@jantstack/adonis-authz 1.0.2 → 2.0.0-alpha.1

package/build/src/testing/scope_tree.js

@@ -0,0 +1,145 @@
+import { APP_SCOPE, APP_SCOPE_TYPE } from '../types.js';
+/** Separador no imprimible: un `type` con ':' no puede colisionar con otro. */
+function key(scope) {
+    return `${scope.type}\u001f${scope.uuid ?? ''}`;
+}
+/**
+ * El resolutor que un harness inyecta al driver para que vea el árbol del
+ * juez: la cadena canónica del árbol (`chainOf`). Un scope que el árbol NO
+ * conoce resuelve a `null` tal cual: el driver deniega y rechaza escribir
+ * (L0.3). Es lo que hace que los casos de herencia dependan de verdad de
+ * `tree.attach` — con un fallback a `[APP_SCOPE]` un driver que ignorase el
+ * árbol seguiría pasando.
+ */
+export function resolveChainFrom(tree) {
+    return (scope) => tree.chainOf(scope);
+}
+/**
+ * El `descendantsOf` que un harness inyecta al MANAGER para que las
+ * primitivas de enumeración (2.1: `authorizedScopes`) vean el árbol del
+ * juez. Se calcula desde `edges()` —lo único que el contrato exige a un
+ * árbol— así que vale para cualquier `ContractScopeTree`. Un scope que el
+ * árbol no conoce resuelve a `null`; más de `maxNodes` descendientes ⇒ lanza
+ * (el contrato del puerto: nunca una lista truncada en silencio).
+ */
+export function descendantsFrom(tree) {
+    if (tree.descendantsOf)
+        return (scope, options) => tree.descendantsOf(scope, options);
+    return async (scope, { maxNodes }) => {
+        if (scope.type !== APP_SCOPE_TYPE && (await tree.chainOf(scope)) === null)
+            return null;
+        const children = new Map();
+        for await (const { child, parent } of tree.edges()) {
+            const k = key(parent);
+            if (!children.has(k))
+                children.set(k, []);
+            children.get(k).push(child);
+        }
+        const result = [];
+        const seen = new Set([key(scope)]);
+        const frontier = [scope];
+        while (frontier.length) {
+            const current = frontier.shift();
+            for (const child of children.get(key(current)) ?? []) {
+                if (seen.has(key(child)))
+                    continue;
+                seen.add(key(child));
+                result.push(child);
+                if (result.length > maxNodes) {
+                    throw new Error(`descendantsFrom: ${key(scope)} tiene más de ${maxNodes} descendientes`);
+                }
+                frontier.push(child);
+            }
+        }
+        return result;
+    };
+}
+/**
+ * Árbol en memoria para harness de test: un `Map` hijo→padre.
+ *
+ * El árbol de TEST también garantiza ser árbol (anti-ciclo, raíz única,
+ * padre existente), igual que hace el manager en `scopes.attached/moved`:
+ * el juez habla con el driver directamente, sin manager, y un test que
+ * construyera un ciclo por error pasaría en falso o se colgaría subiendo
+ * ancestros. Por eso aquí se lanza.
+ */
+export function memoryScopeTree() {
+    const parents = new Map();
+    function isKnown(scope) {
+        return scope.type === APP_SCOPE_TYPE || parents.has(key(scope));
+    }
+    function descendantsOf(scope) {
+        const result = new Set();
+        let frontier = [key(scope)];
+        while (frontier.length) {
+            const next = [];
+            for (const entry of parents.values()) {
+                const childKey = key(entry.child);
+                if (frontier.includes(key(entry.parent)) && !result.has(childKey)) {
+                    result.add(childKey);
+                    next.push(childKey);
+                }
+            }
+            frontier = next;
+        }
+        return result;
+    }
+    function link(child, parent) {
+        if (child.type === APP_SCOPE_TYPE) {
+            throw new Error('memoryScopeTree: la raíz `app` no puede colgar de nada');
+        }
+        if (!isKnown(parent)) {
+            throw new Error(`memoryScopeTree: el padre ${key(parent)} no existe en el árbol`);
+        }
+        if (key(parent) === key(child) || descendantsOf(child).has(key(parent))) {
+            throw new Error(`memoryScopeTree: ciclo — ${key(parent)} desciende de ${key(child)}`);
+        }
+        parents.set(key(child), { child, parent });
+    }
+    return {
+        async attach(child, parent) {
+            link(child, parent);
+        },
+        async move(child, newParent) {
+            if (!parents.has(key(child))) {
+                throw new Error(`memoryScopeTree: no se puede mover ${key(child)}, no existe`);
+            }
+            link(child, newParent);
+        },
+        async detach(child) {
+            for (const k of descendantsOf(child))
+                parents.delete(k);
+            parents.delete(key(child));
+        },
+        async chainOf(scope) {
+            if (scope.type === APP_SCOPE_TYPE)
+                return [APP_SCOPE];
+            const own = parents.get(key(scope));
+            if (!own)
+                return null;
+            // El elemento 0 es el nodo tal como se colgó (canónico para este
+            // árbol); un `Map` compara por bytes, así que aquí un alias nunca casa.
+            const chain = [own.child];
+            // `link` ya impide ciclos; el conjunto de visitados es el cinturón por
+            // si alguien manipula el mapa por otra vía.
+            const visited = new Set([key(scope)]);
+            let current = own;
+            while (current) {
+                chain.push(current.parent);
+                const parentKey = key(current.parent);
+                if (visited.has(parentKey)) {
+                    throw new Error(`memoryScopeTree: ciclo detectado al resolver ${key(scope)}`);
+                }
+                visited.add(parentKey);
+                current = parents.get(parentKey);
+            }
+            return chain;
+        },
+        async *edges() {
+            for (const entry of parents.values())
+                yield { child: entry.child, parent: entry.parent };
+        },
+    };
+}
+export { APP_SCOPE };
+//# sourceMappingURL=scope_tree.js.map

