@jantstack/adonis-authz 1.0.0

package/build/src/catalog.js

@@ -0,0 +1,97 @@
+import db from '@adonisjs/lucid/services/db';
+import { Exception } from '@adonisjs/core/exceptions';
+import { v7 as uuidv7 } from 'uuid';
+/**
+ * Sincroniza un catálogo (roles + permisos + vínculos) a las tablas `authz_*`.
+ *
+ * Idempotente y aditivo (mismo contrato que el organization_acl_seeder): lo
+ * existente se respeta, solo se insertan los diffs nuevos. Quitar algo del
+ * catálogo NO lo borra de DB (limpieza explícita vía migración).
+ *
+ * Lo usan el seeder del nivel app (`app_acl_seeder`) y el harness de la
+ * suite de contrato. El catálogo es metadata compartida entre drivers:
+ * un driver externo (openfga) materializa aparte solo los hechos.
+ */
+/**
+ * Slugs válidos del catálogo: minúsculas, dígitos y . _ - con `:` opcional
+ * (gramática recurso:accion). Prohibidos `~` y `|`: son los caracteres de
+ * encoding/separador del driver openfga — un slug que los contenga
+ * corrompería el mapeo de bindings.
+ */
+const CATALOG_SLUG_FORMAT = /^[a-z0-9][a-z0-9_.-]*(:[a-z0-9][a-z0-9_.-]*)?$/;
+function assertValidSlug(kind, slug) {
+    if (!CATALOG_SLUG_FORMAT.test(slug)) {
+        throw new Exception(`Slug de ${kind} inválido: '${slug}'. Formato: minúsculas/dígitos/._- ` +
+            `con ':' único opcional (recurso:accion); '~' y '|' están prohibidos.`, { status: 500 });
+    }
+}
+export async function syncAuthzCatalog(catalog) {
+    for (const perm of catalog.permissions)
+        assertValidSlug('permiso', perm.slug);
+    for (const role of catalog.roles)
+        assertValidSlug('rol', role.slug);
+    // 1. Permisos: upsert por slug.
+    for (const perm of catalog.permissions) {
+        const existing = await db.from('authz_permissions').where('slug', perm.slug).first();
+        if (existing)
+            continue;
+        await db.table('authz_permissions').insert({
+            uuid: uuidv7(),
+            slug: perm.slug,
+            description: perm.description ?? null,
+            created_at: new Date(),
+            updated_at: new Date(),
+        });
+    }
+    const dbPerms = await db
+        .from('authz_permissions')
+        .whereIn('slug', catalog.permissions.map((p) => p.slug))
+        .select('uuid', 'slug');
+    const permUuidBySlug = new Map(dbPerms.map((p) => [p.slug, p.uuid]));
+    // 2. Roles: upsert por (slug, scope_type).
+    for (const role of catalog.roles) {
+        const existing = await db
+            .from('authz_roles')
+            .where('slug', role.slug)
+            .where('scope_type', role.scopeType)
+            .first();
+        const roleUuid = existing?.uuid ?? role.uuid ?? uuidv7();
+        if (!existing) {
+            await db.table('authz_roles').insert({
+                uuid: roleUuid,
+                slug: role.slug,
+                name: role.name ?? role.slug,
+                description: role.description ?? null,
+                scope_type: role.scopeType,
+                rank: role.rank ?? 0,
+                created_at: new Date(),
+                updated_at: new Date(),
+            });
+        }
+        else if (role.rank !== undefined && existing.rank !== role.rank) {
+            // El rank es metadata de policy: el config manda (a diferencia de los
+            // vínculos, que son aditivos).
+            await db.from('authz_roles').where('uuid', roleUuid).update({ rank: role.rank });
+        }
+        // 3. Vínculos rol→permiso: upsert por par.
+        for (const permSlug of role.permissions) {
+            const permUuid = permUuidBySlug.get(permSlug);
+            if (!permUuid)
+                continue;
+            const linked = await db
+                .from('authz_role_permissions')
+                .where('role_uuid', roleUuid)
+                .where('permission_uuid', permUuid)
+                .first();
+            if (linked)
+                continue;
+            await db.table('authz_role_permissions').insert({
+                uuid: uuidv7(),
+                role_uuid: roleUuid,
+                permission_uuid: permUuid,
+                created_at: new Date(),
+            });
+        }
+    }
+}
+//# sourceMappingURL=catalog.js.map

