorized",
+          code: "UNAUTHENTICATED"
+        });
+        return;
+      }
+      let resolvedResource = null;
+      if (options.resourceResolver) {
+        resolvedResource = await options.resourceResolver({
+          resourceSlug: options.resource,
+          request: req
+        });
+        if (!resolvedResource) {
+          res.status(404).json({
+            error: "Resource not found",
+            code: "NOT_FOUND"
+          });
+          return;
+        }
+      }
+      const result = await client.isAuthorized(
+        options.resource,
+        options.action,
+        {
+          context: {
+            resource: resolvedResource || void 0
+          }
+        },
+        req
+      );
+      debugGrant("Express", {
+        resource: options.resource,
+        action: options.action,
+        authorized: result.authorized,
+        ...result.authorized ? {} : { reason: result.reason }
+      });
+      if (!result.authorized) {
+        res.status(403).json({
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        });
+        return;
+      }
+      req.authorization = result;
+      next();
+    } catch (error) {
+      if (error instanceof AuthenticationError) {
+        res.status(401).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof AuthorizationError) {
+        res.status(403).json({
+          error: error.message,
+          code: error.code,
+          reason: error.reason
+        });
+        return;
+      }
+      if (error instanceof BadRequestError) {
+        res.status(400).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof NotFoundError) {
+        res.status(404).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      next(error);
+    }
+  };
+}
+export {
+  AuthenticationError,
+  AuthorizationError,
+  BadRequestError,
+  G as GrantClient,
+  GrantServerError,
+  NotFoundError,
+  grant
+};
+//# sourceMappingURL=express.mjs.map

package/dist/express.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.mjs","sources":["../src/express/middleware.ts"],"sourcesContent":["import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { Request, Response, NextFunction } from 'express';\n\n/**\n * Extended Express Request with authorization result\n */\nexport interface AuthorizedRequest extends Request {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Express middleware\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create Express middleware to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/express';\n * import { GrantClient } from '@grantjs/server';\n *\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * router.get('/organizations', grant(grantClient, {\n *   resource: 'Organization',\n *   action: 'Query',\n * }), handler);\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (req: AuthorizedRequest, res: Response, next: NextFunction) => Promise<void> {\n  return async (req: AuthorizedRequest, res: Response, next: NextFunction): Promise<void> => {\n    try {\n      debugGrant('Express', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(req, client.config);\n      if (!token) {\n        res.status(401).json({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: req,\n        });\n\n        if (!resolvedResource) {\n          res.status(404).json({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        req\n      );\n\n      debugGrant('Express', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        res.status(403).json({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      (req as AuthorizedRequest).authorization = result;\n\n      // 5. Proceed to next middleware/handler\n      next();\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        res.status(401).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        res.status(403).json({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        res.status(400).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        res.status(404).json({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - pass to Express error handler\n      next(error);\n    }\n  };\n}\n"],"names":[],"mappings":";;;;;AA2CO,SAAS,MACd,QACA,SAC8E;AAC9E,SAAO,OAAO,KAAwB,KAAe,SAAsC;AACzF,QAAI;AACF,iBAAW,WAAW,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAG5E,YAAM,QAAQ,MAAM,wBAAwB,KAAK,OAAO,MAAM;AAC9D,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,QAAA,CACP;AACD;AAAA,MACF;AAGA,UAAI,mBAAmD;AAEvD,UAAI,QAAQ,kBAAkB;AAC5B,2BAAmB,MAAM,QAAQ,iBAAiB;AAAA,UAChD,cAAc,QAAQ;AAAA,UACtB,SAAS;AAAA,QAAA,CACV;AAED,YAAI,CAAC,kBAAkB;AACrB,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UAAA,CACP;AACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,UACE,SAAS;AAAA,YACP,UAAU,oBAAoB;AAAA,UAAA;AAAA,QAChC;AAAA,QAEF;AAAA,MAAA;AAGF,iBAAW,WAAW;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MAAO,CACtD;AAED,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA,CAChB;AACD;AAAA,MACF;AAGC,UAA0B,gBAAgB;AAG3C,WAAA;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,iBAAiB,qBAAqB;AACxC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,oBAAoB;AACvC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,QAAA,CACf;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,iBAAiB;AACpC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,eAAe;AAClC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAGA,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;"}

