@invect/core 0.0.1

package/dist/services/auth/authorization.service.cjs

@@ -0,0 +1,259 @@
+require("../../_virtual/_rolldown/runtime.cjs");
+const require_auth_types = require("../../types/auth.types.cjs");
+let events = require("events");
+//#region src/services/auth/authorization.service.ts
+/**
+* Authorization Service
+*
+* Handles RBAC (Role-Based Access Control) for Invect resources.
+* This service is stateless - all identity information comes from the host app
+* via the resolveUser callback at request time.
+*/
+/**
+* AuthorizationService - Stateless RBAC authorization for Invect
+*
+* Key design decisions:
+* - No database tables for users/roles (BYO Auth pattern)
+* - All identity information resolved at request time
+* - Emits events for host app audit logging
+* - Supports custom roles and permission overrides
+*/
+var AuthorizationService = class extends events.EventEmitter {
+	config;
+	rolePermissions;
+	logger;
+	constructor(options = {}) {
+		super();
+		this.config = {
+			enabled: false,
+			defaultRole: "viewer",
+			onAuthFailure: "throw",
+			...options.config
+		};
+		this.logger = options.logger;
+		this.rolePermissions = /* @__PURE__ */ new Map();
+		for (const [role, permissions] of Object.entries(require_auth_types.DEFAULT_ROLE_PERMISSIONS)) this.rolePermissions.set(role, permissions);
+		if (this.config.customRoles) for (const [role, permissions] of Object.entries(this.config.customRoles)) this.rolePermissions.set(role, permissions);
+	}
+	/**
+	* Check if authentication is enabled.
+	*/
+	isEnabled() {
+		return this.config.enabled ?? true;
+	}
+	/**
+	* Check if a route is public (no auth required).
+	*/
+	isPublicRoute(path) {
+		if (!this.config.publicRoutes) return false;
+		return this.config.publicRoutes.some((pattern) => {
+			if (pattern.endsWith("/*")) {
+				const prefix = pattern.slice(0, -2);
+				return path.startsWith(prefix);
+			}
+			return path === pattern;
+		});
+	}
+	/**
+	* Authorize an action for an identity.
+	*
+	* @param context - Authorization context with identity, action, and optional resource
+	* @returns Authorization result with allowed flag and optional reason
+	*/
+	async authorize(context) {
+		const { identity, action, resource } = context;
+		if (!this.isEnabled()) {
+			this.logger?.debug("Auth disabled, allowing action", { action });
+			return { allowed: true };
+		}
+		if (!identity) {
+			const event = {
+				type: "auth:unauthenticated",
+				timestamp: /* @__PURE__ */ new Date(),
+				action,
+				resource
+			};
+			this.emit("auth:unauthenticated", event);
+			this.logger?.warn("Unauthenticated request", {
+				action,
+				resource
+			});
+			return {
+				allowed: false,
+				reason: "Authentication required"
+			};
+		}
+		if (this.hasDirectPermission(identity, action)) return this.allowAction(context, "direct permission");
+		const role = this.resolveRole(identity);
+		const permissions = this.getPermissionsForRole(role);
+		if (this.permissionMatches(permissions, action)) {
+			if (resource?.id && identity.resourceAccess) {
+				if (!this.checkResourceAccess(identity, resource)) return this.denyAction(context, `No access to ${resource.type} '${resource.id}'`);
+			}
+			return this.allowAction(context, `role '${role}'`);
+		}
+		if (this.config.customAuthorize) try {
+			const customResult = await this.config.customAuthorize(context);
+			if (customResult === true) return this.allowAction(context, "custom authorizer");
+			if (customResult === false) return this.denyAction(context, "Denied by custom authorizer");
+		} catch (error) {
+			this.logger?.error("Custom authorizer error", {
+				error,
+				context
+			});
+		}
+		return this.denyAction(context, `Permission '${action}' required. Role '${role}' does not have this permission.`);
+	}
+	/**
+	* Get all permissions for an identity.
+	*/
+	getPermissions(identity) {
+		if (!identity) return [];
+		const role = this.resolveRole(identity);
+		const rolePerms = this.getPermissionsForRole(role);
+		const directPerms = identity.permissions || [];
+		const allPerms = new Set([...rolePerms, ...directPerms]);
+		if (allPerms.has("admin:*")) return ["admin:*"];
+		return Array.from(allPerms);
+	}
+	/**
+	* Check if identity has a specific permission.
+	*/
+	hasPermission(identity, permission) {
+		if (!identity) return false;
+		const permissions = this.getPermissions(identity);
+		return this.permissionMatches(permissions, permission);
+	}
+	/**
+	* Get the resolved role for an identity.
+	*/
+	getResolvedRole(identity) {
+		return this.resolveRole(identity);
+	}
+	/**
+	* Get available roles and their permissions.
