@lenso/authorization 0.0.0-stage → 0.2.1

package/dist/drizzle/pg.js

@@ -0,0 +1,32 @@
+import {
+  authorizationRoleGraphs2
+} from "../index-4znahyqj.js";
+import {
+  createStore
+} from "../index-t6xdqvqs.js";
+
+// src/drizzle/pg.ts
+import { and, eq, sql } from "drizzle-orm";
+function postgresRoleStore(db, namespace, actions) {
+  return createStore(namespace, actions, async (_evaluation) => {
+    const [row] = await db.select().from(authorizationRoleGraphs2).where(eq(authorizationRoleGraphs2.namespace, namespace)).limit(1);
+    return row;
+  }, async (snapshot) => {
+    await db.insert(authorizationRoleGraphs2).values({
+      namespace,
+      revision: snapshot.revision,
+      graph: sql`${JSON.stringify(snapshot.graph)}::text::jsonb`
+    }).onConflictDoNothing();
+  }, async (expectedRevision, snapshot) => {
+    const rows = await db.update(authorizationRoleGraphs2).set({
+      revision: snapshot.revision,
+      graph: sql`${JSON.stringify(snapshot.graph)}::text::jsonb`
+    }).where(and(eq(authorizationRoleGraphs2.namespace, namespace), eq(authorizationRoleGraphs2.revision, expectedRevision))).returning({
+      namespace: authorizationRoleGraphs2.namespace
+    });
+    return rows.length === 1;
+  });
+}
+export {
+  postgresRoleStore
+};

package/dist/drizzle/schema-pg.d.ts

@@ -0,0 +1,61 @@
+import type { RoleGraph } from "../types";
+export declare const authorizationRoleGraphs: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "authorization_role_graphs";
+    schema: undefined;
+    columns: {
+        namespace: import("drizzle-orm/pg-core").PgColumn<{
+            name: "namespace";
+            tableName: "authorization_role_graphs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revision";
+            tableName: "authorization_role_graphs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        graph: import("drizzle-orm/pg-core").PgColumn<{
+            name: "graph";
+            tableName: "authorization_role_graphs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: RoleGraph<string>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: RoleGraph<string>;
+        }>;
+    };
+    dialect: 'pg';
+}>;

package/dist/drizzle/schema-pg.js

@@ -0,0 +1,6 @@
+import {
+  authorizationRoleGraphs2
+} from "../index-4znahyqj.js";
+export {
+  authorizationRoleGraphs2 as authorizationRoleGraphs
+};

package/dist/drizzle/schema-sqlite.d.ts

@@ -0,0 +1,65 @@
+import type { RoleGraph } from "../types";
+export declare const authorizationRoleGraphs: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "authorization_role_graphs";
+    schema: undefined;
+    columns: {
+        namespace: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "namespace";
+            tableName: "authorization_role_graphs";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        revision: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "revision";
+            tableName: "authorization_role_graphs";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        graph: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "graph";
+            tableName: "authorization_role_graphs";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: RoleGraph<string>;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: RoleGraph<string>;
+        }>;
+    };
+    dialect: 'sqlite';
+}>;

package/dist/drizzle/schema-sqlite.js

@@ -0,0 +1,6 @@
+import {
+  authorizationRoleGraphs3
+} from "../index-qjqy8v4k.js";
+export {
+  authorizationRoleGraphs3 as authorizationRoleGraphs
+};

package/dist/drizzle/shared.d.ts

@@ -0,0 +1,8 @@
+import type { Evaluation, RoleSnapshot, RoleStore } from "../types";
+export declare function decodeSnapshot<A extends string>(revision: unknown, graph: unknown, actions: readonly A[]): RoleSnapshot<A>;
+export declare function createStore<A extends string>(namespace: string, actions: readonly A[], readRow: (evaluation: Evaluation) => Promise<{
+    revision: unknown;
+    graph: unknown;
+} | undefined>, insert: (snapshot: RoleSnapshot<A>) => Promise<void>, update: (expectedRevision: string, snapshot: RoleSnapshot<A>) => Promise<boolean>): RoleStore<A> & {
+    initialize(snapshot: RoleSnapshot<A>): Promise<void>;
+};

