@jantstack/adonis-authz 1.0.0

package/build/src/middleware/app_access_middleware.js

@@ -0,0 +1,53 @@
+import { Exception } from '@adonisjs/core/exceptions';
+import authorization from '../../services/main.js';
+import { APP_SCOPE } from '../types.js';
+/**
+ * Enforcement del ACL de NIVEL APP (gemelo de orgAccess para el scope
+ * global). Debe ir DESPUÉS de `middleware.auth(...)` — típicamente con el
+ * guard `admins`, aunque funciona con cualquier holder con morph name.
+ *
+ * Reglas:
+ *  - No autenticado → 401.
+ *  - Holder sin el rol/permiso requerido a nivel app → 403.
+ *  - El ACL decide por IDENTIDAD; el scope del token lo acota
+ *    middleware.ability() aparte (el token nunca amplía, solo restringe).
+ *
+ * Uso: middleware.appAccess({ permission: 'audit:read' })
+ *      middleware.appAccess({ role: 'superadmin' })
+ */
+export default class AppAccessMiddleware {
+    async handle(ctx, next, options = {}) {
+        if (!options.permission && !options.role) {
+            throw new Exception('middleware.appAccess requiere `permission` o `role`', { status: 500 });
+        }
+        const holder = ctx.auth?.user;
+        if (!holder) {
+            return ctx.response.unauthorized({ message: 'No autenticado', statusCode: 401, errors: [] });
+        }
+        // El morph name lo estampa el decorador @MorphMap en el prototype.
+        const morph = holder.__morphMapName;
+        if (!morph) {
+            throw new Exception('El modelo autenticado no tiene @MorphMap — no es un holder válido', {
+                status: 500,
+            });
+        }
+        const subject = { type: morph, uuid: holder.uuid };
+        if (options.role && !(await authorization.hasRole(subject, options.role, APP_SCOPE))) {
+            return ctx.response.forbidden({
+                message: 'Permiso insuficiente',
+                statusCode: 403,
+                errors: [],
+            });
+        }
+        if (options.permission &&
+            !(await authorization.authorize(subject, options.permission, APP_SCOPE))) {
+            return ctx.response.forbidden({
+                message: 'Permiso insuficiente',
+                statusCode: 403,
+                errors: [],
+            });
+        }
+        return next();
+    }
+}
+//# sourceMappingURL=app_access_middleware.js.map

package/build/src/middleware/app_access_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_access_middleware.js","sourceRoot":"","sources":["../../../src/middleware/app_access_middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,aAAa,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC,KAAK,CAAC,MAAM,CACV,GAAgB,EAChB,IAAY,EACZ,UAAkD,EAAE;QAEpD,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,qDAAqD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAI,GAAW,CAAC,IAAI,EAAE,IAA6D,CAAA;QAC/F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,mEAAmE;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,mEAAmE,EAAE;gBACvF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAElD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QAED,IACE,OAAO,CAAC,UAAU;YAClB,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EACxE,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;CACF"}

