@lenso/authorization 0.2.0 → 0.3.1

package/README.md

@@ -9,6 +9,7 @@ Lenso runtime dependency. RBAC is one module, not the engine's only model.
 | `@lenso/authorization`                                    | Decisions, conditions, scoped RBAC, bounded lists, role management |
 | `@lenso/authorization/auth`                               | Adapter to one exact existing Auth `Access.enforce` chain          |
 | `@lenso/authorization/plugin`                             | Thin Lenso setup wrapper                                           |
+| `@lenso/authorization/manage`                             | Authorized exact-scope role/binding inspection                     |
 | `@lenso/authorization/drizzle/pg`                         | Borrowed native Drizzle PostgreSQL role store                      |
 | `@lenso/authorization/drizzle/d1`                         | Borrowed native Drizzle D1 role store                              |
 | `@lenso/authorization/drizzle/sqlite`                     | Borrowed Bun SQLite role store                                     |

package/dist/drizzle/d1.js

@@ -1,7 +1,7 @@
-import"../index-qjqy8v4k.js";
+import"../index-td6tfw1g.js";
 import {
   sqliteStore2
-} from "../index-pmwmdjss.js";
+} from "../index-4z7d1j8a.js";
 
 // src/drizzle/d1.ts
 function d1RoleStore(db, namespace, actions) {

package/dist/drizzle/pg.js

@@ -1,6 +1,6 @@
 import {
-  authorizationRoleGraphs2
-} from "../index-4znahyqj.js";
+  authorizationRoleGraphs3
+} from "../index-c6f5nt4t.js";
 import {
   createStore
 } from "../index-t6xdqvqs.js";
@@ -9,20 +9,20 @@ import {
 import { and, eq, sql } from "drizzle-orm";
 function postgresRoleStore(db, namespace, actions) {
   return createStore(namespace, actions, async (_evaluation) => {
-    const [row] = await db.select().from(authorizationRoleGraphs2).where(eq(authorizationRoleGraphs2.namespace, namespace)).limit(1);
+    const [row] = await db.select().from(authorizationRoleGraphs3).where(eq(authorizationRoleGraphs3.namespace, namespace)).limit(1);
     return row;
   }, async (snapshot) => {
-    await db.insert(authorizationRoleGraphs2).values({
+    await db.insert(authorizationRoleGraphs3).values({
       namespace,
       revision: snapshot.revision,
       graph: sql`${JSON.stringify(snapshot.graph)}::text::jsonb`
     }).onConflictDoNothing();
   }, async (expectedRevision, snapshot) => {
-    const rows = await db.update(authorizationRoleGraphs2).set({
+    const rows = await db.update(authorizationRoleGraphs3).set({
       revision: snapshot.revision,
       graph: sql`${JSON.stringify(snapshot.graph)}::text::jsonb`
-    }).where(and(eq(authorizationRoleGraphs2.namespace, namespace), eq(authorizationRoleGraphs2.revision, expectedRevision))).returning({
-      namespace: authorizationRoleGraphs2.namespace
+    }).where(and(eq(authorizationRoleGraphs3.namespace, namespace), eq(authorizationRoleGraphs3.revision, expectedRevision))).returning({
+      namespace: authorizationRoleGraphs3.namespace
     });
     return rows.length === 1;
   });

package/dist/drizzle/schema-pg.js

@@ -1,6 +1,6 @@
 import {
-  authorizationRoleGraphs2
-} from "../index-4znahyqj.js";
+  authorizationRoleGraphs3
+} from "../index-c6f5nt4t.js";
 export {
-  authorizationRoleGraphs2 as authorizationRoleGraphs
+  authorizationRoleGraphs3 as authorizationRoleGraphs
 };

package/dist/drizzle/schema-sqlite.js

@@ -1,6 +1,6 @@
 import {
-  authorizationRoleGraphs3
-} from "../index-qjqy8v4k.js";
+  authorizationRoleGraphs2
+} from "../index-td6tfw1g.js";
 export {
-  authorizationRoleGraphs3 as authorizationRoleGraphs
+  authorizationRoleGraphs2 as authorizationRoleGraphs
 };

