@jazzmind/busibox-app 3.0.18 → 3.0.19

package/dist/lib/next/sso.js

@@ -1,167 +0,0 @@
-/**
- * SSO Token Generation (Zero Trust)
- *
- * Uses authz service OAuth2 token exchange (RFC 8693) to generate app-scoped tokens.
- *
- * Flow:
- * 1. User requests access to an app (e.g., busibox-agents)
- * 2. busibox-portal exchanges user's session JWT with authz for an app-scoped token
- * 3. authz verifies user has access to the app via RBAC bindings
- * 4. authz issues RS256 token with app_id claim and user's roles
- * 5. External app validates token via authz JWKS: GET /.well-known/jwks.json
- *
- * Benefits:
- * - Standardized OAuth2 flow (RFC 8693)
- * - Asymmetric signing (RS256) with JWKS
- * - Service-scoped tokens (audience enforcement)
- * - App access controlled via authz RBAC bindings
- * - Centralized audit logging
- * - No client credentials needed - JWT proves identity
- */
-import { logOAuthTokenGenerated } from '../services/audit';
-import { exchangeTokenZeroTrust } from '@jazzmind/busibox-app';
-import { getAuthzBaseUrl } from './authz-client';
-import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore, resolveStableSsoAudience } from '../stores/app-config-store';
-/**
- * Get audit client options for server-side audit logging.
- */
-function getAuditOptions() {
-    return {
-        authzUrl: getAuthzBaseUrl(),
-    };
-}
-function normalizeIdentifier(value) {
-    return value.trim().toLowerCase();
-}
-function normalizePath(value) {
-    const trimmed = value.trim();
-    return trimmed.startsWith('/') ? trimmed.toLowerCase() : `/${trimmed.toLowerCase()}`;
-}
-function isPortalInternalBuiltInRoute(_url) {
-    // In the monorepo, all built-in apps (chat, documents, admin, etc.) run as
-    // separate Next.js apps with their own basePath. Nothing is portal-internal
-    // anymore — all apps need SSO token exchange.
-    return false;
-}
-// ============================================================================
-// Token Generation
-// ============================================================================
-/**
- * Generate an app-scoped access token for a user to access an external app.
- *
- * Zero Trust Flow:
- * 1. Verify app exists and is active in busibox-portal DB
- * 2. Exchange user's session JWT for an app-scoped token via authz
- * 3. Authz verifies user has app access via RBAC bindings
- * 4. Authz issues RS256 token with app_id claim
- *
- * The external app validates this token via authz JWKS endpoint:
- * GET {authz_url}/.well-known/jwks.json
- *
- * @param userInfo - User info including id, email, roles, and sessionJwt
- * @param appIdentifier - App identifier (UUID, stable audience, path, or name)
- * @returns JWT token string and expiration date
- */
-export async function generateSSOToken(userInfo, appIdentifier) {
-    // Verify app exists and is active
-    const context = await getAppConfigStoreContextForUser(userInfo.id, userInfo.sessionJwt);
-    const requestedIdentifier = appIdentifier.trim();
-    let app = await getAppByIdFromStore(context.accessToken, requestedIdentifier);
-    if (!app) {
-        const allApps = await listAppsFromStore(context.accessToken);
-        const normalized = normalizeIdentifier(requestedIdentifier);
-        const pathLike = normalizePath(requestedIdentifier);
-        app =
-            allApps.find((candidate) => candidate.ssoAudience?.toLowerCase() === normalized) ||
-                allApps.find((candidate) => candidate.name.toLowerCase() === normalized) ||
-                allApps.find((candidate) => candidate.url?.toLowerCase() === pathLike) ||
-                allApps.find((candidate) => candidate.deployedPath?.toLowerCase() === pathLike) ||
-                null;
-    }
-    if (!app) {
-        throw new Error(`App not found: ${requestedIdentifier}`);
-    }
-    if (!app.isActive) {
-        throw new Error('App is not active');
-    }
-    // In the monorepo, all apps (BUILT_IN, LIBRARY, EXTERNAL) are separate
-    // Next.js apps and need SSO token exchange.