package/build/src/testing/scope_tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope_tree.js","sourceRoot":"","sources":["../../../src/testing/scope_tree.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAiCvD,+EAA+E;AAC/E,SAAS,GAAG,CAAC,KAAe;IAC1B,OAAO,GAAG,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,aAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACtF,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACtF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;QAC9C,IAAI,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,MAAM,MAAM,GAAe,EAAE,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAe,CAAC,KAAK,CAAC,CAAA;QACpC,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAG,CAAA;YACjC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;gBACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,iBAAiB,QAAQ,gBAAgB,CAAC,CAAA;gBAC1F,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiD,CAAA;IAExE,SAAS,OAAO,CAAC,KAAe;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,SAAS,aAAa,CAAC,KAAe;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;QAChC,IAAI,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QAC3B,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAa,EAAE,CAAA;YACzB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,SAAS,IAAI,CAAC,KAAe,EAAE,MAAgB;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,CAAC,iBAAiB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM;YACxB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAChF,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACxB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACvD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,KAAK,GAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACrC,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC7C,IAAI,OAAO,GAAsD,GAAG,CAAA;YACpE,OAAO,OAAO,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC/E,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACtB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,KAAK,CAAC,CAAC,KAAK;YACV,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE;gBAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;QAC1F,CAAC;KACF,CAAA;AACH,CAAC;AAED,OAAO,EAAE,SAAS,EAAE,CAAA"}