package/build/src/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAGnC;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,gDAAgD,CAAA;AAE5E,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,eAAe,IAAI,qCAAqC;YACrE,sEAAsE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAoB;IACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW;QAAE,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAEnE,gCAAgC;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QACpF,IAAI,QAAQ;YAAE,SAAQ;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE,MAAM,EAAE;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,IAAI,CAAC,mBAAmB,CAAC;SACzB,OAAO,CACN,MAAM,EACN,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACvC;SACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAiB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEzF,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;aACxB,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;aACnC,KAAK,EAAE,CAAA;QAEV,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAA;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;gBACnC,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;gBACpB,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAClE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,2CAA2C;QAC3C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC7C,IAAI,CAAC,QAAQ;gBAAE,SAAQ;YAEvB,MAAM,MAAM,GAAG,MAAM,EAAE;iBACpB,IAAI,CAAC,wBAAwB,CAAC;iBAC9B,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;iBAC5B,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC;iBAClC,KAAK,EAAE,CAAA;YACV,IAAI,MAAM;gBAAE,SAAQ;YAEpB,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,MAAM,EAAE;gBACd,SAAS,EAAE,QAAQ;gBACnB,eAAe,EAAE,QAAQ;gBACzB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/build/src/define_config.d.ts

@@ -0,0 +1,53 @@
+import type { AuthorizationDriverFactory, AuthzWriteEvent } from './types.js';
+import type { HolderTypeMap } from './drivers/openfga_driver.js';
+/**
+ * Config del sistema de autorización. Todo lo específico del consumidor
+ * entra por aquí: qué drivers existen, cuál está activo, cómo se llaman sus
+ * holders y qué hacer cuando el motor escribe.
+ *
+ *   export default defineConfig({
+ *     default: env.get('AUTHZ_DRIVER', 'database'),
+ *     holderTypes: { users: 'user', admins: 'admin' },
+ *     drivers: {
+ *       database: () => new DatabaseAuthorizationDriver({ resolveAncestors }),
+ *       'mi-driver': () => new MiDriver(),
+ *     },
+ *     hooks: { onWrite: auditarEscritura },
+ *   })
+ *
+ * Todo driver debe pasar la suite de contrato que publica el paquete
+ * (`@jantstack/adonis-authz/testing`).
+ */
+export interface AuthorizationConfig {
+    /** Nombre del driver activo (debe existir como key en `drivers`). */
+    default: string;
+    drivers: Record<string, AuthorizationDriverFactory>;
+    /**
+     * Holders del consumidor: morph name (`@MorphMap` del modelo) → tipo del
+     * modelo FGA. Lo necesitan el driver `openfga` y los comandos
+     * `openfga:provision` / `openfga:import`; el driver `database` lo ignora.
+     */
+    holderTypes?: HolderTypeMap;
+    /**
+     * Conexión al servidor OpenFGA para las herramientas de línea de comandos
+     * (el driver recibe estos mismos valores en su factory).
+     */
+    openfga?: {
+        url?: string;
+        storeId?: string;
+        modelId?: string;
+        /** Nombre del store al provisionar. */
+        storeName?: string;
+    };
+    /**
+     * Hooks del consumidor. `onWrite` se llama tras cada escritura del motor
+     * (grant/revoke/deny/removeDeny) — el sitio natural para auditar o emitir
+     * eventos. No debe lanzar: una escritura ya aplicada no se revierte por un
+     * side-effect fallido.
+     */
+    hooks?: {
+        onWrite?: (event: AuthzWriteEvent) => Promise<void>;
+    };
+}
+export declare function defineConfig<T extends AuthorizationConfig>(config: T): T;
+//# sourceMappingURL=define_config.d.ts.map

package/build/src/define_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;IAEnD;;;;OAIG;IACH,WAAW,CAAC,EAAE,aAAa,CAAA;IAE3B;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,uCAAuC;QACvC,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IAED;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACpD,CAAA;CACF;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,mBAAmB,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAExE"}

package/build/src/define_config.js

@@ -0,0 +1,4 @@
+export function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=define_config.js.map

package/build/src/define_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAwDA,MAAM,UAAU,YAAY,CAAgC,MAAS;IACnE,OAAO,MAAM,CAAA;AACf,CAAC"}