package/build/src/models/authz_assignment.d.ts

@@ -0,0 +1,166 @@
+import { DateTime } from 'luxon';
+import type { BelongsTo } from '@adonisjs/lucid/types/relations';
+import AuthzRole from './authz_role.js';
+declare const AuthzAssignment_base: {
+    new (...args: any[]): {
+        $attributes: import("@adonisjs/lucid/types/model").ModelObject;
+        $extras: import("@adonisjs/lucid/types/model").ModelObject;
+        $original: import("@adonisjs/lucid/types/model").ModelObject;
+        $preloaded: {
+            [relation: string]: import("@adonisjs/lucid/types/model").LucidRow | import("@adonisjs/lucid/types/model").LucidRow[];
+        };
+        $sideloaded: import("@adonisjs/lucid/types/model").ModelObject;
+        $primaryKeyValue?: number | string;
+        $isPersisted: boolean;
+        $isNew: boolean;
+        $isLocal: boolean;
+        $dirty: import("@adonisjs/lucid/types/model").ModelObject;
+        $isDirty: boolean;
+        $isDeleted: boolean;
+        $options?: import("@adonisjs/lucid/types/model").ModelOptions;
+        $trx?: import("@adonisjs/lucid/types/database").TransactionClientContract;
+        $setOptionsAndTrx(options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): void;
+        useTransaction(trx: import("@adonisjs/lucid/types/database").TransactionClientContract): /*elided*/ any;
+        useConnection(connection: string): /*elided*/ any;
+        $getQueryFor(action: "insert", client: import("@adonisjs/lucid/types/database").QueryClientContract): ReturnType<import("@adonisjs/lucid/types/database").QueryClientContract["insertQuery"]>;
+        $getQueryFor(action: "update" | "delete" | "refresh", client: import("@adonisjs/lucid/types/database").QueryClientContract): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel>;
+        $setAttribute(key: string, value: any): void;
+        $getAttribute(key: string): any;
+        $getAttributeFromCache(key: string, callback: import("@adonisjs/lucid/types/model").CacheNode["getter"]): any;
+        $hasRelated(key: string): boolean;
+        $setRelated(key: string, result: import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | null): void;
+        $pushRelated(key: string, result: import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | null): void;
+        $getRelated(key: string, defaultValue?: any): import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | undefined | null;
+        $consumeAdapterResult(adapterResult: import("@adonisjs/lucid/types/model").ModelObject, sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject): void;
+        $hydrateOriginals(): void;
+        fill(value: Partial<import("@adonisjs/lucid/types/model").ModelAttributes</*elided*/ any>>, allowExtraProperties?: boolean): /*elided*/ any;
+        merge(value: Partial<import("@adonisjs/lucid/types/model").ModelAttributes</*elided*/ any>>, allowExtraProperties?: boolean): /*elided*/ any;
+        isDirty(fields?: undefined[] | undefined): boolean;
+        enableForceUpdate(): /*elided*/ any;
+        save(): Promise</*elided*/ any>;
+        saveQuietly(): Promise</*elided*/ any>;
+        lockForUpdate<T>(callback: (user: /*elided*/ any) => T | Promise<T>): Promise<T>;
+        delete(): Promise<void>;
+        deleteQuietly(): Promise<void>;
+        refresh(): Promise</*elided*/ any>;
+        load: import("@adonisjs/lucid/types/model").LucidRowPreload</*elided*/ any>;
+        loadOnce: import("@adonisjs/lucid/types/model").LucidRowPreloadOnce</*elided*/ any>;
+        preload: import("@adonisjs/lucid/types/model").LucidRowPreload</*elided*/ any>;
+        loadAggregate: <Self extends /*elided*/ any, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<Self>, RelatedBuilder = NonNullable<Self[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & Self[Name] & {})["subQuery"] : never>(name: Name, callback: (builder: RelatedBuilder) => void) => import("@adonisjs/lucid/types/model").LazyLoadAggregatesContract<Self>;
+        loadCount: <Self extends /*elided*/ any, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<Self>, RelatedBuilder = NonNullable<Self[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & Self[Name] & {})["subQuery"] : never>(name: Name, callback?: ((builder: RelatedBuilder) => void) | undefined) => import("@adonisjs/lucid/types/model").LazyLoadAggregatesContract<Self>;
+        serializeAttributes(fields?: import("@adonisjs/lucid/types/model").CherryPickFields, raw?: boolean): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeComputed(fields?: import("@adonisjs/lucid/types/model").CherryPickFields): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeRelations(fields: undefined, raw: true): {
+            [key: string]: import("@adonisjs/lucid/types/model").LucidRow | import("@adonisjs/lucid/types/model").LucidRow[];
+        };
+        serializeRelations(cherryPick: import("@adonisjs/lucid/types/model").CherryPick["relations"] | undefined, raw: false | undefined): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeRelations(cherryPick?: import("@adonisjs/lucid/types/model").CherryPick["relations"], raw?: boolean): import("@adonisjs/lucid/types/model").ModelObject;
+        serialize(cherryPick?: import("@adonisjs/lucid/types/model").CherryPick): import("@adonisjs/lucid/types/model").ModelObject;
+        toObject(): import("@adonisjs/lucid/types/model").ModelObject;
+        toJSON(): import("@adonisjs/lucid/types/model").ModelObject;
+        toAttributes(): Record<string, any>;
+        related<Name extends undefined>(relation: Name): NonNullable</*elided*/ any[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & /*elided*/ any[Name] & {})["client"] : never;
+    };
+    selfAssignPrimaryKey: boolean;
+    generateUuid(model: any): void;
+    nextUuid(): string;
+    find: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    readonly booted: boolean;
+    $columnsDefinitions: Map<string, import("@adonisjs/lucid/types/model").ModelColumnOptions>;
+    $relationsDefinitions: Map<string, import("@adonisjs/lucid/types/relations").RelationshipsContract>;
+    $computedDefinitions: Map<string, import("@adonisjs/lucid/types/model").ComputedOptions>;
+    primaryKey: string;
+    connection?: string | undefined;
+    namingStrategy: import("@adonisjs/lucid/types/model").NamingStrategyContract;
+    table: string;
+    $adapter: import("@adonisjs/lucid/types/model").AdapterContract;
+    useAdapter: (adapter: import("@adonisjs/lucid/types/model").AdapterContract) => void;
+    $hooks: import("@poppinss/hooks").default<any>;
+    $keys: {
