@grc-claw/rbac-multi-tenant 0.8.0

package/dist/RBACEngine.d.ts

@@ -0,0 +1,42 @@
+import type { Role, RoleName, ScopeLevel, Resource, Action, Permission, UserRoleAssignment, TenantConfig, PermissionCheck, PermissionResult, AuditLogEntry, JWTPayload, RBACConfig } from "./types.js";
+export declare class RBACEngine {
+    private roles;
+    private assignments;
+    private tenants;
+    private auditLog;
+    private config;
+    constructor(config: RBACConfig);
+    createTenant(name: string, parentTenantId?: string): TenantConfig;
+    getTenant(tenantId: string): TenantConfig | undefined;
+    assignRole(userId: string, role: RoleName, scope: ScopeLevel, tenantId: string, assignedBy: string, scopeId?: string): UserRoleAssignment;
+    removeRole(userId: string, tenantId: string, role?: RoleName): boolean;
+    getUserRoles(userId: string, tenantId: string): UserRoleAssignment[];
+    defineCustomRole(name: string, permissions: Permission[], description: string): Role;
+    checkPermission(check: PermissionCheck): PermissionResult;
+    hasPermission(userId: string, tenantId: string, resource: Resource, action: Action, scopeId?: string): boolean;
+    generateJWT(userId: string, tenantId: string): string;
+    verifyJWT(token: string): JWTPayload | null;
+    createMiddleware(): (req: {
+        headers: Record<string, string | undefined>;
+        userId?: string;
+        tenantId?: string;
+    }, res: {
+        status: (code: number) => {
+            json: (body: unknown) => void;
+        };
+    }, next: () => void) => void;
+    requirePermission(resource: Resource, action: Action): (req: {
+        userId?: string;
+        tenantId?: string;
+    }, res: {
+        status: (code: number) => {
+            json: (body: unknown) => void;
+        };
+    }, next: () => void) => void;
+    getAuditLog(tenantId?: string, limit?: number): AuditLogEntry[];
+    getRolePermissions(roleName: RoleName): Permission[];
+    getAllRoles(): Role[];
+    private validateScope;
+    private logAudit;
+    private base64url;
+}

package/dist/RBACEngine.js

@@ -0,0 +1,349 @@
+import { randomUUID, createHmac } from "node:crypto";
+const BUILTIN_ROLES = {
+    admin: {
+        name: "admin",
+        description: "Full system administrator with unrestricted access",
+        permissions: [
+            { resource: "frameworks", actions: ["read", "write", "delete", "manage"] },
+            { resource: "evidence", actions: ["read", "write", "delete", "export"] },
+            { resource: "policies", actions: ["read", "write", "delete", "approve"] },
+            { resource: "controls", actions: ["read", "write", "delete"] },
+            { resource: "assessments", actions: ["read", "write", "delete", "approve"] },
+            { resource: "vendors", actions: ["read", "write", "delete"] },
+            { resource: "risks", actions: ["read", "write", "delete"] },
+            { resource: "incidents", actions: ["read", "write", "delete"] },
+            { resource: "connectors", actions: ["read", "write", "delete", "manage"] },
+            { resource: "users", actions: ["read", "write", "delete", "manage"] },
+            { resource: "roles", actions: ["read", "write", "delete", "manage"] },
+            { resource: "tenants", actions: ["read", "write", "delete", "manage"] },
+            { resource: "audit_logs", actions: ["read", "export"] },
+            { resource: "reports", actions: ["read", "write", "export"] },
+            { resource: "settings", actions: ["read", "write"] },
+        ],
+    },
+    compliance_officer: {
+        name: "compliance_officer",
+        description: "Manages compliance frameworks, policies, and evidence",
+        permissions: [
+            { resource: "frameworks", actions: ["read", "write"] },
+            { resource: "evidence", actions: ["read", "write", "export"] },
+            { resource: "policies", actions: ["read", "write", "approve"] },
+            { resource: "controls", actions: ["read", "write"] },
+            { resource: "assessments", actions: ["read", "write", "approve"] },
+            { resource: "vendors", actions: ["read", "write"] },
+            { resource: "risks", actions: ["read", "write"] },
+            { resource: "incidents", actions: ["read", "write"] },
+            { resource: "audit_logs", actions: ["read"] },
+            { resource: "reports", actions: ["read", "write", "export"] },
+        ],
+    },
+    auditor: {
+        name: "auditor",
+        description: "Read-only access for audit and review purposes",
+        permissions: [
+            { resource: "frameworks", actions: ["read"] },
+            { resource: "evidence", actions: ["read", "export"] },
+            { resource: "policies", actions: ["read"] },
+            { resource: "controls", actions: ["read"] },
+            { resource: "assessments", actions: ["read"] },
+            { resource: "vendors", actions: ["read"] },