package/build/src/drivers/database_driver.d.ts

@@ -0,0 +1,48 @@
+import type { AuthorizationDriver, GrantOptions, ScopeRef, ScopeType, SubjectRef } from '../types.js';
+import type { ScopeAncestorsResolver } from '../types.js';
+/**
+ * UUID centinela para el scope 'app' en las columnas scope_uuid (NOT NULL):
+ * permite que el unique de assignments/denies cubra también el nivel app
+ * (los NULL serían "distintos" para el motor SQL). Detalle de almacenamiento
+ * de ESTE driver — la API pública sigue usando uuid null para app.
+ */
+export declare const APP_SCOPE_DB_UUID = "00000000-0000-0000-0000-000000000000";
+/**
+ * Driver `database`: motor de autorización propio sobre las tablas `authz_*`.
+ * Default autosuficiente del chasis (cero piezas extra en el appliance).
+ *
+ * Resolución de `authorize`: NO hay deny en la cadena de scopes Y alguna
+ * asignación vigente (expires_at null o futuro) en la cadena concede el
+ * permiso vía su rol. La cadena es `[scope, ...ancestros]` — herencia solo
+ * hacia abajo. Solo SQL estándar vía query builder (regla M6: nada
+ * específico de un motor).
+ */
+export declare class DatabaseAuthorizationDriver implements AuthorizationDriver {
+    /**
+     * Resolutor de jerarquía inyectado por el consumidor (el chasis pasa el
+     * suyo, que conoce organizations/units, en `config/authorization.ts`).
+     * Default puro sin dominio: todo cuelga directamente de `app`.
+     */
+    private resolveAncestors;
+    constructor(options?: {
+        resolveAncestors?: ScopeAncestorsResolver;
+    });
+    private chain;
+    /** Filtro (scope_type, scope_uuid) ∈ scopes (centinela para el nivel app). */
+    private whereScopeIn;
+    /** Asignación vigente: sin expiración o con expiración futura. */
+    private whereActive;
+    private findPermission;
+    private findRoleOrFail;
+    authorize(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<boolean>;
+    grant(subject: SubjectRef, role: string, scope: ScopeRef, options?: GrantOptions): Promise<void>;
+    revoke(subject: SubjectRef, role: string, scope: ScopeRef): Promise<void>;
+    hasRole(subject: SubjectRef, role: string, scope: ScopeRef): Promise<boolean>;
+    deny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+    removeDeny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+    listSubjects(role: string, scope: ScopeRef): Promise<SubjectRef[]>;
+    listRoles(subject: SubjectRef, scope: ScopeRef): Promise<string[]>;
+    listRoleScopes(subject: SubjectRef, scopeType: ScopeType): Promise<ScopeRef[]>;
+    listScopes(subject: SubjectRef, permission: string): Promise<ScopeRef[]>;
+}
+//# sourceMappingURL=database_driver.d.ts.map

package/build/src/drivers/database_driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/database_driver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,UAAU,EACX,MAAM,aAAa,CAAA;AAEpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,yCAAyC,CAAA;AAUvE;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IACrE;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAAwB;gBAEpC,OAAO,GAAE;QAAE,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;KAAO;YAKzD,KAAK;IAInB,8EAA8E;IAC9E,OAAO,CAAC,YAAY;IAUpB,kEAAkE;IAClE,OAAO,CAAC,WAAW;YAML,cAAc;YAId,cAAc;IAetB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAkCrF,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,IAAI,CAAC;IAqDV,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2C7E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAenF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAiBlE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBlE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAY9E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;CAkC/E"}