+        attributesToColumns: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        attributesToSerialized: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnsToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnsToSerialized: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        serializedToColumns: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        serializedToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnAliasesToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+    };
+    $createFromAdapterResult: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, result?: import("@adonisjs/lucid/types/model").ModelObject, sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => null | InstanceType<T>;
+    $createMultipleFromAdapterResult: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, results: import("@adonisjs/lucid/types/model").ModelObject[], sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => InstanceType<T>[];
+    $addColumn: (name: string, options: Partial<import("@adonisjs/lucid/types/model").ColumnOptions>) => import("@adonisjs/lucid/types/model").ColumnOptions;
+    $hasColumn: (name: string) => boolean;
+    $getColumn: (name: string) => import("@adonisjs/lucid/types/model").ModelColumnOptions | undefined;
+    $getColumnAlias: (columnName: string) => string;
+    columnsForSelect: () => Record<string, string>;
+    $addComputed: (name: string, options: Partial<import("@adonisjs/lucid/types/model").ComputedOptions>) => import("@adonisjs/lucid/types/model").ComputedOptions;
+    $hasComputed: (name: string) => boolean;
+    $getComputed: (name: string) => import("@adonisjs/lucid/types/model").ComputedOptions | undefined;
+    $addRelation: (name: string, type: import("@adonisjs/lucid/types/relations").ModelRelationTypes["__opaque_type"], relatedModel: () => import("@adonisjs/lucid/types/model").LucidModel, options: import("@adonisjs/lucid/types/model").ModelRelationOptions) => void;
+    $hasRelation: (name: string) => boolean;
+    $getRelation: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<InstanceType<Model>>>(this: Model, name: Name): NonNullable<InstanceType<Model>[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? NonNullable<InstanceType<Model>[Name]>["client"]["relation"] : import("@adonisjs/lucid/types/relations").RelationshipsContract;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, name: string): import("@adonisjs/lucid/types/relations").RelationshipsContract;
+    };
+    $defineProperty: <Model extends import("@adonisjs/lucid/types/model").LucidModel, Prop extends keyof Model>(this: Model, propertyName: Prop, defaultValue: Model[Prop], strategy: "inherit" | "define" | ((value: Model[Prop]) => Model[Prop])) => void;
+    boot: () => void;
+    before: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends "find" | "fetch">(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>, Event>): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "paginate", handler: import("@adonisjs/lucid/types/model").HooksHandler<[import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>, import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>], "paginate">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends import("@adonisjs/lucid/types/model").EventsList>(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>, Event>): void;
+    };
+    after: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "fetch", handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>[], "fetch">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "paginate", handler: import("@adonisjs/lucid/types/model").HooksHandler<import("@adonisjs/lucid/types/model").ModelPaginatorContract<InstanceType<Model>>, "paginate">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends import("@adonisjs/lucid/types/model").EventsList>(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>, Event>): void;
+    };
+    create: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    createQuietly: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    createMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    createManyQuietly: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    findOrFail: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>>;
+    findBy: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<null | InstanceType<T>>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<null | InstanceType<T>>;
+    };
+    findByOrFail: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>>;
+    };
+    findManyBy: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
+    };
+    first: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    firstOrFail: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>>;
+    findMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any[], options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
+    firstOrNew: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, savePayload?: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    firstOrCreate: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, savePayload?: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    updateOrCreate: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, updatePayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    fetchOrNewUpMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    fetchOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    updateOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    all: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
+    query: <Model extends import("@adonisjs/lucid/types/model").LucidModel, Result = InstanceType<Model>>(this: Model, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model, Result>;
+    transaction: import("@adonisjs/lucid/types/database").TransactionFn;
+    truncate: (cascade?: boolean) => Promise<void>;
+} & import("@adonisjs/lucid/types/model").LucidModel;
+/**
+ * Asignación de rol a un holder polimórfico (users/admins/integrations) en un
+ * scope ('app' con scopeUuid null | 'organization' | 'unit'). `expiresAt`
+ * pasado = asignación no vigente (el driver la ignora, no la borra).
+ */
+export default class AuthzAssignment extends AuthzAssignment_base {
+    static table: string;
+    static primaryKey: string;
+    uuid: string;
+    holderType: string;
+    holderUuid: string;
+    roleUuid: string;
+    scopeType: string;
+    scopeUuid: string | null;
+    expiresAt: DateTime | null;
+    role: BelongsTo<typeof AuthzRole>;
+    createdAt: DateTime;
+}
+export {};
+//# sourceMappingURL=authz_assignment.d.ts.map