package/build/src/traits/authz_scopes.d.ts

@@ -1,3 +1,5 @@
+import { scope } from '@adonisjs/lucid/orm';
+import type { Clock } from '../clock.js';
 /**
  * Scopes de query sobre el motor de autorización propio — paridad con los
  * whereRoles/wherePermissions del paquete extirpado, ahora sobre `authz_*`.
@@ -10,12 +12,34 @@
  *
  *   Admin.query().withScopes((s) => s.whereRoles('superadmin'))
  *   User.query().withScopes((s) => s.wherePermissions('audit:read'))
+ *
+ * El reloj (2.5-B · K6, CR#5): la vigencia se decide con el reloj del
+ * sistema, salvo que se pase uno al componer — `compose(BaseModel,
+ * withAuthzScopes({ clock }))`. El trait no ve el manager ni su
+ * `config.clock`: si tu app fija el reloj, pásale el MISMO aquí; si no,
+ * este listado y `authorize` pueden discrepar sobre lo que ya venció.
  */
-export declare function withAuthzScopes<T extends {
-    new (...args: any[]): {};
-}>(Base: T): {
+export interface AuthzScopesOptions {
+    /** Reloj con el que se decide «vigente» (default: `systemClock`). */
+    clock?: Clock;
+}
+type Constructor = {
     new (...args: any[]): {};
-    whereRoles: import("@adonisjs/lucid/types/model").QueryScope<import("@adonisjs/lucid/types/model").LucidModel, (query: any, ...roles: string[]) => void>;
-    wherePermissions: import("@adonisjs/lucid/types/model").QueryScope<import("@adonisjs/lucid/types/model").LucidModel, (query: any, ...permissions: string[]) => void>;
-} & T;
+};
+/** Lo que el trait añade al modelo: dos scopes de query. */
+export interface AuthzScopesStatics {
+    whereRoles: ReturnType<typeof scope<any, (query: any, ...roles: string[]) => void>>;
+    wherePermissions: ReturnType<typeof scope<any, (query: any, ...permissions: string[]) => void>>;
+}
+export type WithAuthzScopes<T extends Constructor> = T & AuthzScopesStatics;
+/**
+ * Como mixin directo (`compose(BaseModel, withAuthzScopes)`: reloj del
+ * sistema) o con opciones (`compose(BaseModel, withAuthzScopes({ clock }))`).
+ * Una sola firma genérica y no dos overloads: TypeScript solo propaga la
+ * inferencia de orden superior de `compose` (`A` = la clase mezclada) cuando
+ * el argumento tiene UNA firma; con overloads `compose(BaseModel,
+ * withAuthzScopes)` perdía los estáticos del modelo.
+ */
+export declare function withAuthzScopes<T extends Constructor | AuthzScopesOptions>(arg: T): T extends Constructor ? WithAuthzScopes<T> : <U extends Constructor>(Base: U) => WithAuthzScopes<U>;
+export {};
 //# sourceMappingURL=authz_scopes.d.ts.map

package/build/src/traits/authz_scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz_scopes.d.ts","sourceRoot":"","sources":["../../../src/traits/authz_scopes.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC;kBAArB,GAAG,EAAE;2HAEzB,GAAG,YAAY,MAAM,EAAE;iIAajB,GAAG,kBAAkB,MAAM,EAAE;MAcxE"}
+{"version":3,"file":"authz_scopes.d.ts","sourceRoot":"","sources":["../../../src/traits/authz_scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAG3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,KAAK,CAAC,EAAE,KAAK,CAAA;CACd;AAED,KAAK,WAAW,GAAG;IAAE,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;CAAE,CAAA;AAE/C,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;IACnF,gBAAgB,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;CAChG;AACD,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,WAAW,IAAI,CAAC,GAAG,kBAAkB,CAAA;AAgD3E;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,GAAG,kBAAkB,EACxE,GAAG,EAAE,CAAC,GACL,CAAC,SAAS,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAA"}