+	* Useful for admin UIs to show role options.
+	*/
+	getAvailableRoles() {
+		const roles = [];
+		for (const [role, permissions] of this.rolePermissions) roles.push({
+			role,
+			permissions
+		});
+		return roles;
+	}
+	/**
+	* Resolve the effective Invect role for an identity.
+	*/
+	resolveRole(identity) {
+		const identityRole = identity.role;
+		if (!identityRole) return this.config.defaultRole ?? "viewer";
+		if (this.config.roleMapper && this.config.roleMapper[identityRole]) return this.config.roleMapper[identityRole];
+		return identityRole;
+	}
+	/**
+	* Get permissions for a role.
+	*/
+	getPermissionsForRole(role) {
+		return this.rolePermissions.get(role) || [];
+	}
+	/**
+	* Check if identity has the permission via direct override.
+	*/
+	hasDirectPermission(identity, action) {
+		if (!identity.permissions) return false;
+		return this.permissionMatches(identity.permissions, action);
+	}
+	/**
+	* Check if a permission list includes the required permission.
+	* Handles admin:* wildcard.
+	*/
+	permissionMatches(permissions, required) {
+		if (permissions.includes("admin:*")) return true;
+		return permissions.includes(required);
+	}
+	/**
+	* Check resource-level access control.
+	*/
+	checkResourceAccess(identity, resource) {
+		if (!identity.resourceAccess || !resource.id) return true;
+		const accessKey = this.getResourceAccessKey(resource.type);
+		if (!accessKey) return true;
+		const accessList = identity.resourceAccess[accessKey];
+		if (accessList === void 0) return true;
+		if (accessList === "*") return true;
+		return accessList.includes(resource.id);
+	}
+	/**
+	* Map resource type to resourceAccess property key.
+	*/
+	getResourceAccessKey(type) {
+		switch (type) {
+			case "flow":
+			case "flow-version":
+			case "flow-run":
+			case "node-execution": return "flows";
+			case "credential": return "credentials";
+			case "agent-tool": return null;
+			default: return null;
+		}
+	}
+	/**
+	* Allow an action and emit event.
+	*/
+	allowAction(context, grantedBy) {
+		const event = {
+			type: "auth:authorized",
+			timestamp: /* @__PURE__ */ new Date(),
+			identity: context.identity,
+			action: context.action,
+			resource: context.resource,
+			allowed: true
+		};
+		this.emit("auth:authorized", event);
+		this.logger?.debug("Action authorized", {
+			action: context.action,
+			resource: context.resource,
+			grantedBy,
+			identity: context.identity?.id
+		});
+		return { allowed: true };
+	}
+	/**
+	* Deny an action and emit event.
+	*/
+	denyAction(context, reason) {
+		const event = {
+			type: "auth:forbidden",
+			timestamp: /* @__PURE__ */ new Date(),
+			identity: context.identity,
+			action: context.action,
+			resource: context.resource,
+			allowed: false,
+			reason
+		};
+		this.emit("auth:forbidden", event);
+		this.logger?.warn("Action denied", {
+			action: context.action,
+			resource: context.resource,
+			reason,
+			identity: context.identity?.id,
+			role: context.identity?.role
+		});
+		return {
+			allowed: false,
+			reason
+		};
+	}
+};
+/**
+* Create an AuthorizationService instance.
+*/
+function createAuthorizationService(options) {
+	return new AuthorizationService(options);
+}
+//#endregion
+exports.AuthorizationService = AuthorizationService;
+exports.createAuthorizationService = createAuthorizationService;
+
+//# sourceMappingURL=authorization.service.cjs.map

package/dist/services/auth/authorization.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.cjs","names":["EventEmitter","DEFAULT_ROLE_PERMISSIONS"],"sources":["../../../src/services/auth/authorization.service.ts"],"sourcesContent":["/**\n * Authorization Service\n *\n * Handles RBAC (Role-Based Access Control) for Invect resources.\n * This service is stateless - all identity information comes from the host app\n * via the resolveUser callback at request time.