package/build/src/drivers/database_driver.js

@@ -0,0 +1,260 @@
+import db from '@adonisjs/lucid/services/db';
+import { Exception } from '@adonisjs/core/exceptions';
+import { v7 as uuidv7 } from 'uuid';
+import { APP_SCOPE } from '../types.js';
+/**
+ * UUID centinela para el scope 'app' en las columnas scope_uuid (NOT NULL):
+ * permite que el unique de assignments/denies cubra también el nivel app
+ * (los NULL serían "distintos" para el motor SQL). Detalle de almacenamiento
+ * de ESTE driver — la API pública sigue usando uuid null para app.
+ */
+export const APP_SCOPE_DB_UUID = '00000000-0000-0000-0000-000000000000';
+function toDbScopeUuid(scope) {
+    return scope.uuid ?? APP_SCOPE_DB_UUID;
+}
+function fromDbScopeUuid(uuid) {
+    return uuid === APP_SCOPE_DB_UUID ? null : uuid;
+}
+/**
+ * Driver `database`: motor de autorización propio sobre las tablas `authz_*`.
+ * Default autosuficiente del chasis (cero piezas extra en el appliance).
+ *
+ * Resolución de `authorize`: NO hay deny en la cadena de scopes Y alguna
+ * asignación vigente (expires_at null o futuro) en la cadena concede el
+ * permiso vía su rol. La cadena es `[scope, ...ancestros]` — herencia solo
+ * hacia abajo. Solo SQL estándar vía query builder (regla M6: nada
+ * específico de un motor).
+ */
+export class DatabaseAuthorizationDriver {
+    /**
+     * Resolutor de jerarquía inyectado por el consumidor (el chasis pasa el
+     * suyo, que conoce organizations/units, en `config/authorization.ts`).
+     * Default puro sin dominio: todo cuelga directamente de `app`.
+     */
+    resolveAncestors;
+    constructor(options = {}) {
+        this.resolveAncestors =
+            options.resolveAncestors ?? (async (scope) => (scope.type === 'app' ? [] : [APP_SCOPE]));
+    }
+    async chain(scope) {
+        return [scope, ...(await this.resolveAncestors(scope))];
+    }
+    /** Filtro (scope_type, scope_uuid) ∈ scopes (centinela para el nivel app). */
+    whereScopeIn(query, column, scopes) {
+        return query.where((outer) => {
+            for (const s of scopes) {
+                outer.orWhere((inner) => {
+                    inner.where(`${column}_type`, s.type).where(`${column}_uuid`, toDbScopeUuid(s));
+                });
+            }
+        });
+    }
+    /** Asignación vigente: sin expiración o con expiración futura. */
+    whereActive(query, column = 'expires_at') {
+        return query.where((builder) => {
+            builder.whereNull(column).orWhere(column, '>', new Date());
+        });
+    }
+    async findPermission(slug) {
+        return db.from('authz_permissions').where('slug', slug).select('uuid').first();
+    }
+    async findRoleOrFail(slug, scopeType) {
+        const role = await db
+            .from('authz_roles')
+            .where('slug', slug)
+            .where('scope_type', scopeType)
+            .select('uuid')
+            .first();
+        if (!role) {
+            throw new Exception(`Rol '${slug}' no existe en el catálogo para el nivel '${scopeType}'`, {
+                status: 422,
+            });
+        }
+        return role;
+    }
+    async authorize(subject, permission, scope) {
+        const perm = await this.findPermission(permission);
+        if (!perm)
+            return false;
+        const chain = await this.chain(scope);
+        const denied = await this.whereScopeIn(db
+            .from('authz_denies')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('permission_uuid', perm.uuid), 'scope', chain).first();
+        if (denied)
+            return false;
+        const granted = await this.whereActive(this.whereScopeIn(db
+            .from('authz_assignments as a')
+            .join('authz_role_permissions as rp', 'rp.role_uuid', 'a.role_uuid')
+            .where('rp.permission_uuid', perm.uuid)
+            .where('a.holder_type', subject.type)
+            .where('a.holder_uuid', subject.uuid), 'a.scope', chain), 'a.expires_at').first();
+        return Boolean(granted);
+    }
+    async grant(subject, role, scope, options = {}) {
+        const { uuid: roleUuid } = await this.findRoleOrFail(role, scope.type);
+        const expiresAt = options.expiresAt ?? null;
+        const existing = await this.whereScopeIn(db
+            .from('authz_assignments')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('role_uuid', roleUuid), 'scope', [scope]).first();
+        if (existing) {
+            // Idempotente: re-grant refresca la expiración (revivir una asignación
+            // expirada es un grant nuevo a todos los efectos).
+            await db.from('authz_assignments').where('uuid', existing.uuid).update({
+                expires_at: expiresAt,
+            });
+            return;
+        }
+        try {
+            await db.table('authz_assignments').insert({
+                uuid: uuidv7(),
+                holder_type: subject.type,
+                holder_uuid: subject.uuid,
+                role_uuid: roleUuid,
+                scope_type: scope.type,
+                scope_uuid: toDbScopeUuid(scope),
+                expires_at: expiresAt,
+                created_at: new Date(),
+            });
+        }
+        catch (error) {
+            // Carrera check-then-insert: el unique (que cubre también el nivel app
+            // vía centinela) la detecta — el perdedor degrada a update (idempotente).
+            const raced = await this.whereScopeIn(db
+                .from('authz_assignments')
+                .where('holder_type', subject.type)
+                .where('holder_uuid', subject.uuid)
+                .where('role_uuid', roleUuid), 'scope', [scope]).first();
