@mahmoud-auth/auth 0.0.0-stage → 0.1.1-beta.0

package/dist/evaluation/service.js

@@ -0,0 +1,125 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EvaluationService = void 0;
+const common_1 = require("@nestjs/common");
+const common_2 = require("@mahmoud-auth/common");
+const errors_1 = require("../errors");
+const policy_1 = require("../policy");
+const tracing_1 = require("../tracing");
+let EvaluationService = class EvaluationService {
+    policyRegistry;
+    trace;
+    constructor(policyRegistry, trace) {
+        this.policyRegistry = policyRegistry;
+        this.trace = trace;
+    }
+    async can(resource, action, context, route) {
+        this.trace.policyEntered(resource.name, action, route);
+        try {
+            const entry = this.policyRegistry.getEntry(resource, action);
+            if (!entry) {
+                throw new errors_1.MissingPolicyException(resource.name, action, route);
+            }
+            const evaluation = await this.evaluate(entry.rule, context);
+            this.trace.policyLeft(resource.name, action, evaluation, route);
+            return evaluation;
+        }
+        catch (error) {
+            this.trace.policyFailed(resource.name, action, error, route);
+            throw error;
+        }
+    }
+    async evaluate(rule, context) {
+        if ((0, common_2.isPermissionRule)(rule)) {
+            return this.evaluatePermission(rule, context);
+        }
+        if ((0, common_2.isConditionRule)(rule)) {
+            return this.evaluateCondition(rule, context);
+        }
+        if ((0, common_2.isAndRule)(rule)) {
+            return this.evaluateAnd(rule, context);
+        }
+        if ((0, common_2.isOrRule)(rule)) {
+            return this.evaluateOr(rule, context);
+        }
+        if ((0, common_2.isNotRule)(rule)) {
+            return this.evaluateNot(rule, context);
+        }
+        return false;
+    }
+    async evaluatePermission(rule, context) {
+        return this.can(rule.resource, rule.action, context);
+    }
+    async evaluateCondition(rule, context) {
+        const ruleId = this.trace.ruleEntered('condition', [rule.description && `description: ${rule.description}`]);
+        try {
+            const resolvedCondition = await Promise.resolve(rule.execute(context));
+            this.trace.ruleResolved('condition', ruleId, resolvedCondition);
+            return resolvedCondition;
+        }
+        catch (error) {
+            this.trace.ruleFailed('condition', ruleId, error);
+            throw error;
+        }
+    }
+    async evaluateChildren(children, context, stop) {
+        for (const child of children) {
+            const result = await this.evaluate(child, context);
+            if (stop(result)) {
+                return result;
+            }
+        }
+        return !stop(true);
+    }
+    async evaluateAnd(rule, context) {
+        const ruleId = this.trace.ruleEntered('and');
+        try {
+            const resolvedAndRule = await this.evaluateChildren(rule.children, context, result => !result);
+            this.trace.ruleResolved('and', ruleId, resolvedAndRule);
+            return resolvedAndRule;
+        }
+        catch (error) {
+            this.trace.ruleFailed('and', ruleId, error);
+            throw error;
+        }
+    }
+    async evaluateOr(rule, context) {
+        const ruleId = this.trace.ruleEntered('or');
+        try {
+            const resolvedOrRule = await this.evaluateChildren(rule.children, context, result => result);
+            this.trace.ruleResolved('or', ruleId, resolvedOrRule);
+            return resolvedOrRule;
+        }
+        catch (error) {
+            this.trace.ruleFailed('or', ruleId, error);
+            throw error;
+        }
+    }
+    async evaluateNot(rule, context) {
+        const ruleId = this.trace.ruleEntered('not');
+        try {
+            const resolvedNotRule = !(await this.evaluate(rule.child, context));
+            this.trace.ruleResolved('not', ruleId, resolvedNotRule);
+            return resolvedNotRule;
+        }
+        catch (error) {
+            this.trace.ruleFailed('not', ruleId, error);
+            throw error;
+        }
+    }
+};
+exports.EvaluationService = EvaluationService;
+exports.EvaluationService = EvaluationService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [policy_1.PolicyRegistry,
+        tracing_1.AuthorizationTraceService])
+], EvaluationService);