package/dist/drizzle/sqlite.d.ts

@@ -0,0 +1,11 @@
+import type { BunSQLiteDatabase } from "drizzle-orm/bun-sqlite";
+import type { DrizzleD1Database } from "drizzle-orm/d1";
+import type { RoleSnapshot, RoleStore } from "../types";
+type SqliteDb<TSchema extends Record<string, unknown>> = BunSQLiteDatabase<TSchema> | DrizzleD1Database<TSchema>;
+export declare function sqliteStore<A extends string, TSchema extends Record<string, unknown>>(db: SqliteDb<TSchema>, namespace: string, actions: readonly A[]): RoleStore<A> & {
+    initialize(snapshot: RoleSnapshot<A>): Promise<void>;
+};
+export declare function sqliteRoleStore<A extends string = string, TSchema extends Record<string, unknown> = Record<string, unknown>>(db: BunSQLiteDatabase<TSchema>, namespace: string, actions: readonly A[]): RoleStore<A> & {
+    initialize(snapshot: RoleSnapshot<A>): Promise<void>;
+};
+export {};

package/dist/drizzle/sqlite.js

@@ -0,0 +1,9 @@
+import {
+  sqliteStore2,
+  sqliteRoleStore2
+} from "../index-pmwmdjss.js";
+import"../index-qjqy8v4k.js";
+export {
+  sqliteRoleStore2 as sqliteRoleStore,
+  sqliteStore2 as sqliteStore
+};

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class AuthorizationError extends Error {
+    constructor();
+}
+export declare class AuthorizationConfigurationError extends Error {
+    constructor();
+}

package/dist/index-4znahyqj.js

@@ -0,0 +1,9 @@
+// src/drizzle/schema-pg.ts
+import { jsonb, pgTable, text } from "drizzle-orm/pg-core";
+var authorizationRoleGraphs2 = pgTable("authorization_role_graphs", {
+  namespace: text("namespace").primaryKey(),
+  revision: text("revision").notNull(),
+  graph: jsonb("graph").$type().notNull()
+});
+
+export { authorizationRoleGraphs2 };

