@mahmoud-auth/auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Mahmoud Project contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,9 @@
-# Temporary Holding Version
+# @mahmoud-auth/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Policy-based authorization for NestJS, including resource policies, route authorization, policy evaluation, and optional inspection endpoints.
+
+```sh
+npm install @mahmoud-auth/auth
+```
+
+Import `MahmoudAuthModule`, policy decorators, and authorization helpers from the package root. Configure `MahmoudAuthModule.forRoot({ resources })` in the application module. NestJS and `reflect-metadata` are peer dependencies.

package/dist/auth-guard/authorization-context.class.d.ts

@@ -0,0 +1,17 @@
+import { Type } from "@nestjs/common";
+import { IAuthorizationContext } from "@mahmoud-auth/common";
+import { ResourceResolverService } from "@mahmoud-auth/model-climbers";
+export declare class AuthorizationContext<TRequest extends Request = Request> implements IAuthorizationContext<TRequest> {
+    private readonly extensions;
+    private readonly resourceResolver;
+    private readonly rootType;
+    private readonly rootResource;
+    private readonly rootRequest;
+    readonly user: unknown;
+    readonly data: unknown;
+    private readonly resourceCache;
+    constructor(extensions: Map<Type, unknown>, resourceResolver: ResourceResolverService, rootType: Type, rootResource: unknown, rootRequest: TRequest, user: unknown, data: unknown);
+    request(): TRequest;
+    use<T>(type: Type<T>): T;
+    get<T>(resourceType: Type<T>): Promise<T | undefined>;
+}

package/dist/auth-guard/authorization-context.class.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationContext = void 0;
+const common_1 = require("@nestjs/common");
+class AuthorizationContext {
+    extensions;
+    resourceResolver;
+    rootType;
+    rootResource;
+    rootRequest;
+    user;
+    data;
+    resourceCache = new Map();
+    constructor(extensions, resourceResolver, rootType, rootResource, rootRequest, user, data) {
+        this.extensions = extensions;
+        this.resourceResolver = resourceResolver;
+        this.rootType = rootType;
+        this.rootResource = rootResource;
+        this.rootRequest = rootRequest;
+        this.user = user;
+        this.data = data;
+        this.resourceCache.set(rootType, rootResource);
+    }
+    request() {
+        return this.rootRequest;
+    }
+    use(type) {
+        const extension = this.extensions.get(type);
+        if (!extension) {
+            throw new common_1.InternalServerErrorException(`Authorization extension ${type.name} was not registered`);
+        }
+        return extension;
+    }
+    async get(resourceType) {
+        const hasResource = this.resourceCache.has(resourceType);
+        const cachedResource = this.resourceCache.get(resourceType);
+        if (hasResource) {
+            return cachedResource;
+        }
+        const resolvedResource = await this.resourceResolver.resolve({
+            rootType: this.rootType,
+            rootResource: this.rootResource,
+            resourceCache: this.resourceCache
+        }, resourceType);
+        if (resolvedResource) {
+            this.resourceCache.set(resourceType, resolvedResource);
+        }
+        return resolvedResource;
+    }
+}
+exports.AuthorizationContext = AuthorizationContext;

package/dist/auth-guard/index.d.ts

@@ -0,0 +1,18 @@
+import { CanActivate, ExecutionContext, Type } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ResourceProviderRegistry, ResourceResolverService } from '@mahmoud-auth/model-climbers';
+import { AuthorizationMetadata } from '../decorators/authorize.decorator';
+import { EvaluationService } from '../evaluation';
+import { AuthorizationTraceService } from '../tracing';
+export declare class AuthorizationGuard<T> implements CanActivate {
+    private reflector;
+    private authService;
+    private readonly providerRegistry;
+    private readonly resourceResolver;
+    private readonly trace;
+    private readonly extensions?;
+    constructor(reflector: Reflector, authService: EvaluationService, providerRegistry: ResourceProviderRegistry, resourceResolver: ResourceResolverService, trace: AuthorizationTraceService, extensions?: Map<Type, unknown> | undefined);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private resolveResource;
+}
+export declare const Authorize: <T, const TActions extends string[]>(metadata: AuthorizationMetadata<T, TActions>) => MethodDecorator;