-    const allowSso = app.type === 'EXTERNAL' ||
-        app.type === 'LIBRARY' ||
-        app.type === 'BUILT_IN';
-    if (!allowSso) {
-        throw new Error('App does not support SSO authentication');
-    }
-    console.log('[SSO] Requesting app-scoped token from authz:', {
-        userId: userInfo.id,
-        requestedIdentifier,
-        appId: app.id,
-        appName: app.name,
-        ssoAudience: app.ssoAudience,
-    });
-    const audience = resolveStableSsoAudience(app);
-    // Exchange session JWT for app-scoped token via authz
-    // Authz will verify user has access to this app via RBAC bindings
-    // and issue RS256 token with app_id claim and user's roles
-    try {
-        const result = await exchangeTokenZeroTrust({
-            sessionJwt: userInfo.sessionJwt,
-            audience,
-            resourceId: app.id, // Canonical app UUID for RBAC check
-            purpose: 'sso-app-access',
-        }, {
-            authzBaseUrl: getAuthzBaseUrl(),
-            verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
-        });
-        const expiresAt = new Date(result.expiresAt);
-        console.log('[SSO] App-scoped token issued by authz:', {
-            userId: userInfo.id,
-            requestedIdentifier,
-            appId: app.id,
-            appName: app.name,
-            audience,
-            expiresIn: result.expiresIn,
-        });
-        // Log token generation (audit failure is non-fatal)
-        // Note: authz already logs the token issuance in its audit log
-        try {
-            const auditOptions = getAuditOptions();
-            await logOAuthTokenGenerated(userInfo.id, app.id, auditOptions);
-        }
-        catch (auditError) {
-            console.error('[SSO] Audit logging failed (non-fatal):', auditError);
-        }
-        // For deployed apps, use deployedPath (e.g., /myapp)
-        // For external web apps, use the URL directly
-        // local-dev:// URLs should use deployedPath once deployed
-        let appUrl = app.url;
-        if (app.deployedPath && app.lastDeploymentStatus === 'completed') {
-            appUrl = app.deployedPath;
-        }
-        else if (app.url?.startsWith('local-dev://')) {
-            // local-dev app not yet deployed - use deployedPath if available
-            appUrl = app.deployedPath || null;
-        }
-        return {
-            token: result.accessToken,
-            expiresAt,
-            appUrl,
-        };
-    }
-    catch (error) {
-        // Map authz errors to user-friendly messages
-        const errorMessage = error.message || String(error);
-        if (errorMessage.includes('user_does_not_have_app_access')) {
-            throw new Error('User does not have permission to access this app');
-        }
-        if (errorMessage.includes('403')) {
-            throw new Error('User does not have permission to access this app');
-        }
-        if (errorMessage.includes('session_revoked') || errorMessage.includes('expired')) {
-            throw new Error('Session has expired. Please log in again.');
-        }
-        console.error('[SSO] Token exchange failed:', error);
-        throw new Error(`Failed to generate app token: ${errorMessage}`);
-    }
-}
-//# sourceMappingURL=sso.js.map

package/dist/lib/next/sso.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/lib/next/sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAA2B,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE/I;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC;AACJ,CAAC;AAgBD,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAoB;IACxD,2EAA2E;IAC3E,4EAA4E;IAC5E,8CAA8C;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAqB,EAAE,aAAqB;IAKjF,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACpD,GAAG;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBAC/E,IAAI,CAAC;IACT,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kBAAkB,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,UAAU;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS;QACtB,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE;QAC3D,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,mBAAmB;QACnB,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAE/C,sDAAsD;IACtD,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;YACE,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,oCAAoC;YACxD,OAAO,EAAE,gBAAgB;SAC1B,EACD;YACE,YAAY,EAAE,eAAe,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;SACtD,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE;YACrD,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,mBAAmB;YACnB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,oDAAoD;QACpD,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,qDAAqD;QACrD,8CAA8C;QAC9C,0DAA0D;QAC1D,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACrB,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,WAAW,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,iEAAiE;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QACpC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,SAAS;YACT,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,6CAA6C;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,YAAY,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/lib/rbac/client.d.ts

@@ -1,320 +0,0 @@
-/**
- * RBAC Client for busibox-app
- *
- * Centralized RBAC client that queries the authz service.