package/dist/drizzle/sqlite.js

@@ -1,8 +1,8 @@
 import {
   sqliteStore2,
   sqliteRoleStore2
-} from "../index-pmwmdjss.js";
-import"../index-qjqy8v4k.js";
+} from "../index-4z7d1j8a.js";
+import"../index-td6tfw1g.js";
 export {
   sqliteRoleStore2 as sqliteRoleStore,
   sqliteStore2 as sqliteStore

package/dist/{index-pmwmdjss.js → index-4z7d1j8a.js}

@@ -1,6 +1,6 @@
 import {
-  authorizationRoleGraphs3
-} from "./index-qjqy8v4k.js";
+  authorizationRoleGraphs2
+} from "./index-td6tfw1g.js";
 import {
   createStore
 } from "./index-t6xdqvqs.js";
@@ -9,19 +9,19 @@ import {
 import { and, eq } from "drizzle-orm";
 function sqliteStore2(db, namespace, actions) {
   return createStore(namespace, actions, async (_evaluation) => {
-    const [row] = await db.select().from(authorizationRoleGraphs3).where(eq(authorizationRoleGraphs3.namespace, namespace)).limit(1).all();
+    const [row] = await db.select().from(authorizationRoleGraphs2).where(eq(authorizationRoleGraphs2.namespace, namespace)).limit(1).all();
     return row;
   }, async (snapshot) => {
-    await db.insert(authorizationRoleGraphs3).values({
+    await db.insert(authorizationRoleGraphs2).values({
       namespace,
       revision: snapshot.revision,
       graph: snapshot.graph
     }).onConflictDoNothing().run();
   }, async (expectedRevision, snapshot) => {
-    const rows = await db.update(authorizationRoleGraphs3).set({
+    const rows = await db.update(authorizationRoleGraphs2).set({
       revision: snapshot.revision,
       graph: snapshot.graph
-    }).where(and(eq(authorizationRoleGraphs3.namespace, namespace), eq(authorizationRoleGraphs3.revision, expectedRevision))).returning().all();
+    }).where(and(eq(authorizationRoleGraphs2.namespace, namespace), eq(authorizationRoleGraphs2.revision, expectedRevision))).returning().all();
     return rows.length === 1;
   });
 }

package/dist/{index-4znahyqj.js → index-c6f5nt4t.js}

@@ -1,9 +1,9 @@
 // src/drizzle/schema-pg.ts
 import { jsonb, pgTable, text } from "drizzle-orm/pg-core";
-var authorizationRoleGraphs2 = pgTable("authorization_role_graphs", {
+var authorizationRoleGraphs3 = pgTable("authorization_role_graphs", {
   namespace: text("namespace").primaryKey(),
   revision: text("revision").notNull(),
   graph: jsonb("graph").$type().notNull()
 });
 
-export { authorizationRoleGraphs2 };
+export { authorizationRoleGraphs3 };

package/dist/{index-qjqy8v4k.js → index-td6tfw1g.js}

@@ -1,9 +1,9 @@
 // src/drizzle/schema-sqlite.ts
 import { sqliteTable, text } from "drizzle-orm/sqlite-core";
-var authorizationRoleGraphs3 = sqliteTable("authorization_role_graphs", {
+var authorizationRoleGraphs2 = sqliteTable("authorization_role_graphs", {
   namespace: text("namespace").primaryKey(),
   revision: text("revision").notNull(),
   graph: text("graph", { mode: "json" }).$type().notNull()
 });
 