package/dist/extensions/index.d.ts

@@ -0,0 +1 @@
+export * from './token';

package/dist/extensions/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./token"), exports);

package/dist/extensions/token/index.d.ts

@@ -0,0 +1,4 @@
+import { IUseFactoryWithToken } from "@mahmoud-auth/utils";
+export declare const MAHMOUD_EXTENSIONS: unique symbol;
+export declare const InjectMahmoudExtensions: () => PropertyDecorator & ParameterDecorator;
+export declare const useFactoryMahmoudExtensions: IUseFactoryWithToken;

package/dist/extensions/token/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useFactoryMahmoudExtensions = exports.InjectMahmoudExtensions = exports.MAHMOUD_EXTENSIONS = void 0;
+const common_1 = require("@nestjs/common");
+const utils_1 = require("@mahmoud-auth/utils");
+exports.MAHMOUD_EXTENSIONS = Symbol('MAHMOUD_EXTENSIONS');
+const InjectMahmoudExtensions = () => (0, common_1.Inject)(exports.MAHMOUD_EXTENSIONS);
+exports.InjectMahmoudExtensions = InjectMahmoudExtensions;
+const useFactoryMahmoudExtensions = (...props) => (0, utils_1.useFactory)(exports.MAHMOUD_EXTENSIONS, ...props);
+exports.useFactoryMahmoudExtensions = useFactoryMahmoudExtensions;

package/dist/feature-shortcuts/index.d.ts

@@ -0,0 +1,4 @@
+import { Type } from "@nestjs/common";
+import { MahmoudAuthModule } from "..";
+export declare const applyExtensions: typeof MahmoudAuthModule.forFeature;
+export declare const applyGlobalExtensions: (...extensions: Type[]) => import("@nestjs/common").DynamicModule;

package/dist/feature-shortcuts/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyGlobalExtensions = exports.applyExtensions = void 0;
+const __1 = require("..");
+exports.applyExtensions = __1.MahmoudAuthModule.forFeature;
+const applyGlobalExtensions = (...extensions) => (0, exports.applyExtensions)({ extensions });
+exports.applyGlobalExtensions = applyGlobalExtensions;

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from './auth-guard';
+export * from './core/resource';
+export * from './decorators';
+export * from './dsl';
+export * from './errors';
+export * from './evaluation';
+export * from './mahmoud.module';
+export * from './feature-shortcuts';

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth-guard"), exports);
+__exportStar(require("./core/resource"), exports);
+__exportStar(require("./decorators"), exports);
+__exportStar(require("./dsl"), exports);
+__exportStar(require("./errors"), exports);
+__exportStar(require("./evaluation"), exports);
+__exportStar(require("./mahmoud.module"), exports);
+__exportStar(require("./feature-shortcuts"), exports);

package/dist/mahmoud.module.d.ts

@@ -0,0 +1,16 @@
+import { DynamicModule, ModuleMetadata, Type } from "@nestjs/common";
+interface MahmoudAuthModuleRootOptions {
+    inspector?: boolean;
+    resources: Type[];
+    global?: boolean;
+    activateTrace?: boolean;
+}
+export interface MahmoudAuthModuleFeatureOptions {
+    imports?: ModuleMetadata['imports'];
+    extensions: Type[];
+}
+export declare class MahmoudAuthModule {
+    static forRoot(options: MahmoudAuthModuleRootOptions): DynamicModule;
+    static forFeature({ imports, extensions }: MahmoudAuthModuleFeatureOptions): DynamicModule;
+}
+export {};