package/build/src/traits/authz_scopes.js

@@ -1,19 +1,21 @@
 import { scope } from '@adonisjs/lucid/orm';
 import db from '@adonisjs/lucid/services/db';
-/**
- * Scopes de query sobre el motor de autorización propio — paridad con los
- * whereRoles/wherePermissions del paquete extirpado, ahora sobre `authz_*`.
- *
- * Filtra holders del modelo con asignación VIGENTE (sin expirar) del rol o
- * permiso, en cualquier scope. Es un listado grueso (¿quién tiene X?): el
- * enforcement fino por scope+denies lo hace `authorization.authorize()`.
- *
- * El morph name del holder sale del decorador @MorphMap del modelo.
- *
- *   Admin.query().withScopes((s) => s.whereRoles('superadmin'))
- *   User.query().withScopes((s) => s.wherePermissions('audit:read'))
- */
-export function withAuthzScopes(Base) {
+import { isClock, systemClock } from '../clock.js';
+import { AuthorizationConfigError } from '../errors.js';
+import { dialectOf, sqlExpiryCodec } from '../drivers/sql_expiry.js';
+/** La clave primaria del modelo comparable con `holder_uuid` en cualquier motor (K3). */
+function comparablePrimaryKey(query) {
+    // En PostgreSQL una PK `uuid` nativa contra un subquery `varchar(64)` es
+    // el error 42883 («operator does not exist: uuid = character varying»):
+    // se compara como texto. MySQL y SQLite coaccionan y la columna vale tal
+    // cual. Se castea la PK y no el subquery: castear `holder_uuid` a `uuid`
+    // reventaría con un holder de OTRO morph cuyo id no sea un UUID.
+    const column = `${query.model.table}.${query.model.primaryKey}`;
+    return dialectOf(db.connection()) === 'postgres' ? db.raw('CAST(?? AS text)', [column]) : column;
+}
+function mixin(Base, clock) {
+    /** `expires_at` vigente con el reloj del trait y el codec del motor (K2: en MySQL, cadena UTC). */
+    const active = (b) => b.whereNull('a.expires_at').orWhere('a.expires_at', '>', sqlExpiryCodec(db.connection()).bind(clock()));
     return class extends Base {
         static whereRoles = scope((query, ...roles) => {
             const model = query.model;
@@ -23,9 +25,9 @@ export function withAuthzScopes(Base) {
                 .join('authz_roles as r', 'r.uuid', 'a.role_uuid')
                 .where('a.holder_type', morph)
                 .whereIn('r.slug', roles)
-                .where((b) => b.whereNull('a.expires_at').orWhere('a.expires_at', '>', new Date()))
+                .where(active)
                 .select('a.holder_uuid');
-            query.whereIn(model.primaryKey, sub);
+            query.whereIn(comparablePrimaryKey(query), sub);
         });
         static wherePermissions = scope((query, ...permissions) => {
             const model = query.model;
@@ -36,10 +38,20 @@ export function withAuthzScopes(Base) {
                 .join('authz_permissions as p', 'p.uuid', 'rp.permission_uuid')
                 .where('a.holder_type', morph)
                 .whereIn('p.slug', permissions)
-                .where((b) => b.whereNull('a.expires_at').orWhere('a.expires_at', '>', new Date()))
+                .where(active)
                 .select('a.holder_uuid');
-            query.whereIn(model.primaryKey, sub);
+            query.whereIn(comparablePrimaryKey(query), sub);
         });
     };
 }
+export function withAuthzScopes(arg) {
+    if (typeof arg === 'function')
+        return mixin(arg, systemClock);
+    const options = arg ?? {};
+    if (options.clock !== undefined && !isClock(options.clock)) {
+        throw new AuthorizationConfigError(`withAuthzScopes: 'clock' debe ser una función () => Date (llegó ${typeof options.clock})`);
+    }
+    const clock = options.clock ?? systemClock;
+    return (Base) => mixin(Base, clock);
+}
 //# sourceMappingURL=authz_scopes.js.map

package/build/src/traits/authz_scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz_scopes.js","sourceRoot":"","sources":["../../../src/traits/authz_scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAyC,IAAO;IAC7E,OAAO,KAAM,SAAQ,IAAI;QACvB,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,KAAU,EAAE,GAAG,KAAe,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAA;YAC5C,MAAM,GAAG,GAAG,EAAE;iBACX,IAAI,CAAC,wBAAwB,CAAC;iBAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;iBACjD,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC;iBAC7B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACxB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;iBAClF,MAAM,CAAC,eAAe,CAAC,CAAA;YAC1B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,KAAU,EAAE,GAAG,WAAqB,EAAE,EAAE;YACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAA;YAC5C,MAAM,GAAG,GAAG,EAAE;iBACX,IAAI,CAAC,wBAAwB,CAAC;iBAC9B,IAAI,CAAC,8BAA8B,EAAE,cAAc,EAAE,aAAa,CAAC;iBACnE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,EAAE,oBAAoB,CAAC;iBAC9D,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC;iBAC7B,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;iBAClF,MAAM,CAAC,eAAe,CAAC,CAAA;YAC1B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;KACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"authz_scopes.js","sourceRoot":"","sources":["../../../src/traits/authz_scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAmCpE,yFAAyF;AACzF,SAAS,oBAAoB,CAAC,KAAU;IACtC,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAC/D,OAAO,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AAClG,CAAC;AAED,SAAS,KAAK,CAAwB,IAAO,EAAE,KAAY;IACzD,mGAAmG;IACnG,MAAM,MAAM,GAAG,CAAC,CAAM,EAAE,EAAE,CACxB,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAQ,CAAC,CAAA;IAEhH,OAAO,KAAM,SAAQ,IAAI;QACvB,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,KAAU,EAAE,GAAG,KAAe,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAA;YAC5C,MAAM,GAAG,GAAG,EAAE;iBACX,IAAI,CAAC,wBAAwB,CAAC;iBAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;iBACjD,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC;iBAC7B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACxB,KAAK,CAAC,MAAM,CAAC;iBACb,MAAM,CAAC,eAAe,CAAC,CAAA;YAC1B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,KAAU,EAAE,GAAG,WAAqB,EAAE,EAAE;YACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAA;YAC5C,MAAM,GAAG,GAAG,EAAE;iBACX,IAAI,CAAC,wBAAwB,CAAC;iBAC9B,IAAI,CAAC,8BAA8B,EAAE,cAAc,EAAE,aAAa,CAAC;iBACnE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,EAAE,oBAAoB,CAAC;iBAC9D,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC;iBAC7B,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;iBAC9B,KAAK,CAAC,MAAM,CAAC;iBACb,MAAM,CAAC,eAAe,CAAC,CAAA;YAC1B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;KACH,CAAA;AACH,CAAC;AAaD,MAAM,UAAU,eAAe,CAAC,GAAsC;IACpE,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,GAAG,IAAI,EAAE,CAAA;IACzB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,wBAAwB,CAChC,mEAAmE,OAAO,OAAO,CAAC,KAAK,GAAG,CAC3F,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAA;IAC1C,OAAO,CAAwB,IAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC/D,CAAC"}

