@jcdubs/janus 1.1.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +156 -12
- package/dist/auth-lambda/auth-lambda.js +1 -1
- package/dist/auth-lambda/auth-lambda.js.map +1 -1
- package/dist/authorization-service/authorization-service.d.ts +3 -3
- package/dist/authorization-service/authorization-service.d.ts.map +1 -1
- package/dist/authorization-service/authorization-service.js.map +1 -1
- package/dist/entity-builder/entity-builder.d.ts +90 -0
- package/dist/entity-builder/entity-builder.d.ts.map +1 -0
- package/dist/entity-builder/entity-builder.js +159 -0
- package/dist/entity-builder/entity-builder.js.map +1 -0
- package/dist/entity-builder/index.d.ts +2 -0
- package/dist/entity-builder/index.d.ts.map +1 -0
- package/dist/entity-builder/index.js +18 -0
- package/dist/entity-builder/index.js.map +1 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/types.d.ts +25 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +3 -0
- package/dist/types.js.map +1 -0
- package/package.json +6 -4
package/README.md
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
# Janus
|
|
2
2
|
|
|
3
|
+
|
|
3
4
|
[](https://github.com/JCDubs/Janus/actions/workflows/main.yaml)
|
|
4
5
|
[](https://opensource.org/licenses/MIT)
|
|
5
6
|
[](https://nodejs.org)
|
|
@@ -16,6 +17,8 @@ Open source serverless authentication: A Cedar-based authorization engine for de
|
|
|
16
17
|
|
|
17
18
|
Janus is a TypeScript library that provides fine-grained, policy-based authorization for AWS Lambda functions using [Cedar](https://www.cedarpolicy.com/). It enables you to define complex authorization rules and evaluate them efficiently within your serverless applications.
|
|
18
19
|
|
|
20
|
+
Janus is based on the pattern discussed in this blog post: [Serverless: Granular Authorisation with Cedar — High control, minimal cost](https://medium.com/@jcdubs/serverless-granular-authorisation-with-cedar-high-control-minimal-cost-1149640f8cd9).
|
|
21
|
+
|
|
19
22
|
### Key Features
|
|
20
23
|
|
|
21
24
|
- 🔐 **Cedar Policy Engine** - Leverage Amazon's Cedar policy language for authorization
|
|
@@ -115,31 +118,112 @@ namespace OrderService {
|
|
|
115
118
|
}
|
|
116
119
|
```
|
|
117
120
|
|
|
121
|
+
### Implement the Auth Lambda
|
|
122
|
+
|
|
123
|
+
The following example demonstrates a simple AWS Lambda handler that uses the middleware
|
|
124
|
+
to load Cedar authorization and then performs an authorization check inside the handler.
|
|
125
|
+
|
|
126
|
+
```typescript
|
|
127
|
+
import middy from '@middy/core';
|
|
128
|
+
import type { APIGatewayProxyEvent, APIGatewayProxyResult } from 'aws-lambda';
|
|
129
|
+
import {
|
|
130
|
+
loadCedarAuthorization,
|
|
131
|
+
AuthorizationService,
|
|
132
|
+
EntityBuilder,
|
|
133
|
+
getUserName,
|
|
134
|
+
} from '@jcdubs/janus';
|
|
135
|
+
|
|
136
|
+
const authorizationConfig = {
|
|
137
|
+
namespace: 'OrderService::',
|
|
138
|
+
principleType: 'User',
|
|
139
|
+
resourceType: 'Order',
|
|
140
|
+
roleType: 'Role',
|
|
141
|
+
};
|
|
142
|
+
|
|
143
|
+
const handler = async (
|
|
144
|
+
event: APIGatewayProxyEvent,
|
|
145
|
+
): Promise<APIGatewayProxyResult> => {
|
|
146
|
+
// AuthorizationService is cached by the middleware, but retrieving it here is safe
|
|
147
|
+
// and inexpensive (cached) and makes the intent explicit in the handler.
|
|
148
|
+
const authService = await AuthorizationService.getService(authorizationConfig);
|
|
149
|
+
|
|
150
|
+
const resourceId = event.pathParameters?.orderId ?? 'order-123';
|
|
151
|
+
|
|
152
|
+
const isAuthorized = authService
|
|
153
|
+
.setAction('viewOrder')
|
|
154
|
+
.setResource(resourceId)
|
|
155
|
+
.addEntity(
|
|
156
|
+
new EntityBuilder(resourceId, authorizationConfig)
|
|
157
|
+
.withStringAttr('customerId', getUserName())
|
|
158
|
+
.build(),
|
|
159
|
+
)
|
|
160
|
+
.isAuthorized();
|
|
161
|
+
|
|
162
|
+
return {
|
|
163
|
+
statusCode: isAuthorized ? 200 : 403,
|
|
164
|
+
body: JSON.stringify({ allowed: isAuthorized }),
|
|
165
|
+
};
|
|
166
|
+
};
|
|
167
|
+
|
|
168
|
+
export const main = middy(handler).use(loadCedarAuthorization(authorizationConfig));
|
|
169
|
+
```
|
|
170
|
+
|
|
118
171
|
### 3. Use the Authorization Service
|
|
119
172
|
|
|
120
173
|
```typescript
|
|
121
|
-
import { AuthorizationService } from '@jcdubs/janus';
|
|
174
|
+
import { AuthorizationService, EntityBuilder } from '@jcdubs/janus';
|
|
122
175
|
|
|
123
|
-
//
|
|
124
|
-
const
|
|
176
|
+