package/dist/mahmoud.module.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var MahmoudAuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MahmoudAuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const model_climbers_1 = require("@mahmoud-auth/model-climbers");
+const tracing_1 = require("./tracing");
+const utils_1 = require("@mahmoud-auth/utils");
+const evaluation_1 = require("./evaluation");
+const extensions_1 = require("./extensions");
+const policy_1 = require("./policy");
+let MahmoudAuthModule = MahmoudAuthModule_1 = class MahmoudAuthModule {
+    static forRoot(options) {
+        const { resources = [], inspector = false, global = false, activateTrace = false } = options;
+        return {
+            module: MahmoudAuthModule_1,
+            imports: [
+                tracing_1.TraceModule.forRoot({ activateTrace }),
+                model_climbers_1.TransitionModule,
+                policy_1.PolicyModule,
+                model_climbers_1.ResourceRelationsModule.forRoot(...resources)
+            ],
+            global,
+            providers: [evaluation_1.EvaluationService],
+            exports: [evaluation_1.EvaluationService, model_climbers_1.ResourceRelationsModule, model_climbers_1.TransitionModule, tracing_1.TraceModule]
+        };
+    }
+    static forFeature({ imports = [], extensions }) {
+        return {
+            module: MahmoudAuthModule_1,
+            imports,
+            providers: [(0, extensions_1.useFactoryMahmoudExtensions)(utils_1.getClassInstanceMap, { inject: extensions })],
+            exports: [extensions_1.MAHMOUD_EXTENSIONS],
+        };
+    }
+};
+exports.MahmoudAuthModule = MahmoudAuthModule;
+exports.MahmoudAuthModule = MahmoudAuthModule = MahmoudAuthModule_1 = __decorate([
+    (0, common_1.Module)({})
+], MahmoudAuthModule);

package/dist/policy/compiler.d.ts

@@ -0,0 +1,12 @@
+import { Reflector } from '@nestjs/core';
+import { PolicyRegistry } from './registry';
+import { PolicyScanner } from './scanner';
+export declare class PolicyCompiler {
+    private scanner;
+    private reflector;
+    private graph;
+    constructor(scanner: PolicyScanner, reflector: Reflector, graph: PolicyRegistry);
+    compilePolicies(): void;
+    private compilePolicy;
+    private mapPolicyMethodToEntry;
+}

package/dist/policy/compiler.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyCompiler = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const common_2 = require("@mahmoud-auth/common");
+const permission_decorator_1 = require("../decorators/permission.decorator");
+const errors_1 = require("../errors");
+const registry_1 = require("./registry");
+const scanner_1 = require("./scanner");
+let PolicyCompiler = class PolicyCompiler {
+    scanner;
+    reflector;
+    graph;
+    constructor(scanner, reflector, graph) {
+        this.scanner = scanner;
+        this.reflector = reflector;
+        this.graph = graph;
+    }
+    compilePolicies() {
+        this.scanner
+            .lookupPolicyProviders()
+            .flatMap(policy => this.compilePolicy(policy))
+            .forEach(entry => this.graph.registerEntry(entry));
+        this.graph.freeze();
+    }
+    compilePolicy({ instance, resource }) {
+        const prototype = Object.getPrototypeOf(instance);
+        return Object
+            .getOwnPropertyNames(prototype)
+            .filter(key => key !== 'constructor' && typeof Object.getOwnPropertyDescriptor(prototype, key)?.value === 'function')
+            .map(method => this.mapPolicyMethodToEntry({ resource, instance, method, prototype }))
+            .filter(common_2.isNotNull);
+    }
+    mapPolicyMethodToEntry({ resource, instance, method, prototype }) {
+        const implementation = Object.getOwnPropertyDescriptor(prototype, method)?.value;
+        if (typeof implementation !== 'function') {
+            return null;
+        }
+        const action = this.reflector.get(permission_decorator_1.PERMISSION_METADATA, implementation);
+        if (!action) {
+            return null;
+        }
+        if (!resource.actions.includes(action)) {
+            throw new errors_1.OutOfBoundsActionException(resource.name, action, resource.actions);
+        }
+        return { resource, action, rule: (implementation).call(instance) };
+    }
+};
+exports.PolicyCompiler = PolicyCompiler;
+exports.PolicyCompiler = PolicyCompiler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [scanner_1.PolicyScanner,
+        core_1.Reflector,
+        registry_1.PolicyRegistry])
+], PolicyCompiler);

package/dist/policy/index.d.ts

@@ -0,0 +1,4 @@
+export * from './registry';
+export * from './permission-node.type';
+export * from './validator';
+export * from './module';

package/dist/policy/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./registry"), exports);
+__exportStar(require("./permission-node.type"), exports);
+__exportStar(require("./validator"), exports);
+__exportStar(require("./module"), exports);