package/dist/index-5k98eatm.js

@@ -0,0 +1,224 @@
+// src/conditions.ts
+function all2(...conditions) {
+  return { kind: "all", conditions };
+}
+function any2(...conditions) {
+  return { kind: "any", conditions };
+}
+function predicate2(test) {
+  return { kind: "predicate", test };
+}
+function attribute2(source, key, operator, value) {
+  return { kind: "attribute", source, key, operator, value };
+}
+function relation2(name, target) {
+  return { kind: "relation", relation: name, ...target ? { target } : {} };
+}
+function sameScope2(left, right) {
+  return left.type === right.type && left.id === right.id;
+}
+function matchesPermission2(permission, request) {
+  return permission.action === request.action && permission.resourceType === request.resource.type && sameScope2(permission.scope, request.resource.scope) && (permission.resourceId === undefined || permission.resourceId === request.resource.id);
+}
+
+// src/snapshot.ts
+function snapshot(value, limits = { maxNodes: 1e4, maxDepth: 64 }) {
+  let nodes = 0;
+  const visiting = new Set;
+  function copy(item, depth) {
+    if (++nodes > limits.maxNodes || depth > limits.maxDepth)
+      throw new Error("Invalid facts");
+    if (item === null || item === undefined || typeof item === "string" || typeof item === "boolean")
+      return item;
+    if (typeof item === "number" && Number.isFinite(item))
+      return item;
+    if (typeof item !== "object" || visiting.has(item))
+      throw new Error("Invalid facts");
+    if (!Array.isArray(item) && ![Object.prototype, null].includes(Object.getPrototypeOf(item)))
+      throw new Error("Invalid facts");
+    visiting.add(item);
+    const result = Array.isArray(item) ? [] : {};
+    for (const key of Reflect.ownKeys(item)) {
+      if (Array.isArray(item) && key === "length")
+        continue;
+      const property = Object.getOwnPropertyDescriptor(item, key);
+      if (typeof key !== "string" || !property.enumerable || !("value" in property))
+        throw new Error("Invalid facts");
+      Object.defineProperty(result, key, {
+        value: copy(property.value, depth + 1),
+        enumerable: true
+      });
+    }
+    visiting.delete(item);
+    return Object.freeze(result);
+  }
+  return copy(value, 0);
+}
+
+// src/rbac.ts
+class RoleGraphError2 extends Error {
+  constructor() {
+    super("Invalid role graph");
+    this.name = "RoleGraphError";
+  }
+}
+var MAX_ROLES = 512;
+var MAX_BINDINGS = 4096;
+var MAX_ITEMS = 512;
+var text = (value) => typeof value === "string" && value.length > 0 && value.length <= 256;
+var scopeValid = (scope) => !!scope && text(scope.type) && text(scope.id);
+var samePrincipal = (a, b) => a.realmId === b.realmId && a.subjectId === b.subjectId && a.kind === b.kind;
+var principalValid = (p) => !!p && text(p.realmId) && text(p.subjectId) && text(p.kind);
+var key = (scope, id) => JSON.stringify([scope.type, scope.id, id]);
+var permissionKey = (p) => JSON.stringify([p.action, p.resourceType, p.scope.type, p.scope.id, p.resourceId ?? null]);
+function permissionCovers(ceiling, permission) {
+  return ceiling.action === permission.action && ceiling.resourceType === permission.resourceType && sameScope2(ceiling.scope, permission.scope) && (ceiling.resourceId === undefined || ceiling.resourceId === permission.resourceId);
+}
+function validateRoleGraph2(graph, actions) {
+  const fail = () => {
+    throw new RoleGraphError2;
+  };
+  if (!Array.isArray(actions) || actions.length === 0 || actions.length > MAX_ITEMS || actions.some((a) => !text(a)) || new Set(actions).size !== actions.length)
+    fail();
+  if (!graph || !Array.isArray(graph.roles) || !Array.isArray(graph.bindings) || graph.roles.length > MAX_ROLES || graph.bindings.length > MAX_BINDINGS)
+    fail();
+  const known = new Set(actions);
+  const roles = new Map;
+  for (const role of graph.roles) {
+    if (!role || !text(role.id) || !scopeValid(role.scope) || !Array.isArray(role.permissions) || role.permissions.length > MAX_ITEMS || role.inherits !== undefined && (!Array.isArray(role.inherits) || role.inherits.length > MAX_ROLES))
+      fail();
+    const k = key(role.scope, role.id);
+    if (roles.has(k))
+      fail();
+    roles.set(k, role);
+    const permissions = new Set;
+    for (const p of role.permissions) {
+      if (!p || !known.has(p.action) || !text(p.resourceType) || !scopeValid(p.scope) || !sameScope2(role.scope, p.scope) || p.resourceId !== undefined && !text(p.resourceId))
+        fail();
+      const pk = permissionKey(p);