\n */\n\nimport { EventEmitter } from 'events';\nimport {\n  InvectIdentity,\n  InvectPermission,\n  InvectRole,\n  InvectResourceType,\n  InvectAuthConfig,\n  AuthorizationContext,\n  AuthorizationResult,\n  AuthAuthorizedEvent,\n  AuthForbiddenEvent,\n  AuthUnauthenticatedEvent,\n  DEFAULT_ROLE_PERMISSIONS,\n} from '../../types/auth.types';\nimport type { Logger } from '../../types/schemas-fresh/invect-config';\n\n/**\n * Options for creating the AuthorizationService\n */\nexport interface AuthorizationServiceOptions {\n  config?: InvectAuthConfig;\n  logger?: Logger;\n}\n\n/**\n * AuthorizationService - Stateless RBAC authorization for Invect\n *\n * Key design decisions:\n * - No database tables for users/roles (BYO Auth pattern)\n * - All identity information resolved at request time\n * - Emits events for host app audit logging\n * - Supports custom roles and permission overrides\n */\nexport class AuthorizationService extends EventEmitter {\n  private readonly config: InvectAuthConfig;\n  private readonly rolePermissions: Map<string, InvectPermission[]>;\n  private readonly logger?: Logger;\n\n  constructor(options: AuthorizationServiceOptions = {}) {\n    super();\n\n    this.config = {\n      enabled: false, // RBAC disabled by default\n      defaultRole: 'viewer',\n      onAuthFailure: 'throw',\n      ...options.config,\n    };\n\n    this.logger = options.logger;\n\n    // Initialize role → permissions map with defaults + custom roles\n    this.rolePermissions = new Map();\n\n    // Add built-in roles\n    for (const [role, permissions] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {\n      this.rolePermissions.set(role, permissions);\n    }\n\n    // Add custom roles from config\n    if (this.config.customRoles) {\n      for (const [role, permissions] of Object.entries(this.config.customRoles)) {\n        this.rolePermissions.set(role, permissions);\n      }\n    }\n  }\n\n  /**\n   * Check if authentication is enabled.\n   */\n  isEnabled(): boolean {\n    return this.config.enabled ?? true;\n  }\n\n  /**\n   * Check if a route is public (no auth required).\n   */\n  isPublicRoute(path: string): boolean {\n    if (!this.config.publicRoutes) {\n      return false;\n    }\n\n    return this.config.publicRoutes.some((pattern) => {\n      // Support simple wildcard matching\n      if (pattern.endsWith('/*')) {\n        const prefix = pattern.slice(0, -2);\n        return path.startsWith(prefix);\n      }\n      return path === pattern;\n    });\n  }\n\n  /**\n   * Authorize an action for an identity.\n   *\n   * @param context - Authorization context with identity, action, and optional resource\n   * @returns Authorization result with allowed flag and optional reason\n   */\n  async authorize(context: AuthorizationContext): Promise<AuthorizationResult> {\n    const { identity, action, resource } = context;\n\n    // If auth is disabled, allow everything\n    if (!this.isEnabled()) {\n      this.logger?.debug('Auth disabled, allowing action', { action });\n      return { allowed: true };\n    }\n\n    // No identity = not authenticated\n    if (!identity) {\n      const event: AuthUnauthenticatedEvent = {\n        type: 'auth:unauthenticated',\n        timestamp: new Date(),\n        action,\n        resource,\n      };\n      this.emit('auth:unauthenticated', event);\n      this.logger?.warn('Unauthenticated request', { action, resource });\n\n      return {\n        allowed: false,\n        reason: 'Authentication required',\n      };\n    }\n\n    // Check direct permission overrides first\n    if (this.hasDirectPermission(identity, action)) {\n      return this.allowAction(context, 'direct permission');\n    }\n\n    // Check role-based permissions\n    const role = this.resolveRole(identity);\n    const permissions = this.getPermissionsForRole(role);\n\n    if (this.permissionMatches(permissions, action)) {\n      // If we have permission, also check resource-level access\n      if (resource?.id && identity.resourceAccess) {\n        const resourceAllowed = this.checkResourceAccess(identity, resource);\n        if (!resourceAllowed) {\n          