// Define the authorization configuration and initialize the service (cached as a singleton)
|
|
177
|
+
const authorizationConfig = {
|
|
125
178
|
namespace: 'OrderService::',
|
|
126
179
|
principleType: 'User',
|
|
127
180
|
resourceType: 'Order',
|
|
128
181
|
roleType: 'Role'
|
|
129
|
-
}
|
|
182
|
+
};
|
|
183
|
+
|
|
184
|
+
const authService = await AuthorizationService.getService(authorizationConfig);
|
|
185
|
+
|
|
186
|
+
// Examples showing varied `EntityBuilder` usage patterns
|
|
187
|
+
|
|
188
|
+
// Minimal: build an entity with only UID
|
|
189
|
+
const isAuthorizedMinimal = authService
|
|
190
|
+
.setAction('viewOrder')
|
|
191
|
+
.setResource('order-123')
|
|
192
|
+
.addEntity(new EntityBuilder('order-123', authorizationConfig).build())
|
|
193
|
+
.isAuthorized();
|
|
130
194
|
|
|
131
|
-
//
|
|
132
|
-
const
|
|
195
|
+
// Typical: add a few simple attributes
|
|
196
|
+
const isAuthorizedTypical = authService
|
|
133
197
|
.setAction('viewOrder')
|
|
134
198
|
.setResource('order-123')
|
|
135
|
-
.addEntity(
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
199
|
+
.addEntity(
|
|
200
|
+
new EntityBuilder('order-123', authorizationConfig)
|
|
201
|
+
.withStringAttr('customerId', 'user-456')
|
|
202
|
+
.withStringAttr('status', 'PENDING')
|
|
203
|
+
.withNumberAttr('items', 3)
|
|
204
|
+
.build()
|
|
205
|
+
)
|
|
140
206
|
.isAuthorized();
|
|
141
207
|
|
|
142
|
-
|
|
208
|
+
// Full: include sets, references, extension attrs, parents and tags
|
|
209
|
+
const isAuthorizedFull = authService
|
|
210
|
+
.setAction('viewOrder')
|
|
211
|
+
.setResource('order-123')
|
|
212
|
+
.addEntity(
|
|
213
|
+
new EntityBuilder('order-123', authorizationConfig)
|
|
214
|
+
.withStringAttr('customerId', 'user-456')
|
|
215
|
+
.withBooleanAttr('active', true)
|
|
216
|
+
.withNumberAttr('items', 5)
|
|
217
|
+
.withSetAttr('flags', ['flagA', 'flagB'])
|
|
218
|
+
.withAttr('owner', 'u1', authorizationConfig.principleType)
|
|
219
|
+
.withExtnAttr('ip', 'ipaddr', '192.168.1.10')
|
|
220
|
+
.withParent('role-1', 'Role')
|
|
221
|
+
.withTag('label', 'lbl1', 'Label')
|
|
222
|
+
.build()
|
|
223
|
+
)
|
|
224
|
+
.isAuthorized();
|
|
225
|
+
|
|
226
|
+
logger.info('Create authorisation requests', isAuthorizedMinimal, isAuthorizedTypical, isAuthorizedFull);
|
|
143
227
|
```
|
|
144
228
|
|
|
145
229
|
## API Reference
|
|
@@ -243,6 +327,56 @@ const handler = middy(async (event) => {
|
|
|
243
327
|
}));
|
|
244
328
|
```
|
|
245
329
|
|
|
330
|
+
### Auth Lambda Construct
|
|
331
|
+
|
|
332
|
+
Provides a CDK construct to bundle a Node.js Lambda with Cedar policy and schema files and the Cedar WASM runtime.
|
|
333
|
+
|
|
334
|
+
- **Export:** `AuthLambda` (class)
|
|
335
|
+
- **Props:** `AuthLambdaProps` — extends `NodejsFunctionProps` and adds `authorisation: { policyFilePath: string; schemaFilePath: string }`.
|
|
336
|
+
|
|
337
|
+
Usage: Use `AuthLambda` in CDK stacks to ensure Cedar policies and schema are bundled with the Lambda package and the Cedar WASM runtime copied into `node_modules/@cedar-policy/cedar-wasm`. In particular, `AuthLambda` makes sure the `@cedar-policy/cedar-wasm` package, your Cedar policy file (for example `policies.cedar`) and your Cedar schema file (for example `schema.cedarschema`) are included in the Lambda deployment package so they are available at runtime.
|
|
338
|
+
|
|
339
|
+
### EntityBuilder
|
|
340
|
+
|
|
341
|
+
Fluent builder for creating Cedar entity JSON objects used in authorization requests.
|
|
342
|
+
|
|
343
|
+
- **Export:** `EntityBuilder` (class)
|
|
344
|
+
- **Constructor:** `new EntityBuilder(id: string, authorizationConfig: AuthorizationConfigType, type?: string)`
|
|
345
|
+
- **Common Methods:** `withAttr(name, id, type)`, `withExtnAttr(name, fn, arg)`, `withBooleanAttr(name, value)`, `withNumberAttr(name, value)`, `withStringAttr(name, value)`, `withSetAttr(name, value)`, `withParent(id, type)`, `withTag(name, id, type)`, `build()` — returns `EntityJson`.
|
|
346
|
+
|
|
347
|
+
Example usage is shown in the Quick Start section above.
|
|
348
|
+
|
|
349
|
+
### File Loader
|
|
350
|
+
|
|
351
|
+
Small utility to read bundled files (Cedar policy and schema) from the Lambda package.
|
|
352
|
+
|
|
353
|
+
- **Export:** `loadFileAsString(fileName: string): string`
|
|
354
|
+
|
|
355
|
+
Throws an `Error` if the file cannot be read. Typically used by the `AuthorizationService` to load `policies.cedar` and `schema.cedarschema`.