package/build/src/models/authz_assignment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_assignment.d.ts","sourceRoot":"","sources":["../../../src/models/authz_assignment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEhC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAA;AAEhE,OAAO,SAAS,MAAM,iBAAiB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oZAuCymsB,gDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AApCjssB;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,oBAA2B;IACtE,OAAc,KAAK,SAAsB;IACzC,OAAc,UAAU,SAAS;IAGzB,IAAI,EAAE,MAAM,CAAA;IAGZ,UAAU,EAAE,MAAM,CAAA;IAGlB,UAAU,EAAE,MAAM,CAAA;IAGlB,QAAQ,EAAE,MAAM,CAAA;IAGhB,SAAS,EAAE,MAAM,CAAA;IAGjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAGxB,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAA;IAG1B,IAAI,EAAE,SAAS,CAAC,OAAO,SAAS,CAAC,CAAA;IAGjC,SAAS,EAAE,QAAQ,CAAA;CAC5B"}

package/build/src/models/authz_assignment.js

@@ -0,0 +1,60 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { DateTime } from 'luxon';
+import { BaseModel, column, belongsTo } from '@adonisjs/lucid/orm';
+import { compose } from '@adonisjs/core/helpers';
+import AuthzRole from './authz_role.js';
+import { hasUuid } from '../traits/has_uuid.js';
+/**
+ * Asignación de rol a un holder polimórfico (users/admins/integrations) en un
+ * scope ('app' con scopeUuid null | 'organization' | 'unit'). `expiresAt`
+ * pasado = asignación no vigente (el driver la ignora, no la borra).
+ */
+export default class AuthzAssignment extends compose(BaseModel, hasUuid) {
+    static table = 'authz_assignments';
+    static primaryKey = 'uuid';
+}
+__decorate([
+    column({ isPrimary: true }),
+    __metadata("design:type", String)
+], AuthzAssignment.prototype, "uuid", void 0);
+__decorate([
+    column({ columnName: 'holder_type' }),
+    __metadata("design:type", String)
+], AuthzAssignment.prototype, "holderType", void 0);
+__decorate([
+    column({ columnName: 'holder_uuid' }),
+    __metadata("design:type", String)
+], AuthzAssignment.prototype, "holderUuid", void 0);
+__decorate([
+    column({ columnName: 'role_uuid' }),
+    __metadata("design:type", String)
+], AuthzAssignment.prototype, "roleUuid", void 0);
+__decorate([
+    column({ columnName: 'scope_type' }),
+    __metadata("design:type", String)
+], AuthzAssignment.prototype, "scopeType", void 0);
+__decorate([
+    column({ columnName: 'scope_uuid' }),
+    __metadata("design:type", Object)
+], AuthzAssignment.prototype, "scopeUuid", void 0);
+__decorate([
+    column.dateTime({ columnName: 'expires_at' }),
+    __metadata("design:type", Object)
+], AuthzAssignment.prototype, "expiresAt", void 0);
+__decorate([
+    belongsTo(() => AuthzRole, { foreignKey: 'roleUuid' }),
+    __metadata("design:type", Object)
+], AuthzAssignment.prototype, "role", void 0);
+__decorate([
+    column.dateTime({ autoCreate: true, columnName: 'created_at' }),
+    __metadata("design:type", DateTime)
+], AuthzAssignment.prototype, "createdAt", void 0);
+//# sourceMappingURL=authz_assignment.js.map