package/dist/fastify/index.d.ts

@@ -0,0 +1,6 @@
+export { grantPlugin, grant } from './plugin';
+export type { GrantOptions, AuthorizedFastifyRequest, GrantPluginOptions } from './plugin';
+export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions, Scope, ResourceResolver, } from '../types';
+export { GrantServerError, AuthenticationError, AuthorizationError, BadRequestError, NotFoundError, } from '../errors';
+export { GrantClient } from '../grant-client';
+//# sourceMappingURL=index.d.ts.map

package/dist/fastify/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fastify/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAG3F,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,EACL,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/fastify/plugin.d.ts

@@ -0,0 +1,74 @@
+import { FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify';
+import { GrantClient } from '../grant-client';
+import { ResourceResolver, AuthorizationResult, GrantServerConfig } from '../types';
+/**
+ * Extended Fastify Request with authorization result
+ */
+export interface AuthorizedFastifyRequest extends FastifyRequest {
+    authorization?: AuthorizationResult;
+}
+/**
+ * Options for Fastify preHandler hook
+ */
+export interface GrantOptions {
+    /** The resource slug to check (e.g., "Organization", "Project", "Document") */
+    resource: string;
+    /** The action to check (e.g., "Query", "Create", "Update", "Delete") */
+    action: string;
+    /** Custom resource resolver for condition evaluation */
+    resourceResolver?: ResourceResolver;
+}
+/**
+ * Create a Fastify preHandler hook to check if user is granted permission
+ *
+ * @example
+ * ```ts
+ * import { grant } from '@grantjs/server/fastify';
+ * import { GrantClient } from '@grantjs/server';
+ * import Fastify from 'fastify';
+ *
+ * const fastify = Fastify();
+ * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });
+ *
+ * fastify.get('/organizations', {
+ *   preHandler: grant(grantClient, {
+ *     resource: 'Organization',
+ *     action: 'Query',
+ *   }),
+ * }, async (request, reply) => {
+ *   return { organizations: [] };
+ * });
+ * ```
+ */
+export declare function grant(client: GrantClient, options: GrantOptions): (request: AuthorizedFastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Fastify plugin options
+ * Extends GrantServerConfig - plugin-specific options can be added here in the future
+ */
+export type GrantPluginOptions = GrantServerConfig;
+/**
+ * Fastify plugin that decorates the instance with GrantClient
+ *
+ * @example
+ * ```ts
+ * import Fastify from 'fastify';
+ * import { grantPlugin } from '@grantjs/server/fastify';
+ *
+ * const fastify = Fastify();
+ *
+ * await fastify.register(grantPlugin, {
+ *   apiUrl: 'https://api.grant.com',
+ *   cookieName: 'grant-access-token',
+ * });
+ *
+ * // GrantClient is now available on fastify.grant
+ * const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });
+ * ```
+ */
+export declare const grantPlugin: FastifyPluginAsync<GrantPluginOptions>;
+declare module 'fastify' {
+    interface FastifyInstance {
+        grant: GrantClient;
+    }
+}
+//# sourceMappingURL=plugin.d.ts.map

package/dist/fastify/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/fastify/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,cAAc;IAC9D,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,KAAK,CACnB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,CAAC,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAsG3E;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAK9D,CAAC;AAIF,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,KAAK,EAAE,WAAW,CAAC;KACpB;CACF"}