|
|
356
|
+
|
|
357
|
+
### Types
|
|
358
|
+
|
|
359
|
+
Shared TypeScript types used across the library.
|
|
360
|
+
|
|
361
|
+
- `TypeAndId` — `{ type: string; id: string }`
|
|
362
|
+
- `EntityUidJson` — `{ __entity: TypeAndId } | TypeAndId`
|
|
363
|
+
- `CedarValueJson` — union of entity refs, extn values, primitives, arrays, objects, or null
|
|
364
|
+
- `FnAndArg` — `{ fn: string; arg: CedarValueJson }`
|
|
365
|
+
- `EntityJson` — `{ uid: EntityUidJson; attrs: Record<string, CedarValueJson>; parents: EntityUidJson[]; tags?: Record<string, CedarValueJson> }`
|
|
366
|
+
|
|
367
|
+
### Errors
|
|
368
|
+
|
|
369
|
+
The library exports a set of specific error classes used by the authorization flow.
|
|
370
|
+
|
|
371
|
+
- `MissingAuthenticatedUserDetailsError`
|
|
372
|
+
- `MissingAuthorizationActionError`
|
|
373
|
+
- `MissingAuthorizationPolicyError`
|
|
374
|
+
- `MissingAuthorizationResourceError`
|
|
375
|
+
- `MissingAuthorizationSchemaError`
|
|
376
|
+
- `UnauthorizedError`
|
|
377
|
+
|
|
378
|
+
These are exported from the `errors` module and are thrown by the `AuthorizationService` and middleware where applicable.
|
|
379
|
+
|
|
246
380
|
## User Details
|
|
247
381
|
|
|
248
382
|
The library provides utilities to extract user information from Lambda events:
|
|
@@ -267,6 +401,15 @@ The library provides specific error classes for different authorization failures
|
|
|
267
401
|
|
|
268
402
|
## Examples
|
|
269
403
|
|
|
404
|
+
### Order Service Example
|
|
405
|
+
|
|
406
|
+
The `examples/order-service` project demonstrates a complete integration of Janus in a real-world serverless service. It shows how the Janus CDK construct, middleware and SDK are used together to provide Cedar-based authorization for AWS Lambda CRUD handlers.
|
|
407
|
+
|
|
408
|
+
- **Janus Integration**: The example uses the provided `Auth` Lambda construct and the `authorizationMiddleware` to bundle and load Cedar policy and schema files. The authorization checks inside the order CRUD Lambdas use the `AuthorizationService` from the Janus SDK (via the auth secondary adapter) to evaluate requests against the deployed Cedar policies and schema.
|
|
409
|
+
- **Full CRUD API**: The example implements a full Create/Read/Update/Delete API for `orders` backed by the included lambda handlers.
|
|
410
|
+
- **Scripts**: See the `examples/order-service/scripts` directory — it contains scripts to hydrate the database, create users and groups in the Cognito user pool, and login scripts for individual users associated with specific groups.
|
|
411
|
+
- **Postman Collection**: A Postman collection (`Auth.postman_collection.json`) is included in the example. It contains requests that exercise each user and group against the Cedar policy and schema files deployed with the order CRUD Lambdas.
|
|
412
|
+
|
|
270
413
|
See the [authorization-tests](./src/authorization-service/authorization-tests/) directory for comprehensive examples including:
|
|
271
414
|
|
|
272
415
|
- Customer role permissions
|
|
@@ -282,6 +425,7 @@ See the [authorization-tests](./src/authorization-service/authorization-tests/)
|
|
|
282
425
|
- [Cedar Policy Blog](https://www.cedarpolicy.com/blog)
|
|
283
426
|
- [Cedar SDK](https://github.com/cedar-policy)
|
|
284
427
|
- [Cedar Policy Playground](https://www.cedarpolicy.com/en/playground)
|
|
428
|
+
- [Serverless: Granular Authorisation with Cedar — High control, minimal cost (blog post)](https://medium.com/@jcdubs/serverless-granular-authorisation-with-cedar-high-control-minimal-cost-1149640f8cd9)
|
|
285
429
|
|
|
286
430
|
## Development
|
|
287
431
|
|
|
@@ -96,7 +96,7 @@ class AuthLambda extends njsLambda.NodejsFunction {
|
|
|
96
96
|
return [
|
|
97
97
|
`echo "Copying node_modules/@cedar-policy/cedar-wasm directory to Lambda package..."`,
|
|
98
98
|
`mkdir -p ${outputDir}/node_modules/@cedar-policy/cedar-wasm/`,
|
|
99
|
-
`cp -r ${inputDir}/node_modules/janus/vendor/@cedar-policy/cedar-wasm ${outputDir}/node_modules/@cedar-policy/`,
|
|
99
|
+
`cp -r ${inputDir}/node_modules/@jcdubs/janus/vendor/@cedar-policy/cedar-wasm ${outputDir}/node_modules/@cedar-policy/`,
|
|
100
100
|
`echo "node_modules/@cedar-policy/cedar-wasm directory copied successfully to ${outputDir}/node_modules/@cedar-policy"`,
|
|
101
101
|
`echo "Copying policy and schema files to Lambda package..."`,
|
|
102
102
|
`cp ${props.authorisation.policyFilePath} ${outputDir}/policies.cedar`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-lambda.js","sourceRoot":"","sources":["../../src/auth-lambda/auth-lambda.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yEAA2D;AAuC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAa,UAAW,SAAQ,SAAS,CAAC,cAAc;IACvD;;;;;;;;OAQG;IACH,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAsB;QAC/D,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YAChB,GAAG,KAAK;YACR,QAAQ,EAAE;gBACT,GAAG,KAAK,CAAC,QAAQ;gBACjB,YAAY,EAAE;oBACb,cAAc,CAAC,SAAiB,EAAE,UAAkB;wBACnD,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACrE,CAAC;oBACD,aAAa,CAAC,SAAiB,EAAE,UAAkB;wBAClD,OAAO,EAAE,CAAC;oBACX,CAAC;oBACD,aAAa,CAAC,QAAgB,EAAE,SAAiB;wBAChD,OAAO;4BACN,qFAAqF;4BACrF,YAAY,SAAS,yCAAyC;4BAC9D,SAAS,QAAQ,