package/build/src/models/authz_assignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_assignment.js","sourceRoot":"","sources":["../../../src/models/authz_assignment.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,SAAS,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;IAC/D,MAAM,CAAC,KAAK,GAAG,mBAAmB,CAAA;IAClC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAA;;AAGzB;IADP,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;;6CACR;AAGZ;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;;mDACZ;AAGlB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;;mDACZ;AAGlB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;;iDACZ;AAGhB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;;kDACZ;AAGjB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;;kDACL;AAGxB;IADP,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;;kDACZ;AAG1B;IADP,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;;6CACd;AAGjC;IADP,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;8BAC7C,QAAQ;kDAAA"}

package/build/src/models/authz_deny.d.ts

@@ -0,0 +1,161 @@
+import { DateTime } from 'luxon';
+declare const AuthzDeny_base: {
+    new (...args: any[]): {
+        $attributes: import("@adonisjs/lucid/types/model").ModelObject;
+        $extras: import("@adonisjs/lucid/types/model").ModelObject;
+        $original: import("@adonisjs/lucid/types/model").ModelObject;
+        $preloaded: {
+            [relation: string]: import("@adonisjs/lucid/types/model").LucidRow | import("@adonisjs/lucid/types/model").LucidRow[];
+        };
+        $sideloaded: import("@adonisjs/lucid/types/model").ModelObject;
+        $primaryKeyValue?: number | string;
+        $isPersisted: boolean;
+        $isNew: boolean;
+        $isLocal: boolean;
+        $dirty: import("@adonisjs/lucid/types/model").ModelObject;
+        $isDirty: boolean;
+        $isDeleted: boolean;
+        $options?: import("@adonisjs/lucid/types/model").ModelOptions;
+        $trx?: import("@adonisjs/lucid/types/database").TransactionClientContract;
+        $setOptionsAndTrx(options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): void;
+        useTransaction(trx: import("@adonisjs/lucid/types/database").TransactionClientContract): /*elided*/ any;
+        useConnection(connection: string): /*elided*/ any;
+        $getQueryFor(action: "insert", client: import("@adonisjs/lucid/types/database").QueryClientContract): ReturnType<import("@adonisjs/lucid/types/database").QueryClientContract["insertQuery"]>;
+        $getQueryFor(action: "update" | "delete" | "refresh", client: import("@adonisjs/lucid/types/database").QueryClientContract): import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<import("@adonisjs/lucid/types/model").LucidModel>;
+        $setAttribute(key: string, value: any): void;
+        $getAttribute(key: string): any;
+        $getAttributeFromCache(key: string, callback: import("@adonisjs/lucid/types/model").CacheNode["getter"]): any;
+        $hasRelated(key: string): boolean;
+        $setRelated(key: string, result: import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | null): void;
+        $pushRelated(key: string, result: import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | null): void;
+        $getRelated(key: string, defaultValue?: any): import("@adonisjs/lucid/types/querybuilder").OneOrMany<import("@adonisjs/lucid/types/model").LucidRow> | undefined | null;
+        $consumeAdapterResult(adapterResult: import("@adonisjs/lucid/types/model").ModelObject, sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject): void;
+        $hydrateOriginals(): void;
+        fill(value: Partial<import("@adonisjs/lucid/types/model").ModelAttributes</*elided*/ any>>, allowExtraProperties?: boolean): /*elided*/ any;
+        merge(value: Partial<import("@adonisjs/lucid/types/model").ModelAttributes</*elided*/ any>>, allowExtraProperties?: boolean): /*elided*/ any;
+        isDirty(fields?: undefined[] | undefined): boolean;
+        enableForceUpdate(): /*elided*/ any;
+        save(): Promise</*elided*/ any>;
+        saveQuietly(): Promise</*elided*/ any>;
+        lockForUpdate<T>(callback: (user: /*elided*/ any) => T | Promise<T>): Promise<T>;
+        delete(): Promise<void>;
+        deleteQuietly(): Promise<void>;
+        refresh(): Promise</*elided*/ any>;
+        load: import("@adonisjs/lucid/types/model").LucidRowPreload</*elided*/ any>;
+        loadOnce: import("@adonisjs/lucid/types/model").LucidRowPreloadOnce</*elided*/ any>;
+        preload: import("@adonisjs/lucid/types/model").LucidRowPreload</*elided*/ any>;
+        loadAggregate: <Self extends /*elided*/ any, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<Self>, RelatedBuilder = NonNullable<Self[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & Self[Name] & {})["subQuery"] : never>(name: Name, callback: (builder: RelatedBuilder) => void) => import("@adonisjs/lucid/types/model").LazyLoadAggregatesContract<Self>;
