@invect/core 0.0.1

package/dist/services/auth/authorization.service.js

@@ -0,0 +1,257 @@
+import { DEFAULT_ROLE_PERMISSIONS } from "../../types/auth.types.js";
+import { EventEmitter } from "events";
+//#region src/services/auth/authorization.service.ts
+/**
+* Authorization Service
+*
+* Handles RBAC (Role-Based Access Control) for Invect resources.
+* This service is stateless - all identity information comes from the host app
+* via the resolveUser callback at request time.
+*/
+/**
+* AuthorizationService - Stateless RBAC authorization for Invect
+*
+* Key design decisions:
+* - No database tables for users/roles (BYO Auth pattern)
+* - All identity information resolved at request time
+* - Emits events for host app audit logging
+* - Supports custom roles and permission overrides
+*/
+var AuthorizationService = class extends EventEmitter {
+	config;
+	rolePermissions;
+	logger;
+	constructor(options = {}) {
+		super();
+		this.config = {
+			enabled: false,
+			defaultRole: "viewer",
+			onAuthFailure: "throw",
+			...options.config
+		};
+		this.logger = options.logger;
+		this.rolePermissions = /* @__PURE__ */ new Map();
+		for (const [role, permissions] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) this.rolePermissions.set(role, permissions);
+		if (this.config.customRoles) for (const [role, permissions] of Object.entries(this.config.customRoles)) this.rolePermissions.set(role, permissions);
+	}
+	/**
+	* Check if authentication is enabled.
+	*/
+	isEnabled() {
+		return this.config.enabled ?? true;
+	}
+	/**
+	* Check if a route is public (no auth required).
+	*/
+	isPublicRoute(path) {
+		if (!this.config.publicRoutes) return false;
+		return this.config.publicRoutes.some((pattern) => {
+			if (pattern.endsWith("/*")) {
+				const prefix = pattern.slice(0, -2);
+				return path.startsWith(prefix);
+			}
+			return path === pattern;
+		});
+	}
+	/**
+	* Authorize an action for an identity.
+	*
+	* @param context - Authorization context with identity, action, and optional resource
+	* @returns Authorization result with allowed flag and optional reason
+	*/
+	async authorize(context) {
+		const { identity, action, resource } = context;
+		if (!this.isEnabled()) {
+			this.logger?.debug("Auth disabled, allowing action", { action });
+			return { allowed: true };
+		}
+		if (!identity) {
+			const event = {
+				type: "auth:unauthenticated",
+				timestamp: /* @__PURE__ */ new Date(),
+				action,
+				resource
+			};
+			this.emit("auth:unauthenticated", event);
+			this.logger?.warn("Unauthenticated request", {
+				action,
+				resource
+			});
+			return {
+				allowed: false,
+				reason: "Authentication required"
+			};
+		}
+		if (this.hasDirectPermission(identity, action)) return this.allowAction(context, "direct permission");
+		const role = this.resolveRole(identity);
+		const permissions = this.getPermissionsForRole(role);
+		if (this.permissionMatches(permissions, action)) {
+			if (resource?.id && identity.resourceAccess) {
+				if (!this.checkResourceAccess(identity, resource)) return this.denyAction(context, `No access to ${resource.type} '${resource.id}'`);
+			}
+			return this.allowAction(context, `role '${role}'`);
+		}
+		if (this.config.customAuthorize) try {
+			const customResult = await this.config.customAuthorize(context);
+			if (customResult === true) return this.allowAction(context, "custom authorizer");
+			if (customResult === false) return this.denyAction(context, "Denied by custom authorizer");
+		} catch (error) {
+			this.logger?.error("Custom authorizer error", {
+				error,
+				context
+			});
+		}
+		return this.denyAction(context, `Permission '${action}' required. Role '${role}' does not have this permission.`);
+	}
+	/**
+	* Get all permissions for an identity.
+	*/
+	getPermissions(identity) {
+		if (!identity) return [];
+		const role = this.resolveRole(identity);
+		const rolePerms = this.getPermissionsForRole(role);
+		const directPerms = identity.permissions || [];
+		const allPerms = new Set([...rolePerms, ...directPerms]);
+		if (allPerms.has("admin:*")) return ["admin:*"];
+		return Array.from(allPerms);
+	}
+	/**
+	* Check if identity has a specific permission.
+	*/
+	hasPermission(identity, permission) {
+		if (!identity) return false;
+		const permissions = this.getPermissions(identity);
+		return this.permissionMatches(permissions, permission);
+	}
+	/**
+	* Get the resolved role for an identity.
+	*/
+	getResolvedRole(identity) {
+		return this.resolveRole(identity);
+	}
+	/**
+	* Get available roles and their permissions.
+	* Useful for admin UIs to show role options.
+	*/
+	getAvailableRoles() {
+		const roles = [];
+		for (const [role, permissions] of this.rolePermissions) roles.push({
+			role,
+			permissions
+		});
+		return roles;
+	}
+	/**
+	* Resolve the effective Invect role for an identity.
+	*/
+	resolveRole(identity) {
+		const identityRole = identity.role;
+		if (!identityRole) return this.config.defaultRole ?? "viewer";
+		if (this.config.roleMapper && this.config.roleMapper[identityRole]) return this.config.roleMapper[identityRole];
+		return identityRole;
+	}
+	/**
+	* Get permissions for a role.
+	*/
+	getPermissionsForRole(role) {
+		return this.rolePermissions.get(role) || [];
+	}
+	/**
+	* Check if identity has the permission via direct override.
+	*/
+	hasDirectPermission(identity, action) {
+		if (!identity.permissions) return false;
+		return this.permissionMatches(identity.permissions, action);
+	}
+	/**
+	* Check if a permission list includes the required permission.
+	* Handles admin:* wildcard.
+	*/
+	permissionMatches(permissions, required) {
+		if (permissions.includes("admin:*")) return true;
+		return permissions.includes(required);
+	}
+	/**
+	* Check resource-level access control.
+	*/
+	checkResourceAccess(identity, resource) {
+		if (!identity.resourceAccess || !resource.id) return true;
+		const accessKey = this.getResourceAccessKey(resource.type);
+		if (!accessKey) return true;
+		const accessList = identity.resourceAccess[accessKey];
+		if (accessList === void 0) return true;
+		if (accessList === "*") return true;
+		return accessList.includes(resource.id);
+	}
+	/**
+	* Map resource type to resourceAccess property key.
+	*/
+	getResourceAccessKey(type) {
+		switch (type) {
+			case "flow":
+			case "flow-version":
+			case "flow-run":
+			case "node-execution": return "flows";
+			case "credential": return "credentials";
+			case "agent-tool": return null;
+			default: return null;
+		}
+	}
+	/**
+	* Allow an action and emit event.
+	*/
+	allowAction(context, grantedBy) {
+		const event = {
+			type: "auth:authorized",
+			timestamp: /* @__PURE__ */ new Date(),
+			identity: context.identity,
+			action: context.action,
+			resource: context.resource,
+			allowed: true
+		};
+		this.emit("auth:authorized", event);
+		this.logger?.debug("Action authorized", {
+			action: context.action,
+			resource: context.resource,
+			grantedBy,
+			identity: context.identity?.id
+		});
+		return { allowed: true };
+	}
+	/**
+	* Deny an action and emit event.
+	*/
+	denyAction(context, reason) {
+		const event = {
+			type: "auth:forbidden",
+			timestamp: /* @__PURE__ */ new Date(),
+			identity: context.identity,
+			action: context.action,
+			resource: context.resource,
+			allowed: false,
+			reason
+		};
+		this.emit("auth:forbidden", event);
+		this.logger?.warn("Action denied", {
+			action: context.action,
+			resource: context.resource,
+			reason,
+			identity: context.identity?.id,
+			role: context.identity?.role
+		});
+		return {
+			allowed: false,
+			reason
+		};
+	}
+};
+/**
+* Create an AuthorizationService instance.