|
|
1
|
+
{"version":3,"file":"auth-lambda.js","sourceRoot":"","sources":["../../src/auth-lambda/auth-lambda.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yEAA2D;AAuC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAa,UAAW,SAAQ,SAAS,CAAC,cAAc;IACvD;;;;;;;;OAQG;IACH,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAsB;QAC/D,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YAChB,GAAG,KAAK;YACR,QAAQ,EAAE;gBACT,GAAG,KAAK,CAAC,QAAQ;gBACjB,YAAY,EAAE;oBACb,cAAc,CAAC,SAAiB,EAAE,UAAkB;wBACnD,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACrE,CAAC;oBACD,aAAa,CAAC,SAAiB,EAAE,UAAkB;wBAClD,OAAO,EAAE,CAAC;oBACX,CAAC;oBACD,aAAa,CAAC,QAAgB,EAAE,SAAiB;wBAChD,OAAO;4BACN,qFAAqF;4BACrF,YAAY,SAAS,yCAAyC;4BAC9D,SAAS,QAAQ,+DAA+D,SAAS,8BAA8B;4BACvH,gFAAgF,SAAS,8BAA8B;4BACvH,6DAA6D;4BAC7D,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,IAAI,SAAS,iBAAiB;4BACtE,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,IAAI,SAAS,qBAAqB;4BAC1E,wDAAwD,SAAS,GAAG;yBACpE,CAAC;oBACH,CAAC;iBACD;gBACD,eAAe,EAAE;oBAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;oBAC1C,WAAW;oBACX,0BAA0B;iBAC1B;aACD;SACD,CAAC,CAAC;IACJ,CAAC;CACD;AA3CD,gCA2CC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import
|
|
1
|
+
import type { EntityJson } from '../types';
|
|
2
2
|
import type { AuthorizationConfigType } from './types';
|
|
3
3
|
/**
|
|
4
4
|
* Service for evaluating Cedar policy-based authorization requests.
|
|
@@ -124,7 +124,7 @@ export declare class AuthorizationService {
|
|
|
124
124
|
* });
|
|
125
125
|
* ```
|
|
126
126
|
*/
|
|
127
|
-
addEntity(entity:
|
|
127
|
+
addEntity(entity: EntityJson): AuthorizationService;
|
|
128
128
|
/**
|
|
129
129
|
* Replaces all entities with a new array of entities for the Cedar authorization request.
|
|
130
130
|
*
|
|
@@ -135,7 +135,7 @@ export declare class AuthorizationService {
|
|
|
135
135
|
* @remarks
|
|
136
136
|
* This replaces any previously added entities. Use {@link addEntity} to append individual entities.
|
|
137
137
|
*/
|
|
138
|
-
setEntities(entities:
|
|
138
|
+
setEntities(entities: EntityJson[]): AuthorizationService;
|
|
139
139
|
/**
|
|
140
140
|
* Validates that all required authorization properties are set.
|
|
141
141
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service/authorization-service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"authorization-service.d.ts","sourceRoot":"","sources":["../../src/authorization-service/authorization-service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,qBAAa,oBAAoB;IAChC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAuB;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA0B;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,OAAO,CAAmD;IAClE,OAAO,CAAC,QAAQ,CAA2B;IAE3C;;;;;;;;;;;OAWG;IACH,OAAO;IAUP;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB;IAK/C;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB;IAKnD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB;IAQnD;;;;;;;;;OASG;IACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,oBAAoB;IAKzD;;;;;;;;OAQG;IACH,OAAO,CAAC,+BAA+B;IAsBvC;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK;IA0Cb;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,IAAI,OAAO;IAgBvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;WACU,UAAU,CACtB,mBAAmB,EAAE,uBAAuB,EAC5C,OAAO,UAAQ,GACb,OAAO,CAAC,oBAAoB,CAAC;CAkChC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorization-service.js","sourceRoot":"","sources":["../../src/authorization-service/authorization-service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0DAAuD;AACvD,uEAAyD;AACzD,sCAMmB;AACnB,4DAA8D;
|
|
1
|
+
{"version":3,"file":"authorization-service.js","sourceRoot":"","sources":["../../src/authorization-service/authorization-service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0DAAuD;AACvD,uEAAyD;AACzD,sCAMmB;AACnB,4DAA8D;AAE9D,kDAAwD;AACxD,mDAAqD;AAGrD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;AACpE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAa,oBAAoB;IAUhC;;;;;;;;;;;OAWG;IACH,YACC,MAAc,EACd,MAAc,EACd,mBAA4C;QAE5C,IAAI,CAAC,MAAM,GAAG,IAAA,kCAAkB,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAc;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,QAAgB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAkB;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,QAAsB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACK,+BAA+B;QACtC,mDAAmD;QACnD,IAAI,CAAC,IAAA,0BAAW,GAAE,IAAI,CAAC,IAAA,uBAAQ,GAAE,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CACX,4DAA4D,CAC5D,CAAC;YACF,MAAM,IAAI,6CAAoC,EAAE,CAAC;QAClD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACjE,MAAM,IAAI,wCAA+B,EAAE,CAAC;QAC7C,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACnE,MAAM,IAAI,0CAAiC,EAAE,CAAC;QAC/C,CAAC;IACF,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY;QACnB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC;QACpB,CAAC;IACF