package/dist/fastify.cjs

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const index = require("./index.cjs");
+const grantClient = require("./grant-client-DywfJN5P.cjs");
+const debug = require("./debug-Crb5gNDM.cjs");
+function grant(client, options) {
+  return async (request, reply) => {
+    try {
+      debug.debugGrant("Fastify", { resource: options.resource, action: options.action });
+      const token = await grantClient.extractTokenFromRequest(request, client.config);
+      if (!token) {
+        reply.status(401).send({
+          error: "Unauthorized",
+          code: "UNAUTHENTICATED"
+        });
+        return;
+      }
+      let resolvedResource = null;
+      if (options.resourceResolver) {
+        resolvedResource = await options.resourceResolver({
+          resourceSlug: options.resource,
+          request
+        });
+        if (!resolvedResource) {
+          reply.status(404).send({
+            error: "Resource not found",
+            code: "NOT_FOUND"
+          });
+          return;
+        }
+      }
+      const result = await client.isAuthorized(
+        options.resource,
+        options.action,
+        {
+          context: {
+            resource: resolvedResource || void 0
+          }
+        },
+        request
+      );
+      debug.debugGrant("Fastify", {
+        resource: options.resource,
+        action: options.action,
+        authorized: result.authorized,
+        ...result.authorized ? {} : { reason: result.reason }
+      });
+      if (!result.authorized) {
+        reply.status(403).send({
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        });
+        return;
+      }
+      request.authorization = result;
+    } catch (error) {
+      if (error instanceof index.AuthenticationError) {
+        reply.status(401).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof index.AuthorizationError) {
+        reply.status(403).send({
+          error: error.message,
+          code: error.code,
+          reason: error.reason
+        });
+        return;
+      }
+      if (error instanceof index.BadRequestError) {
+        reply.status(400).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof index.NotFoundError) {
+        reply.status(404).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      throw error;
+    }
+  };
+}
+const grantPlugin = async (fastify, options) => {
+  const grant2 = new grantClient.GrantClient(options);
+  fastify.decorate("grant", grant2);
+};
+exports.AuthenticationError = index.AuthenticationError;
+exports.AuthorizationError = index.AuthorizationError;
+exports.BadRequestError = index.BadRequestError;
+exports.GrantServerError = index.GrantServerError;
+exports.NotFoundError = index.NotFoundError;
+exports.GrantClient = grantClient.GrantClient;
+exports.grant = grant;
+exports.grantPlugin = grantPlugin;
+//# sourceMappingURL=fastify.cjs.map

package/dist/fastify.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.cjs","sources":["../src/fastify/plugin.ts"],"sourcesContent":["import { FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify';\n\nimport { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult, GrantServerConfig } from '../types';\n\n/**\n * Extended Fastify Request with authorization result\n */\nexport interface AuthorizedFastifyRequest extends FastifyRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Fastify preHandler hook\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create a Fastify preHandler hook to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/fastify';\n * import { GrantClient } from '@grantjs/server';\n * import Fastify from 'fastify';\n *\n * const fastify = Fastify();\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * fastify.get('/organizations', {\n *   preHandler: grant(grantClient, {\n *     resource: 'Organization',\n *     action: 'Query',\n *   }),\n * }, async (request, reply) => {\n *   return { organizations: [] };\n * });\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (request: AuthorizedFastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request: AuthorizedFastifyRequest, reply: FastifyReply): Promise<void> => {\n    try {\n      debugGrant('Fastify', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(request, client.config);\n      if (!token) {\n        reply.status(401).send({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: request,\n        });\n\n        if (!resolvedResource) {\n          reply.status(404).send({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        request\n      );\n\n      debugGrant('Fastify', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        reply.status(403).send({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      request.authorization = result;\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        reply.status(401).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        reply.status(403).send({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        reply.status(400).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        reply.status(404).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - rethrow to let Fastify handle it\n      throw error;\n    }\n  };\n}\n\n/**\n * Fastify plugin options\n * Extends GrantServerConfig - plugin-specific options can be added here in the future\n */\nexport type GrantPluginOptions = GrantServerConfig;\n\n/**\n * Fastify plugin that decorates the instance with GrantClient\n *\n * @example\n * ```ts\n * import Fastify from 'fastify';\n * import { grantPlugin } from '@grantjs/server/fastify';\n *\n * const fastify = Fastify();\n *\n * await fastify.register(grantPlugin, {\n *   apiUrl: 'https://api.grant.com',\n *   cookieName: 'grant-access-token',\n * });\n *\n * // GrantClient is now available on fastify.grant\n * const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });\n * ```\n */\nexport const grantPlugin: FastifyPluginAsync<GrantPluginOptions> = async (fastify, options) => {\n  const grant = new GrantClient(options);\n\n  // Decorate Fastify instance with GrantClient\n  fastify.decorate('grant', grant);\n};\n\n// Type declaration for TypeScript\n// This will work once Fastify is installed (it's a peer dependency)\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    grant: GrantClient;\n  }\n}\n"],"names":["debugGrant","extractTokenFromRequest","AuthenticationError","AuthorizationError","BadRequestError","NotFoundError","grant","GrantClient"],"mappings":";;;;;AAkDO,SAAS,MACd,QACA,SAC2E;AAC3E,SAAO,OAAO,SAAmC,UAAuC;AACtF,QAAI;AACFA,uBAAW,WAAW,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAG5E,YAAM,QAAQ,MAAMC,YAAAA,wBAAwB,SAAS,OAAO,MAAM;AAClE,UAAI,CAAC,OAAO;AACV,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,QAAA,CACP;AACD;AAAA,MACF;AAGA,UAAI,mBAAmD;AAEvD,UAAI,QAAQ,kBAAkB;AAC5B,2BAAmB,MAAM,QAAQ,iBAAiB;AAAA,UAChD,cAAc,QAAQ;AAAA,UACtB;AAAA,QAAA,CACD;AAED,YAAI,CAAC,kBAAkB;AACrB,gBAAM,OAAO,GAAG,EAAE,KAAK;AAAA,YACrB,OAAO;AAAA,YACP,MAAM;AAAA,UAAA,CACP;AACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,UACE,SAAS;AAAA,YACP,UAAU,oBAAoB;AAAA,UAAA;AAAA,QAChC;AAAA,QAEF;AAAA,MAAA;AAGFD,YAAAA,WAAW,WAAW;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MAAO,CACtD;AAED,UAAI,CAAC,OAAO,YAAY;AACtB,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA,CAChB;AACD;AAAA,MACF;AAGA,cAAQ,gBAAgB;AAAA,IAC1B,SAAS,OAAO;AAEd,UAAI,iBAAiBE,MAAAA,qBAAqB;AACxC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,oBAAoB;AACvC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,QAAA,CACf;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,iBAAiB;AACpC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiBC,MAAAA,eAAe;AAClC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AA2BO,MAAM,cAAsD,OAAO,SAAS,YAAY;AAC7F,QAAMC,SAAQ,IAAIC,YAAAA,YAAY,OAAO;AAGrC,UAAQ,SAAS,SAASD,MAAK;AACjC;;;;;;;;;"}