+        loadCount: <Self extends /*elided*/ any, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<Self>, RelatedBuilder = NonNullable<Self[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & Self[Name] & {})["subQuery"] : never>(name: Name, callback?: ((builder: RelatedBuilder) => void) | undefined) => import("@adonisjs/lucid/types/model").LazyLoadAggregatesContract<Self>;
+        serializeAttributes(fields?: import("@adonisjs/lucid/types/model").CherryPickFields, raw?: boolean): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeComputed(fields?: import("@adonisjs/lucid/types/model").CherryPickFields): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeRelations(fields: undefined, raw: true): {
+            [key: string]: import("@adonisjs/lucid/types/model").LucidRow | import("@adonisjs/lucid/types/model").LucidRow[];
+        };
+        serializeRelations(cherryPick: import("@adonisjs/lucid/types/model").CherryPick["relations"] | undefined, raw: false | undefined): import("@adonisjs/lucid/types/model").ModelObject;
+        serializeRelations(cherryPick?: import("@adonisjs/lucid/types/model").CherryPick["relations"], raw?: boolean): import("@adonisjs/lucid/types/model").ModelObject;
+        serialize(cherryPick?: import("@adonisjs/lucid/types/model").CherryPick): import("@adonisjs/lucid/types/model").ModelObject;
+        toObject(): import("@adonisjs/lucid/types/model").ModelObject;
+        toJSON(): import("@adonisjs/lucid/types/model").ModelObject;
+        toAttributes(): Record<string, any>;
+        related<Name extends undefined>(relation: Name): NonNullable</*elided*/ any[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? (import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> & /*elided*/ any[Name] & {})["client"] : never;
+    };
+    selfAssignPrimaryKey: boolean;
+    generateUuid(model: any): void;
+    nextUuid(): string;
+    find: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    readonly booted: boolean;
+    $columnsDefinitions: Map<string, import("@adonisjs/lucid/types/model").ModelColumnOptions>;
+    $relationsDefinitions: Map<string, import("@adonisjs/lucid/types/relations").RelationshipsContract>;
+    $computedDefinitions: Map<string, import("@adonisjs/lucid/types/model").ComputedOptions>;
+    primaryKey: string;
+    connection?: string | undefined;
+    namingStrategy: import("@adonisjs/lucid/types/model").NamingStrategyContract;
+    table: string;
+    $adapter: import("@adonisjs/lucid/types/model").AdapterContract;
+    useAdapter: (adapter: import("@adonisjs/lucid/types/model").AdapterContract) => void;
+    $hooks: import("@poppinss/hooks").default<any>;
+    $keys: {
+        attributesToColumns: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        attributesToSerialized: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnsToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnsToSerialized: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        serializedToColumns: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        serializedToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+        columnAliasesToAttributes: import("@adonisjs/lucid/types/model").ModelKeysContract;
+    };
+    $createFromAdapterResult: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, result?: import("@adonisjs/lucid/types/model").ModelObject, sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => null | InstanceType<T>;
+    $createMultipleFromAdapterResult: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, results: import("@adonisjs/lucid/types/model").ModelObject[], sideloadAttributes?: import("@adonisjs/lucid/types/model").ModelObject, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => InstanceType<T>[];
+    $addColumn: (name: string, options: Partial<import("@adonisjs/lucid/types/model").ColumnOptions>) => import("@adonisjs/lucid/types/model").ColumnOptions;
+    $hasColumn: (name: string) => boolean;
+    $getColumn: (name: string) => import("@adonisjs/lucid/types/model").ModelColumnOptions | undefined;
+    $getColumnAlias: (columnName: string) => string;
+    columnsForSelect: () => Record<string, string>;
+    $addComputed: (name: string, options: Partial<import("@adonisjs/lucid/types/model").ComputedOptions>) => import("@adonisjs/lucid/types/model").ComputedOptions;
+    $hasComputed: (name: string) => boolean;
+    $getComputed: (name: string) => import("@adonisjs/lucid/types/model").ComputedOptions | undefined;
+    $addRelation: (name: string, type: import("@adonisjs/lucid/types/relations").ModelRelationTypes["__opaque_type"], relatedModel: () => import("@adonisjs/lucid/types/model").LucidModel, options: import("@adonisjs/lucid/types/model").ModelRelationOptions) => void;
+    $hasRelation: (name: string) => boolean;