,CAAC;IAED;;;;;;;;;;OAUG;IACK,mBAAmB;QAC1B,MAAM,QAAQ,GAAG,IAAA,0BAAW,GAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAClE,MAAM,IAAI,6CAAoC,EAAE,CAAC;QAClD,CAAC;QACD,OAAO;YACN,GAAG,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACtF,EAAE,EAAE,QAAQ;aACZ;YACD,KAAK,EAAE,EAAE;YACT,OAAO,EACN,IAAA,uBAAQ,GAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE;gBACjF,EAAE,EAAE,IAAI;aACR,CAAC,CAAC,IAAI,EAAE;SACV,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB;QAC5B,OAAO,CACN,IAAA,uBAAQ,GAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,GAAG,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE;gBACjF,EAAE,EAAE,IAAI;aACR;YACD,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;SACX,CAAC,CAAC,IAAI,EAAE,CACT,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK;QACZ,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE3C,MAAM,QAAQ,GAAG,IAAA,0BAAW,GAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAClE,MAAM,IAAI,6CAAoC,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACjE,MAAM,IAAI,wCAA+B,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACnE,MAAM,IAAI,0CAAiC,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO;YACN,SAAS,EAAE;gBACV,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACtF,EAAE,EAAE,QAAQ;aACZ;YACD,MAAM,EAAE;gBACP,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,QAAQ;gBACnD,EAAE,EAAE,IAAI,CAAC,MAAM;aACf;YACD,QAAQ,EAAE;gBACT,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE;gBACrF,EAAE,EAAE,IAAI,CAAC,QAAQ;aACjB;YACD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;YAC3B,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE;gBACT,cAAc,EAAE,IAAI,CAAC,MAAM;aAC3B;YACD,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC;SACpD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY;QACX,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAChE,UAAU;aACV,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC,QAAQ,KAAM,OAA0B,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACtB,mBAA4C,EAC5C,OAAO,GAAG,KAAK;QAEf,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACvD,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACrC,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,MAA0B,CAAC;QAE/B,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,8BAAgB,EAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,wCAA+B,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,8BAAgB,EAAC,gBAAgB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,wCAA+B,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;YACxC,MAAM;YACN,MAAM;SACN,CAAC,CAAC;QACH,oBAAoB,CAAC,OAAO,GAAG,IAAI,oBAAoB,CACtD,MAAM,EACN,MAAM,EACN,mBAAmB,CACnB,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACrC,CAAC;CACD;AA1YD,oDA0YC"}
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
import type { AuthorizationConfigType } from '../authorization-service/types';
|
|
2
|
+
import type { EntityJson } from '../types';
|
|
3
|
+
/**
|
|
4
|
+
* Builder for creating Cedar entity JSON objects used in authorization requests.
|
|
5
|
+
*
|
|
6
|
+
* The builder accumulates `uid`, `attrs`, `parents`, and optional `tags`, and
|
|
7
|
+
* returns a fully-formed `EntityJson` via `build()`.
|
|
8
|
+
*/
|
|
9
|
+
export declare class EntityBuilder {
|
|
10
|
+
private uid;
|
|
11
|
+
private attrs;
|
|
12
|
+
private parents;
|
|
13
|
+
private tags?;
|
|
14
|
+
private authorizationConfig;
|
|
15
|
+
constructor(id: string, authorizationConfig: AuthorizationConfigType, type?: string);
|
|
16
|
+
/**
|
|
17
|
+
* Add an attribute that references another entity by UID.
|
|
18
|
+
*
|
|
19
|
+
* @param name - Attribute name to set on the entity.
|
|
20
|
+
* @param id - The id of the referenced entity.
|
|
21
|
+
* @param type - The resource type of the referenced entity.
|
|
22
|
+
* @returns The `EntityBuilder` for chaining.
|
|
23
|
+
*/
|
|
24
|
+
withAttr(name: string, id: string, type: string): EntityBuilder;
|
|
25
|
+
/**
|
|
26
|
+
* Add an extension attribute (`__extn`) with a function and argument.
|
|
27
|
+
*
|
|
28
|
+
* @param name - Attribute name.
|
|
29
|
+
* @param fn - Extension function name.
|
|
30
|
+
* @param arg - Argument for the extension function.
|
|
31
|
+
* @returns The `EntityBuilder` for chaining.
|
|
32
|
+
*/
|
|
33
|
+
withExtnAttr(name: string, fn: string, arg: string): EntityBuilder;
|
|
34
|
+
/**
|
|
35
|
+
* Add a boolean attribute.
|
|
36
|
+
*
|
|
37
|
+
* @param name - Attribute name.
|
|
38
|
+
* @param value - Boolean value to set.
|
|
39
|
+
* @returns The `EntityBuilder` for chaining.
|
|
40
|
+
*/
|
|
41
|
+
withBooleanAttr(name: string, value: boolean): EntityBuilder;
|
|
42
|
+
/**
|
|
43
|
+
* Add a numeric attribute.
|
|
44
|
+
*
|
|
45
|
+
* @param name - Attribute name.
|
|
46
|
+
* @param value - Number value to set.
|
|
47
|
+
* @returns The `EntityBuilder` for chaining.
|
|
48
|
+
*/
|
|
49
|
+
withNumberAttr(name: string, value: number): EntityBuilder;
|
|
50
|
+
/**
|
|
51
|
+
* Add a string attribute.
|
|
52
|
+
*
|
|
53
|
+
* @param name - Attribute name.
|
|
54
|
+
* @param value - String value to set.