package/dist/fastify.mjs

@@ -0,0 +1,104 @@
+import { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from "./index.mjs";
+import { GrantServerError } from "./index.mjs";
+import { e as extractTokenFromRequest, G as GrantClient } from "./grant-client-D1LZI2f4.js";
+import { d as debugGrant } from "./debug-C8ibbrE5.js";
+function grant(client, options) {
+  return async (request, reply) => {
+    try {
+      debugGrant("Fastify", { resource: options.resource, action: options.action });
+      const token = await extractTokenFromRequest(request, client.config);
+      if (!token) {
+        reply.status(401).send({
+          error: "Unauthorized",
+          code: "UNAUTHENTICATED"
+        });
+        return;
+      }
+      let resolvedResource = null;
+      if (options.resourceResolver) {
+        resolvedResource = await options.resourceResolver({
+          resourceSlug: options.resource,
+          request
+        });
+        if (!resolvedResource) {
+          reply.status(404).send({
+            error: "Resource not found",
+            code: "NOT_FOUND"
+          });
+          return;
+        }
+      }
+      const result = await client.isAuthorized(
+        options.resource,
+        options.action,
+        {
+          context: {
+            resource: resolvedResource || void 0
+          }
+        },
+        request
+      );
+      debugGrant("Fastify", {
+        resource: options.resource,
+        action: options.action,
+        authorized: result.authorized,
+        ...result.authorized ? {} : { reason: result.reason }
+      });
+      if (!result.authorized) {
+        reply.status(403).send({
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        });
+        return;
+      }
+      request.authorization = result;
+    } catch (error) {
+      if (error instanceof AuthenticationError) {
+        reply.status(401).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof AuthorizationError) {
+        reply.status(403).send({
+          error: error.message,
+          code: error.code,
+          reason: error.reason
+        });
+        return;
+      }
+      if (error instanceof BadRequestError) {
+        reply.status(400).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof NotFoundError) {
+        reply.status(404).send({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      throw error;
+    }
+  };
+}
+const grantPlugin = async (fastify, options) => {
+  const grant2 = new GrantClient(options);
+  fastify.decorate("grant", grant2);
+};
+export {
+  AuthenticationError,
+  AuthorizationError,
+  BadRequestError,
+  GrantClient,
+  GrantServerError,
+  NotFoundError,
+  grant,
+  grantPlugin
+};
+//# sourceMappingURL=fastify.mjs.map