- * All Busibox applications should use this client for role/permission checks.
- *
- * Authentication:
- * - For self-service operations (user checking own access), pass the session JWT
- *   as `accessToken` - authz accepts it directly, no token exchange required.
- * - For admin operations (accessing other users' data), use an exchanged access
- *   token with appropriate authz.bindings.* scopes.
- *
- * Usage:
- * ```typescript
- * import { hasRole, isAdmin, getUserRoles, getUserAccessibleResources } from 'busibox-app';
- *
- * // Self-service: pass session JWT directly
- * const resources = await getUserAccessibleResources(userId, 'app', {
- *   authzUrl: 'http://authz-api:8010',
- *   accessToken: sessionJwt,
- * });
- *
- * // Admin: use exchanged access token with scopes
- * const roles = await getUserRoles('other-user-123', {
- *   accessToken: adminAccessToken,
- * });
- * ```
- */
-export interface RbacClientOptions {
-    /** User ID (for server-side token acquisition) */
-    userId?: string;
-    /** Custom token acquisition function */
-    getAuthzToken?: (userId: string, audience: string, scopes: string[]) => Promise<string>;
-    /** Override authz service URL */
-    authzUrl?: string;
-    /**
-     * Access token (JWT) for authentication.
-     *
-     * For self-service operations (user accessing their own resources),
-     * you can pass the session JWT directly - authz accepts it.
-     *
-     * For admin operations (accessing other users' resources),
-     * use an exchanged access token with authz.bindings.* scopes.
-     */
-    accessToken?: string;
-}
-export interface Role {
-    id: string;
-    name: string;
-    description?: string | null;
-    scopes?: string[];
-    is_system?: boolean;
-    created_at: string;
-    updated_at: string;
-}
-export interface User {
-    /** User ID (returned as 'id' from authz API) */
-    id: string;
-    /** @deprecated Use 'id' instead. Alias for backwards compatibility. */
-    user_id?: string;
-    email: string;
-    status?: string;
-    display_name?: string | null;
-    first_name?: string | null;
-    last_name?: string | null;
-    avatar_url?: string | null;
-    email_verified_at?: string | null;
-    last_login_at?: string | null;
-    pending_expires_at?: string | null;
-    roles: Role[];
-    created_at: string;
-    updated_at: string;
-}
-export interface UserListResponse {
-    users: User[];
-    pagination: {
-        page: number;
-        limit: number;
-        total_count: number;
-        total_pages: number;
-    };
-}
-export interface CreateUserParams {
-    email: string;
-    role_ids?: string[];
-    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
-    assigned_by?: string;
-}
-export interface UpdateUserParams {
-    email?: string;
-    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
-    display_name?: string;
-    first_name?: string;
-    last_name?: string;
-    avatar_url?: string;
-    email_verified_at?: string;
-    last_login_at?: string;
-    pending_expires_at?: string;
-}
-export interface ListUsersParams {
-    page?: number;
-    limit?: number;
-    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
-    search?: string;
-}
-/**
- * Admin options type - Zero Trust with optional access token.
- *
- * For protected endpoints, accessToken should be provided (obtained via token exchange).
- * Some endpoints may be public (e.g., role lookups for session validation).
- */
-export type AdminAuthOptions = RbacClientOptions;
-/**
- * Get all roles from authz service
- */
-export declare function listRoles(options?: RbacClientOptions): Promise<Role[]>;
-/**
- * Get a specific role by ID
- */
-export declare function getRole(roleId: string, options?: RbacClientOptions): Promise<Role | null>;
-/**
- * Get a role by name
- */
-export declare function getRoleByName(roleName: string, options?: RbacClientOptions): Promise<Role | null>;
-/**
- * List users with pagination and filtering
- */
-export declare function listUsers(params?: ListUsersParams, options?: RbacClientOptions): Promise<UserListResponse>;
-/**
- * Get all users (convenience function that pages through all results)
- */
-export declare function getAllUsers(options?: RbacClientOptions): Promise<User[]>;
-/**
- * Get a specific user by ID (includes roles)
- */
-export declare function getUser(userId: string, options?: RbacClientOptions): Promise<User | null>;
-/**
- * Get a user by email address (includes roles)
- * Returns null if user not found.