|
|
55
|
+
* @returns The `EntityBuilder` for chaining.
|
|
56
|
+
*/
|
|
57
|
+
withStringAttr(name: string, value: string): EntityBuilder;
|
|
58
|
+
/**
|
|
59
|
+
* Add a set attribute (array wrapped in `{ set: [...] }`).
|
|
60
|
+
*
|
|
61
|
+
* @param name - Attribute name.
|
|
62
|
+
* @param value - Array of string values for the set.
|
|
63
|
+
* @returns The `EntityBuilder` for chaining.
|
|
64
|
+
*/
|
|
65
|
+
withSetAttr(name: string, value: string[]): EntityBuilder;
|
|
66
|
+
/**
|
|
67
|
+
* Add a parent relationship referencing another entity UID.
|
|
68
|
+
*
|
|
69
|
+
* @param id - Parent entity id.
|
|
70
|
+
* @param type - Parent entity resource type.
|
|
71
|
+
* @returns The `EntityBuilder` for chaining.
|
|
72
|
+
*/
|
|
73
|
+
withParent(id: string, type: string): EntityBuilder;
|
|
74
|
+
/**
|
|
75
|
+
* Add a tag to the entity. Initializes the `tags` map lazily.
|
|
76
|
+
*
|
|
77
|
+
* @param name - Tag name.
|
|
78
|
+
* @param id - Tagged entity id.
|
|
79
|
+
* @param type - Optional resource type for the tagged entity.
|
|
80
|
+
* @returns The `EntityBuilder` for chaining.
|
|
81
|
+
*/
|
|
82
|
+
withTag(name: string, id: string, type?: string): EntityBuilder;
|
|
83
|
+
/**
|
|
84
|
+
* Build and return the `EntityJson` object.
|
|
85
|
+
*
|
|
86
|
+
* @returns A complete `EntityJson` representation suitable for Cedar requests.
|
|
87
|
+
*/
|
|
88
|
+
build(): EntityJson;
|
|
89
|
+
}
|
|
90
|
+
//# sourceMappingURL=entity-builder.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"entity-builder.d.ts","sourceRoot":"","sources":["../../src/entity-builder/entity-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAkB,UAAU,EAAiB,MAAM,UAAU,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,aAAa;IACzB,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,KAAK,CAAsC;IACnD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,IAAI,CAAC,CAAiC;IAC9C,OAAO,CAAC,mBAAmB,CAA0B;gBAGpD,EAAE,EAAE,MAAM,EACV,mBAAmB,EAAE,uBAAuB,EAC5C,IAAI,GAAE,MAAyC;IAgBhD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa;IAU/D;;;;;;;OAOG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa;IAUlE;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,aAAa;IAK5D;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa;IAK1D;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa;IAK1D;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa;IAKzD;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa;IAUnD;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa;IAa/D;;;;OAIG;IACH,KAAK,IAAI,UAAU;CAWnB"}
|
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.EntityBuilder = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* Builder for creating Cedar entity JSON objects used in authorization requests.
|
|
6
|
+
*
|
|
7
|
+
* The builder accumulates `uid`, `attrs`, `parents`, and optional `tags`, and
|
|
8
|
+
* returns a fully-formed `EntityJson` via `build()`.
|
|
9
|
+
*/
|
|
10
|
+
class EntityBuilder {
|
|
11
|
+
constructor(id, authorizationConfig, type = authorizationConfig.resourceType) {
|
|
12
|
+
this.attrs = {};
|
|
13
|
+
this.parents = [];
|
|
14
|
+
/**
|
|
15
|
+
* Create a new `EntityBuilder`.
|
|
16
|
+
*
|
|
17
|
+
* @param id - The entity id portion of the UID.
|
|
18
|
+
* @param authorizationConfig - Authorization configuration providing namespace and defaults.
|
|
19
|
+
* @param type - Optional resource type (defaults to `authorizationConfig.resourceType`).
|
|
20
|
+
*/
|
|
21
|
+
this.uid = {
|
|
22
|
+
type: `${authorizationConfig.namespace}${type}`,
|
|
23
|
+
id,
|
|
24
|
+
};
|
|
25
|
+
this.authorizationConfig = authorizationConfig;
|
|
26
|
+
}
|
|
27
|
+
/**
|
|
28
|
+
* Add an attribute that references another entity by UID.
|
|
29
|
+
*
|
|
30
|
+
* @param name - Attribute name to set on the entity.
|
|
31
|
+
* @param id - The id of the referenced entity.
|
|
32
|
+
* @param type - The resource type of the referenced entity.
|
|
33
|
+
* @returns The `EntityBuilder` for chaining.
|
|
34
|
+
*/
|
|
35
|
+
withAttr(name, id, type) {
|
|
36
|
+
this.attrs[name] = {
|
|
37
|
+
__entity: {
|
|
38
|
+
type: `${this.authorizationConfig.namespace}${type}`,
|
|
39
|
+
id: id,
|
|
40
|
+
},
|
|
41
|
+
};
|
|
42
|
+
return this;
|
|
43
|
+
}
|
|
44
|
+
/**
|
|
45
|
+
* Add an extension attribute (`__extn`) with a function and argument.
|
|
46
|
+
*
|
|
47
|
+
* @param name - Attribute name.
|
|
48
|
+
* @param fn - Extension function name.
|
|
49
|
+
* @param arg - Argument for the extension function.
|
|
50
|
+
* @returns The `EntityBuilder` for chaining.
|
|
51
|
+
*/
|
|
52
|
+
withExtnAttr(name, fn, arg) {
|
|
53
|
+
this.attrs[name] = {
|
|
54
|
+
__extn: {
|
|
55
|
+
fn,
|
|
56
|
+
arg,
|
|
57
|
+
},
|
|
58
|
+
};
|
|
59
|
+
return this;
|
|
60
|
+
}
|
|
61
|
+
/**
|
|
62
|
+
* Add a boolean attribute.