+    $getRelation: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Name extends import("@adonisjs/lucid/types/relations").ExtractModelRelations<InstanceType<Model>>>(this: Model, name: Name): NonNullable<InstanceType<Model>[Name]> extends import("@adonisjs/lucid/types/relations").ModelRelations<import("@adonisjs/lucid/types/model").LucidModel, import("@adonisjs/lucid/types/model").LucidModel> ? NonNullable<InstanceType<Model>[Name]>["client"]["relation"] : import("@adonisjs/lucid/types/relations").RelationshipsContract;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, name: string): import("@adonisjs/lucid/types/relations").RelationshipsContract;
+    };
+    $defineProperty: <Model extends import("@adonisjs/lucid/types/model").LucidModel, Prop extends keyof Model>(this: Model, propertyName: Prop, defaultValue: Model[Prop], strategy: "inherit" | "define" | ((value: Model[Prop]) => Model[Prop])) => void;
+    boot: () => void;
+    before: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends "find" | "fetch">(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>, Event>): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "paginate", handler: import("@adonisjs/lucid/types/model").HooksHandler<[import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>, import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model>], "paginate">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends import("@adonisjs/lucid/types/model").EventsList>(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>, Event>): void;
+    };
+    after: {
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "fetch", handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>[], "fetch">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel>(this: Model, event: "paginate", handler: import("@adonisjs/lucid/types/model").HooksHandler<import("@adonisjs/lucid/types/model").ModelPaginatorContract<InstanceType<Model>>, "paginate">): void;
+        <Model extends import("@adonisjs/lucid/types/model").LucidModel, Event extends import("@adonisjs/lucid/types/model").EventsList>(this: Model, event: Event, handler: import("@adonisjs/lucid/types/model").HooksHandler<InstanceType<Model>, Event>): void;
+    };
+    create: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    createQuietly: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    createMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    createManyQuietly: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, values: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    findOrFail: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>>;
+    findBy: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<null | InstanceType<T>>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<null | InstanceType<T>>;
+    };
+    findByOrFail: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>>;
+    };
+    findManyBy: {
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
+        <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
+    };
+    first: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    firstOrFail: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>>;
+    findMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any[], options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
+    firstOrNew: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, savePayload?: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    firstOrCreate: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, savePayload?: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    updateOrCreate: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, updatePayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
+    fetchOrNewUpMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    fetchOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    updateOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
+    all: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
+    query: <Model extends import("@adonisjs/lucid/types/model").LucidModel, Result = InstanceType<Model>>(this: Model, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model, Result>;
+    transaction: import("@adonisjs/lucid/types/database").TransactionFn;
+    truncate: (cascade?: boolean) => Promise<void>;
+} & import("@adonisjs/lucid/types/model").LucidModel;
+/**
+ * Deny explícito: bloquea UN permiso a un holder en un scope y sus
+ * descendientes, aunque un rol se lo conceda. Gana siempre sobre los grants.
+ */
+export default class AuthzDeny extends AuthzDeny_base {
+    static table: string;
+    static primaryKey: string;
+    uuid: string;
+    holderType: string;
+    holderUuid: string;
+    permissionUuid: string;
+    scopeType: string;
+    scopeUuid: string | null;
+    createdAt: DateTime;
+}
+export {};
+//# sourceMappingURL=authz_deny.d.ts.map