- */
-export declare function getUserByEmail(email: string, options?: RbacClientOptions): Promise<User | null>;
-/**
- * Get user's roles
- */
-export declare function getUserRoles(userId: string, options?: RbacClientOptions): Promise<Role[]>;
-/**
- * Get user's role names
- */
-export declare function getUserRoleNames(userId: string, options?: RbacClientOptions): Promise<string[]>;
-/**
- * Check if user has a specific role
- */
-export declare function hasRole(userId: string, roleName: string, options?: RbacClientOptions): Promise<boolean>;
-/**
- * Check if user has any of the specified roles
- */
-export declare function hasAnyRole(userId: string, roleNames: string[], options?: RbacClientOptions): Promise<boolean>;
-/**
- * Check if user has all of the specified roles
- */
-export declare function hasAllRoles(userId: string, roleNames: string[], options?: RbacClientOptions): Promise<boolean>;
-/**
- * Check if user is an admin
- */
-export declare function isAdmin(userId: string, options?: RbacClientOptions): Promise<boolean>;
-/**
- * Check if user is a guest
- */
-export declare function isGuest(userId: string, options?: RbacClientOptions): Promise<boolean>;
-/**
- * Create a new role (requires admin token)
- *
- * @param name - Role name
- * @param description - Optional description
- * @param scopes - Optional OAuth scopes for this role (e.g. ['data.read', 'search.write'])
- * @param options - RBAC client options with adminToken
- */
-export declare function createRole(name: string, description: string | null, options: AdminAuthOptions, scopes?: string[]): Promise<Role>;
-/**
- * Update a role (requires admin token)
- *
- * @param roleId - Role UUID
- * @param updates - Fields to update (name, description, scopes)
- * @param options - RBAC client options with adminToken
- */
-export declare function updateRole(roleId: string, updates: {
-    name?: string;
-    description?: string | null;
-    scopes?: string[];
-}, options: AdminAuthOptions): Promise<Role>;
-/**
- * Delete a role (requires admin token)
- */
-export declare function deleteRole(roleId: string, options: AdminAuthOptions): Promise<void>;
-/**
- * Add a role to a user (requires admin token)
- */
-export declare function addUserRole(userId: string, roleId: string, options: AdminAuthOptions): Promise<void>;
-/**
- * Remove a role from a user (requires admin token)
- */
-export declare function removeUserRole(userId: string, roleId: string, options: AdminAuthOptions): Promise<void>;
-/**
- * Delete a user (requires admin token)
- */
-export declare function deleteUser(userId: string, options: AdminAuthOptions): Promise<void>;
-/**
- * Create a new user (requires admin token)
- */
-export declare function createUser(params: CreateUserParams, options: AdminAuthOptions): Promise<User>;
-/**
- * Update a user (requires admin token)
- */
-export declare function updateUser(userId: string, updates: UpdateUserParams, options: AdminAuthOptions): Promise<User>;
-/**
- * Activate a pending user (requires admin token)
- */
-export declare function activateUser(userId: string, options: AdminAuthOptions): Promise<User>;
-/**
- * Deactivate an active user (requires admin token)
- */
-export declare function deactivateUser(userId: string, options: AdminAuthOptions): Promise<User>;
-/**
- * Reactivate a deactivated user (requires admin token)
- */
-export declare function reactivateUser(userId: string, options: AdminAuthOptions): Promise<User>;
-export interface EmailDomainRule {
-    id: string;
-    domain: string;
-    is_allowed: boolean;
-    created_at: string;
-    updated_at: string;
-}
-/**
- * List email domain rules (requires admin token)
- */
-export declare function listEmailDomains(options: AdminAuthOptions): Promise<EmailDomainRule[]>;
-/**
- * Add or update an email domain rule (requires admin token)
- */
-export declare function addEmailDomain(domain: string, isAllowed: boolean, options: AdminAuthOptions): Promise<EmailDomainRule>;
-/**
- * Remove an email domain rule (requires admin token)
- */
-export declare function removeEmailDomain(domain: string, options: AdminAuthOptions): Promise<void>;
-export type ResourceType = 'app' | 'library' | 'document';
-export interface RoleBinding {
-    id: string;
-    role_id: string;
-    resource_type: ResourceType;
-    resource_id: string;