+            { resource: "risks", actions: ["read"] },
+            { resource: "incidents", actions: ["read"] },
+            { resource: "audit_logs", actions: ["read", "export"] },
+            { resource: "reports", actions: ["read", "export"] },
+        ],
+    },
+    viewer: {
+        name: "viewer",
+        description: "Basic read-only access to view compliance data",
+        permissions: [
+            { resource: "frameworks", actions: ["read"] },
+            { resource: "evidence", actions: ["read"] },
+            { resource: "policies", actions: ["read"] },
+            { resource: "controls", actions: ["read"] },
+            { resource: "assessments", actions: ["read"] },
+            { resource: "reports", actions: ["read"] },
+        ],
+    },
+    custom: {
+        name: "custom",
+        description: "Custom role with user-defined permissions",
+        permissions: [],
+    },
+};
+export class RBACEngine {
+    roles = new Map();
+    assignments = new Map();
+    tenants = new Map();
+    auditLog = [];
+    config;
+    constructor(config) {
+        this.config = {
+            jwtExpiresIn: 3600,
+            auditLogLimit: 10000,
+            ...config,
+        };
+        for (const [name, role] of Object.entries(BUILTIN_ROLES)) {
+            this.roles.set(name, { ...role });
+        }
+    }
+    createTenant(name, parentTenantId) {
+        const tenant = {
+            id: `tenant-${randomUUID()}`,
+            name,
+            parentTenantId,
+            createdAt: new Date().toISOString(),
+            settings: {},
+        };
+        this.tenants.set(tenant.id, tenant);
+        return tenant;
+    }
+    getTenant(tenantId) {
+        return this.tenants.get(tenantId);
+    }
+    assignRole(userId, role, scope, tenantId, assignedBy, scopeId) {
+        const roleDef = this.roles.get(role);
+        if (!roleDef)
+            throw new Error(`Role not found: ${role}`);
+        const assignment = {
+            userId,
+            role,
+            scope,
+            scopeId,
+            tenantId,
+            assignedAt: new Date().toISOString(),
+            assignedBy,
+        };
+        const key = `${userId}:${tenantId}`;
+        const existing = this.assignments.get(key) || [];
+        existing.push(assignment);
+        this.assignments.set(key, existing);
+        this.logAudit({
+            userId: assignedBy,
+            tenantId,
+            resource: "roles",
+            action: "write",
+            allowed: true,
+            role: "admin",
+            scope: "global",
+            reason: `Assigned role ${role} to user ${userId}`,
+        });
+        return assignment;
+    }
+    removeRole(userId, tenantId, role) {
+        const key = `${userId}:${tenantId}`;
+        const existing = this.assignments.get(key);
+        if (!existing)
+            return false;
+        if (role) {
+            const filtered = existing.filter((a) => a.role !== role);
+            this.assignments.set(key, filtered);
+            return filtered.length < existing.length;
+        }
+        return this.assignments.delete(key);
+    }
+    getUserRoles(userId, tenantId) {
+        return this.assignments.get(`${userId}:${tenantId}`) || [];
+    }
+    defineCustomRole(name, permissions, description) {
+        const role = { name: "custom", permissions, description };
+        this.roles.set(name, role);
+        return role;
+    }
+    checkPermission(check) {
+        const assignments = this.getUserRoles(check.userId, check.tenantId);
+        if (assignments.length === 0) {
+            const result = {
+                allowed: false,
+                role: "viewer",
+                scope: "global",
+                reason: "No role assignments found",
+            };
+            this.logAudit({
+                ...check,
+                ...result,
+            });
+            return result;
+        }
+        for (const assignment of assignments) {
+            const roleDef = this.roles.get(assignment.role);
+            if (!roleDef)
+                continue;
+            for (const perm of roleDef.permissions) {
+                if (perm.resource === check.resource && perm.actions.includes(check.action)) {
+                    const scopeValid = this.validateScope(assignment, check.scopeId);
+                    const result = {
+                        allowed: scopeValid,
+                        role: assignment.role,
+                        scope: assignment.scope,
+                        reason: scopeValid
+                            ? `Granted via role ${assignment.role}`
+                            : `Insufficient scope: required ${assignment.scope}`,
+                    };
+                    this.logAudit({
+                        ...check,
+                        ...result,
+                    });
+                    return result;