-export { authorizationRoleGraphs3 };
+export { authorizationRoleGraphs2 };

package/dist/manage.d.ts

@@ -0,0 +1,73 @@
+import { type Plugin } from "@lenso/core/plugin";
+import { z } from "zod";
+import type { Awaitable, Binding, Evaluation, RoleSnapshot, RoleStore, Scope } from "./types";
+export interface AuthorizationInspection<C, A extends string = string> {
+    inspect(scope: Scope, caller: C, evaluation: Evaluation): Promise<RoleSnapshot<A>>;
+}
+/** The repository stays private; authorization is repeated after the asynchronous read. */
+export declare function createAuthorizationInspection<C, A extends string>(options: {
+    readonly store: RoleStore<A>;
+    readonly actions: readonly A[];
+    readonly authorize: (caller: C, scope: Scope, evaluation: Evaluation) => Awaitable<boolean>;
+    readonly authorizeBinding: (caller: C, binding: Binding, evaluation: Evaluation) => Awaitable<boolean>;
+}): AuthorizationInspection<C, A>;
+/** Explicit metadata-only exposure; role mutation requires a separate audited revision contract. */
+export declare function createAuthorizationManage<C, A extends string>(inspection: Plugin<AuthorizationInspection<C, A>>, id: string): {
+    plugin: Plugin<{
+        inspect: (input: {
+            scope: Scope;
+        }, invocation: {
+            caller: C;
+            evaluation: Evaluation;
+        }) => Promise<RoleSnapshot<A>>;
+    }>;
+    operations: (import("@lenso/engine/operations").Operation<{
+        caller: C;
+        evaluation: Evaluation;
+    }> & {
+        readonly plugin: Plugin<{
+            inspect: (input: {
+                scope: Scope;
+            }, invocation: {
+                caller: C;
+                evaluation: Evaluation;
+            }) => Promise<RoleSnapshot<A>>;
+        }>;
+        readonly method: "inspect";
+        readonly input: z.ZodObject<{
+            scope: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        readonly context: true;
+    })[];
+    manage: import("@lenso/manage").Manage<Plugin<{
+        inspect: (input: {
+            scope: Scope;
+        }, invocation: {
+            caller: C;
+            evaluation: Evaluation;
+        }) => Promise<RoleSnapshot<A>>;
+    }>, (import("@lenso/engine/operations").Operation<{
+        caller: C;
+        evaluation: Evaluation;
+    }> & {
+        readonly plugin: Plugin<{
+            inspect: (input: {
+                scope: Scope;
+            }, invocation: {
+                caller: C;
+                evaluation: Evaluation;
+            }) => Promise<RoleSnapshot<A>>;
+        }>;
+        readonly method: "inspect";
+        readonly input: z.ZodObject<{
+            scope: z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        readonly context: true;
+    })[]>;
+};