package/dist/policy/module.d.ts

@@ -0,0 +1,9 @@
+import { OnModuleInit } from "@nestjs/common";
+import { PolicyCompiler } from "./compiler";
+import { PolicyValidator } from "./validator";
+export declare class PolicyModule implements OnModuleInit {
+    private readonly policyCompiler;
+    private readonly validator;
+    constructor(policyCompiler: PolicyCompiler, validator: PolicyValidator);
+    onModuleInit(): void;
+}

package/dist/policy/module.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyModule = void 0;
+const common_1 = require("@nestjs/common");
+const compiler_1 = require("./compiler");
+const registry_1 = require("./registry");
+const scanner_1 = require("./scanner");
+const core_1 = require("@nestjs/core");
+const validator_1 = require("./validator");
+const controller_1 = require("./visualizer/controller");
+let PolicyModule = class PolicyModule {
+    policyCompiler;
+    validator;
+    constructor(policyCompiler, validator) {
+        this.policyCompiler = policyCompiler;
+        this.validator = validator;
+    }
+    onModuleInit() {
+        this.policyCompiler.compilePolicies();
+        this.validator.validatePolicies();
+    }
+};
+exports.PolicyModule = PolicyModule;
+exports.PolicyModule = PolicyModule = __decorate([
+    (0, common_1.Module)({
+        imports: [core_1.DiscoveryModule],
+        providers: [registry_1.PolicyRegistry, scanner_1.PolicyScanner, compiler_1.PolicyCompiler, validator_1.PolicyValidator],
+        controllers: [controller_1.VisualizerController],
+        exports: [registry_1.PolicyRegistry]
+    }),
+    __metadata("design:paramtypes", [compiler_1.PolicyCompiler,
+        validator_1.PolicyValidator])
+], PolicyModule);

package/dist/policy/permission-node.type.d.ts

@@ -0,0 +1,5 @@
+import { IResourceToken } from '@mahmoud-auth/common';
+export interface IPermissionNode<T> {
+    resource: IResourceToken<T>;
+    action: string;
+}

package/dist/policy/permission-node.type.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/policy/registry.d.ts

@@ -0,0 +1,17 @@
+import { IAuthorizationGraphDto, IResourceToken, RuleNode } from '@mahmoud-auth/common';
+import { IPermissionNode } from './permission-node.type';
+import { BaseMahmoudRegistry } from '@mahmoud-auth/base-registry';
+export interface GraphEntry<T = unknown> extends IPermissionNode<T> {
+    rule: RuleNode;
+}
+export declare class PolicyRegistry extends BaseMahmoudRegistry<string, GraphEntry> {
+    constructor();
+    registerEntry(entry: GraphEntry): void;
+    getEntry<T>(resource: IResourceToken<T>, action: string): GraphEntry<unknown> | undefined;
+    hasEntry<T>(resource: IResourceToken<T>, action: string): boolean;
+    getValues(): GraphEntry<unknown>[];
+    toVisualizationDto(): IAuthorizationGraphDto;
+    private toVisualizationRule;
+    private collectPermissionEdges;
+    private permissionKey;
+}