+*/
+function createAuthorizationService(options) {
+	return new AuthorizationService(options);
+}
+//#endregion
+export { AuthorizationService, createAuthorizationService };
+
+//# sourceMappingURL=authorization.service.js.map

package/dist/services/auth/authorization.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.js","names":[],"sources":["../../../src/services/auth/authorization.service.ts"],"sourcesContent":["/**\n * Authorization Service\n *\n * Handles RBAC (Role-Based Access Control) for Invect resources.\n * This service is stateless - all identity information comes from the host app\n * via the resolveUser callback at request time.\n */\n\nimport { EventEmitter } from 'events';\nimport {\n  InvectIdentity,\n  InvectPermission,\n  InvectRole,\n  InvectResourceType,\n  InvectAuthConfig,\n  AuthorizationContext,\n  AuthorizationResult,\n  AuthAuthorizedEvent,\n  AuthForbiddenEvent,\n  AuthUnauthenticatedEvent,\n  DEFAULT_ROLE_PERMISSIONS,\n} from '../../types/auth.types';\nimport type { Logger } from '../../types/schemas-fresh/invect-config';\n\n/**\n * Options for creating the AuthorizationService\n */\nexport interface AuthorizationServiceOptions {\n  config?: InvectAuthConfig;\n  logger?: Logger;\n}\n\n/**\n * AuthorizationService - Stateless RBAC authorization for Invect\n *\n * Key design decisions:\n * - No database tables for users/roles (BYO Auth pattern)\n * - All identity information resolved at request time\n * - Emits events for host app audit logging\n * - Supports custom roles and permission overrides\n */\nexport class AuthorizationService extends EventEmitter {\n  private readonly config: InvectAuthConfig;\n  private readonly rolePermissions: Map<string, InvectPermission[]>;\n  private readonly logger?: Logger;\n\n  constructor(options: AuthorizationServiceOptions = {}) {\n    super();\n\n    this.config = {\n      enabled: false, // RBAC disabled by default\n      defaultRole: 'viewer',\n      onAuthFailure: 'throw',\n      ...options.config,\n    };\n\n    this.logger = options.logger;\n\n    // Initialize role → permissions map with defaults + custom roles\n    this.rolePermissions = new Map();\n\n    // Add built-in roles\n    for (const [role, permissions] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {\n      this.rolePermissions.set(role, permissions);\n    }\n\n    // Add custom roles from config\n    if (this.config.customRoles) {\n      for (const [role, permissions] of Object.entries(this.config.customRoles)) {\n        this.rolePermissions.set(role, permissions);\n      }\n    }\n  }\n\n  /**\n   * Check if authentication is enabled.\n   */\n  isEnabled(): boolean {\n    return this.config.enabled ?? true;\n  }\n\n  /**\n   * Check if a route is public (no auth required).\n   */\n  isPublicRoute(path: string): boolean {\n    if (!this.config.publicRoutes) {\n      return false;\n    }\n\n    return this.config.publicRoutes.some((pattern) => {\n      // Support simple wildcard matching\n      if (pattern.endsWith('/*')) {\n        const prefix = pattern.slice(0, -2);\n        return path.startsWith(prefix);\n      }\n      return path === pattern;\n    });\n  }\n\n  /**\n   * Authorize an action for an identity.\n   *\n   * @param context - Authorization context with identity, action, and optional resource\n   * @returns Authorization result with allowed flag and optional reason\n   */\n  async authorize(context: AuthorizationContext): Promise<AuthorizationResult> {\n    const { identity, action, resource } = context;\n\n    // If auth is disabled, allow everything\n    if (!this.isEnabled()) {\n      this.logger?.debug('Auth disabled, allowing action', { action });\n      return { allowed: true };\n    }\n\n    // No identity = not authenticated\n    if (!identity) {\n      const event: AuthUnauthenticatedEvent = {\n        type: 'auth:unauthenticated',\n        timestamp: new Date(),\n        action,\n        resource,\n      };\n      this.emit('auth:unauthenticated', event);\n      this.logger?.warn('Unauthenticated request', { action, resource });\n\n      return {\n        allowed: false,\n        reason: 'Authentication required',\n      };\n    }\n\n    // Check direct permission overrides first\n    if (this.hasDirectPermission(identity, action)) {\n      return this.allowAction(context, 'direct permission');\n    }\n\n    // Check role-based permissions\n    const role = this.resolveRole(identity);\n    const permissions = this.getPermissionsForRole(role);\n\n    if (this.permissionMatches(permissions, action)) {\n      // If we have permission, also check resource-level access\n      if (resource?.id && identity.resourceAccess) {\n        const resourceAllowed = this.checkResourceAccess(identity, resource);\n        if (!resourceAllowed) {\n          return this.denyAction(context, `No access to ${resource.type} '${resource.id}'`);\n        }\n      }\n      return this.allowAction(context, `role '${role}'`);\n    }\n\n    // Check custom authorization callback\n    if (this.config.customAuthorize) {\n      try {\n        const customResult = await this.config.customAuthorize(context);\n        if (customResult === true) {\n          return this.allowAction(context, 'custom authorizer');\n        }\n        if (customResult === false) {\n          return this.denyAction(context, 'Denied by custom authorizer');\n        }\n        // undefined = fall through to default denial\n      } catch (error) {\n        this.logger?.error('Custom authorizer error', { error, context });\n        // On error, fall through to denial\n      }\n    }\n\n    // Default: deny\n    return this.denyAction(\n      context,\n      `Permission '${action}' required. Role '${role}' does not have this permission.`,\n    );\n  }\n\n  /**\n   * Get all permissions for an identity.\n   */\n  getPermissions(identity: InvectIdentity | null): InvectPermission[] {\n    if (!identity) {\n      return [];\n    }\n\n    const role = this.resolveRole(identity);\n    const rolePerms = this.getPermissionsForRole(role);\n    const directPerms = identity.permissions || [];\n\n    // Combine and deduplicate\n    const allPerms = new Set([...rolePerms, ...directPerms]);\n\n    // If admin:*, expand to all permissions\n    if (allPerms.has('admin:*')) {\n      return ['admin:*'];\n    }\n\n    return Array.from(allPerms);\n  }\n\n  /**\n   * Check if identity has a specific permission.