+            if (!raced)
+                throw error;
+            await db.from('authz_assignments').where('uuid', raced.uuid).update({
+                expires_at: expiresAt,
+            });
+        }
+    }
+    async revoke(subject, role, scope) {
+        const roleRow = await db
+            .from('authz_roles')
+            .where('slug', role)
+            .where('scope_type', scope.type)
+            .select('uuid')
+            .first();
+        if (!roleRow)
+            return;
+        await this.whereScopeIn(db
+            .from('authz_assignments')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('role_uuid', roleRow.uuid), 'scope', [scope]).delete();
+    }
+    async hasRole(subject, role, scope) {
+        const chain = await this.chain(scope);
+        const found = await this.whereActive(this.whereScopeIn(db
+            .from('authz_assignments as a')
+            .join('authz_roles as r', 'r.uuid', 'a.role_uuid')
+            .where('r.slug', role)
+            .where('a.holder_type', subject.type)
+            .where('a.holder_uuid', subject.uuid), 'a.scope', chain), 'a.expires_at').first();
+        return Boolean(found);
+    }
+    async deny(subject, permission, scope) {
+        const perm = await this.findPermission(permission);
+        if (!perm) {
+            throw new Exception(`Permiso '${permission}' no existe en el catálogo`, { status: 422 });
+        }
+        const existing = await this.whereScopeIn(db
+            .from('authz_denies')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('permission_uuid', perm.uuid), 'scope', [scope]).first();
+        if (existing)
+            return;
+        try {
+            await db.table('authz_denies').insert({
+                uuid: uuidv7(),
+                holder_type: subject.type,
+                holder_uuid: subject.uuid,
+                permission_uuid: perm.uuid,
+                scope_type: scope.type,
+                scope_uuid: toDbScopeUuid(scope),
+                created_at: new Date(),
+            });
+        }
+        catch (error) {
+            // Carrera: si otro proceso insertó el mismo deny, el unique lo detecta
+            // y el resultado deseado ya existe.
+            const raced = await this.whereScopeIn(db
+                .from('authz_denies')
+                .where('holder_type', subject.type)
+                .where('holder_uuid', subject.uuid)
+                .where('permission_uuid', perm.uuid), 'scope', [scope]).first();
+            if (!raced)
+                throw error;
+        }
+    }
+    async removeDeny(subject, permission, scope) {
+        const perm = await this.findPermission(permission);
+        if (!perm)
+            return;
+        await this.whereScopeIn(db
+            .from('authz_denies')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('permission_uuid', perm.uuid), 'scope', [scope]).delete();
+    }
+    async listSubjects(role, scope) {
+        const rows = await this.whereActive(this.whereScopeIn(db
+            .from('authz_assignments as a')
+            .join('authz_roles as r', 'r.uuid', 'a.role_uuid')
+            .where('r.slug', role)
+            .where('r.scope_type', scope.type), 'a.scope', [scope]), 'a.expires_at').distinct('a.holder_type', 'a.holder_uuid');
+        return rows.map((row) => ({ type: row.holder_type, uuid: row.holder_uuid }));
+    }
+    async listRoles(subject, scope) {
+        const rows = await this.whereActive(this.whereScopeIn(db
+            .from('authz_assignments as a')
+            .join('authz_roles as r', 'r.uuid', 'a.role_uuid')
+            .where('a.holder_type', subject.type)
+            .where('a.holder_uuid', subject.uuid), 'a.scope', [scope]), 'a.expires_at').distinct('r.slug');
+        return rows.map((row) => row.slug);
+    }
+    async listRoleScopes(subject, scopeType) {
+        const rows = await this.whereActive(db
+            .from('authz_assignments as a')
+            .where('a.holder_type', subject.type)
+            .where('a.holder_uuid', subject.uuid)
+            .where('a.scope_type', scopeType), 'a.expires_at').distinct('a.scope_type', 'a.scope_uuid');
+        return rows.map((row) => ({ type: row.scope_type, uuid: fromDbScopeUuid(row.scope_uuid) }));
+    }
+    async listScopes(subject, permission) {
+        const perm = await this.findPermission(permission);
+        if (!perm)
+            return [];
+        const rows = await this.whereActive(db
+            .from('authz_assignments as a')
+            .join('authz_role_permissions as rp', 'rp.role_uuid', 'a.role_uuid')
+            .where('rp.permission_uuid', perm.uuid)
+            .where('a.holder_type', subject.type)
+            .where('a.holder_uuid', subject.uuid), 'a.expires_at').distinct('a.scope_type', 'a.scope_uuid');
+        const denies = await db
+            .from('authz_denies')
+            .where('holder_type', subject.type)
+            .where('holder_uuid', subject.uuid)
+            .where('permission_uuid', perm.uuid)
+            .select('scope_type', 'scope_uuid');
+        const deniedKeys = new Set(denies.map((d) => `${d.scope_type}:${fromDbScopeUuid(d.scope_uuid) ?? ''}`));
+        const result = [];
+        for (const row of rows) {
+            const candidate = { type: row.scope_type, uuid: fromDbScopeUuid(row.scope_uuid) };
+            const chain = await this.chain(candidate);
+            const blocked = chain.some((s) => deniedKeys.has(`${s.type}:${s.uuid ?? ''}`));
+            if (!blocked)
+                result.push(candidate);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=database_driver.js.map