return this.denyAction(context, `No access to ${resource.type} '${resource.id}'`);\n        }\n      }\n      return this.allowAction(context, `role '${role}'`);\n    }\n\n    // Check custom authorization callback\n    if (this.config.customAuthorize) {\n      try {\n        const customResult = await this.config.customAuthorize(context);\n        if (customResult === true) {\n          return this.allowAction(context, 'custom authorizer');\n        }\n        if (customResult === false) {\n          return this.denyAction(context, 'Denied by custom authorizer');\n        }\n        // undefined = fall through to default denial\n      } catch (error) {\n        this.logger?.error('Custom authorizer error', { error, context });\n        // On error, fall through to denial\n      }\n    }\n\n    // Default: deny\n    return this.denyAction(\n      context,\n      `Permission '${action}' required. Role '${role}' does not have this permission.`,\n    );\n  }\n\n  /**\n   * Get all permissions for an identity.\n   */\n  getPermissions(identity: InvectIdentity | null): InvectPermission[] {\n    if (!identity) {\n      return [];\n    }\n\n    const role = this.resolveRole(identity);\n    const rolePerms = this.getPermissionsForRole(role);\n    const directPerms = identity.permissions || [];\n\n    // Combine and deduplicate\n    const allPerms = new Set([...rolePerms, ...directPerms]);\n\n    // If admin:*, expand to all permissions\n    if (allPerms.has('admin:*')) {\n      return ['admin:*'];\n    }\n\n    return Array.from(allPerms);\n  }\n\n  /**\n   * Check if identity has a specific permission.\n   */\n  hasPermission(identity: InvectIdentity | null, permission: InvectPermission): boolean {\n    if (!identity) {\n      return false;\n    }\n\n    const permissions = this.getPermissions(identity);\n    return this.permissionMatches(permissions, permission);\n  }\n\n  /**\n   * Get the resolved role for an identity.\n   */\n  getResolvedRole(identity: InvectIdentity): InvectRole {\n    return this.resolveRole(identity);\n  }\n\n  /**\n   * Get available roles and their permissions.\n   * Useful for admin UIs to show role options.\n   */\n  getAvailableRoles(): Array<{ role: string; permissions: InvectPermission[] }> {\n    const roles: Array<{ role: string; permissions: InvectPermission[] }> = [];\n\n    for (const [role, permissions] of this.rolePermissions) {\n      roles.push({ role, permissions });\n    }\n\n    return roles;\n  }\n\n  // ===========================================================================\n  // Private Methods\n  // ===========================================================================\n\n  /**\n   * Resolve the effective Invect role for an identity.\n   */\n  private resolveRole(identity: InvectIdentity): string {\n    const identityRole = identity.role;\n\n    // No role provided - use default\n    if (!identityRole) {\n      return this.config.defaultRole ?? 'viewer';\n    }\n\n    // Check if role needs mapping\n    if (this.config.roleMapper && this.config.roleMapper[identityRole]) {\n      return this.config.roleMapper[identityRole];\n    }\n\n    return identityRole;\n  }\n\n  /**\n   * Get permissions for a role.\n   */\n  private getPermissionsForRole(role: string): InvectPermission[] {\n    return this.rolePermissions.get(role) || [];\n  }\n\n  /**\n   * Check if identity has the permission via direct override.\n   */\n  private hasDirectPermission(identity: InvectIdentity, action: InvectPermission): boolean {\n    if (!identity.permissions) {\n      return false;\n    }\n    return this.permissionMatches(identity.permissions, action);\n  }\n\n  /**\n   * Check if a permission list includes the required permission.\n   * Handles admin:* wildcard.\n   */\n  private permissionMatches(permissions: InvectPermission[], required: InvectPermission): boolean {\n    // Admin wildcard grants everything\n    if (permissions.includes('admin:*')) {\n      return true;\n    }\n    return permissions.includes(required);\n  }\n\n  /**\n   * Check resource-level access control.