\n   */\n  hasPermission(identity: InvectIdentity | null, permission: InvectPermission): boolean {\n    if (!identity) {\n      return false;\n    }\n\n    const permissions = this.getPermissions(identity);\n    return this.permissionMatches(permissions, permission);\n  }\n\n  /**\n   * Get the resolved role for an identity.\n   */\n  getResolvedRole(identity: InvectIdentity): InvectRole {\n    return this.resolveRole(identity);\n  }\n\n  /**\n   * Get available roles and their permissions.\n   * Useful for admin UIs to show role options.\n   */\n  getAvailableRoles(): Array<{ role: string; permissions: InvectPermission[] }> {\n    const roles: Array<{ role: string; permissions: InvectPermission[] }> = [];\n\n    for (const [role, permissions] of this.rolePermissions) {\n      roles.push({ role, permissions });\n    }\n\n    return roles;\n  }\n\n  // ===========================================================================\n  // Private Methods\n  // ===========================================================================\n\n  /**\n   * Resolve the effective Invect role for an identity.\n   */\n  private resolveRole(identity: InvectIdentity): string {\n    const identityRole = identity.role;\n\n    // No role provided - use default\n    if (!identityRole) {\n      return this.config.defaultRole ?? 'viewer';\n    }\n\n    // Check if role needs mapping\n    if (this.config.roleMapper && this.config.roleMapper[identityRole]) {\n      return this.config.roleMapper[identityRole];\n    }\n\n    return identityRole;\n  }\n\n  /**\n   * Get permissions for a role.\n   */\n  private getPermissionsForRole(role: string): InvectPermission[] {\n    return this.rolePermissions.get(role) || [];\n  }\n\n  /**\n   * Check if identity has the permission via direct override.\n   */\n  private hasDirectPermission(identity: InvectIdentity, action: InvectPermission): boolean {\n    if (!identity.permissions) {\n      return false;\n    }\n    return this.permissionMatches(identity.permissions, action);\n  }\n\n  /**\n   * Check if a permission list includes the required permission.\n   * Handles admin:* wildcard.\n   */\n  private permissionMatches(permissions: InvectPermission[], required: InvectPermission): boolean {\n    // Admin wildcard grants everything\n    if (permissions.includes('admin:*')) {\n      return true;\n    }\n    return permissions.includes(required);\n  }\n\n  /**\n   * Check resource-level access control.\n   */\n  private checkResourceAccess(\n    identity: InvectIdentity,\n    resource: { type: InvectResourceType; id?: string },\n  ): boolean {\n    if (!identity.resourceAccess || !resource.id) {\n      return true; // No restriction\n    }\n\n    // Map resource type to resourceAccess key\n    const accessKey = this.getResourceAccessKey(resource.type);\n    if (!accessKey) {\n      return true; // Unknown resource type, allow\n    }\n\n    const accessList = identity.resourceAccess[accessKey];\n\n    // No restriction for this resource type\n    if (accessList === undefined) {\n      return true;\n    }\n\n    // Wildcard allows all\n    if (accessList === '*') {\n      return true;\n    }\n\n    // Check if resource ID is in the list\n    return accessList.includes(resource.id);\n  }\n\n  /**\n   * Map resource type to resourceAccess property key.\n   */\n  private getResourceAccessKey(\n    type: InvectResourceType,\n  ): keyof NonNullable<InvectIdentity['resourceAccess']> | null {\n    switch (type) {\n      case 'flow':\n      case 'flow-version':\n      case 'flow-run':\n      case 'node-execution':\n        return 'flows';\n      case 'credential':\n        return 'credentials';\n      case 'agent-tool':\n        return null; // No resource-level restriction for tools\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Allow an action and emit event.\n   */\n  private allowAction(context: AuthorizationContext, grantedBy: string): AuthorizationResult {\n    const event: AuthAuthorizedEvent = {\n      type: 'auth:authorized',\n      timestamp: new Date(),\n      identity: context.identity,\n      action: context.action,\n      resource: context.resource,\n      allowed: true,\n    };\n\n    this.emit('auth:authorized', event);\n    this.logger?.debug('Action authorized', {\n      action: context.action,\n      resource: context.resource,\n      grantedBy,\n      identity: context.identity?.id,\n    });\n\n    return { allowed: true };\n  }\n\n  /**\n   * Deny an action and emit event.\n   */\n  private denyAction(context: AuthorizationContext, reason: string): AuthorizationResult {\n    const event: AuthForbiddenEvent = {\n      type: 'auth:forbidden',\n      timestamp: new Date(),\n      identity: context.identity,\n      action: context.action,\n      resource: context.resource,\n      allowed: false,\n      reason,\n    };\n\n    this.emit('auth:forbidden', event);\n    this.logger?.warn('Action denied', {\n      action: context.action,\n      resource: context.resource,\n      reason,\n      identity: context.identity?.id,\n      role: context.identity?.role,\n    });\n\n    return { allowed: false, reason };\n  }\n}\n\n/**\n * Create an AuthorizationService instance.