package/build/src/drivers/database_driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database_driver.js","sourceRoot":"","sources":["../../../src/drivers/database_driver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAQnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAKvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sCAAsC,CAAA;AAEvE,SAAS,aAAa,CAAC,KAAe;IACpC,OAAO,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAA;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IACtC;;;;OAIG;IACK,gBAAgB,CAAwB;IAEhD,YAAY,UAAyD,EAAE;QACrE,IAAI,CAAC,gBAAgB;YACnB,OAAO,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAe;QACjC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,8EAA8E;IACtE,YAAY,CAAC,KAAmB,EAAE,MAAc,EAAE,MAAkB;QAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtB,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;gBACjF,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAC1D,WAAW,CAAC,KAAmB,EAAE,SAAiB,YAAY;QACpE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,OAAO,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;IAChF,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAiB;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;aACnB,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC;aAC9B,MAAM,CAAC,MAAM,CAAC;aACd,KAAK,EAAE,CAAA;QACV,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,6CAA6C,SAAS,GAAG,EAAE;gBACzF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,EAAE;aACC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,EACtC,OAAO,EACP,KAAK,CACN,CAAC,KAAK,EAAE,CAAA;QACT,IAAI,MAAM;YAAE,OAAO,KAAK,CAAA;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CACpC,IAAI,CAAC,YAAY,CACf,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC,8BAA8B,EAAE,cAAc,EAAE,aAAa,CAAC;aACnE,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC;aACtC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EACvC,SAAS,EACT,KAAK,CACN,EACD,cAAc,CACf,CAAC,KAAK,EAAE,CAAA;QAET,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAmB,EACnB,IAAY,EACZ,KAAe,EACf,UAAwB,EAAE;QAE1B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;QAE3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CACtC,EAAE;aACC,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAC/B,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,KAAK,EAAE,CAAA;QAET,IAAI,QAAQ,EAAE,CAAC;YACb,uEAAuE;YACvE,mDAAmD;YACnD,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBACrE,UAAU,EAAE,SAAS;aACtB,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;gBACzC,IAAI,EAAE,MAAM,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC;gBAChC,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CACnC,EAAE;iBACC,IAAI,CAAC,mBAAmB,CAAC;iBACzB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;iBAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAC/B,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,KAAK,EAAE,CAAA;YACT,IAAI,CAAC,KAAK;gBAAE,MAAM,KAAK,CAAA;YACvB,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAClE,UAAU,EAAE,SAAS;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC7D,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;aACnB,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC;aAC/B,MAAM,CAAC,MAAM,CAAC;aACd,KAAK,EAAE,CAAA;QACV,IAAI,CAAC,OAAO;YAAE,OAAM;QAEpB,MAAM,IAAI,CAAC,YAAY,CACrB,EAAE;aACC,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,EACnC,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,MAAM,EAAE,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,IAAI,CAAC,YAAY,CACf,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;aACjD,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;aACrB,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EACvC,SAAS,EACT,KAAK,CACN,EACD,cAAc,CACf,CAAC,KAAK,EAAE,CAAA;QACT,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CAAC,YAAY,UAAU,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CACtC,EAAE;aACC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,EACtC,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,KAAK,EAAE,CAAA;QACT,IAAI,QAAQ;YAAE,OAAM;QAEpB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;gBACpC,IAAI,EAAE,MAAM,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,eAAe,EAAE,IAAI,CAAC,IAAI;gBAC1B,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC;gBAChC,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CACnC,EAAE;iBACC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;iBAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;iBAClC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,EACtC,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,KAAK,EAAE,CAAA;YACT,IAAI,CAAC,KAAK;gBAAE,MAAM,KAAK,CAAA;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAM;QAEjB,MAAM,IAAI,CAAC,YAAY,CACrB,EAAE;aACC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,EACtC,OAAO,EACP,CAAC,KAAK,CAAC,CACR,CAAC,MAAM,EAAE,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAe;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,IAAI,CAAC,YAAY,CACf,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;aACjD,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;aACrB,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,EACpC,SAAS,EACT,CAAC,KAAK,CAAC,CACR,EACD,cAAc,CACf,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA;QAE5C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,KAAe;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,IAAI,CAAC,YAAY,CACf,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;aACjD,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EACvC,SAAS,EACT,CAAC,KAAK,CAAC,CACR,EACD,cAAc,CACf,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAmB,EAAE,SAAoB;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,EACnC,cAAc,CACf,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAClG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,EAAE;aACC,IAAI,CAAC,wBAAwB,CAAC;aAC9B,IAAI,CAAC,8BAA8B,EAAE,cAAc,EAAE,aAAa,CAAC;aACnE,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC;aACtC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,EACvC,cAAc,CACf,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,CAAA;QAE1C,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;aAClC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC;aACnC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;QAErC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CACjF,CAAA;QAED,MAAM,MAAM,GAAe,EAAE,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAa,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;YAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;YAC9E,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/build/src/drivers/openfga_driver.d.ts