package/dist/auth-guard/index.js

@@ -0,0 +1,101 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Authorize = exports.AuthorizationGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const lodash_1 = __importDefault(require("lodash"));
+const model_climbers_1 = require("@mahmoud-auth/model-climbers");
+const authorize_decorator_1 = require("../decorators/authorize.decorator");
+const evaluation_1 = require("../evaluation");
+const extensions_1 = require("../extensions");
+const authorization_context_class_1 = require("./authorization-context.class");
+const tracing_1 = require("../tracing");
+let AuthorizationGuard = class AuthorizationGuard {
+    reflector;
+    authService;
+    providerRegistry;
+    resourceResolver;
+    trace;
+    extensions;
+    constructor(reflector, authService, providerRegistry, resourceResolver, trace, extensions) {
+        this.reflector = reflector;
+        this.authService = authService;
+        this.providerRegistry = providerRegistry;
+        this.resourceResolver = resourceResolver;
+        this.trace = trace;
+        this.extensions = extensions;
+    }
+    async canActivate(context) {
+        const authorizationMetadata = this.reflector.get(authorize_decorator_1.RESOURCE_AUTHORIZE_METADATA, context.getHandler());
+        if (!authorizationMetadata) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const resource = await this.resolveResource(authorizationMetadata, request);
+        return this.authService.can(authorizationMetadata.resourceToken, authorizationMetadata.action, new authorization_context_class_1.AuthorizationContext(this.extensions || new Map(), this.resourceResolver, authorizationMetadata.resourceToken.model, resource, request, request.user, request.body), request.url);
+    }
+    async resolveResource(metadata, request) {
+        if (!metadata.identifierPath) {
+            this.trace.resourceResolved(metadata.resourceToken.name, 'skipped');
+            return undefined;
+        }
+        const id = lodash_1.default.get(request, metadata.identifierPath);
+        if (!id) {
+            this.trace.resourceResolved(metadata.resourceToken.name, 'missing_id');
+            return null;
+        }
+        const provider = this.providerRegistry.get(metadata.resourceToken.model);
+        if (!provider) {
+            const error = new model_climbers_1.MissingResourceProviderException(metadata.resourceToken.name);
+            this.trace.resourceResolved(metadata.resourceToken.name, 'error', error);
+            throw error;
+        }
+        try {
+            const resource = await provider(id);
+            this.trace.resourceResolved(metadata.resourceToken.name, resource ? 'found' : 'not_found');
+            return resource;
+        }
+        catch (error) {
+            this.trace.resourceResolved(metadata.resourceToken.name, 'error', error);
+            throw error;
+        }
+    }
+};
+exports.AuthorizationGuard = AuthorizationGuard;
+exports.AuthorizationGuard = AuthorizationGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, extensions_1.InjectMahmoudExtensions)()),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        evaluation_1.EvaluationService,
+        model_climbers_1.ResourceProviderRegistry,
+        model_climbers_1.ResourceResolverService,
+        tracing_1.AuthorizationTraceService,
+        Map])
+], AuthorizationGuard);
+const Authorize = (metadata) => {
+    const routeDecorator = (0, common_1.applyDecorators)((0, authorize_decorator_1.ResourceAuthorize)(metadata), (0, common_1.UseGuards)((AuthorizationGuard)));
+    const methodDecorator = (target, propertyKey, descriptor) => {
+        if (propertyKey === undefined) {
+            throw new TypeError('@Authorize can only be applied to route methods');
+        }
+        routeDecorator(target, propertyKey, descriptor);
+    };
+    return methodDecorator;
+};
+exports.Authorize = Authorize;

package/dist/core/index.d.ts

@@ -0,0 +1 @@
+export * from './resource';