package/dist/fastify.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.mjs","sources":["../src/fastify/plugin.ts"],"sourcesContent":["import { FastifyPluginAsync, FastifyRequest, FastifyReply } from 'fastify';\n\nimport { AuthenticationError, AuthorizationError, BadRequestError, NotFoundError } from '../errors';\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport type { ResourceResolver, AuthorizationResult, GrantServerConfig } from '../types';\n\n/**\n * Extended Fastify Request with authorization result\n */\nexport interface AuthorizedFastifyRequest extends FastifyRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Options for Fastify preHandler hook\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n  /** Custom resource resolver for condition evaluation */\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * Create a Fastify preHandler hook to check if user is granted permission\n *\n * @example\n * ```ts\n * import { grant } from '@grantjs/server/fastify';\n * import { GrantClient } from '@grantjs/server';\n * import Fastify from 'fastify';\n *\n * const fastify = Fastify();\n * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });\n *\n * fastify.get('/organizations', {\n *   preHandler: grant(grantClient, {\n *     resource: 'Organization',\n *     action: 'Query',\n *   }),\n * }, async (request, reply) => {\n *   return { organizations: [] };\n * });\n * ```\n */\nexport function grant(\n  client: GrantClient,\n  options: GrantOptions\n): (request: AuthorizedFastifyRequest, reply: FastifyReply) => Promise<void> {\n  return async (request: AuthorizedFastifyRequest, reply: FastifyReply): Promise<void> => {\n    try {\n      debugGrant('Fastify', { resource: options.resource, action: options.action });\n\n      // 1. Check authentication (token must be present)\n      const token = await extractTokenFromRequest(request, client.config);\n      if (!token) {\n        reply.status(401).send({\n          error: 'Unauthorized',\n          code: 'UNAUTHENTICATED',\n        });\n        return;\n      }\n\n      // 2. Optionally resolve resource for condition evaluation\n      let resolvedResource: Record<string, unknown> | null = null;\n\n      if (options.resourceResolver) {\n        resolvedResource = await options.resourceResolver({\n          resourceSlug: options.resource,\n          request: request,\n        });\n\n        if (!resolvedResource) {\n          reply.status(404).send({\n            error: 'Resource not found',\n            code: 'NOT_FOUND',\n          });\n          return;\n        }\n      }\n\n      // 3. Check authorization (pass request for token extraction; scope comes from JWT claims)\n      const result = await client.isAuthorized(\n        options.resource,\n        options.action,\n        {\n          context: {\n            resource: resolvedResource || undefined,\n          },\n        },\n        request\n      );\n\n      debugGrant('Fastify', {\n        resource: options.resource,\n        action: options.action,\n        authorized: result.authorized,\n        ...(result.authorized ? {} : { reason: result.reason }),\n      });\n\n      if (!result.authorized) {\n        reply.status(403).send({\n          error: 'Forbidden',\n          code: 'FORBIDDEN',\n          reason: result.reason,\n        });\n        return;\n      }\n\n      // 4. Attach authorization result to request for downstream use\n      request.authorization = result;\n    } catch (error) {\n      // Handle known errors\n      if (error instanceof AuthenticationError) {\n        reply.status(401).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof AuthorizationError) {\n        reply.status(403).send({\n          error: error.message,\n          code: error.code,\n          reason: error.reason,\n        });\n        return;\n      }\n\n      if (error instanceof BadRequestError) {\n        reply.status(400).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      if (error instanceof NotFoundError) {\n        reply.status(404).send({\n          error: error.message,\n          code: error.code,\n        });\n        return;\n      }\n\n      // Unknown error - rethrow to let Fastify handle it\n      throw error;\n    }\n  };\n}\n\n/**\n * Fastify plugin options\n * Extends GrantServerConfig - plugin-specific options can be added here in the future\n */\nexport type GrantPluginOptions = GrantServerConfig;\n\n/**\n * Fastify plugin that decorates the instance with GrantClient\n *\n * @example\n * ```ts\n * import Fastify from 'fastify';\n * import { grantPlugin } from '@grantjs/server/fastify';\n *\n * const fastify = Fastify();\n *\n * await fastify.register(grantPlugin, {\n *   apiUrl: 'https://api.grant.com',\n *   cookieName: 'grant-access-token',\n * });\n *\n * // GrantClient is now available on fastify.grant\n * const canEdit = await fastify.grant.isGranted('Document', 'Update', { scope });\n * ```\n */\nexport const grantPlugin: FastifyPluginAsync<GrantPluginOptions> = async (fastify, options) => {\n  const grant = new GrantClient(options);\n\n  // Decorate Fastify instance with GrantClient\n  fastify.decorate('grant', grant);\n};\n\n// Type declaration for TypeScript\n// This will work once Fastify is installed (it's a peer dependency)\ndeclare module 'fastify' {\n  interface FastifyInstance {\n    grant: GrantClient;\n  }\n}\n"],"names":["grant"],"mappings":";;;;AAkDO,SAAS,MACd,QACA,SAC2E;AAC3E,SAAO,OAAO,SAAmC,UAAuC;AACtF,QAAI;AACF,iBAAW,WAAW,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,QAAQ;AAG5E,YAAM,QAAQ,MAAM,wBAAwB,SAAS,OAAO,MAAM;AAClE,UAAI,CAAC,OAAO;AACV,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,QAAA,CACP;AACD;AAAA,MACF;AAGA,UAAI,mBAAmD;AAEvD,UAAI,QAAQ,kBAAkB;AAC5B,2BAAmB,MAAM,QAAQ,iBAAiB;AAAA,UAChD,cAAc,QAAQ;AAAA,UACtB;AAAA,QAAA,CACD;AAED,YAAI,CAAC,kBAAkB;AACrB,gBAAM,OAAO,GAAG,EAAE,KAAK;AAAA,YACrB,OAAO;AAAA,YACP,MAAM;AAAA,UAAA,CACP;AACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,UACE,SAAS;AAAA,YACP,UAAU,oBAAoB;AAAA,UAAA;AAAA,QAChC;AAAA,QAEF;AAAA,MAAA;AAGF,iBAAW,WAAW;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MAAO,CACtD;AAED,UAAI,CAAC,OAAO,YAAY;AACtB,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,QAAQ,OAAO;AAAA,QAAA,CAChB;AACD;AAAA,MACF;AAGA,cAAQ,gBAAgB;AAAA,IAC1B,SAAS,OAAO;AAEd,UAAI,iBAAiB,qBAAqB;AACxC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,oBAAoB;AACvC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,UACZ,QAAQ,MAAM;AAAA,QAAA,CACf;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,iBAAiB;AACpC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAEA,UAAI,iBAAiB,eAAe;AAClC,cAAM,OAAO,GAAG,EAAE,KAAK;AAAA,UACrB,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QAAA,CACb;AACD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AA2BO,MAAM,cAAsD,OAAO,SAAS,YAAY;AAC7F,QAAMA,SAAQ,IAAI,YAAY,OAAO;AAGrC,UAAQ,SAAS,SAASA,MAAK;AACjC;"}