+      if (permissions.has(pk))
+        fail();
+      permissions.add(pk);
+    }
+    if (new Set(role.inherits ?? []).size !== (role.inherits ?? []).length)
+      fail();
+  }
+  const visited = new Set;
+  const visiting = new Set;
+  const visit = (k) => {
+    if (visiting.has(k))
+      fail();
+    if (visited.has(k))
+      return;
+    const role = roles.get(k);
+    if (!role)
+      fail();
+    visiting.add(k);
+    for (const id of role.inherits ?? []) {
+      if (!text(id))
+        fail();
+      visit(key(role.scope, id));
+    }
+    visiting.delete(k);
+    visited.add(k);
+  };
+  for (const k of roles.keys())
+    visit(k);
+  const bindings = new Set;
+  for (const b of graph.bindings) {
+    if (!b || !text(b.id) || bindings.has(b.id) || !principalValid(b.principal) || !scopeValid(b.scope) || !text(b.roleId) || !roles.has(key(b.scope, b.roleId)) || b.expiresAt !== undefined && (!Number.isSafeInteger(b.expiresAt) || b.expiresAt < 0))
+      fail();
+    bindings.add(b.id);
+  }
+}
+function effectiveRolePermissions2(graph, roleId, scope) {
+  const pending = [roleId];
+  const visited = new Set;
+  const permissions = new Map;
+  while (pending.length) {
+    const id = pending.pop();
+    if (visited.has(id))
+      continue;
+    if (visited.size >= MAX_ROLES)
+      throw new RoleGraphError2;
+    visited.add(id);
+    const role = graph.roles.find((r) => r.id === id && sameScope2(r.scope, scope));
+    if (!role || role.permissions.length > MAX_ITEMS || (role.inherits?.length ?? 0) > MAX_ROLES) {
+      throw new RoleGraphError2;
+    }
+    for (const p of role.permissions)
+      permissions.set(permissionKey(p), p);
+    pending.push(...role.inherits ?? []);
+  }
+  return [...permissions.values()];
+}
+function effectivePermissions2(graph, principal, scope, now) {
+  if (!Number.isFinite(now))
+    return [];
+  const permissions = new Map;
+  for (const b of graph.bindings) {
+    if (samePrincipal(b.principal, principal) && sameScope2(b.scope, scope) && (b.expiresAt === undefined || b.expiresAt > now)) {
+      for (const p of effectiveRolePermissions2(graph, b.roleId, scope)) {
+        permissions.set(permissionKey(p), p);
+      }
+    }
+  }
+  return [...permissions.values()];
+}
+function immutableRoleSnapshot(value, actions) {
+  try {
+    const copy = snapshot(value, { maxNodes: 4000000, maxDepth: 32 });
+    if (!text(copy.revision))
+      throw new RoleGraphError2;
+    validateRoleGraph2(copy.graph, actions);
+    return copy;
+  } catch {
+    throw new RoleGraphError2;
+  }
+}
+function memoryRoleStore2(graph, actions) {
+  const known = [...actions];
+  let current = immutableRoleSnapshot({ revision: crypto.randomUUID(), graph }, known);
+  return {
+    read: () => current,
+    compareAndSwap(expected, next, evaluation) {
+      if (evaluation.signal.aborted || expected !== current.revision)
+        return false;
+      const candidate = immutableRoleSnapshot(next, known);
+      if (candidate.revision === current.revision)
+        throw new RoleGraphError2;
+      current = candidate;
+      return true;
+    }
+  };
+}
+function rbacPredicate2(options) {
+  const actions = [...options.actions];
+  validateRoleGraph2({ roles: [], bindings: [] }, actions);
+  const store = options.store ?? memoryRoleStore2(options.graph, actions);
+  return async (request, evaluation) => {
+    if (!request.principal || !actions.includes(request.action) || evaluation.signal.aborted || !Number.isFinite(evaluation.now))
+      return false;
+    try {
+      const current = immutableRoleSnapshot(await store.read(evaluation), actions);
+      if (evaluation.signal.aborted)
+        return false;
+      return effectivePermissions2(current.graph, request.principal, request.resource.scope, evaluation.now).some((p) => permissionCovers(p, {
+        action: request.action,
+        resourceType: request.resource.type,
+        resourceId: request.resource.id,
+        scope: request.resource.scope
+      }));
+    } catch {
+      throw new RoleGraphError2;
+    }
+  };
+}
+function rbacPolicy2(options) {
+  const test = rbacPredicate2(options);
+  return {
+    evaluate: async (request, evaluation) => await test(request, evaluation) ? "allow" : "abstain"
+  };
+}
+
+export { all2, any2, predicate2, attribute2, relation2, sameScope2, matchesPermission2, snapshot, RoleGraphError2, samePrincipal, permissionCovers, validateRoleGraph2, effectiveRolePermissions2, effectivePermissions2, immutableRoleSnapshot, memoryRoleStore2, rbacPredicate2, rbacPolicy2 };