package/dist/policy/registry.js

@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyRegistry = void 0;
+const common_1 = require("@nestjs/common");
+const common_2 = require("@mahmoud-auth/common");
+const core_1 = require("../core");
+const errors_1 = require("../errors");
+const base_registry_1 = require("@mahmoud-auth/base-registry");
+let PolicyRegistry = class PolicyRegistry extends base_registry_1.BaseMahmoudRegistry {
+    constructor() {
+        super(new Map());
+    }
+    registerEntry(entry) {
+        this.checkIsFrozen(this.constructor.name);
+        if (this.entries.get((0, core_1.createResourceKey)(entry.resource, entry.action))) {
+            throw new errors_1.DuplicatePolicyException(entry.resource.name, entry.action);
+        }
+        this.entries.set((0, core_1.createResourceKey)(entry.resource, entry.action), entry);
+    }
+    getEntry(resource, action) {
+        return this.entries.get((0, core_1.createResourceKey)(resource, action));
+    }
+    hasEntry(resource, action) {
+        return this.entries.has((0, core_1.createResourceKey)(resource, action));
+    }
+    getValues() {
+        return [...this.entries.values()];
+    }
+    toVisualizationDto() {
+        const nodes = new Map();
+        const edges = [];
+        this.getValues()
+            .forEach(entry => {
+            const nodeId = this.permissionKey(entry.resource, entry.action);
+            nodes.set(nodeId, {
+                id: nodeId,
+                resource: entry.resource.name,
+                action: entry.action,
+                rule: this.toVisualizationRule(entry.rule),
+            });
+            this.collectPermissionEdges(entry.rule, nodeId, edges);
+        });
+        return {
+            nodes: [...nodes.values()],
+            edges,
+        };
+    }
+    toVisualizationRule(rule) {
+        if ((0, common_2.isConditionRule)(rule)) {
+            const conditionTreeNode = {
+                type: 'condition',
+                description: rule.description ?? 'No description found',
+            };
+            return conditionTreeNode;
+        }
+        if ((0, common_2.isPermissionRule)(rule)) {
+            const permissionTreeNode = {
+                type: 'permission',
+                target: this.permissionKey(rule.resource, rule.action),
+            };
+            return permissionTreeNode;
+        }
+        if ((0, common_2.isAndRule)(rule) || (0, common_2.isOrRule)(rule)) {
+            const treeNode = {
+                type: rule.type,
+                children: rule.children.map(child => this.toVisualizationRule(child)),
+            };
+            return treeNode;
+        }
+        if ((0, common_2.isNotRule)(rule)) {
+            const treeNotNode = {
+                type: 'not',
+                child: this.toVisualizationRule(rule.child),
+            };
+            return treeNotNode;
+        }
+        throw new common_1.InternalServerErrorException(`Unknown rule type: ${rule.type}`);
+    }
+    collectPermissionEdges(rule, source, edges) {
+        if ((0, common_2.isPermissionRule)(rule)) {
+            edges.push({
+                from: source,
+                to: this.permissionKey(rule.resource, rule.action),
+                type: 'requires',
+            });
+            return;
+        }
+        if ((0, common_2.isAndRule)(rule) || (0, common_2.isOrRule)(rule)) {
+            rule.children.forEach(child => this.collectPermissionEdges(child, source, edges));
+            return;
+        }
+        if ((0, common_2.isNotRule)(rule)) {
+            this.collectPermissionEdges(rule.child, source, edges);
+        }
+    }
+    permissionKey(resource, action) {
+        return `${resource.name}.${action}`;
+    }
+};
+exports.PolicyRegistry = PolicyRegistry;
+exports.PolicyRegistry = PolicyRegistry = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], PolicyRegistry);

package/dist/policy/scanner.d.ts

@@ -0,0 +1,12 @@
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { IResourceToken } from '@mahmoud-auth/common';
+export declare class PolicyScanner {
+    private discovery;
+    private reflector;
+    constructor(discovery: DiscoveryService, reflector: Reflector);
+    lookupPolicyProviders(): {
+        instance: object;
+        resource: IResourceToken<unknown, string[]>;
+    }[];
+    private getPolicyProviderMetadata;
+}

package/dist/policy/scanner.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyScanner = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const policy_decorator_1 = require("../decorators/policy.decorator");
+const common_2 = require("@mahmoud-auth/common");
+let PolicyScanner = class PolicyScanner {
+    discovery;
+    reflector;
+    constructor(discovery, reflector) {
+        this.discovery = discovery;
+        this.reflector = reflector;
+    }
+    lookupPolicyProviders() {
+        return this.discovery
+            .getProviders()
+            .map(provider => this.getPolicyProviderMetadata(provider))
+            .filter(common_2.isNotNull);
+    }
+    getPolicyProviderMetadata(provider) {
+        const instance = provider.instance;
+        if (typeof instance !== 'object' || instance === null) {
+            return null;
+        }
+        const resource = this.reflector.get(policy_decorator_1.RESOURCE_POLICY_METADATA, instance.constructor);
+        if (!resource) {
+            return null;
+        }
+        return { instance, resource };
+    }
+};
+exports.PolicyScanner = PolicyScanner;
+exports.PolicyScanner = PolicyScanner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.Reflector])
+], PolicyScanner);

package/dist/policy/validator.d.ts

@@ -0,0 +1,8 @@
+import { PolicyRegistry } from "./registry";
+export declare class PolicyValidator {
+    private readonly policies;
+    constructor(policies: PolicyRegistry);
+    validatePolicies(): void;
+    private validateCycles;
+    private getPermissionDependencies;
+}