@@ -0,0 +1,107 @@
+import type { AuthorizationDriver, GrantOptions, ScopeAncestorsResolver, ScopeRef, ScopeType, SubjectRef } from '../types.js';
+/**
+ * Driver `openfga` — los HECHOS (asignaciones y denies) viven en un servidor
+ * OpenFGA; el CATÁLOGO (roles/permisos/vínculos) y la JERARQUÍA (orgs/units)
+ * siguen siendo metadata local en las tablas del chasis (split de propiedad
+ * de datos del análisis: cambiar de driver = migrar una tabla de hechos).
+ *
+ * Modelo FGA genérico (ver `openFgaAuthorizationModel()`):
+ *  - `role_binding:<scopeKey>|<rol>`   #assignee  → asignación de rol
+ *  - `deny_binding:<scopeKey>|<perm>`  #denied    → deny explícito
+ *  - Expiración vía condition `not_expired` (valid_until en la tupla,
+ *    current_time en cada check) — ni scheduler necesita.
+ *
+ * La herencia se resuelve igual que en el driver database: la cadena de
+ * scopes se calcula localmente (el árbol lo declara el consumidor vía
+ * `resolveAncestors`) y se consulta FGA por batchCheck sobre la cadena.
+ *
+ * NADA del dominio está cableado: los holders llegan como `holderTypes`
+ * (morph name → tipo FGA) y los niveles de scope se derivan del propio
+ * `ScopeRef`, así que un consumidor con otros guards u otra jerarquía solo
+ * cambia config.
+ */
+/**
+ * Mapa morph name → tipo del modelo FGA (`users` → `user`). Debe ser el
+ * MISMO con el que se generó el authorization model del store.
+ */
+export type HolderTypeMap = Record<string, string>;
+/**
+ * El authorization model en formato JSON del API de FGA, generado a partir
+ * de los holders del consumidor. El mismo mapa debe usarse al construir el
+ * driver: si difieren, los checks no encuentran las tuplas.
+ */
+export declare function openFgaAuthorizationModel(holderTypeMap: HolderTypeMap): any;
+/**
+ * Crea un store nuevo + escribe el authorization model derivado de los
+ * holders del consumidor. Para bootstrap de un appliance o del harness de
+ * tests. El `name` lo decide el caller (el comando openfga:provision
+ * resuelve APP_NAME del entorno — el motor no lee env).
+ */
+export declare function provisionOpenFgaStore(apiUrl: string, name: string, holderTypeMap: HolderTypeMap): Promise<{
+    storeId: string;
+    modelId: string;
+}>;
+export interface OpenFgaDriverOptions {
+    apiUrl: string;
+    storeId: string;
+    /** Pin del model; si se omite, FGA usa el último. */
+    modelId?: string;
+    /** Jerarquía del consumidor (ver ScopeAncestorsResolver). */
+    resolveAncestors?: ScopeAncestorsResolver;
+    /**
+     * Holders del consumidor: morph name → tipo FGA. Debe coincidir con el
+     * mapa usado al escribir el authorization model del store.
+     */
+    holderTypes: HolderTypeMap;
+}
+export interface ImportFactsResult {
+    assignments: number;
+    denies: number;
+    skippedExpired: number;
+    dryRun: boolean;
+}
+/**
+ * Migración de hechos database → openfga: copia las asignaciones vigentes y
+ * los denies de las tablas `authz_*` como tuples del store FGA.
+ *
+ * - COPIA, no mueve: las tablas locales quedan intactas → el rollback es
+ *   volver a AUTHZ_DRIVER=database (solo se pierde lo escrito mientras se
+ *   operó con openfga). El catálogo y la jerarquía nunca migran: son
+ *   metadata local para ambos drivers.
+ * - Idempotente: re-ejecutar no duplica (onDuplicateWrites: Ignore).