\n   */\n  private checkResourceAccess(\n    identity: InvectIdentity,\n    resource: { type: InvectResourceType; id?: string },\n  ): boolean {\n    if (!identity.resourceAccess || !resource.id) {\n      return true; // No restriction\n    }\n\n    // Map resource type to resourceAccess key\n    const accessKey = this.getResourceAccessKey(resource.type);\n    if (!accessKey) {\n      return true; // Unknown resource type, allow\n    }\n\n    const accessList = identity.resourceAccess[accessKey];\n\n    // No restriction for this resource type\n    if (accessList === undefined) {\n      return true;\n    }\n\n    // Wildcard allows all\n    if (accessList === '*') {\n      return true;\n    }\n\n    // Check if resource ID is in the list\n    return accessList.includes(resource.id);\n  }\n\n  /**\n   * Map resource type to resourceAccess property key.\n   */\n  private getResourceAccessKey(\n    type: InvectResourceType,\n  ): keyof NonNullable<InvectIdentity['resourceAccess']> | null {\n    switch (type) {\n      case 'flow':\n      case 'flow-version':\n      case 'flow-run':\n      case 'node-execution':\n        return 'flows';\n      case 'credential':\n        return 'credentials';\n      case 'agent-tool':\n        return null; // No resource-level restriction for tools\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Allow an action and emit event.\n   */\n  private allowAction(context: AuthorizationContext, grantedBy: string): AuthorizationResult {\n    const event: AuthAuthorizedEvent = {\n      type: 'auth:authorized',\n      timestamp: new Date(),\n      identity: context.identity,\n      action: context.action,\n      resource: context.resource,\n      allowed: true,\n    };\n\n    this.emit('auth:authorized', event);\n    this.logger?.debug('Action authorized', {\n      action: context.action,\n      resource: context.resource,\n      grantedBy,\n      identity: context.identity?.id,\n    });\n\n    return { allowed: true };\n  }\n\n  /**\n   * Deny an action and emit event.\n   */\n  private denyAction(context: AuthorizationContext, reason: string): AuthorizationResult {\n    const event: AuthForbiddenEvent = {\n      type: 'auth:forbidden',\n      timestamp: new Date(),\n      identity: context.identity,\n      action: context.action,\n      resource: context.resource,\n      allowed: false,\n      reason,\n    };\n\n    this.emit('auth:forbidden', event);\n    this.logger?.warn('Action denied', {\n      action: context.action,\n      resource: context.resource,\n      reason,\n      identity: context.identity?.id,\n      role: context.identity?.role,\n    });\n\n    return { allowed: false, reason };\n  }\n}\n\n/**\n * Create an AuthorizationService instance.\n */\nexport function createAuthorizationService(\n  options?: AuthorizationServiceOptions,\n): AuthorizationService {\n  return new AuthorizationService(options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,uBAAb,cAA0CA,OAAAA,aAAa;CACrD;CACA;CACA;CAEA,YAAY,UAAuC,EAAE,EAAE;AACrD,SAAO;AAEP,OAAK,SAAS;GACZ,SAAS;GACT,aAAa;GACb,eAAe;GACf,GAAG,QAAQ;GACZ;AAED,OAAK,SAAS,QAAQ;AAGtB,OAAK,kCAAkB,IAAI,KAAK;AAGhC,OAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQC,mBAAAA,yBAAyB,CACxE,MAAK,gBAAgB,IAAI,MAAM,YAAY;AAI7C,MAAI,KAAK,OAAO,YACd,MAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,OAAO,YAAY,CACvE,MAAK,gBAAgB,IAAI,MAAM,YAAY;;;;;CAQjD,YAAqB;AACnB,SAAO,KAAK,OAAO,WAAW;;;;;CAMhC,cAAc,MAAuB;AACnC,MAAI,CAAC,KAAK,OAAO,aACf,QAAO;AAGT,SAAO,KAAK,OAAO,aAAa,MAAM,YAAY;AAEhD,OAAI,QAAQ,SAAS,KAAK,EAAE;IAC1B,MAAM,SAAS,QAAQ,MAAM,GAAG,GAAG;AACnC,WAAO,KAAK,WAAW,OAAO;;AAEhC,UAAO,SAAS;IAChB;;;;;;;;CASJ,MAAM,UAAU,SAA6D;EAC3E,MAAM,EAAE,UAAU,QAAQ,aAAa;AAGvC,MAAI,CAAC,KAAK,WAAW,EAAE;AACrB,QAAK,QAAQ,MAAM,kCAAkC,EAAE,QAAQ,CAAC;AAChE,UAAO,EAAE,SAAS,MAAM;;AAI1B,MAAI,CAAC,UAAU;GACb,MAAM,QAAkC;IACtC,MAAM;IACN,2BAAW,IAAI,MAAM;IACrB;IACA;IACD;AACD,QAAK,KAAK,wBAAwB,MAAM;AACxC,QAAK,QAAQ,KAAK,2BAA2B;IAAE;IAAQ;IAAU,CAAC;AAElE,UAAO;IACL,SAAS;IACT,QAAQ;IACT;;AAIH,MAAI,KAAK,oBAAoB,UAAU,OAAO,CAC5C,QAAO,KAAK,YAAY,SAAS,oBAAoB;EAIvD,MAAM,OAAO,KAAK,YAAY,SAAS;EACvC,MAAM,cAAc,KAAK,sBAAsB,KAAK;AAEpD,MAAI,KAAK,kBAAkB,aAAa,OAAO,EAAE;AAE/C,OAAI,UAAU,MAAM,SAAS;QAEvB,CADoB,KAAK,oBAAoB,UAAU,SAAS,CAElE,QAAO,KAAK,WAAW,SAAS,gBAAgB,SAAS,KAAK,IAAI,SAAS,GAAG,GAAG;;AAGrF,UAAO,KAAK,YAAY,SAAS,SAAS,KAAK,GAAG;;AAIpD,MAAI,KAAK,OAAO,gBACd,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,OAAO,gBAAgB,QAAQ;AAC/D,OAAI,iBAAiB,KACnB,QAAO,KAAK,YAAY,SAAS,oBAAoB;AAEvD,OAAI,iBAAiB,MACnB,QAAO,KAAK,WAAW,SAAS,8BAA8B;WAGzD,OAAO;AACd,QAAK,QAAQ,MAAM,2BAA2B;IAAE;IAAO;IAAS,CAAC;;AAMrE,SAAO,KAAK,WACV,SACA,eAAe,OAAO,oBAAoB,KAAK,kCAChD;;;;;CAMH,eAAe,UAAqD;AAClE,MAAI,CAAC,SACH,QAAO,EAAE;EAGX,MAAM,OAAO,KAAK,YAAY,SAAS;EACvC,MAAM,YAAY,KAAK,sBAAsB,KAAK;EAClD,MAAM,cAAc,SAAS,eAAe,EAAE;EAG9C,MAAM,WAAW,IAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAGxD,MAAI,SAAS,IAAI,UAAU,CACzB,QAAO,CAAC,UAAU;AAGpB,SAAO,MAAM,KAAK,SAAS;;;;;CAM7B,cAAc,UAAiC,YAAuC;AACpF,MAAI,CAAC,SACH,QAAO;EAGT,MAAM,cAAc,KAAK,eAAe,SAAS;AACjD,SAAO,KAAK,kBAAkB,aAAa,WAAW;;;;;CAMxD,gBAAgB,UAAsC;AACpD,SAAO,KAAK,YAAY,SAAS;;;;;;CAOnC,oBAA8E;EAC5E,MAAM,QAAkE,EAAE;AAE1E,OAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,gBACrC,OAAM,KAAK;GAAE;GAAM;GAAa,CAAC;AAGnC,SAAO;;;;;CAUT,YAAoB,UAAkC;EACpD,MAAM,eAAe,SAAS;AAG9B,MAAI,CAAC,aACH,QAAO,KAAK,OAAO,eAAe;AAIpC,MAAI,KAAK,OAAO,cAAc,KAAK,OAAO,WAAW,cACnD,QAAO,KAAK,OAAO,WAAW;AAGhC,SAAO;;;;;CAMT,sBAA8B,MAAkC;AAC9D,SAAO,KAAK,gBAAgB,IAAI,KAAK,IAAI,EAAE;;;;;CAM7C,oBAA4B,UAA0B,QAAmC;AACvF,MAAI,CAAC,SAAS,YACZ,QAAO;AAET,SAAO,KAAK,kBAAkB,SAAS,aAAa,OAAO;;;;;;CAO7D,kBAA0B,aAAiC,UAAqC;AAE9F,MAAI,YAAY,SAAS,UAAU,CACjC,QAAO;AAET,SAAO,YAAY,SAAS,SAAS;;;;;CAMvC,oBACE,UACA,UACS;AACT,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,GACxC,QAAO;EAIT,MAAM,YAAY,KAAK,qBAAqB,SAAS,KAAK;AAC1D,MAAI,CAAC,UACH,QAAO;EAGT,MAAM,aAAa,SAAS,eAAe;AAG3C,MAAI,eAAe,KAAA,EACjB,QAAO;AAIT,MAAI,eAAe,IACjB,QAAO;AAIT,SAAO,WAAW,SAAS,SAAS,GAAG;;;;;CAMzC,qBACE,MAC4D;AAC5D,UAAQ,MAAR;GACE,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACH,QAAO;GACT,KAAK,aACH,QAAO;GACT,KAAK,aACH,QAAO;GACT,QACE,QAAO;;;;;;CAOb,YAAoB,SAA+B,WAAwC;EACzF,MAAM,QAA6B;GACjC,MAAM;GACN,2BAAW,IAAI,MAAM;GACrB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS;GACV;AAED,OAAK,KAAK,mBAAmB,MAAM;AACnC,OAAK,QAAQ,MAAM,qBAAqB;GACtC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB;GACA,UAAU,QAAQ,UAAU;GAC7B,CAAC;AAEF,SAAO,EAAE,SAAS,MAAM;;;;;CAM1B,WAAmB,SAA+B,QAAqC;EACrF,MAAM,QAA4B;GAChC,MAAM;GACN,2BAAW,IAAI,MAAM;GACrB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS;GACT;GACD;AAED,OAAK,KAAK,kBAAkB,MAAM;AAClC,OAAK,QAAQ,KAAK,iBAAiB;GACjC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB;GACA,UAAU,QAAQ,UAAU;GAC5B,MAAM,QAAQ,UAAU;GACzB,CAAC;AAEF,SAAO;GAAE,SAAS;GAAO;GAAQ;;;;;;AAOrC,SAAgB,2BACd,SACsB;AACtB,QAAO,IAAI,qBAAqB,QAAQ"}

package/dist/services/auth/authorization.service.d.cts

@@ -0,0 +1,102 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.cjs";
+import { AuthorizationContext, AuthorizationResult, InvectAuthConfig, InvectIdentity, InvectPermission, InvectRole } from "../../types/auth.types.cjs";
+import { EventEmitter } from "events";
+
+//#region src/services/auth/authorization.service.d.ts
+/**
+ * Options for creating the AuthorizationService
+ */
+interface AuthorizationServiceOptions {
+  config?: InvectAuthConfig;
+  logger?: Logger;
+}
+/**
+ * AuthorizationService - Stateless RBAC authorization for Invect
+ *
+ * Key design decisions:
+ * - No database tables for users/roles (BYO Auth pattern)
+ * - All identity information resolved at request time
+ * - Emits events for host app audit logging
+ * - Supports custom roles and permission overrides
+ */
+declare class AuthorizationService extends EventEmitter {
+  private readonly config;
+  private readonly rolePermissions;
+  private readonly logger?;
+  constructor(options?: AuthorizationServiceOptions);
+  /**
+   * Check if authentication is enabled.