package/build/src/models/authz_deny.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_deny.d.ts","sourceRoot":"","sources":["../../../src/models/authz_deny.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oZAkC++sB,gDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA7BhktB;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,cAA2B;IAChE,OAAc,KAAK,SAAiB;IACpC,OAAc,UAAU,SAAS;IAGzB,IAAI,EAAE,MAAM,CAAA;IAGZ,UAAU,EAAE,MAAM,CAAA;IAGlB,UAAU,EAAE,MAAM,CAAA;IAGlB,cAAc,EAAE,MAAM,CAAA;IAGtB,SAAS,EAAE,MAAM,CAAA;IAGjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAGxB,SAAS,EAAE,QAAQ,CAAA;CAC5B"}

package/build/src/models/authz_deny.js

@@ -0,0 +1,50 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { DateTime } from 'luxon';
+import { BaseModel, column } from '@adonisjs/lucid/orm';
+import { compose } from '@adonisjs/core/helpers';
+import { hasUuid } from '../traits/has_uuid.js';
+/**
+ * Deny explícito: bloquea UN permiso a un holder en un scope y sus
+ * descendientes, aunque un rol se lo conceda. Gana siempre sobre los grants.
+ */
+export default class AuthzDeny extends compose(BaseModel, hasUuid) {
+    static table = 'authz_denies';
+    static primaryKey = 'uuid';
+}
+__decorate([
+    column({ isPrimary: true }),
+    __metadata("design:type", String)
+], AuthzDeny.prototype, "uuid", void 0);
+__decorate([
+    column({ columnName: 'holder_type' }),
+    __metadata("design:type", String)
+], AuthzDeny.prototype, "holderType", void 0);
+__decorate([
+    column({ columnName: 'holder_uuid' }),
+    __metadata("design:type", String)
+], AuthzDeny.prototype, "holderUuid", void 0);
+__decorate([
+    column({ columnName: 'permission_uuid' }),
+    __metadata("design:type", String)
+], AuthzDeny.prototype, "permissionUuid", void 0);
+__decorate([
+    column({ columnName: 'scope_type' }),
+    __metadata("design:type", String)
+], AuthzDeny.prototype, "scopeType", void 0);
+__decorate([
+    column({ columnName: 'scope_uuid' }),
+    __metadata("design:type", Object)
+], AuthzDeny.prototype, "scopeUuid", void 0);
+__decorate([
+    column.dateTime({ autoCreate: true, columnName: 'created_at' }),
+    __metadata("design:type", DateTime)
+], AuthzDeny.prototype, "createdAt", void 0);
+//# sourceMappingURL=authz_deny.js.map

package/build/src/models/authz_deny.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_deny.js","sourceRoot":"","sources":["../../../src/models/authz_deny.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;IACzD,MAAM,CAAC,KAAK,GAAG,cAAc,CAAA;IAC7B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAA;;AAGzB;IADP,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;;uCACR;AAGZ;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;;6CACZ;AAGlB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;;6CACZ;AAGlB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;;iDACZ;AAGtB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;;4CACZ;AAGjB;IADP,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;;4CACL;AAGxB;IADP,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;8BAC7C,QAAQ;4CAAA"}