|
|
63
|
+
*
|
|
64
|
+
* @param name - Attribute name.
|
|
65
|
+
* @param value - Boolean value to set.
|
|
66
|
+
* @returns The `EntityBuilder` for chaining.
|
|
67
|
+
*/
|
|
68
|
+
withBooleanAttr(name, value) {
|
|
69
|
+
this.attrs[name] = value;
|
|
70
|
+
return this;
|
|
71
|
+
}
|
|
72
|
+
/**
|
|
73
|
+
* Add a numeric attribute.
|
|
74
|
+
*
|
|
75
|
+
* @param name - Attribute name.
|
|
76
|
+
* @param value - Number value to set.
|
|
77
|
+
* @returns The `EntityBuilder` for chaining.
|
|
78
|
+
*/
|
|
79
|
+
withNumberAttr(name, value) {
|
|
80
|
+
this.attrs[name] = value;
|
|
81
|
+
return this;
|
|
82
|
+
}
|
|
83
|
+
/**
|
|
84
|
+
* Add a string attribute.
|
|
85
|
+
*
|
|
86
|
+
* @param name - Attribute name.
|
|
87
|
+
* @param value - String value to set.
|
|
88
|
+
* @returns The `EntityBuilder` for chaining.
|
|
89
|
+
*/
|
|
90
|
+
withStringAttr(name, value) {
|
|
91
|
+
this.attrs[name] = value;
|
|
92
|
+
return this;
|
|
93
|
+
}
|
|
94
|
+
/**
|
|
95
|
+
* Add a set attribute (array wrapped in `{ set: [...] }`).
|
|
96
|
+
*
|
|
97
|
+
* @param name - Attribute name.
|
|
98
|
+
* @param value - Array of string values for the set.
|
|
99
|
+
* @returns The `EntityBuilder` for chaining.
|
|
100
|
+
*/
|
|
101
|
+
withSetAttr(name, value) {
|
|
102
|
+
this.attrs[name] = { set: value };
|
|
103
|
+
return this;
|
|
104
|
+
}
|
|
105
|
+
/**
|
|
106
|
+
* Add a parent relationship referencing another entity UID.
|
|
107
|
+
*
|
|
108
|
+
* @param id - Parent entity id.
|
|
109
|
+
* @param type - Parent entity resource type.
|
|
110
|
+
* @returns The `EntityBuilder` for chaining.
|
|
111
|
+
*/
|
|
112
|
+
withParent(id, type) {
|
|
113
|
+
this.parents.push({
|
|
114
|
+
__entity: {
|
|
115
|
+
type: `${this.authorizationConfig.namespace}${type}`,
|
|
116
|
+
id,
|
|
117
|
+
},
|
|
118
|
+
});
|
|
119
|
+
return this;
|
|
120
|
+
}
|
|
121
|
+
/**
|
|
122
|
+
* Add a tag to the entity. Initializes the `tags` map lazily.
|
|
123
|
+
*
|
|
124
|
+
* @param name - Tag name.
|
|
125
|
+
* @param id - Tagged entity id.
|
|
126
|
+
* @param type - Optional resource type for the tagged entity.
|
|
127
|
+
* @returns The `EntityBuilder` for chaining.
|
|
128
|
+
*/
|
|
129
|
+
withTag(name, id, type) {
|
|
130
|
+
if (!this.tags) {
|
|
131
|
+
this.tags = {};
|
|
132
|
+
}
|
|
133
|
+
this.tags[name] = {
|
|
134
|
+
__entity: {
|
|
135
|
+
type: `${this.authorizationConfig.namespace}${type}`,
|
|
136
|
+
id,
|
|
137
|
+
},
|
|
138
|
+
};
|
|
139
|
+
return this;
|
|
140
|
+
}
|
|
141
|
+
/**
|
|
142
|
+
* Build and return the `EntityJson` object.
|
|
143
|
+
*
|
|
144
|
+
* @returns A complete `EntityJson` representation suitable for Cedar requests.
