@kindgi/authz 0.1.5 → 0.1.6

package/dist/check.d.ts

@@ -80,5 +80,18 @@ export interface AuthzCheckBinding {
      * Without it, such a key reaches only the project itself.
      */
     inProject?(principal: Principal, resource: ResourceRef, projectId: string, ctx?: AuthzCheckContext): Promise<boolean>;
+    /**
+     * Optional. Records a decision the API layer made without asking
+     * `check`: a refusal by the caller's API key itself (a `member` key's
+     * tenant admin, a key limited to a project reaching outside it), or a
+     * check the authorization model can't answer (an action it doesn't
+     * define on the type, a bug in the route). Recorded where `check`
+     * records its own decisions (the runtime: one `authz-decision` audit
+     * event, its `failing` and `reason` saying which check refused), so the
+     * audit holds every refusal, whichever check made it. Fire-and-forget:
+     * it never fails the request. Without it, those refusals aren't
+     * recorded.
+     */
+    recordDecision?(principal: Principal, action: Action, resource: ResourceRef, decision: Decision, ctx?: AuthzCheckContext): void;
 }
 //# sourceMappingURL=check.d.ts.map

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAC1F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CACH,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB;;;;OAIG;IACH,UAAU,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,WAAW,EAAE,EACjC,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAEhC;;;;;;OAMG;IACH,WAAW,CAAC,CACV,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,SAAS,CAAC,CACR,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAC1F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CACH,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB;;;;OAIG;IACH,UAAU,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,WAAW,EAAE,EACjC,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAEhC;;;;;;OAMG;IACH,WAAW,CAAC,CACV,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,SAAS,CAAC,CACR,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,CACb,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,QAAQ,EAClB,GAAG,CAAC,EAAE,iBAAiB,GACtB,IAAI,CAAC;CACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/authz",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Kindgi™ authorization shape. The public vocabulary and interfaces of Kindgi's authorization stack: Action verbs (read/write/execute/…), ObjectType enum (agent/flow/tool/…), ResourceRef, Principal (who is calling, with delegation and downscoping), the AuthzCheckBinding decision-point interface and its Decision (allow/deny + reason), FGA tuple builders and the TupleEnqueueHook outbox contract, the 403 DenyPayload shape, and reviewer roles. Types and pure functions — no runtime state. The FGA store, the check implementation and the tuple worker are supplied by the deployment.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@kindgi/types": "0.1.5"
+    "@kindgi/types": "0.1.6"
   },
   "engines": {
     "node": ">=22.12.0"

package/src/check.ts

@@ -121,4 +121,24 @@ export interface AuthzCheckBinding {
     projectId: string,
     ctx?: AuthzCheckContext,
   ): Promise<boolean>;
+
+  /**
+   * Optional. Records a decision the API layer made without asking
+   * `check`: a refusal by the caller's API key itself (a `member` key's
+   * tenant admin, a key limited to a project reaching outside it), or a
+   * check the authorization model can't answer (an action it doesn't
+   * define on the type, a bug in the route). Recorded where `check`
+   * records its own decisions (the runtime: one `authz-decision` audit
+   * event, its `failing` and `reason` saying which check refused), so the
+   * audit holds every refusal, whichever check made it. Fire-and-forget:
+   * it never fails the request. Without it, those refusals aren't
+   * recorded.
+   */
+  recordDecision?(
+    principal: Principal,
+    action: Action,
+    resource: ResourceRef,
+    decision: Decision,
+    ctx?: AuthzCheckContext,
+  ): void;
 }