package/dist/core/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./resource"), exports);

package/dist/core/resource.d.ts

@@ -0,0 +1,5 @@
+import { IResourceToken } from "@mahmoud-auth/common";
+type CreateResourcePolicyProps<T, TActions extends string[]> = Pick<IResourceToken<T, TActions>, 'model' | 'actions'>;
+export declare const createResourcePolicy: <T, const TActions extends string[]>({ model, actions }: CreateResourcePolicyProps<T, TActions>) => IResourceToken<T, TActions>;
+export declare const createResourceKey: <T>(resource: IResourceToken<T>, action: string) => string;
+export {};

package/dist/core/resource.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createResourceKey = exports.createResourcePolicy = void 0;
+const utils_1 = require("@mahmoud-auth/utils");
+const createResourcePolicy = ({ model, actions }) => ({
+    name: `${model.name}Policy`,
+    model,
+    actions,
+    mahmoudId: (0, utils_1.nanoid)(8)
+});
+exports.createResourcePolicy = createResourcePolicy;
+const createResourceKey = (resource, action) => {
+    return `${resource.name}:${action}`;
+};
+exports.createResourceKey = createResourceKey;

package/dist/decorators/authorize.decorator.d.ts

@@ -0,0 +1,8 @@
+import { IResourceToken } from '@mahmoud-auth/common';
+export declare const RESOURCE_AUTHORIZE_METADATA: unique symbol;
+export interface AuthorizationMetadata<T, TActions extends string[] = string[]> {
+    resourceToken: IResourceToken<T, TActions>;
+    action: TActions[number];
+    identifierPath: string;
+}
+export declare const ResourceAuthorize: <T, const TActions extends string[]>(metadata: AuthorizationMetadata<T, TActions>) => import("@nestjs/common").CustomDecorator<typeof RESOURCE_AUTHORIZE_METADATA>;

package/dist/decorators/authorize.decorator.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceAuthorize = exports.RESOURCE_AUTHORIZE_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+const errors_1 = require("../errors");
+exports.RESOURCE_AUTHORIZE_METADATA = Symbol('RESOURCE_AUTHORIZE');
+const PATH_REGEX = /^(params|query|body)(\.[a-zA-Z_$][\w$]*)+$/;
+const validateIdPath = (identifierPath) => {
+    if (!PATH_REGEX.test(identifierPath)) {
+        throw new common_1.InternalServerErrorException(`Invalid identifierPath "${identifierPath}". Expected format examples: params.id, query.id, body.id`);
+    }
+};
+const ResourceAuthorize = (metadata) => {
+    if (!metadata.resourceToken.actions.includes(metadata.action)) {
+        throw new errors_1.OutOfBoundsActionException(metadata.resourceToken.name, metadata.action, metadata.resourceToken.actions);
+    }
+    if (metadata.identifierPath) {
+        validateIdPath(metadata.identifierPath);
+    }
+    return (0, common_1.SetMetadata)(exports.RESOURCE_AUTHORIZE_METADATA, metadata);
+};
+exports.ResourceAuthorize = ResourceAuthorize;

package/dist/decorators/index.d.ts

@@ -0,0 +1,3 @@
+export * from './authorize.decorator';
+export * from './permission.decorator';
+export * from './policy.decorator';

package/dist/decorators/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authorize.decorator"), exports);
+__exportStar(require("./permission.decorator"), exports);
+__exportStar(require("./policy.decorator"), exports);

package/dist/decorators/permission.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const PERMISSION_METADATA: unique symbol;
+export declare const Permission: (action: string) => import("@nestjs/common").CustomDecorator<typeof PERMISSION_METADATA>;

package/dist/decorators/permission.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Permission = exports.PERMISSION_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+exports.PERMISSION_METADATA = Symbol('PERMISSION');
+const Permission = (action) => ((0, common_1.SetMetadata)(exports.PERMISSION_METADATA, action));
+exports.Permission = Permission;