+                }
+            }
+        }
+        const result = {
+            allowed: false,
+            role: assignments[0].role,
+            scope: assignments[0].scope,
+            reason: `No matching permission for ${check.resource}:${check.action}`,
+        };
+        this.logAudit({
+            ...check,
+            ...result,
+        });
+        return result;
+    }
+    hasPermission(userId, tenantId, resource, action, scopeId) {
+        return this.checkPermission({ userId, tenantId, resource, action, scopeId }).allowed;
+    }
+    generateJWT(userId, tenantId) {
+        const assignments = this.getUserRoles(userId, tenantId);
+        const primaryRole = assignments[0]?.role || "viewer";
+        const primaryScope = assignments[0]?.scope || "global";
+        const scopeId = assignments[0]?.scopeId;
+        const permissions = [];
+        for (const assignment of assignments) {
+            const roleDef = this.roles.get(assignment.role);
+            if (roleDef) {
+                for (const perm of roleDef.permissions) {
+                    for (const action of perm.actions) {
+                        const p = `${perm.resource}:${action}`;
+                        if (!permissions.includes(p))
+                            permissions.push(p);
+                    }
+                }
+            }
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: userId,
+            tenant_id: tenantId,
+            role: primaryRole,
+            scope: primaryScope,
+            scope_id: scopeId,
+            permissions,
+            iat: now,
+            exp: now + (this.config.jwtExpiresIn || 3600),
+        };
+        const header = this.base64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+        const body = this.base64url(JSON.stringify(payload));
+        const signature = createHmac("sha256", this.config.jwtSecret)
+            .update(`${header}.${body}`)
+            .digest("base64url");
+        return `${header}.${body}.${signature}`;
+    }
+    verifyJWT(token) {
+        try {
+            const parts = token.split(".");
+            if (parts.length !== 3)
+                return null;
+            const [header, body, signature] = parts;
+            const expectedSig = createHmac("sha256", this.config.jwtSecret)
+                .update(`${header}.${body}`)
+                .digest("base64url");
+            if (signature !== expectedSig)
+                return null;
+            const payload = JSON.parse(Buffer.from(body, "base64url").toString());
+            if (payload.exp < Math.floor(Date.now() / 1000))
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    createMiddleware() {
+        return (req, res, next) => {
+            const authHeader = req.headers.authorization;
+            if (!authHeader?.startsWith("Bearer ")) {
+                res.status(401).json({ error: "Missing or invalid authorization header" });
+                return;
+            }
+            const token = authHeader.slice(7);
+            const payload = this.verifyJWT(token);
+            if (!payload) {
+                res.status(401).json({ error: "Invalid or expired token" });
+                return;
+            }
+            req.userId = payload.sub;
+            req.tenantId = payload.tenant_id;
+            next();
+        };
+    }
+    requirePermission(resource, action) {
+        return (req, res, next) => {
+            if (!req.userId || !req.tenantId) {
+                res.status(401).json({ error: "Not authenticated" });
+                return;
+            }
+            const result = this.checkPermission({
+                userId: req.userId,
+                tenantId: req.tenantId,
+                resource,
+                action,
+            });
+            if (!result.allowed) {
+                res.status(403).json({
+                    error: "Insufficient permissions",
+                    reason: result.reason,
+                    required: `${resource}:${action}`,
+                });
+                return;
+            }
+            next();
+        };
+    }
+    getAuditLog(tenantId, limit) {
+        let logs = tenantId
+            ? this.auditLog.filter((l) => l.tenantId === tenantId)
+            : this.auditLog;
+        const max = limit || this.config.auditLogLimit || 1000;
+        return logs.slice(-max);
+    }
+    getRolePermissions(roleName) {
+        return this.roles.get(roleName)?.permissions || [];
+    }
+    getAllRoles() {
+        return Array.from(this.roles.values());
+    }
+    validateScope(assignment, requestedScopeId) {
+        if (assignment.scope === "global")
+            return true;
+        if (assignment.scope === "entity") {
+            if (!assignment.scopeId)
+                return true;
+            return !requestedScopeId || assignment.scopeId === requestedScopeId;
+        }
+        if (assignment.scope === "department") {