\n */\nexport function createAuthorizationService(\n  options?: AuthorizationServiceOptions,\n): AuthorizationService {\n  return new AuthorizationService(options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAyCA,IAAa,uBAAb,cAA0C,aAAa;CACrD;CACA;CACA;CAEA,YAAY,UAAuC,EAAE,EAAE;AACrD,SAAO;AAEP,OAAK,SAAS;GACZ,SAAS;GACT,aAAa;GACb,eAAe;GACf,GAAG,QAAQ;GACZ;AAED,OAAK,SAAS,QAAQ;AAGtB,OAAK,kCAAkB,IAAI,KAAK;AAGhC,OAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,yBAAyB,CACxE,MAAK,gBAAgB,IAAI,MAAM,YAAY;AAI7C,MAAI,KAAK,OAAO,YACd,MAAK,MAAM,CAAC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,OAAO,YAAY,CACvE,MAAK,gBAAgB,IAAI,MAAM,YAAY;;;;;CAQjD,YAAqB;AACnB,SAAO,KAAK,OAAO,WAAW;;;;;CAMhC,cAAc,MAAuB;AACnC,MAAI,CAAC,KAAK,OAAO,aACf,QAAO;AAGT,SAAO,KAAK,OAAO,aAAa,MAAM,YAAY;AAEhD,OAAI,QAAQ,SAAS,KAAK,EAAE;IAC1B,MAAM,SAAS,QAAQ,MAAM,GAAG,GAAG;AACnC,WAAO,KAAK,WAAW,OAAO;;AAEhC,UAAO,SAAS;IAChB;;;;;;;;CASJ,MAAM,UAAU,SAA6D;EAC3E,MAAM,EAAE,UAAU,QAAQ,aAAa;AAGvC,MAAI,CAAC,KAAK,WAAW,EAAE;AACrB,QAAK,QAAQ,MAAM,kCAAkC,EAAE,QAAQ,CAAC;AAChE,UAAO,EAAE,SAAS,MAAM;;AAI1B,MAAI,CAAC,UAAU;GACb,MAAM,QAAkC;IACtC,MAAM;IACN,2BAAW,IAAI,MAAM;IACrB;IACA;IACD;AACD,QAAK,KAAK,wBAAwB,MAAM;AACxC,QAAK,QAAQ,KAAK,2BAA2B;IAAE;IAAQ;IAAU,CAAC;AAElE,UAAO;IACL,SAAS;IACT,QAAQ;IACT;;AAIH,MAAI,KAAK,oBAAoB,UAAU,OAAO,CAC5C,QAAO,KAAK,YAAY,SAAS,oBAAoB;EAIvD,MAAM,OAAO,KAAK,YAAY,SAAS;EACvC,MAAM,cAAc,KAAK,sBAAsB,KAAK;AAEpD,MAAI,KAAK,kBAAkB,aAAa,OAAO,EAAE;AAE/C,OAAI,UAAU,MAAM,SAAS;QAEvB,CADoB,KAAK,oBAAoB,UAAU,SAAS,CAElE,QAAO,KAAK,WAAW,SAAS,gBAAgB,SAAS,KAAK,IAAI,SAAS,GAAG,GAAG;;AAGrF,UAAO,KAAK,YAAY,SAAS,SAAS,KAAK,GAAG;;AAIpD,MAAI,KAAK,OAAO,gBACd,KAAI;GACF,MAAM,eAAe,MAAM,KAAK,OAAO,gBAAgB,QAAQ;AAC/D,OAAI,iBAAiB,KACnB,QAAO,KAAK,YAAY,SAAS,oBAAoB;AAEvD,OAAI,iBAAiB,MACnB,QAAO,KAAK,WAAW,SAAS,8BAA8B;WAGzD,OAAO;AACd,QAAK,QAAQ,MAAM,2BAA2B;IAAE;IAAO;IAAS,CAAC;;AAMrE,SAAO,KAAK,WACV,SACA,eAAe,OAAO,oBAAoB,KAAK,kCAChD;;;;;CAMH,eAAe,UAAqD;AAClE,MAAI,CAAC,SACH,QAAO,EAAE;EAGX,MAAM,OAAO,KAAK,YAAY,SAAS;EACvC,MAAM,YAAY,KAAK,sBAAsB,KAAK;EAClD,MAAM,cAAc,SAAS,eAAe,EAAE;EAG9C,MAAM,WAAW,IAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,CAAC;AAGxD,MAAI,SAAS,IAAI,UAAU,CACzB,QAAO,CAAC,UAAU;AAGpB,SAAO,MAAM,KAAK,SAAS;;;;;CAM7B,cAAc,UAAiC,YAAuC;AACpF,MAAI,CAAC,SACH,QAAO;EAGT,MAAM,cAAc,KAAK,eAAe,SAAS;AACjD,SAAO,KAAK,kBAAkB,aAAa,WAAW;;;;;CAMxD,gBAAgB,UAAsC;AACpD,SAAO,KAAK,YAAY,SAAS;;;;;;CAOnC,oBAA8E;EAC5E,MAAM,QAAkE,EAAE;AAE1E,OAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,gBACrC,OAAM,KAAK;GAAE;GAAM;GAAa,CAAC;AAGnC,SAAO;;;;;CAUT,YAAoB,UAAkC;EACpD,MAAM,eAAe,SAAS;AAG9B,MAAI,CAAC,aACH,QAAO,KAAK,OAAO,eAAe;AAIpC,MAAI,KAAK,OAAO,cAAc,KAAK,OAAO,WAAW,cACnD,QAAO,KAAK,OAAO,WAAW;AAGhC,SAAO;;;;;CAMT,sBAA8B,MAAkC;AAC9D,SAAO,KAAK,gBAAgB,IAAI,KAAK,IAAI,EAAE;;;;;CAM7C,oBAA4B,UAA0B,QAAmC;AACvF,MAAI,CAAC,SAAS,YACZ,QAAO;AAET,SAAO,KAAK,kBAAkB,SAAS,aAAa,OAAO;;;;;;CAO7D,kBAA0B,aAAiC,UAAqC;AAE9F,MAAI,YAAY,SAAS,UAAU,CACjC,QAAO;AAET,SAAO,YAAY,SAAS,SAAS;;;;;CAMvC,oBACE,UACA,UACS;AACT,MAAI,CAAC,SAAS,kBAAkB,CAAC,SAAS,GACxC,QAAO;EAIT,MAAM,YAAY,KAAK,qBAAqB,SAAS,KAAK;AAC1D,MAAI,CAAC,UACH,QAAO;EAGT,MAAM,aAAa,SAAS,eAAe;AAG3C,MAAI,eAAe,KAAA,EACjB,QAAO;AAIT,MAAI,eAAe,IACjB,QAAO;AAIT,SAAO,WAAW,SAAS,SAAS,GAAG;;;;;CAMzC,qBACE,MAC4D;AAC5D,UAAQ,MAAR;GACE,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,iBACH,QAAO;GACT,KAAK,aACH,QAAO;GACT,KAAK,aACH,QAAO;GACT,QACE,QAAO;;;;;;CAOb,YAAoB,SAA+B,WAAwC;EACzF,MAAM,QAA6B;GACjC,MAAM;GACN,2BAAW,IAAI,MAAM;GACrB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS;GACV;AAED,OAAK,KAAK,mBAAmB,MAAM;AACnC,OAAK,QAAQ,MAAM,qBAAqB;GACtC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB;GACA,UAAU,QAAQ,UAAU;GAC7B,CAAC;AAEF,SAAO,EAAE,SAAS,MAAM;;;;;CAM1B,WAAmB,SAA+B,QAAqC;EACrF,MAAM,QAA4B;GAChC,MAAM;GACN,2BAAW,IAAI,MAAM;GACrB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,SAAS;GACT;GACD;AAED,OAAK,KAAK,kBAAkB,MAAM;AAClC,OAAK,QAAQ,KAAK,iBAAiB;GACjC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB;GACA,UAAU,QAAQ,UAAU;GAC5B,MAAM,QAAQ,UAAU;GACzB,CAAC;AAEF,SAAO;GAAE,SAAS;GAAO;GAAQ;;;;;;AAOrC,SAAgB,2BACd,SACsB;AACtB,QAAO,IAAI,qBAAqB,QAAQ"}

package/dist/services/auth/flow-access.service.cjs

@@ -0,0 +1,259 @@
+//#region src/services/auth/flow-access.service.ts
+const TABLE = "flow_access";
+/**
+* Permission hierarchy for access checks.
+* Higher number = more permissions.
+*/
+const PERMISSION_LEVELS = {
+	viewer: 1,
+	operator: 2,
+	editor: 3,
+	owner: 4
+};
+/**
+* FlowAccessService - Manages flow access permissions
+*/
+var FlowAccessService = class {
+	adapter;
+	logger;
+	constructor(options) {
+		this.adapter = options.adapter;
+		this.logger = options.logger;
+	}
+	/**
+	* Grant access to a flow for a user or team.
+	*/
+	async grantAccess(input) {
+		if (!input.userId && !input.teamId) throw new Error("Either userId or teamId must be provided");
+		if (input.userId && input.teamId) throw new Error("Cannot set both userId and teamId - use one or the other");
+		this.logger?.debug("Granting flow access", { input });
+		const existing = await this.findExistingAccess(input.flowId, input.userId, input.teamId);
+		if (existing) {
+			const updated = await this.adapter.update({
+				model: TABLE,
+				where: [{
+					field: "id",
+					value: existing.id
+				}],
+				update: {
+					permission: input.permission,
+					granted_by: input.grantedBy,
+					granted_at: /* @__PURE__ */ new Date(),
+					expires_at: input.expiresAt ?? null
+				}
+			});
+			if (!updated) throw new Error(`Flow access ${existing.id} no longer exists`);
+			const record = this.normalize(updated);
+			this.logger?.info("Updated flow access", {
+				id: record.id,
+				flowId: input.flowId
+			});
+			return record;
+		}
+		const created = await this.adapter.create({
+			model: TABLE,
+			data: {
+				flow_id: input.flowId,
+				user_id: input.userId ?? null,
+				team_id: input.teamId ?? null,
+				permission: input.permission,
+				granted_by: input.grantedBy ?? null,
+				granted_at: /* @__PURE__ */ new Date(),
+				expires_at: input.expiresAt ?? null
+			}
+		});
+		const record = this.normalize(created);
+		this.logger?.info("Granted flow access", {
+			id: record.id,
+			flowId: input.flowId
+		});
+		return record;
+	}
+	/**
+	* Revoke access to a flow for a user or team.
+	*/
+	async revokeAccess(accessId) {
+		this.logger?.debug("Revoking flow access", { accessId });
+		await this.adapter.delete({
+			model: TABLE,
+			where: [{
+				field: "id",
+				value: accessId
+			}]
+		});
+		this.logger?.info("Revoked flow access", { accessId });
+	}
+	/**
+	* Revoke all access to a flow for a specific user or team.
+	*/
+	async revokeAccessForUserOrTeam(flowId, userId, teamId) {
+		if (!userId && !teamId) throw new Error("Either userId or teamId must be provided");
+		const where = [{
+			field: "flow_id",
+			value: flowId
+		}];
+		if (userId) where.push({
+			field: "user_id",
+			value: userId
+		});
+		if (teamId) where.push({
+			field: "team_id",
+			value: teamId
+		});
+		await this.adapter.delete({
+			model: TABLE,
+			where
+		});
+		this.logger?.info("Revoked flow access for user/team", {
+			flowId,
+			userId,
+			teamId
+		});
+	}
+	/**
+	* List all access records for a flow.