package/dist/decorators/policy.decorator.d.ts

@@ -0,0 +1,3 @@
+import { IResourceToken } from '@mahmoud-auth/common';
+export declare const RESOURCE_POLICY_METADATA: unique symbol;
+export declare const ResourcePolicy: <T>(resource: IResourceToken<T>) => import("@nestjs/common").CustomDecorator<typeof RESOURCE_POLICY_METADATA>;

package/dist/decorators/policy.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourcePolicy = exports.RESOURCE_POLICY_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+exports.RESOURCE_POLICY_METADATA = Symbol('RESOURCE_POLICY');
+const ResourcePolicy = (resource) => (0, common_1.SetMetadata)(exports.RESOURCE_POLICY_METADATA, resource);
+exports.ResourcePolicy = ResourcePolicy;

package/dist/dsl/can.d.ts

@@ -0,0 +1,2 @@
+import { IPermissionRule, IResourceToken } from '@mahmoud-auth/common';
+export declare const can: <T, const TActions extends string[]>(resource: IResourceToken<T, TActions>, action: TActions[number]) => IPermissionRule<T>;

package/dist/dsl/can.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.can = void 0;
+const can = (resource, action) => ({
+    type: 'permission',
+    resource,
+    action,
+});
+exports.can = can;

package/dist/dsl/condition.d.ts

@@ -0,0 +1,2 @@
+import { IConditionExecute, IConditionRule } from "@mahmoud-auth/common";
+export declare const condition: (execute: IConditionExecute, info?: Pick<IConditionRule, "description">) => IConditionRule;

package/dist/dsl/condition.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.condition = void 0;
+const condition = (execute, info = {}) => ({
+    type: 'condition',
+    execute,
+    ...info,
+});
+exports.condition = condition;

package/dist/dsl/index.d.ts

@@ -0,0 +1,3 @@
+export * from './can';
+export * from './condition';
+export * from './trinary';

package/dist/dsl/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./can"), exports);
+__exportStar(require("./condition"), exports);
+__exportStar(require("./trinary"), exports);

package/dist/dsl/trinary/and.d.ts

@@ -0,0 +1,2 @@
+import { RuleNode, IAndRule } from '@mahmoud-auth/common';
+export declare const all: (...children: RuleNode[]) => IAndRule;

package/dist/dsl/trinary/and.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.all = void 0;
+const all = (...children) => ({
+    type: 'and',
+    children
+});
+exports.all = all;

package/dist/dsl/trinary/index.d.ts

@@ -0,0 +1,3 @@
+export * from './and';
+export * from './not';
+export * from './or';

package/dist/dsl/trinary/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./and"), exports);
+__exportStar(require("./not"), exports);
+__exportStar(require("./or"), exports);

package/dist/dsl/trinary/not.d.ts

@@ -0,0 +1,2 @@
+import { RuleNode, INotRule } from "@mahmoud-auth/common";
+export declare const not: (child: RuleNode) => INotRule;

package/dist/dsl/trinary/not.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.not = void 0;
+const not = (child) => ({
+    type: 'not',
+    child
+});
+exports.not = not;

package/dist/dsl/trinary/or.d.ts

@@ -0,0 +1,2 @@
+import { RuleNode, IOrRule } from "@mahmoud-auth/common";
+export declare const any: (...children: RuleNode[]) => IOrRule;

package/dist/dsl/trinary/or.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.any = void 0;
+const any = (...children) => ({
+    type: 'or',
+    children
+});
+exports.any = any;

package/dist/errors/circular-policy.exception.d.ts

@@ -0,0 +1,4 @@
+import { InternalServerErrorException } from '@nestjs/common';
+export declare class CircularPolicyException extends InternalServerErrorException {
+    constructor(path: string[]);
+}

package/dist/errors/circular-policy.exception.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CircularPolicyException = void 0;
+const common_1 = require("@nestjs/common");
+class CircularPolicyException extends common_1.InternalServerErrorException {
+    constructor(path) {
+        super(`Circular authorization dependency detected: ${path.join(' -> ')}`);
+    }
+}
+exports.CircularPolicyException = CircularPolicyException;