+   */
+  isEnabled(): boolean;
+  /**
+   * Check if a route is public (no auth required).
+   */
+  isPublicRoute(path: string): boolean;
+  /**
+   * Authorize an action for an identity.
+   *
+   * @param context - Authorization context with identity, action, and optional resource
+   * @returns Authorization result with allowed flag and optional reason
+   */
+  authorize(context: AuthorizationContext): Promise<AuthorizationResult>;
+  /**
+   * Get all permissions for an identity.
+   */
+  getPermissions(identity: InvectIdentity | null): InvectPermission[];
+  /**
+   * Check if identity has a specific permission.
+   */
+  hasPermission(identity: InvectIdentity | null, permission: InvectPermission): boolean;
+  /**
+   * Get the resolved role for an identity.
+   */
+  getResolvedRole(identity: InvectIdentity): InvectRole;
+  /**
+   * Get available roles and their permissions.
+   * Useful for admin UIs to show role options.
+   */
+  getAvailableRoles(): Array<{
+    role: string;
+    permissions: InvectPermission[];
+  }>;
+  /**
+   * Resolve the effective Invect role for an identity.
+   */
+  private resolveRole;
+  /**
+   * Get permissions for a role.
+   */
+  private getPermissionsForRole;
+  /**
+   * Check if identity has the permission via direct override.
+   */
+  private hasDirectPermission;
+  /**
+   * Check if a permission list includes the required permission.
+   * Handles admin:* wildcard.
+   */
+  private permissionMatches;
+  /**
+   * Check resource-level access control.
+   */
+  private checkResourceAccess;
+  /**
+   * Map resource type to resourceAccess property key.
+   */
+  private getResourceAccessKey;
+  /**
+   * Allow an action and emit event.
+   */
+  private allowAction;
+  /**
+   * Deny an action and emit event.
+   */
+  private denyAction;
+}
+/**
+ * Create an AuthorizationService instance.
+ */
+declare function createAuthorizationService(options?: AuthorizationServiceOptions): AuthorizationService;
+//#endregion
+export { AuthorizationService, AuthorizationServiceOptions, createAuthorizationService };
+//# sourceMappingURL=authorization.service.d.cts.map

package/dist/services/auth/authorization.service.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.d.cts","names":[],"sources":["../../../src/services/auth/authorization.service.ts"],"mappings":";;;;;;;;UA2BiB,2BAAA;EACf,MAAA,GAAS,gBAAA;EACT,MAAA,GAAS,MAAA;AAAA;;;;;;;;;;cAYE,oBAAA,SAA6B,YAAA;EAAA,iBACvB,MAAA;EAAA,iBACA,eAAA;EAAA,iBACA,MAAA;cAEL,OAAA,GAAS,2BAAA;EAL+B;;;EAoCpD,SAAA,CAAA;EAlCiB;;;EAyCjB,aAAA,CAAc,IAAA;EAtCF;;;;;;EA2DN,SAAA,CAAU,OAAA,EAAS,oBAAA,GAAuB,OAAA,CAAQ,mBAAA;EAAR;;;EAyEhD,cAAA,CAAe,QAAA,EAAU,cAAA,UAAwB,gBAAA;EAAlC;;;EAuBf,aAAA,CAAc,QAAA,EAAU,cAAA,SAAuB,UAAA,EAAY,gBAAA;EAA7C;;;EAYd,eAAA,CAAgB,QAAA,EAAU,cAAA,GAAiB,UAAA;EAAjB;;;;EAQ1B,iBAAA,CAAA,GAAqB,KAAA;IAAQ,IAAA;IAAc,WAAA,EAAa,gBAAA;EAAA;EAiBhD;;;EAAA,QAAA,WAAA;EAgDA;;;EAAA,QA7BA,qBAAA;EA2GU;;AA2BpB;EA3BoB,QApGV,mBAAA;;;;;UAWA,iBAAA;EAsHa;;;EAAA,QA3Gb,mBAAA;;;;UAiCA,oBAAA;;;;UAqBA,WAAA;;;;UAwBA,UAAA;AAAA;;;;iBA2BM,0BAAA,CACd,OAAA,GAAU,2BAAA,GACT,oBAAA"}

package/dist/services/auth/authorization.service.d.ts

@@ -0,0 +1,102 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.js";
+import { AuthorizationContext, AuthorizationResult, InvectAuthConfig, InvectIdentity, InvectPermission, InvectRole } from "../../types/auth.types.js";
+import { EventEmitter } from "events";
+
+//#region src/services/auth/authorization.service.d.ts
+/**
+ * Options for creating the AuthorizationService
+ */
+interface AuthorizationServiceOptions {
+  config?: InvectAuthConfig;
+  logger?: Logger;
+}
+/**
+ * AuthorizationService - Stateless RBAC authorization for Invect
+ *
+ * Key design decisions:
+ * - No database tables for users/roles (BYO Auth pattern)
+ * - All identity information resolved at request time
+ * - Emits events for host app audit logging
+ * - Supports custom roles and permission overrides
+ */
+declare class AuthorizationService extends EventEmitter {
+  private readonly config;
+  private readonly rolePermissions;
+  private readonly logger?;
+  constructor(options?: AuthorizationServiceOptions);
+  /**
+   * Check if authentication is enabled.