+	*/
+	async listFlowAccess(flowId) {
+		return (await this.adapter.findMany({
+			model: TABLE,
+			where: [{
+				field: "flow_id",
+				value: flowId
+			}]
+		})).map((r) => this.normalize(r));
+	}
+	/**
+	* Get all flows a user has access to (directly or via teams).
+	* Fetches matching records and filters in application code.
+	*/
+	async getAccessibleFlowIds(userId, teamIds = []) {
+		const userRows = await this.adapter.findMany({
+			model: TABLE,
+			where: [{
+				field: "user_id",
+				value: userId
+			}],
+			select: ["flow_id", "expires_at"]
+		});
+		let teamRows = [];
+		if (teamIds.length > 0) teamRows = await this.adapter.findMany({
+			model: TABLE,
+			where: [{
+				field: "team_id",
+				operator: "in",
+				value: teamIds
+			}],
+			select: ["flow_id", "expires_at"]
+		});
+		const now = /* @__PURE__ */ new Date();
+		const flowIds = /* @__PURE__ */ new Set();
+		for (const row of [...userRows, ...teamRows]) {
+			const expiresAt = row.expires_at ?? row.expiresAt;
+			if (expiresAt && new Date(expiresAt) <= now) continue;
+			flowIds.add(String(row.flow_id ?? row.flowId));
+		}
+		return [...flowIds];
+	}
+	/**
+	* Check if a user has access to a flow with at least the required permission.
+	*/
+	async hasFlowAccess(flowId, userId, teamIds = [], requiredPermission = "viewer") {
+		const records = await this.getFlowAccessRecords(flowId, userId, teamIds);
+		const requiredLevel = PERMISSION_LEVELS[requiredPermission];
+		return records.some((r) => PERMISSION_LEVELS[r.permission] >= requiredLevel);
+	}
+	/**
+	* Get the highest permission level a user has for a flow.
+	*/
+	async getFlowPermission(flowId, userId, teamIds = []) {
+		const records = await this.getFlowAccessRecords(flowId, userId, teamIds);
+		if (records.length === 0) return null;
+		let highest = "viewer";
+		for (const record of records) if (PERMISSION_LEVELS[record.permission] > PERMISSION_LEVELS[highest]) highest = record.permission;
+		return highest;
+	}
+	/**
+	* Auto-grant owner access when a flow is created.
+	*/
+	async grantOwnerAccess(flowId, userId) {
+		return this.grantAccess({
+			flowId,
+			userId,
+			permission: "owner",
+			grantedBy: userId
+		});
+	}
+	/**
+	* Get non-expired access records for a user (direct + teams) on a specific flow.
+	*/
+	async getFlowAccessRecords(flowId, userId, teamIds) {
+		const userRows = await this.adapter.findMany({
+			model: TABLE,
+			where: [{
+				field: "flow_id",
+				value: flowId
+			}, {
+				field: "user_id",
+				value: userId
+			}]
+		});
+		let teamRows = [];
+		if (teamIds.length > 0) teamRows = await this.adapter.findMany({
+			model: TABLE,
+			where: [{
+				field: "flow_id",
+				value: flowId
+			}, {
+				field: "team_id",
+				operator: "in",
+				value: teamIds
+			}]
+		});
+		const now = /* @__PURE__ */ new Date();
+		return [...userRows, ...teamRows].map((r) => this.normalize(r)).filter((r) => {
+			if (!r.expiresAt) return true;
+			return new Date(r.expiresAt) > now;
+		});
+	}
+	/**
+	* Find existing access record for a user/team on a flow.
+	*/
+	async findExistingAccess(flowId, userId, teamId) {
+		const where = [{
+			field: "flow_id",
+			value: flowId
+		}];
+		if (userId) where.push({
+			field: "user_id",
+			value: userId
+		});
+		if (teamId) where.push({
+			field: "team_id",
+			value: teamId
+		});
+		const row = await this.adapter.findOne({
+			model: TABLE,
+			where
+		});
+		return row ? this.normalize(row) : null;
+	}
+	/**
+	* Normalize a raw database row into a FlowAccessRecord.
+	*/
+	normalize(raw) {
+		return {
+			id: String(raw.id),
+			flowId: String(raw.flow_id ?? raw.flowId),
+			userId: raw.user_id ?? raw.userId ?? null,
+			teamId: raw.team_id ?? raw.teamId ?? null,
+			permission: String(raw.permission),
+			grantedBy: raw.granted_by ?? raw.grantedBy ?? null,
+			grantedAt: raw.granted_at ?? raw.grantedAt ?? /* @__PURE__ */ new Date(),
+			expiresAt: raw.expires_at ?? raw.expiresAt ?? null
+		};
+	}
+};
+//#endregion
+exports.FlowAccessService = FlowAccessService;
+
+//# sourceMappingURL=flow-access.service.cjs.map

package/dist/services/auth/flow-access.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-access.service.cjs","names":[],"sources":["../../../src/services/auth/flow-access.service.ts"],"sourcesContent":["/**\n * Flow Access Service\n *\n * Manages flow-level access permissions stored in the Invect database.\n * Supports both user-level and team-level access control.\n *\n * Uses the InvectAdapter for database operations (no direct Drizzle usage).\n */\n\nimport type { Logger } from '../../types/schemas-fresh/invect-config';\nimport type { InvectAdapter, WhereClause } from '../../database/adapter';\n\n// Types for the service\nexport type FlowAccessPermission = 'owner' | 'editor' | 'operator' | 'viewer';\n\nexport interface FlowAccessRecord {\n  id: string;\n  flowId: string;\n  userId?: string | null;\n  teamId?: string | null;\n  permission: FlowAccessPermission;\n  grantedBy?: string | null;\n  grantedAt: Date | string;\n  expiresAt?: Date | string | null;\n}\n\nexport interface GrantFlowAccessInput {\n  flowId: string;\n  userId?: string;\n  teamId?: string;\n  permission: FlowAccessPermission;\n  grantedBy?: string;\n  expiresAt?: Date | string;\n}\n\nexport interface FlowAccessQuery {\n  userId?: string;\n  teamIds?: string[];\n  flowId?: string;\n  includeExpired?: boolean;\n}\n\nexport interface FlowAccessServiceOptions {\n  adapter: InvectAdapter;\n  logger?: Logger;\n}\n\nconst TABLE = 'flow_access';\n\n/**\n * Permission hierarchy for access checks.\n * Higher number = more permissions.