-    permissions?: Record<string, boolean>;
-    created_at: string;
-    created_by?: string | null;
-}
-export interface RoleWithBinding {
-    id: string;
-    name: string;
-    description?: string | null;
-    scopes?: string[];
-    binding_id: string;
-    permissions?: Record<string, boolean>;
-    binding_created_at: string;
-}
-export interface CreateRoleBindingParams {
-    role_id: string;
-    resource_type: ResourceType;
-    resource_id: string;
-    permissions?: Record<string, boolean>;
-}
-export interface ListRoleBindingsParams {
-    role_id?: string;
-    resource_type?: ResourceType;
-    resource_id?: string;
-    limit?: number;
-    offset?: number;
-}
-/**
- * Create a new role-resource binding (requires admin token)
- */
-export declare function createRoleBinding(params: CreateRoleBindingParams, options: AdminAuthOptions): Promise<RoleBinding>;
-/**
- * Get a role binding by ID (requires admin token)
- */
-export declare function getRoleBinding(bindingId: string, options: AdminAuthOptions): Promise<RoleBinding | null>;
-/**
- * Delete a role binding by ID (requires admin token)
- */
-export declare function deleteRoleBinding(bindingId: string, options: AdminAuthOptions): Promise<void>;
-/**
- * List role bindings with optional filters (requires admin token)
- */
-export declare function listRoleBindings(params: ListRoleBindingsParams | undefined, options: AdminAuthOptions): Promise<RoleBinding[]>;
-/**
- * Get all bindings for a specific role (requires admin token)
- */
-export declare function getRoleResourceBindings(roleId: string, resourceType?: ResourceType, options?: AdminAuthOptions): Promise<RoleBinding[]>;
-/**
- * Get all roles that have access to a specific resource (requires admin token)
- */
-export declare function getResourceRoles(resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<RoleWithBinding[]>;
-/**
- * Check if a user can access a specific resource (requires admin token)
- */
-export declare function userCanAccessResource(userId: string, resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<boolean>;
-/**
- * Get all resource IDs of a given type that a user can access (requires admin token)
- */
-export declare function getUserAccessibleResources(userId: string, resourceType: ResourceType, options: AdminAuthOptions): Promise<string[]>;
-/**
- * Helper: Grant a role access to a resource (creates binding)
- * Convenience wrapper around createRoleBinding
- */
-export declare function grantRoleResourceAccess(roleId: string, resourceType: ResourceType, resourceId: string, permissions?: Record<string, boolean>, options?: AdminAuthOptions): Promise<RoleBinding>;
-/**
- * Helper: Revoke a role's access to a resource (deletes binding)
- * Finds and deletes the binding for the given role/resource combo
- */
-export declare function revokeRoleResourceAccess(roleId: string, resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<boolean>;
-//# sourceMappingURL=client.d.ts.map

package/dist/lib/rbac/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/rbac/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,IAAI;IACnB,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AA6DjD;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAQhF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQnG;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ3G;AAMD;;GAEG;AACH,wBAAsB,SAAS,CAC7B,MAAM,GAAE,eAAoB,EAC5B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBlF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQnG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQzG;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAQnG;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGzG;AAMD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAMD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC1E,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAMD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,EAAE,CAAC,CAI5B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,CAAC,CAOtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAQ7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,YAAK,EACnC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CAaxB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC,CAexB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,EAAE,CAAC,CAM5B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB"}