package/dist/grant-client-D1LZI2f4.js

@@ -0,0 +1,180 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+function extractBearerToken(authHeader) {
+  if (!authHeader) return null;
+  const parts = authHeader.trim().split(/\s+/);
+  if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+    return null;
+  }
+  return parts[1];
+}
+function parseCookieHeader(cookieHeader) {
+  const cookies = {};
+  cookieHeader.split(";").forEach((cookie) => {
+    const [name, ...rest] = cookie.trim().split("=");
+    if (name && rest.length > 0) {
+      cookies[name.trim()] = rest.join("=").trim();
+    }
+  });
+  return cookies;
+}
+function extractTokenFromCookies(cookieHeader, cookieName) {
+  if (!cookieHeader) return null;
+  const cookies = parseCookieHeader(cookieHeader);
+  return cookies[cookieName] || null;
+}
+async function extractTokenFromRequest(request, config) {
+  if (config.getToken) {
+    const token = await config.getToken(request);
+    if (token) return token;
+  }
+  const req = request;
+  if (!req?.headers) return null;
+  const headersGet = req.headers.get;
+  if (typeof headersGet === "function") {
+    const authHeader2 = headersGet.call(req.headers, "authorization");
+    const bearerToken2 = extractBearerToken(authHeader2 ?? void 0);
+    if (bearerToken2) return bearerToken2;
+    const cookieName2 = config.cookieName || "grant-access-token";
+    const cookieHeader2 = headersGet.call(req.headers, "cookie");
+    if (cookieHeader2) {
+      const cookieToken = extractTokenFromCookies(cookieHeader2, cookieName2);
+      if (cookieToken) return cookieToken;
+    }
+    return null;
+  }
+  const plainHeaders = req.headers;
+  const authHeader = plainHeaders.authorization;
+  const bearerToken = extractBearerToken(authHeader);
+  if (bearerToken) return bearerToken;
+  const cookieName = config.cookieName || "grant-access-token";
+  if (req.cookies?.[cookieName]) {
+    return req.cookies[cookieName];
+  }
+  const cookieHeader = plainHeaders.cookie;
+  if (cookieHeader) {
+    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);
+    if (cookieToken) return cookieToken;
+  }
+  return null;
+}
+class GrantClient {
+  constructor(config) {
+    __publicField(this, "config");
+    this.config = config;
+  }
+  // ============================================================================
+  // Public API - Permission Checks
+  // ============================================================================
+  /**
+   * Check if the current user has a specific permission
+   *
+   * @example
+   * ```ts
+   * const canEdit = await grant.isGranted('document', 'update', { scope });
+   * if (canEdit) {
+   *   // Proceed with operation
+   * }
+   * ```
+   */
+  async isGranted(resource, action, options, request) {
+    const result = await this.isAuthorized(resource, action, options, request);
+    return result.authorized;
+  }
+  /**
+   * Check authorization with full result details
+   *
+   * @example
+   * ```ts
+   * const result = await grant.isAuthorized('document', 'update', { scope }, request);
+   * if (!result.authorized) {
+   *   console.log('Denied:', result.reason);
+   * }
+   * ```
+   */
+  async isAuthorized(resource, action, options, request) {
+    try {
+      const response = await this.fetchWithAuth(
+        "/api/auth/is-authorized",
+        {
+          method: "POST",
+          body: JSON.stringify({
+            permission: {
+              resource,
+              action
+            },
+            context: {
+              resource: options?.context?.resource || null
+            }
+          })
+        },
+        request
+      );
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({}));
+        return {
+          authorized: false,
+          reason: error.message || `API error: ${response.status}`
+        };
+      }
+      const json = await response.json();
+      const result = json.data ?? json;
+      return result;
+    } catch (error) {
+      return {
+        authorized: false,
+        reason: error instanceof Error ? error.message : "Unknown error"
+      };
+    }
+  }
+  /**
+   * Extract token from a request object
+   * Useful for middleware that needs to extract token before making authorization calls
+   */
+  async getTokenFromRequest(request) {
+    return extractTokenFromRequest(request, this.config);
+  }
+  // ============================================================================
+  // Private - HTTP & Authentication
+  // ============================================================================
+  /**
+   * Make an authenticated fetch request (token from request; no refresh).
+   */
+  async fetchWithAuth(url, init, request) {
+    return this.doFetch(url, init, request);
+  }
+  /**
+   * Perform the actual fetch request
+   */
+  async doFetch(url, init, request) {
+    const fetchFn = this.config.fetch ?? globalThis.fetch;
+    const fullUrl = url.startsWith("http") ? url : `${this.config.apiUrl}${url}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...init?.headers
+    };
+    if (request) {
+      const token = await extractTokenFromRequest(request, this.config);
+      if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+      const req = request;
+      if (req.headers?.cookie) {
+        headers["Cookie"] = req.headers.cookie;
+      }
+    }
+    return fetchFn(fullUrl, {
+      ...init,
+      headers,
+      // Include cookies for same-origin requests (supports cookie-based auth)
+      credentials: this.config.credentials ?? "include"
+    });
+  }
+}
+export {
+  GrantClient as G,
+  extractBearerToken as a,
+  extractTokenFromRequest as e
+};
+//# sourceMappingURL=grant-client-D1LZI2f4.js.map