package/build/src/traits/has_uuid.d.ts

@@ -68,15 +68,18 @@ export declare const hasUuid: <Model extends NormalizeConstructor<typeof BaseMod
     generateUuid(model: any): void;
     /** Devuelve un nuevo UUID v7 (para uso en pivots u otros datos que no son instancias del modelo). */
     nextUuid(): string;
+    all: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
     find: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    table: string;
+    connection?: string | undefined;
+    first: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
+    truncate: (cascade?: boolean) => Promise<void>;
     readonly booted: boolean;
     $columnsDefinitions: Map<string, import("@adonisjs/lucid/types/model").ModelColumnOptions>;
     $relationsDefinitions: Map<string, import("@adonisjs/lucid/types/relations").RelationshipsContract>;
     $computedDefinitions: Map<string, import("@adonisjs/lucid/types/model").ComputedOptions>;
     primaryKey: string;
-    connection?: string | undefined;
     namingStrategy: import("@adonisjs/lucid/types/model").NamingStrategyContract;
-    table: string;
     $adapter: import("@adonisjs/lucid/types/model").AdapterContract;
     useAdapter: (adapter: import("@adonisjs/lucid/types/model").AdapterContract) => void;
     $hooks: import("@poppinss/hooks").default<any>;
@@ -134,7 +137,6 @@ export declare const hasUuid: <Model extends NormalizeConstructor<typeof BaseMod
         <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, clause: Record<string, unknown>, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
         <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, key: string, value: any, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions): Promise<InstanceType<T>[]>;
     };
-    first: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<null | InstanceType<T>>;
     firstOrFail: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>>;
     findMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, value: any[], options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
     firstOrNew: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, searchPayload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, savePayload?: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>, options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>>;
@@ -143,9 +145,7 @@ export declare const hasUuid: <Model extends NormalizeConstructor<typeof BaseMod
     fetchOrNewUpMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
     fetchOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
     updateOrCreateMany: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, predicate: keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>> | (keyof import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>)[], payload: Partial<import("@adonisjs/lucid/types/model").ModelAttributes<InstanceType<T>>>[], options?: import("@adonisjs/lucid/types/model").ModelAssignOptions) => Promise<InstanceType<T>[]>;
-    all: <T extends import("@adonisjs/lucid/types/model").LucidModel>(this: T, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => Promise<InstanceType<T>[]>;
     query: <Model_1 extends import("@adonisjs/lucid/types/model").LucidModel, Result = InstanceType<Model_1>>(this: Model_1, options?: import("@adonisjs/lucid/types/model").ModelAdapterOptions) => import("@adonisjs/lucid/types/model").ModelQueryBuilderContract<Model_1, Result>;
     transaction: import("@adonisjs/lucid/types/database").TransactionFn;
-    truncate: (cascade?: boolean) => Promise<void>;
 } & Model;
 //# sourceMappingURL=has_uuid.d.ts.map

package/build/src/traits/has_uuid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"has_uuid.d.ts","sourceRoot":"","sources":["../../../src/traits/has_uuid.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAGxE;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,KAAK,SAAS,oBAAoB,CAAC,OAAO,SAAS,CAAC,EAC1E,YAAY,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAMY,GAAG;IAO9B,qGAAqG;gBAClF,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kaAM0jtB,oDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SADvotB,CAAA"}
+{"version":3,"file":"has_uuid.d.ts","sourceRoot":"","sources":["../../../src/traits/has_uuid.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAGxE;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,KAAK,SAAS,oBAAoB,CAAC,OAAO,SAAS,CAAC,EAC1E,YAAY,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAMY,GAAG;IAO9B,qGAAqG;gBAClF,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kaAM0jtB,oDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SADvotB,CAAA"}