package/dist/manage.js

@@ -0,0 +1,79 @@
+import {
+  AuthorizationError2
+} from "./index-6f5nrdh9.js";
+import {
+  sameScope2,
+  immutableRoleSnapshot
+} from "./index-5k98eatm.js";
+
+// src/manage.ts
+import { definePlugin } from "@lenso/core/plugin";
+import { defineOperation } from "@lenso/engine/operations";
+import { defineManage } from "@lenso/manage";
+import { z } from "zod";
+function createAuthorizationInspection(options) {
+  return Object.freeze({
+    async inspect(scope, caller, evaluation) {
+      const boundScope = Object.freeze({ type: scope.type, id: scope.id });
+      const boundEvaluation = Object.freeze({ now: evaluation.now, signal: evaluation.signal });
+      boundEvaluation.signal.throwIfAborted();
+      if (!Number.isSafeInteger(boundEvaluation.now) || !boundScope.type || !boundScope.id || await options.authorize(caller, boundScope, boundEvaluation) !== true) {
+        throw new AuthorizationError2;
+      }
+      const current = immutableRoleSnapshot(await options.store.read(boundEvaluation), options.actions);
+      boundEvaluation.signal.throwIfAborted();
+      const bindings = [];
+      for (const binding of current.graph.bindings) {
+        if (!sameScope2(binding.scope, boundScope))
+          continue;
+        boundEvaluation.signal.throwIfAborted();
+        if (await options.authorizeBinding(caller, binding, boundEvaluation) === true) {
+          bindings.push(binding);
+        }
+      }
+      if (await options.authorize(caller, boundScope, boundEvaluation) !== true) {
+        throw new AuthorizationError2;
+      }
+      boundEvaluation.signal.throwIfAborted();
+      return Object.freeze({
+        revision: current.revision,
+        graph: Object.freeze({
+          roles: Object.freeze(current.graph.roles.filter((role) => sameScope2(role.scope, boundScope))),
+          bindings: Object.freeze(bindings)
+        })
+      });
+    }
+  });
+}
+function createAuthorizationManage(inspection, id) {
+  const plugin = definePlugin({
+    id,
+    requires: [inspection],
+    setup(context) {
+      const service = context.get(inspection);
+      return {
+        inspect: (input, invocation) => service.inspect(input.scope, invocation.caller, invocation.evaluation)
+      };
+    }
+  });
+  const identifier = z.string().min(1).max(256).refine((value) => !!value.trim());
+  const operation = defineOperation({
+    plugin,
+    method: "inspect",
+    context: true,
+    input: z.object({
+      scope: z.object({ type: identifier, id: identifier }).strict()
+    }).strict(),
+    effect: "read",
+    retry: "safe",
+    cancellation: "cooperative",
+    mapError: (error) => error instanceof AuthorizationError2 ? { code: "denied", phase: "invoke", message: "Authorization operation denied" } : undefined,
+    description: "Inspect authorized roles and bindings in one exact scope."
+  });
+  const operations = [operation];
+  return { plugin, operations, manage: defineManage({ plugin, operations }) };
+}
+export {
+  createAuthorizationInspection,
+  createAuthorizationManage
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenso/authorization",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -28,6 +28,10 @@
       "types": "./dist/plugin.d.ts",
       "default": "./dist/plugin.js"
     },
+    "./manage": {
+      "types": "./dist/manage.d.ts",
+      "default": "./dist/manage.js"
+    },
     "./drizzle/pg": {
       "types": "./dist/drizzle/pg.d.ts",
       "default": "./dist/drizzle/pg.js"
@@ -51,24 +55,39 @@
     "./migrations/*": "./migrations/*"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && bun build src/index.ts src/auth.ts src/plugin.ts src/drizzle/pg.ts src/drizzle/d1.ts src/drizzle/sqlite.ts src/drizzle/schema-pg.ts src/drizzle/schema-sqlite.ts --root src --outdir dist --target browser --packages external --splitting",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && bun build src/index.ts src/auth.ts src/plugin.ts src/manage.ts src/drizzle/pg.ts src/drizzle/d1.ts src/drizzle/sqlite.ts src/drizzle/schema-pg.ts src/drizzle/schema-sqlite.ts --root src --outdir dist --target browser --packages external --splitting",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "bun test test"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20261008.1",
-    "@lenso/auth": "^0.3.0",
-    "@lenso/core": "^0.2.1",
+    "@lenso/auth": "^0.3.1",
+    "@lenso/core": "^0.3.1",
+    "@lenso/engine": "^0.6.0",
+    "@lenso/manage": "^0.5.0",
     "@standard-schema/spec": "1.1.0",
     "drizzle-orm": "0.45.3",
-    "miniflare": "5.20261006.0-alpha"
+    "miniflare": "5.20261006.0-alpha",
+    "zod": "4.6.5"
   },
   "peerDependencies": {
-    "@lenso/auth": "^0.3.0",
-    "@lenso/core": "^0.2.1",
-    "drizzle-orm": "^0.45.3"
+    "@lenso/auth": "^0.3.1",
+    "@lenso/core": "^0.3.1",
+    "@lenso/engine": "^0.6.0",
+    "@lenso/manage": "^0.5.0",
+    "drizzle-orm": "^0.45.3",
+    "zod": "4.6.5"
   },
   "peerDependenciesMeta": {
+    "@lenso/engine": {
+      "optional": true
+    },
+    "@lenso/manage": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    },
     "@lenso/auth": {
       "optional": true
     },