|
|
145
|
+
*/
|
|
146
|
+
build() {
|
|
147
|
+
const entity = {
|
|
148
|
+
uid: this.uid,
|
|
149
|
+
attrs: this.attrs,
|
|
150
|
+
parents: this.parents,
|
|
151
|
+
};
|
|
152
|
+
if (this.tags) {
|
|
153
|
+
entity.tags = this.tags;
|
|
154
|
+
}
|
|
155
|
+
return entity;
|
|
156
|
+
}
|
|
157
|
+
}
|
|
158
|
+
exports.EntityBuilder = EntityBuilder;
|
|
159
|
+
//# sourceMappingURL=entity-builder.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"entity-builder.js","sourceRoot":"","sources":["../../src/entity-builder/entity-builder.ts"],"names":[],"mappings":";;;AAGA;;;;;GAKG;AACH,MAAa,aAAa;IAOzB,YACC,EAAU,EACV,mBAA4C,EAC5C,OAAe,mBAAmB,CAAC,YAAY;QARxC,UAAK,GAAmC,EAAE,CAAC;QAC3C,YAAO,GAAoB,EAAE,CAAC;QASrC;;;;;;WAMG;QACH,IAAI,CAAC,GAAG,GAAG;YACV,IAAI,EAAE,GAAG,mBAAmB,CAAC,SAAS,GAAG,IAAI,EAAE;YAC/C,EAAE;SACF,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;YAClB,QAAQ,EAAE;gBACT,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,EAAE;gBACpD,EAAE,EAAE,EAAE;aACN;SACD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,IAAY,EAAE,EAAU,EAAE,GAAW;QACjD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;YAClB,MAAM,EAAE;gBACP,EAAE;gBACF,GAAG;aACH;SACD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,IAAY,EAAE,KAAc;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,IAAY,EAAE,KAAa;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,IAAY,EAAE,KAAa;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAY,EAAE,KAAe;QACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,EAAU,EAAE,IAAY;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE;gBACT,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,EAAE;gBACpD,EAAE;aACF;SACD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,IAAa;QAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjB,QAAQ,EAAE;gBACT,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,IAAI,EAAE;gBACpD,EAAE;aACF;SACD,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK;QACJ,MAAM,MAAM,GAAe;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD;AApKD,sCAoKC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/entity-builder/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
|
+
};
|
|
16
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
+
__exportStar(require("./entity-builder"), exports);
|
|
18
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/entity-builder/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
|
-
export { CedarValueJson, EntityJson, EntityUidJson, } from '@cedar-policy/cedar-wasm/nodejs';
|
|
2
1
|
export * from './auth-lambda';
|
|
3
2
|
export * from './authorization-middleware';
|
|
4
3
|
export * from './authorization-service';
|
|
4
|
+
export * from './entity-builder';
|
|
5
5
|
export * from './errors';
|
|
6
|
+
export * from './types';
|
|
6
7
|
export * from './user-details';
|
|
7
8
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -17,6 +17,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
17
17
|
__exportStar(require("./auth-lambda"), exports);
|
|
18
18
|
__exportStar(require("./authorization-middleware"), exports);
|
|
19
19
|
__exportStar(require("./authorization-service"), exports);
|
|
20
|
+
__exportStar(require("./entity-builder"), exports);
|
|
20
21
|
__exportStar(require("./errors"), exports);
|
|
22
|
+
__exportStar(require("./types"), exports);
|
|
21
23
|
__exportStar(require("./user-details"), exports);
|
|
22
24
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,6DAA2C;AAC3C,0DAAwC;AACxC,mDAAiC;AACjC,2CAAyB;AACzB,0CAAwB;AACxB,iDAA+B"}
|
package/dist/types.d.ts
ADDED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
export interface TypeAndId {
|
|
2
|
+
type: string;
|
|
3
|
+
id: string;
|
|
4
|
+
}
|
|
5
|
+
export type EntityUidJson = {
|
|
6
|
+
__entity: TypeAndId;
|
|
7
|
+
} | TypeAndId;
|
|
8
|
+
export type CedarValueJson = {
|
|
9
|
+
__entity: TypeAndId;
|
|
10
|
+
} | {
|
|
11
|
+
__extn: FnAndArg;
|
|
12
|
+
} | boolean | number | string | CedarValueJson[] | {
|
|
13
|
+
[key: string]: CedarValueJson;
|
|
14
|
+
} | null;
|
|
15
|
+
export interface FnAndArg {
|
|
16
|
+
fn: string;
|
|
17
|
+
arg: CedarValueJson;
|
|
18
|
+
}
|
|
19
|
+
export interface EntityJson {
|
|
20
|
+
uid: EntityUidJson;
|
|
21
|
+
attrs: Record<string, CedarValueJson>;
|
|
22
|
+
parents: EntityUidJson[];
|
|
23
|
+
tags?: Record<string, CedarValueJson>;
|
|
24
|
+
}
|
|
25
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACX;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAAC;AAEhE,MAAM,MAAM,cAAc,GACvB;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB,OAAO,GACP,MAAM,GACN,MAAM,GACN,cAAc,EAAE,GAChB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GACjC,IAAI,CAAC;AAER,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,cAAc,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC"}
|
package/dist/types.js
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@jcdubs/janus",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"description": "Open source Serverless authentication: A Cedar-based authorisation engine for deterministic, deny-by-default access decisions through a CDK construct and SDK libraries.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -38,11 +38,11 @@
|
|
|
38
38
|
"homepage": "https://github.com/JCDubs/Janus#readme",
|
|
39
39
|
"license": "MIT",
|
|
40
40
|
"devDependencies": {
|
|
41
|
-
"@aws-lambda-powertools/logger": "2.
|
|
41
|
+
"@aws-lambda-powertools/logger": "2.30.1",
|
|
42
42
|
"@biomejs/biome": "^2.3.10",
|
|
43
43
|
"@commitlint/cli": "20.1.0",
|
|
44
44
|
"@commitlint/config-conventional": "20.0.0",
|
|
45
|
-
"@middy/core": "
|
|
45
|
+
"@middy/core": "6.4.5",
|
|
46
46
|
"@semantic-release/changelog": "6.0.3",
|
|
47
47
|
"@semantic-release/git": "10.0.1",
|
|
48
48
|
"@swc/jest": "0.2.39",
|
|
@@ -60,11 +60,13 @@
|
|
|
60
60
|
"typescript": "^5.9.3"
|
|
61
61
|
},
|
|
62
62
|
"dependencies": {
|
|
63
|
+
"@aws-lambda-powertools/logger": "2.30.1",
|
|
63
64
|
"@cedar-policy/cedar-wasm": "4.3.3",
|
|
64
65
|
"uuid": "^13.0.0"
|
|
65
66
|
},
|
|
66
67
|
"peerDependencies": {
|
|
67
|
-
"@aws-lambda-powertools/logger": "2.
|
|
68
|
+
"@aws-lambda-powertools/logger": "2.30.1",
|
|
69
|
+
"@middy/core": "6.4.5",
|
|
68
70
|
"aws-cdk-lib": "2.219.0",
|
|
69
71
|
"constructs": "10.4.2"
|
|
70
72
|
},
|