+   */
+  isEnabled(): boolean;
+  /**
+   * Check if a route is public (no auth required).
+   */
+  isPublicRoute(path: string): boolean;
+  /**
+   * Authorize an action for an identity.
+   *
+   * @param context - Authorization context with identity, action, and optional resource
+   * @returns Authorization result with allowed flag and optional reason
+   */
+  authorize(context: AuthorizationContext): Promise<AuthorizationResult>;
+  /**
+   * Get all permissions for an identity.
+   */
+  getPermissions(identity: InvectIdentity | null): InvectPermission[];
+  /**
+   * Check if identity has a specific permission.
+   */
+  hasPermission(identity: InvectIdentity | null, permission: InvectPermission): boolean;
+  /**
+   * Get the resolved role for an identity.
+   */
+  getResolvedRole(identity: InvectIdentity): InvectRole;
+  /**
+   * Get available roles and their permissions.
+   * Useful for admin UIs to show role options.
+   */
+  getAvailableRoles(): Array<{
+    role: string;
+    permissions: InvectPermission[];
+  }>;
+  /**
+   * Resolve the effective Invect role for an identity.
+   */
+  private resolveRole;
+  /**
+   * Get permissions for a role.
+   */
+  private getPermissionsForRole;
+  /**
+   * Check if identity has the permission via direct override.
+   */
+  private hasDirectPermission;
+  /**
+   * Check if a permission list includes the required permission.
+   * Handles admin:* wildcard.
+   */
+  private permissionMatches;
+  /**
+   * Check resource-level access control.
+   */
+  private checkResourceAccess;
+  /**
+   * Map resource type to resourceAccess property key.
+   */
+  private getResourceAccessKey;
+  /**
+   * Allow an action and emit event.
+   */
+  private allowAction;
+  /**
+   * Deny an action and emit event.
+   */
+  private denyAction;
+}
+/**
+ * Create an AuthorizationService instance.
+ */
+declare function createAuthorizationService(options?: AuthorizationServiceOptions): AuthorizationService;
+//#endregion
+export { AuthorizationService, AuthorizationServiceOptions, createAuthorizationService };
+//# sourceMappingURL=authorization.service.d.ts.map

package/dist/services/auth/authorization.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.d.ts","names":[],"sources":["../../../src/services/auth/authorization.service.ts"],"mappings":";;;;;;;;UA2BiB,2BAAA;EACf,MAAA,GAAS,gBAAA;EACT,MAAA,GAAS,MAAA;AAAA;;;;;;;;;;cAYE,oBAAA,SAA6B,YAAA;EAAA,iBACvB,MAAA;EAAA,iBACA,eAAA;EAAA,iBACA,MAAA;cAEL,OAAA,GAAS,2BAAA;EAL+B;;;EAoCpD,SAAA,CAAA;EAlCiB;;;EAyCjB,aAAA,CAAc,IAAA;EAtCF;;;;;;EA2DN,SAAA,CAAU,OAAA,EAAS,oBAAA,GAAuB,OAAA,CAAQ,mBAAA;EAAR;;;EAyEhD,cAAA,CAAe,QAAA,EAAU,cAAA,UAAwB,gBAAA;EAAlC;;;EAuBf,aAAA,CAAc,QAAA,EAAU,cAAA,SAAuB,UAAA,EAAY,gBAAA;EAA7C;;;EAYd,eAAA,CAAgB,QAAA,EAAU,cAAA,GAAiB,UAAA;EAAjB;;;;EAQ1B,iBAAA,CAAA,GAAqB,KAAA;IAAQ,IAAA;IAAc,WAAA,EAAa,gBAAA;EAAA;EAiBhD;;;EAAA,QAAA,WAAA;EAgDA;;;EAAA,QA7BA,qBAAA;EA2GU;;AA2BpB;EA3BoB,QApGV,mBAAA;;;;;UAWA,iBAAA;EAsHa;;;EAAA,QA3Gb,mBAAA;;;;UAiCA,oBAAA;;;;UAqBA,WAAA;;;;UAwBA,UAAA;AAAA;;;;iBA2BM,0BAAA,CACd,OAAA,GAAU,2BAAA,GACT,oBAAA"}