\n */\nconst PERMISSION_LEVELS: Record<FlowAccessPermission, number> = {\n  viewer: 1,\n  operator: 2,\n  editor: 3,\n  owner: 4,\n};\n\n/**\n * FlowAccessService - Manages flow access permissions\n */\nexport class FlowAccessService {\n  private readonly adapter: InvectAdapter;\n  private readonly logger?: Logger;\n\n  constructor(options: FlowAccessServiceOptions) {\n    this.adapter = options.adapter;\n    this.logger = options.logger;\n  }\n\n  /**\n   * Grant access to a flow for a user or team.\n   */\n  async grantAccess(input: GrantFlowAccessInput): Promise<FlowAccessRecord> {\n    if (!input.userId && !input.teamId) {\n      throw new Error('Either userId or teamId must be provided');\n    }\n    if (input.userId && input.teamId) {\n      throw new Error('Cannot set both userId and teamId - use one or the other');\n    }\n\n    this.logger?.debug('Granting flow access', { input });\n\n    // Check if access already exists\n    const existing = await this.findExistingAccess(input.flowId, input.userId, input.teamId);\n\n    if (existing) {\n      // Update existing access\n      const updated = await this.adapter.update<Record<string, unknown>>({\n        model: TABLE,\n        where: [{ field: 'id', value: existing.id }],\n        update: {\n          permission: input.permission,\n          granted_by: input.grantedBy,\n          granted_at: new Date(),\n          expires_at: input.expiresAt ?? null,\n        },\n      });\n\n      if (!updated) {\n        throw new Error(`Flow access ${existing.id} no longer exists`);\n      }\n\n      const record = this.normalize(updated);\n      this.logger?.info('Updated flow access', { id: record.id, flowId: input.flowId });\n      return record;\n    }\n\n    // Create new access\n    const created = await this.adapter.create({\n      model: TABLE,\n      data: {\n        flow_id: input.flowId,\n        user_id: input.userId ?? null,\n        team_id: input.teamId ?? null,\n        permission: input.permission,\n        granted_by: input.grantedBy ?? null,\n        granted_at: new Date(),\n        expires_at: input.expiresAt ?? null,\n      },\n    });\n\n    const record = this.normalize(created);\n    this.logger?.info('Granted flow access', { id: record.id, flowId: input.flowId });\n    return record;\n  }\n\n  /**\n   * Revoke access to a flow for a user or team.\n   */\n  async revokeAccess(accessId: string): Promise<void> {\n    this.logger?.debug('Revoking flow access', { accessId });\n\n    await this.adapter.delete({\n      model: TABLE,\n      where: [{ field: 'id', value: accessId }],\n    });\n\n    this.logger?.info('Revoked flow access', { accessId });\n  }\n\n  /**\n   * Revoke all access to a flow for a specific user or team.\n   */\n  async revokeAccessForUserOrTeam(flowId: string, userId?: string, teamId?: string): Promise<void> {\n    if (!userId && !teamId) {\n      throw new Error('Either userId or teamId must be provided');\n    }\n\n    const where: WhereClause[] = [{ field: 'flow_id', value: flowId }];\n    if (userId) {\n      where.push({ field: 'user_id', value: userId });\n    }\n    if (teamId) {\n      where.push({ field: 'team_id', value: teamId });\n    }\n\n    await this.adapter.delete({ model: TABLE, where });\n\n    this.logger?.info('Revoked flow access for user/team', { flowId, userId, teamId });\n  }\n\n  /**\n   * List all access records for a flow.\n   */\n  async listFlowAccess(flowId: string): Promise<FlowAccessRecord[]> {\n    const rows = await this.adapter.findMany<Record<string, unknown>>({\n      model: TABLE,\n      where: [{ field: 'flow_id', value: flowId }],\n    });\n    return rows.map((r) => this.normalize(r));\n  }\n\n  /**\n   * Get all flows a user has access to (directly or via teams).\n   * Fetches matching records and filters in application code.\n   */\n  async getAccessibleFlowIds(userId: string, teamIds: string[] = []): Promise<string[]> {\n    // Fetch user-level access\n    const userRows = await this.adapter.findMany<Record<string, unknown>>({\n      model: TABLE,\n      where: [{ field: 'user_id', value: userId }],\n      select: ['flow_id', 'expires_at'],\n    });\n\n    // Fetch team-level access\n    let teamRows: Record<string, unknown>[] = [];\n    if (teamIds.length > 0) {\n      teamRows = await this.adapter.findMany<Record<string, unknown>>({\n        model: TABLE,\n        where: [{ field: 'team_id', operator: 'in', value: teamIds }],\n        select: ['flow_id', 'expires_at'],\n      });\n    }\n\n    const now = new Date();\n    const flowIds = new Set<string>();\n\n    for (const row of [...userRows, ...teamRows]) {\n      const expiresAt = row.expires_at ?? row.expiresAt;\n      if (expiresAt && new Date(expiresAt as string) <= now) {\n        continue;\n      }\n      flowIds.add(String(row.flow_id ?? row.flowId));\n    }\n\n    return [...flowIds];\n  }\n\n  /**\n   * Check if a user has access to a flow with at least the required permission.\n   */\n  async hasFlowAccess(\n    flowId: string,\n    userId: string,\n    teamIds: string[] = [],\n    requiredPermission: FlowAccessPermission = 'viewer',\n  ): Promise<boolean> {\n    const records = await this.getFlowAccessRecords(flowId, userId, teamIds);\n    const requiredLevel = PERMISSION_LEVELS[requiredPermission];\n    return records.some((r) => PERMISSION_LEVELS[r.permission] >= requiredLevel);\n  }\n\n  /**\n   * Get the highest permission level a user has for a flow.\n   */\n  async getFlowPermission(\n    flowId: string,\n    userId: string,\n    teamIds: string[] = [],\n  ): Promise<FlowAccessPermission | null> {\n    const records = await this.getFlowAccessRecords(flowId, userId, teamIds);\n\n    if (records.length === 0) {\n      return null;\n    }\n\n    let highest: FlowAccessPermission = 'viewer';\n    for (const record of records) {\n      if (PERMISSION_LEVELS[record.permission] > PERMISSION_LEVELS[highest]) {\n        highest = record.permission;\n      }\n    }\n    return highest;\n  }\n\n  /**\n   * Auto-grant owner access when a flow is created.