package/dist/errors/duplicate-policy.exception.d.ts

@@ -0,0 +1,4 @@
+import { InternalServerErrorException } from "@nestjs/common";
+export declare class DuplicatePolicyException extends InternalServerErrorException {
+    constructor(resource: string, action: string);
+}

package/dist/errors/duplicate-policy.exception.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DuplicatePolicyException = void 0;
+const common_1 = require("@nestjs/common");
+class DuplicatePolicyException extends common_1.InternalServerErrorException {
+    constructor(resource, action) {
+        super(`Duplicate policy found for ${resource}.${action}`);
+    }
+}
+exports.DuplicatePolicyException = DuplicatePolicyException;

package/dist/errors/index.d.ts

@@ -0,0 +1,4 @@
+export * from './circular-policy.exception';
+export * from './missing-policy.exception';
+export * from './duplicate-policy.exception';
+export * from './out-of-bounds-action.exception';

package/dist/errors/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./circular-policy.exception"), exports);
+__exportStar(require("./missing-policy.exception"), exports);
+__exportStar(require("./duplicate-policy.exception"), exports);
+__exportStar(require("./out-of-bounds-action.exception"), exports);

package/dist/errors/missing-policy.exception.d.ts

@@ -0,0 +1,4 @@
+import { InternalServerErrorException } from "@nestjs/common";
+export declare class MissingPolicyException extends InternalServerErrorException {
+    constructor(resource: string, action: string, route?: string);
+}

package/dist/errors/missing-policy.exception.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingPolicyException = void 0;
+const common_1 = require("@nestjs/common");
+class MissingPolicyException extends common_1.InternalServerErrorException {
+    constructor(resource, action, route) {
+        const routeMessage = route ? `in route ${route}` : '';
+        super(`No authorization policy found for ${resource}.${action} ${routeMessage}`);
+    }
+}
+exports.MissingPolicyException = MissingPolicyException;

package/dist/errors/out-of-bounds-action.exception.d.ts

@@ -0,0 +1,5 @@
+import { InternalServerErrorException } from "@nestjs/common";
+export declare class OutOfBoundsActionException extends InternalServerErrorException {
+    readonly validActions?: string[] | undefined;
+    constructor(resource: string, action: string, validActions?: string[] | undefined);
+}

package/dist/errors/out-of-bounds-action.exception.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OutOfBoundsActionException = void 0;
+const common_1 = require("@nestjs/common");
+class OutOfBoundsActionException extends common_1.InternalServerErrorException {
+    validActions;
+    constructor(resource, action, validActions) {
+        const validActionsMessage = validActions ? `in actions [${validActions.map(validAction => `'${validAction}'`).join(', ')}]` : '';
+        super(`Action '${action}' is not a valid action for resource ${resource} ${validActionsMessage}`);
+        this.validActions = validActions;
+    }
+}
+exports.OutOfBoundsActionException = OutOfBoundsActionException;

package/dist/evaluation/index.d.ts

@@ -0,0 +1 @@
+export * from './service';

package/dist/evaluation/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./service"), exports);

package/dist/evaluation/service.d.ts

@@ -0,0 +1,16 @@
+import { IAuthorizationContext, IResourceToken } from "@mahmoud-auth/common";
+import { PolicyRegistry } from "../policy";
+import { AuthorizationTraceService } from "../tracing";
+export declare class EvaluationService {
+    private readonly policyRegistry;
+    private readonly trace;
+    constructor(policyRegistry: PolicyRegistry, trace: AuthorizationTraceService);
+    can<T>(resource: IResourceToken<T>, action: string, context: IAuthorizationContext, route?: string): Promise<boolean>;
+    private evaluate;
+    private evaluatePermission;
+    private evaluateCondition;
+    private evaluateChildren;
+    private evaluateAnd;
+    private evaluateOr;
+    private evaluateNot;
+}