+            if (!assignment.scopeId)
+                return true;
+            return !requestedScopeId || assignment.scopeId === requestedScopeId;
+        }
+        return false;
+    }
+    logAudit(entry) {
+        const logEntry = {
+            id: `audit-${randomUUID()}`,
+            timestamp: new Date().toISOString(),
+            ...entry,
+        };
+        this.auditLog.push(logEntry);
+        if (this.auditLog.length > (this.config.auditLogLimit || 10000)) {
+            this.auditLog = this.auditLog.slice(-((this.config.auditLogLimit || 10000) / 2));
+        }
+    }
+    base64url(data) {
+        return Buffer.from(data)
+            .toString("base64")
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=+$/, "");
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { RBACEngine } from "./RBACEngine.js";
+export type { RoleName, ScopeLevel, Resource, Action, PermissionString, Permission, Role, UserRoleAssignment, TenantConfig, PermissionCheck, PermissionResult, AuditLogEntry, JWTPayload, RBACConfig, } from "./types.js";

package/dist/index.js

@@ -0,0 +1 @@
+export { RBACEngine } from "./RBACEngine.js";

package/dist/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.test.js

@@ -0,0 +1,289 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { RBACEngine } from "./RBACEngine.js";
+function createEngine() {
+    return new RBACEngine({ jwtSecret: "test-secret-key-12345" });
+}
+describe("RBACEngine", () => {
+    describe("Tenant Management", () => {
+        it("creates a tenant", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            assert.ok(tenant.id.startsWith("tenant-"));
+            assert.equal(tenant.name, "Acme Corp");
+            assert.ok(tenant.createdAt);
+        });
+        it("retrieves a tenant", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            const retrieved = engine.getTenant(tenant.id);
+            assert.deepStrictEqual(retrieved, tenant);
+        });
+        it("returns undefined for unknown tenant", () => {
+            const engine = createEngine();
+            assert.equal(engine.getTenant("unknown"), undefined);
+        });
+    });
+    describe("Role Assignment", () => {
+        it("assigns a role to a user", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            const assignment = engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            assert.equal(assignment.userId, "user-1");
+            assert.equal(assignment.role, "admin");
+            assert.equal(assignment.scope, "global");
+            assert.equal(assignment.tenantId, tenant.id);
+        });
+        it("retrieves user roles", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            engine.assignRole("user-1", "auditor", "entity", tenant.id, "system", "entity-1");
+            const roles = engine.getUserRoles("user-1", tenant.id);
+            assert.equal(roles.length, 2);
+        });
+        it("removes a specific role", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            engine.assignRole("user-1", "auditor", "global", tenant.id, "system");
+            const removed = engine.removeRole("user-1", tenant.id, "admin");
+            assert.equal(removed, true);
+            const roles = engine.getUserRoles("user-1", tenant.id);
+            assert.equal(roles.length, 1);
+            assert.equal(roles[0].role, "auditor");
+        });
+        it("removes all roles for a user", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            engine.assignRole("user-1", "auditor", "global", tenant.id, "system");
+            const removed = engine.removeRole("user-1", tenant.id);
+            assert.equal(removed, true);
+            assert.equal(engine.getUserRoles("user-1", tenant.id).length, 0);
+        });
+        it("throws for unknown role", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            assert.throws(() => engine.assignRole("user-1", "nonexistent", "global", tenant.id, "system"), /Role not found/);
+        });
+    });
+    describe("Permission Checking", () => {
+        it("allows admin to write frameworks", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "frameworks",
+                action: "write",
+            });
+            assert.equal(result.allowed, true);
+            assert.equal(result.role, "admin");
+        });
+        it("denies viewer from writing frameworks", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "viewer", "global", tenant.id, "system");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "frameworks",
+                action: "write",
+            });
+            assert.equal(result.allowed, false);
+        });
+        it("allows auditor to export evidence", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "auditor", "global", tenant.id, "system");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "evidence",
+                action: "export",
+            });