\n   */\n  async grantOwnerAccess(flowId: string, userId: string): Promise<FlowAccessRecord> {\n    return this.grantAccess({\n      flowId,\n      userId,\n      permission: 'owner',\n      grantedBy: userId,\n    });\n  }\n\n  // ─── Private helpers ─────────────────────────────────────────────\n\n  /**\n   * Get non-expired access records for a user (direct + teams) on a specific flow.\n   */\n  private async getFlowAccessRecords(\n    flowId: string,\n    userId: string,\n    teamIds: string[],\n  ): Promise<FlowAccessRecord[]> {\n    // User-level records for this flow\n    const userRows = await this.adapter.findMany<Record<string, unknown>>({\n      model: TABLE,\n      where: [\n        { field: 'flow_id', value: flowId },\n        { field: 'user_id', value: userId },\n      ],\n    });\n\n    // Team-level records for this flow\n    let teamRows: Record<string, unknown>[] = [];\n    if (teamIds.length > 0) {\n      teamRows = await this.adapter.findMany<Record<string, unknown>>({\n        model: TABLE,\n        where: [\n          { field: 'flow_id', value: flowId },\n          { field: 'team_id', operator: 'in', value: teamIds },\n        ],\n      });\n    }\n\n    const now = new Date();\n    return [...userRows, ...teamRows]\n      .map((r) => this.normalize(r))\n      .filter((r) => {\n        if (!r.expiresAt) {\n          return true;\n        }\n        return new Date(r.expiresAt as string) > now;\n      });\n  }\n\n  /**\n   * Find existing access record for a user/team on a flow.\n   */\n  private async findExistingAccess(\n    flowId: string,\n    userId?: string,\n    teamId?: string,\n  ): Promise<FlowAccessRecord | null> {\n    const where: WhereClause[] = [{ field: 'flow_id', value: flowId }];\n    if (userId) {\n      where.push({ field: 'user_id', value: userId });\n    }\n    if (teamId) {\n      where.push({ field: 'team_id', value: teamId });\n    }\n\n    const row = await this.adapter.findOne<Record<string, unknown>>({\n      model: TABLE,\n      where,\n    });\n\n    return row ? this.normalize(row) : null;\n  }\n\n  /**\n   * Normalize a raw database row into a FlowAccessRecord.\n   */\n  private normalize(raw: Record<string, unknown>): FlowAccessRecord {\n    return {\n      id: String(raw.id),\n      flowId: String(raw.flow_id ?? raw.flowId),\n      userId: (raw.user_id ?? raw.userId ?? null) as string | null,\n      teamId: (raw.team_id ?? raw.teamId ?? null) as string | null,\n      permission: String(raw.permission) as FlowAccessPermission,\n      grantedBy: (raw.granted_by ?? raw.grantedBy ?? null) as string | null,\n      grantedAt: (raw.granted_at ?? raw.grantedAt ?? new Date()) as Date | string,\n      expiresAt: (raw.expires_at ?? raw.expiresAt ?? null) as Date | string | null,\n    };\n  }\n}\n"],"mappings":";AA+CA,MAAM,QAAQ;;;;;AAMd,MAAM,oBAA0D;CAC9D,QAAQ;CACR,UAAU;CACV,QAAQ;CACR,OAAO;CACR;;;;AAKD,IAAa,oBAAb,MAA+B;CAC7B;CACA;CAEA,YAAY,SAAmC;AAC7C,OAAK,UAAU,QAAQ;AACvB,OAAK,SAAS,QAAQ;;;;;CAMxB,MAAM,YAAY,OAAwD;AACxE,MAAI,CAAC,MAAM,UAAU,CAAC,MAAM,OAC1B,OAAM,IAAI,MAAM,2CAA2C;AAE7D,MAAI,MAAM,UAAU,MAAM,OACxB,OAAM,IAAI,MAAM,2DAA2D;AAG7E,OAAK,QAAQ,MAAM,wBAAwB,EAAE,OAAO,CAAC;EAGrD,MAAM,WAAW,MAAM,KAAK,mBAAmB,MAAM,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAExF,MAAI,UAAU;GAEZ,MAAM,UAAU,MAAM,KAAK,QAAQ,OAAgC;IACjE,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO,SAAS;KAAI,CAAC;IAC5C,QAAQ;KACN,YAAY,MAAM;KAClB,YAAY,MAAM;KAClB,4BAAY,IAAI,MAAM;KACtB,YAAY,MAAM,aAAa;KAChC;IACF,CAAC;AAEF,OAAI,CAAC,QACH,OAAM,IAAI,MAAM,eAAe,SAAS,GAAG,mBAAmB;GAGhE,MAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,QAAK,QAAQ,KAAK,uBAAuB;IAAE,IAAI,OAAO;IAAI,QAAQ,MAAM;IAAQ,CAAC;AACjF,UAAO;;EAIT,MAAM,UAAU,MAAM,KAAK,QAAQ,OAAO;GACxC,OAAO;GACP,MAAM;IACJ,SAAS,MAAM;IACf,SAAS,MAAM,UAAU;IACzB,SAAS,MAAM,UAAU;IACzB,YAAY,MAAM;IAClB,YAAY,MAAM,aAAa;IAC/B,4BAAY,IAAI,MAAM;IACtB,YAAY,MAAM,aAAa;IAChC;GACF,CAAC;EAEF,MAAM,SAAS,KAAK,UAAU,QAAQ;AACtC,OAAK,QAAQ,KAAK,uBAAuB;GAAE,IAAI,OAAO;GAAI,QAAQ,MAAM;GAAQ,CAAC;AACjF,SAAO;;;;;CAMT,MAAM,aAAa,UAAiC;AAClD,OAAK,QAAQ,MAAM,wBAAwB,EAAE,UAAU,CAAC;AAExD,QAAM,KAAK,QAAQ,OAAO;GACxB,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO;IAAU,CAAC;GAC1C,CAAC;AAEF,OAAK,QAAQ,KAAK,uBAAuB,EAAE,UAAU,CAAC;;;;;CAMxD,MAAM,0BAA0B,QAAgB,QAAiB,QAAgC;AAC/F,MAAI,CAAC,UAAU,CAAC,OACd,OAAM,IAAI,MAAM,2CAA2C;EAG7D,MAAM,QAAuB,CAAC;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;AAClE,MAAI,OACF,OAAM,KAAK;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;AAEjD,MAAI,OACF,OAAM,KAAK;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;AAGjD,QAAM,KAAK,QAAQ,OAAO;GAAE,OAAO;GAAO;GAAO,CAAC;AAElD,OAAK,QAAQ,KAAK,qCAAqC;GAAE;GAAQ;GAAQ;GAAQ,CAAC;;;;;CAMpF,MAAM,eAAe,QAA6C;AAKhE,UAJa,MAAM,KAAK,QAAQ,SAAkC;GAChE,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAW,OAAO;IAAQ,CAAC;GAC7C,CAAC,EACU,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC;;;;;;CAO3C,MAAM,qBAAqB,QAAgB,UAAoB,EAAE,EAAqB;EAEpF,MAAM,WAAW,MAAM,KAAK,QAAQ,SAAkC;GACpE,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAW,OAAO;IAAQ,CAAC;GAC5C,QAAQ,CAAC,WAAW,aAAa;GAClC,CAAC;EAGF,IAAI,WAAsC,EAAE;AAC5C,MAAI,QAAQ,SAAS,EACnB,YAAW,MAAM,KAAK,QAAQ,SAAkC;GAC9D,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAW,UAAU;IAAM,OAAO;IAAS,CAAC;GAC7D,QAAQ,CAAC,WAAW,aAAa;GAClC,CAAC;EAGJ,MAAM,sBAAM,IAAI,MAAM;EACtB,MAAM,0BAAU,IAAI,KAAa;AAEjC,OAAK,MAAM,OAAO,CAAC,GAAG,UAAU,GAAG,SAAS,EAAE;GAC5C,MAAM,YAAY,IAAI,cAAc,IAAI;AACxC,OAAI,aAAa,IAAI,KAAK,UAAoB,IAAI,IAChD;AAEF,WAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,OAAO,CAAC;;AAGhD,SAAO,CAAC,GAAG,QAAQ;;;;;CAMrB,MAAM,cACJ,QACA,QACA,UAAoB,EAAE,EACtB,qBAA2C,UACzB;EAClB,MAAM,UAAU,MAAM,KAAK,qBAAqB,QAAQ,QAAQ,QAAQ;EACxE,MAAM,gBAAgB,kBAAkB;AACxC,SAAO,QAAQ,MAAM,MAAM,kBAAkB,EAAE,eAAe,cAAc;;;;;CAM9E,MAAM,kBACJ,QACA,QACA,UAAoB,EAAE,EACgB;EACtC,MAAM,UAAU,MAAM,KAAK,qBAAqB,QAAQ,QAAQ,QAAQ;AAExE,MAAI,QAAQ,WAAW,EACrB,QAAO;EAGT,IAAI,UAAgC;AACpC,OAAK,MAAM,UAAU,QACnB,KAAI,kBAAkB,OAAO,cAAc,kBAAkB,SAC3D,WAAU,OAAO;AAGrB,SAAO;;;;;CAMT,MAAM,iBAAiB,QAAgB,QAA2C;AAChF,SAAO,KAAK,YAAY;GACtB;GACA;GACA,YAAY;GACZ,WAAW;GACZ,CAAC;;;;;CAQJ,MAAc,qBACZ,QACA,QACA,SAC6B;EAE7B,MAAM,WAAW,MAAM,KAAK,QAAQ,SAAkC;GACpE,OAAO;GACP,OAAO,CACL;IAAE,OAAO;IAAW,OAAO;IAAQ,EACnC;IAAE,OAAO;IAAW,OAAO;IAAQ,CACpC;GACF,CAAC;EAGF,IAAI,WAAsC,EAAE;AAC5C,MAAI,QAAQ,SAAS,EACnB,YAAW,MAAM,KAAK,QAAQ,SAAkC;GAC9D,OAAO;GACP,OAAO,CACL;IAAE,OAAO;IAAW,OAAO;IAAQ,EACnC;IAAE,OAAO;IAAW,UAAU;IAAM,OAAO;IAAS,CACrD;GACF,CAAC;EAGJ,MAAM,sBAAM,IAAI,MAAM;AACtB,SAAO,CAAC,GAAG,UAAU,GAAG,SAAS,CAC9B,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC,CAC7B,QAAQ,MAAM;AACb,OAAI,CAAC,EAAE,UACL,QAAO;AAET,UAAO,IAAI,KAAK,EAAE,UAAoB,GAAG;IACzC;;;;;CAMN,MAAc,mBACZ,QACA,QACA,QACkC;EAClC,MAAM,QAAuB,CAAC;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;AAClE,MAAI,OACF,OAAM,KAAK;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;AAEjD,MAAI,OACF,OAAM,KAAK;GAAE,OAAO;GAAW,OAAO;GAAQ,CAAC;EAGjD,MAAM,MAAM,MAAM,KAAK,QAAQ,QAAiC;GAC9D,OAAO;GACP;GACD,CAAC;AAEF,SAAO,MAAM,KAAK,UAAU,IAAI,GAAG;;;;;CAMrC,UAAkB,KAAgD;AAChE,SAAO;GACL,IAAI,OAAO,IAAI,GAAG;GAClB,QAAQ,OAAO,IAAI,WAAW,IAAI,OAAO;GACzC,QAAS,IAAI,WAAW,IAAI,UAAU;GACtC,QAAS,IAAI,WAAW,IAAI,UAAU;GACtC,YAAY,OAAO,IAAI,WAAW;GAClC,WAAY,IAAI,cAAc,IAAI,aAAa;GAC/C,WAAY,IAAI,cAAc,IAAI,6BAAa,IAAI,MAAM;GACzD,WAAY,IAAI,cAAc,IAAI,aAAa;GAChD"}

package/dist/services/auth/flow-access.service.d.cts

@@ -0,0 +1,89 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.cjs";
+import { InvectAdapter } from "../../database/adapter.cjs";
+
+//#region src/services/auth/flow-access.service.d.ts
+type FlowAccessPermission = 'owner' | 'editor' | 'operator' | 'viewer';
+interface FlowAccessRecord {
+  id: string;
+  flowId: string;
+  userId?: string | null;
+  teamId?: string | null;
+  permission: FlowAccessPermission;
+  grantedBy?: string | null;
+  grantedAt: Date | string;
+  expiresAt?: Date | string | null;
+}
+interface GrantFlowAccessInput {
+  flowId: string;
+  userId?: string;
+  teamId?: string;
+  permission: FlowAccessPermission;
+  grantedBy?: string;
+  expiresAt?: Date | string;
+}
+interface FlowAccessQuery {
+  userId?: string;
+  teamIds?: string[];
+  flowId?: string;
+  includeExpired?: boolean;
+}
+interface FlowAccessServiceOptions {
+  adapter: InvectAdapter;
+  logger?: Logger;
+}
+/**
+ * FlowAccessService - Manages flow access permissions
+ */
+declare class FlowAccessService {
+  private readonly adapter;
+  private readonly logger?;
+  constructor(options: FlowAccessServiceOptions);
+  /**
+   * Grant access to a flow for a user or team.
+   */
+  grantAccess(input: GrantFlowAccessInput): Promise<FlowAccessRecord>;
+  /**
+   * Revoke access to a flow for a user or team.
+   */
+  revokeAccess(accessId: string): Promise<void>;
+  /**
+   * Revoke all access to a flow for a specific user or team.
+   */
+  revokeAccessForUserOrTeam(flowId: string, userId?: string, teamId?: string): Promise<void>;
+  /**
+   * List all access records for a flow.
+   */
+  listFlowAccess(flowId: string): Promise<FlowAccessRecord[]>;
+  /**
+   * Get all flows a user has access to (directly or via teams).
+   * Fetches matching records and filters in application code.
+   */
+  getAccessibleFlowIds(userId: string, teamIds?: string[]): Promise<string[]>;
+  /**
+   * Check if a user has access to a flow with at least the required permission.
+   */
+  hasFlowAccess(flowId: string, userId: string, teamIds?: string[], requiredPermission?: FlowAccessPermission): Promise<boolean>;
+  /**
+   * Get the highest permission level a user has for a flow.
+   */
+  getFlowPermission(flowId: string, userId: string, teamIds?: string[]): Promise<FlowAccessPermission | null>;
+  /**
+   * Auto-grant owner access when a flow is created.
+   */
+  grantOwnerAccess(flowId: string, userId: string): Promise<FlowAccessRecord>;
+  /**
+   * Get non-expired access records for a user (direct + teams) on a specific flow.
+   */
+  private getFlowAccessRecords;
+  /**
+   * Find existing access record for a user/team on a flow.
+   */
+  private findExistingAccess;
+  /**
+   * Normalize a raw database row into a FlowAccessRecord.
+   */
+  private normalize;
+}
+//#endregion
+export { FlowAccessPermission, FlowAccessQuery, FlowAccessRecord, FlowAccessService, FlowAccessServiceOptions, GrantFlowAccessInput };
+//# sourceMappingURL=flow-access.service.d.cts.map

package/dist/services/auth/flow-access.service.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-access.service.d.cts","names":[],"sources":["../../../src/services/auth/flow-access.service.ts"],"mappings":";;;;KAaY,oBAAA;AAAA,UAEK,gBAAA;EACf,EAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,UAAA,EAAY,oBAAA;EACZ,SAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,GAAY,IAAA;AAAA;AAAA,UAGG,oBAAA;EACf,MAAA;EACA,MAAA;EACA,MAAA;EACA,UAAA,EAAY,oBAAA;EACZ,SAAA;EACA,SAAA,GAAY,IAAA;AAAA;AAAA,UAGG,eAAA;EACf,MAAA;EACA,OAAA;EACA,MAAA;EACA,cAAA;AAAA;AAAA,UAGe,wBAAA;EACf,OAAA,EAAS,aAAA;EACT,MAAA,GAAS,MAAA;AAAA;;;;cAmBE,iBAAA;EAAA,iBACM,OAAA;EAAA,iBACA,MAAA;cAEL,OAAA,EAAS,wBAAA;;;;EAQf,WAAA,CAAY,KAAA,EAAO,oBAAA,GAAuB,OAAA,CAAQ,gBAAA;EArCxD;;;EA8FM,YAAA,CAAa,QAAA,WAAmB,OAAA;EA1FvB;;;EAwGT,yBAAA,CAA0B,MAAA,UAAgB,MAAA,WAAiB,MAAA,YAAkB,OAAA;EAvGnF;;;EA4HM,cAAA,CAAe,MAAA,WAAiB,OAAA,CAAQ,gBAAA;EA3H/B;;AAmBjB;;EAoHQ,oBAAA,CAAqB,MAAA,UAAgB,OAAA,cAAyB,OAAA;EAhH/C;;;EAmJf,aAAA,CACJ,MAAA,UACA,MAAA,UACA,OAAA,aACA,kBAAA,GAAoB,oBAAA,GACnB,OAAA;EAvFmC;;;EAgGhC,iBAAA,CACJ,MAAA,UACA,MAAA,UACA,OAAA,cACC,OAAA,CAAQ,oBAAA;EArDyD;;;EAwE9D,gBAAA,CAAiB,MAAA,UAAgB,MAAA,WAAiB,OAAA,CAAQ,gBAAA;EAnB7D;;;EAAA,QAiCW,oBAAA;EAdiD;;;EAAA,QAsDjD,kBAAA;EA9OO;;;EAAA,QAsQb,SAAA;AAAA"}