+ * - Las asignaciones ya expiradas se saltan (no tiene sentido copiarlas);
+ *   las de expiración futura viajan con la condition `not_expired`.
+ */
+export declare function importAuthzFactsToOpenFga(options: OpenFgaDriverOptions & {
+    dryRun?: boolean;
+}): Promise<ImportFactsResult>;
+export declare class OpenFgaAuthorizationDriver implements AuthorizationDriver {
+    private client;
+    private resolveAncestors;
+    private holderTypes;
+    constructor(options: OpenFgaDriverOptions);
+    private chain;
+    private fgaSubject;
+    /**
+     * batchCheck troceado al límite del servidor FGA (50 checks/request) y con
+     * verificación de completitud: TODOS los checks deben volver respondidos.
+     */
+    private batchCheckAll;
+    private findPermission;
+    private findRoleOrFail;
+    /** Roles del catálogo que conceden el permiso, agrupados por scope_type. */
+    private rolesGranting;
+    authorize(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<boolean>;
+    grant(subject: SubjectRef, role: string, scope: ScopeRef, options?: GrantOptions): Promise<void>;
+    revoke(subject: SubjectRef, role: string, scope: ScopeRef): Promise<void>;
+    hasRole(subject: SubjectRef, role: string, scope: ScopeRef): Promise<boolean>;
+    deny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+    removeDeny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+    listSubjects(role: string, scope: ScopeRef): Promise<SubjectRef[]>;
+    /** role_binding ids del subject (asignaciones directas vigentes). */
+    private listBindings;
+    listRoles(subject: SubjectRef, scope: ScopeRef): Promise<string[]>;
+    listRoleScopes(subject: SubjectRef, scopeType: ScopeType): Promise<ScopeRef[]>;
+    listScopes(subject: SubjectRef, permission: string): Promise<ScopeRef[]>;
+}
+//# sourceMappingURL=openfga_driver.d.ts.map

package/build/src/drivers/openfga_driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/openfga_driver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,UAAU,EACX,MAAM,aAAa,CAAA;AAIpB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AA0ElD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,aAAa,GAAG,GAAG,CAqC3E;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/C;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IACzC;;;OAGG;IACH,WAAW,EAAE,aAAa,CAAA;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,oBAAoB,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,iBAAiB,CAAC,CA4E5B;AAED,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,gBAAgB,CAAwB;IAChD,OAAO,CAAC,WAAW,CAAe;gBAEtB,OAAO,EAAE,oBAAoB;YAY3B,KAAK;IAInB,OAAO,CAAC,UAAU;IAIlB;;;OAGG;YACW,aAAa;YAiBb,cAAc;YAId,cAAc;IAc5B,4EAA4E;YAC9D,aAAa;IAiBrB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAkCrF,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,IAAI,CAAC;IA4BV,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAazE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAc7E,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB7E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAanF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAsBxE,qEAAqE;YACvD,YAAY;IAUpB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUlE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAW9E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;CAgC/E"}