+            assert.equal(result.allowed, true);
+        });
+        it("allows compliance_officer to approve policies", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "compliance_officer", "global", tenant.id, "system");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "policies",
+                action: "approve",
+            });
+            assert.equal(result.allowed, true);
+        });
+        it("denies user with no assignments", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            const result = engine.checkPermission({
+                userId: "unknown-user",
+                tenantId: tenant.id,
+                resource: "frameworks",
+                action: "read",
+            });
+            assert.equal(result.allowed, false);
+            assert.equal(result.reason, "No role assignments found");
+        });
+        it("hasPermission returns boolean", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            assert.equal(engine.hasPermission("user-1", tenant.id, "frameworks", "read"), true);
+            assert.equal(engine.hasPermission("user-1", tenant.id, "tenants", "delete"), true);
+            assert.equal(engine.hasPermission("user-2", tenant.id, "frameworks", "read"), false);
+        });
+    });
+    describe("Scope Validation", () => {
+        it("global scope allows access to all resources", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "frameworks",
+                action: "write",
+            });
+            assert.equal(result.allowed, true);
+        });
+        it("entity scope restricts to specific entity", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "compliance_officer", "entity", tenant.id, "system", "entity-1");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "evidence",
+                action: "write",
+                scopeId: "entity-1",
+            });
+            assert.equal(result.allowed, true);
+        });
+        it("entity scope denies access to different entity", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "compliance_officer", "entity", tenant.id, "system", "entity-1");
+            const result = engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "evidence",
+                action: "write",
+                scopeId: "entity-2",
+            });
+            assert.equal(result.allowed, false);
+        });
+    });
+    describe("JWT Token", () => {
+        it("generates and verifies a valid JWT", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const token = engine.generateJWT("user-1", tenant.id);
+            assert.ok(token);
+            assert.equal(token.split(".").length, 3);
+            const payload = engine.verifyJWT(token);
+            assert.ok(payload);
+            assert.equal(payload.sub, "user-1");
+            assert.equal(payload.tenant_id, tenant.id);
+            assert.equal(payload.role, "admin");
+            assert.ok(payload.permissions.length > 0);
+        });
+        it("rejects invalid token", () => {
+            const engine = createEngine();
+            assert.equal(engine.verifyJWT("invalid.token.here"), null);
+        });
+        it("rejects token with wrong secret", () => {
+            const engine1 = new RBACEngine({ jwtSecret: "secret-1" });
+            const engine2 = new RBACEngine({ jwtSecret: "secret-2" });
+            const tenant = engine1.createTenant("Acme Corp");
+            engine1.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const token = engine1.generateJWT("user-1", tenant.id);
+            assert.equal(engine2.verifyJWT(token), null);
+        });
+        it("rejects expired token", () => {
+            const engine = new RBACEngine({ jwtSecret: "test", jwtExpiresIn: -1 });
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const token = engine.generateJWT("user-1", tenant.id);
+            assert.equal(engine.verifyJWT(token), null);
+        });
+    });
+    describe("Audit Logging", () => {
+        it("logs permission checks", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            engine.checkPermission({
+                userId: "user-1",
+                tenantId: tenant.id,
+                resource: "frameworks",
+                action: "read",
+            });
+            const logs = engine.getAuditLog(tenant.id);
+            const permLog = logs.find((l) => l.resource === "frameworks");
+            assert.ok(permLog);
+            assert.equal(permLog.action, "read");
+            assert.equal(permLog.allowed, true);
+        });
+        it("logs role assignments", () => {
+            const engine = createEngine();
+            const tenant = engine.createTenant("Acme Corp");
+            engine.assignRole("user-1", "admin", "global", tenant.id, "system");
+            const logs = engine.getAuditLog(tenant.id);
+            assert.ok(logs.length > 0);
+            assert.equal(logs[0].resource, "roles");