package/dist/index-6f5nrdh9.js

@@ -0,0 +1,16 @@
+// src/errors.ts
+class AuthorizationError2 extends Error {
+  constructor() {
+    super("Access denied.");
+    this.name = "AuthorizationError";
+  }
+}
+
+class AuthorizationConfigurationError2 extends Error {
+  constructor() {
+    super("Invalid authorization configuration.");
+    this.name = "AuthorizationConfigurationError";
+  }
+}
+
+export { AuthorizationError2, AuthorizationConfigurationError2 };

package/dist/index-pmwmdjss.js

@@ -0,0 +1,32 @@
+import {
+  authorizationRoleGraphs3
+} from "./index-qjqy8v4k.js";
+import {
+  createStore
+} from "./index-t6xdqvqs.js";
+
+// src/drizzle/sqlite.ts
+import { and, eq } from "drizzle-orm";
+function sqliteStore2(db, namespace, actions) {
+  return createStore(namespace, actions, async (_evaluation) => {
+    const [row] = await db.select().from(authorizationRoleGraphs3).where(eq(authorizationRoleGraphs3.namespace, namespace)).limit(1).all();
+    return row;
+  }, async (snapshot) => {
+    await db.insert(authorizationRoleGraphs3).values({
+      namespace,
+      revision: snapshot.revision,
+      graph: snapshot.graph
+    }).onConflictDoNothing().run();
+  }, async (expectedRevision, snapshot) => {
+    const rows = await db.update(authorizationRoleGraphs3).set({
+      revision: snapshot.revision,
+      graph: snapshot.graph
+    }).where(and(eq(authorizationRoleGraphs3.namespace, namespace), eq(authorizationRoleGraphs3.revision, expectedRevision))).returning().all();
+    return rows.length === 1;
+  });
+}
+function sqliteRoleStore2(db, namespace, actions) {
+  return sqliteStore2(db, namespace, actions);
+}
+
+export { sqliteStore2, sqliteRoleStore2 };

package/dist/index-qjqy8v4k.js

@@ -0,0 +1,9 @@
+// src/drizzle/schema-sqlite.ts
+import { sqliteTable, text } from "drizzle-orm/sqlite-core";
+var authorizationRoleGraphs3 = sqliteTable("authorization_role_graphs", {
+  namespace: text("namespace").primaryKey(),
+  revision: text("revision").notNull(),
+  graph: text("graph", { mode: "json" }).$type().notNull()
+});
+
+export { authorizationRoleGraphs3 };

package/dist/index-t6xdqvqs.js

@@ -0,0 +1,56 @@
+import {
+  RoleGraphError2,
+  immutableRoleSnapshot
+} from "./index-5k98eatm.js";
+
+// src/drizzle/shared.ts
+function decodeSnapshot(revision, graph, actions) {
+  try {
+    const value = typeof graph === "string" ? JSON.parse(graph) : graph;
+    return immutableRoleSnapshot({ revision, graph: value }, actions);
+  } catch {
+    throw new RoleGraphError2;
+  }
+}
+function createStore(namespace, actions, readRow, insert, update) {
+  if (typeof namespace !== "string" || !namespace.length || namespace.length > 256)
+    throw new RoleGraphError2;
+  const known = Object.freeze([...actions]);
+  immutableRoleSnapshot({ revision: "validation", graph: { roles: [], bindings: [] } }, known);
+  return {
+    async read(evaluation) {
+      try {
+        evaluation.signal.throwIfAborted();
+        const row = await readRow(evaluation);
+        evaluation.signal.throwIfAborted();
+        if (!row)
+          throw new RoleGraphError2;
+        return decodeSnapshot(row.revision, row.graph, known);
+      } catch {
+        throw new RoleGraphError2;
+      }
+    },
+    async compareAndSwap(expectedRevision, next, evaluation) {
+      try {
+        evaluation.signal.throwIfAborted();
+        if (typeof expectedRevision !== "string" || !expectedRevision.length || expectedRevision.length > 256 || next.revision === expectedRevision)
+          throw new RoleGraphError2;
+        const candidate = immutableRoleSnapshot(next, known);
+        const changed = await update(expectedRevision, candidate);
+        evaluation.signal.throwIfAborted();
+        return changed;
+      } catch {
+        throw new RoleGraphError2;
+      }
+    },
+    async initialize(value) {
+      try {
+        await insert(immutableRoleSnapshot(value, known));
+      } catch {
+        throw new RoleGraphError2;
+      }
+    }
+  };
+}
+
+export { createStore };

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type * from "./types";
+export { createAuthorization } from "./core";
+export { AuthorizationError, AuthorizationConfigurationError } from "./errors";
+export { all, any, predicate, attribute, relation, sameScope, matchesPermission, } from "./conditions";
+export { authorizeList } from "./list";
+export { rbacPolicy, rbacPredicate, validateRoleGraph, effectiveRolePermissions, effectivePermissions, memoryRoleStore, RoleGraphError, } from "./rbac";
+export type { RbacOptions } from "./rbac";
+export { createRoleManagement, RoleManagementError } from "./management";
+export type { ManagementAction, ManagementRequest, GrantAuthority, RoleManagementOptions, RoleMutationResult, } from "./management";