+            assert.equal(logs[0].action, "write");
+        });
+        it("filters audit log by tenant", () => {
+            const engine = createEngine();
+            const tenant1 = engine.createTenant("Tenant 1");
+            const tenant2 = engine.createTenant("Tenant 2");
+            engine.assignRole("user-1", "admin", "global", tenant1.id, "system");
+            engine.assignRole("user-2", "admin", "global", tenant2.id, "system");
+            const logs1 = engine.getAuditLog(tenant1.id);
+            assert.ok(logs1.every((l) => l.tenantId === tenant1.id));
+        });
+    });
+    describe("Role Permissions", () => {
+        it("returns permissions for a role", () => {
+            const engine = createEngine();
+            const perms = engine.getRolePermissions("admin");
+            assert.ok(perms.length > 0);
+            assert.ok(perms.some((p) => p.resource === "frameworks"));
+        });
+        it("returns all built-in roles", () => {
+            const engine = createEngine();
+            const roles = engine.getAllRoles();
+            assert.ok(roles.length >= 5);
+            assert.ok(roles.some((r) => r.name === "admin"));
+            assert.ok(roles.some((r) => r.name === "viewer"));
+        });
+    });
+    describe("Multi-Tenant Isolation", () => {
+        it("isolates users across tenants", () => {
+            const engine = createEngine();
+            const tenant1 = engine.createTenant("Tenant 1");
+            const tenant2 = engine.createTenant("Tenant 2");
+            engine.assignRole("user-1", "admin", "global", tenant1.id, "system");
+            engine.assignRole("user-1", "viewer", "global", tenant2.id, "system");
+            const roles1 = engine.getUserRoles("user-1", tenant1.id);
+            const roles2 = engine.getUserRoles("user-1", tenant2.id);
+            assert.equal(roles1[0].role, "admin");
+            assert.equal(roles2[0].role, "viewer");
+        });
+        it("prevents cross-tenant permission leakage", () => {
+            const engine = createEngine();
+            const tenant1 = engine.createTenant("Tenant 1");
+            const tenant2 = engine.createTenant("Tenant 2");
+            engine.assignRole("user-1", "admin", "global", tenant1.id, "system");
+            assert.equal(engine.hasPermission("user-1", tenant1.id, "frameworks", "write"), true);
+            assert.equal(engine.hasPermission("user-1", tenant2.id, "frameworks", "write"), false);
+        });
+    });
+});

package/dist/types.d.ts

@@ -0,0 +1,71 @@
+export type RoleName = "admin" | "compliance_officer" | "auditor" | "viewer" | "custom";
+export type ScopeLevel = "global" | "entity" | "department";
+export type Resource = "frameworks" | "evidence" | "policies" | "controls" | "assessments" | "vendors" | "risks" | "incidents" | "connectors" | "users" | "roles" | "tenants" | "audit_logs" | "reports" | "settings";
+export type Action = "read" | "write" | "delete" | "approve" | "export" | "manage";
+export type PermissionString = `${Resource}:${Action}`;
+export interface Permission {
+    resource: Resource;
+    actions: Action[];
+}
+export interface Role {
+    name: RoleName;
+    permissions: Permission[];
+    description: string;
+}
+export interface UserRoleAssignment {
+    userId: string;
+    role: RoleName;
+    scope: ScopeLevel;
+    scopeId?: string;
+    tenantId: string;
+    assignedAt: string;
+    assignedBy: string;
+}
+export interface TenantConfig {
+    id: string;
+    name: string;
+    parentTenantId?: string;
+    createdAt: string;
+    settings: Record<string, unknown>;
+}
+export interface PermissionCheck {
+    userId: string;
+    tenantId: string;
+    resource: Resource;
+    action: Action;
+    scopeId?: string;
+}
+export interface PermissionResult {
+    allowed: boolean;
+    role: RoleName;
+    scope: ScopeLevel;
+    reason: string;
+}
+export interface AuditLogEntry {
+    id: string;
+    timestamp: string;
+    userId: string;
+    tenantId: string;
+    resource: Resource;
+    action: Action;
+    allowed: boolean;
+    role: RoleName;
+    scope: ScopeLevel;
+    reason: string;
+    metadata?: Record<string, unknown>;
+}
+export interface JWTPayload {
+    sub: string;
+    tenant_id: string;
+    role: RoleName;
+    scope: ScopeLevel;
+    scope_id?: string;
+    permissions: PermissionString[];
+    iat: number;
+    exp: number;
+}
+export interface RBACConfig {
+    jwtSecret: string;
+    jwtExpiresIn?: number;
+    auditLogLimit?: number;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@grc-claw/rbac-multi-tenant",
+  "version": "0.8.0",
+  "description": "RBAC engine with multi-tenant isolation for A2Z SOC platform",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --import tsx --test src/**/*.test.ts"
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "tsx": "^4.19.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AAH20/GRC_Claw"
+  }
+}