@nebutra/permissions 2.0.0 → 3.0.0

package/README.md

@@ -1,19 +1,17 @@
-> **Status: Foundation** — CASL in-process evaluation supports deterministic role inheritance, ABAC conditions, and field-level rules. OpenFGA support now uses the store-scoped REST API, but model and tuple lifecycle management remain external to this package.
+> **Status: Foundation** — CASL in-process evaluation supports deterministic role inheritance, ABAC conditions, and field-level rules.
 
 # @nebutra/permissions
 
-RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control) permissions engine for the Nebutra-Sailor monorepo. Built on CASL with optional OpenFGA support for relationship-based access at scale.
+RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control) permissions engine for the Nebutra-Sailor monorepo. Built on CASL — the only supported provider.
 
 ## Features
 
 - **CASL-based in-process evaluation** — Fast, no network calls, great for UI + API middleware
-- **OpenFGA integration** — Store-scoped REST checks, writes, deletes, and list-objects calls for managed/self-hosted Zanzibar relationship graphs
 - **Role hierarchy** — Roles inherit permissions from parent roles; child rules override inherited grants deterministically
 - **ABAC conditions** — Dynamic field resolution at evaluation time
 - **Field-level permissions** — Restrict access to specific fields through CASL-backed checks
 - **React hooks & components** — `usePermission()`, `<Can>` component for UI gate-keeping
 - **Hono middleware** — Automatic permission checks in API routes
-- **Provider auto-detection** — Automatically picks CASL or OpenFGA based on env vars
 
 ## Installation
 
@@ -172,7 +170,7 @@ permissions.can(context, "read", "Document", undefined, "internalNotes"); // fal
 
 ## Provider Configuration
 
-### CASL (Default, In-Process)
+### CASL (In-Process, only supported provider)
 
 Fast, no network calls. Great for UI and API middleware.
 
@@ -182,50 +180,11 @@ import { createCASLProvider } from "@nebutra/permissions/casl";
 const provider = createCASLProvider();
 ```
 
-**Auto-detection:** Uses CASL if no `OPENFGA_API_URL` env var is set.
-
-### OpenFGA (Relationship-Based)
-
-OpenFGA uses the store-scoped REST API and fails closed when configuration or network calls are invalid. This package does not manage OpenFGA authorization models or tuple migrations.
-
-```typescript
-import { createOpenFGAProvider } from "@nebutra/permissions/openfga";
-
-const provider = createOpenFGAProvider(
-  {
-    apiUrl: "http://openfga.internal:8080",
-    storeId: "store_abc123",
-    authToken: process.env.OPENFGA_AUTH_TOKEN,
-  },
-  roles
-);
-
-// Write relationship tuples
-await provider.write([
-  { user: "user_123", relation: "member", object: "team:acme" },
-  { user: "team:acme", relation: "parent", object: "org:company" },
-]);
-
-// Check access
-const allowed = await provider.check(
-  "user_123",
-  "can_edit",
-  "document:doc_456"
-);
-```
-
-**Auto-detection:** Uses OpenFGA if `OPENFGA_API_URL` env var is set.
-
 ## Environment Variables
 
 ```env
-# Provider selection (auto-detects if empty)
-PERMISSIONS_PROVIDER=casl              # "casl" | "openfga"
-
-# OpenFGA configuration
-OPENFGA_API_URL=http://openfga:8080    # Triggers OpenFGA provider
-OPENFGA_STORE_ID=abc123                # Required for OpenFGA REST calls
-OPENFGA_AUTH_TOKEN=secret              # Optional for managed OpenFGA
+# Provider selection (optional — casl is the only supported provider)
+PERMISSIONS_PROVIDER=casl
 ```
 
 ## API Reference
@@ -236,11 +195,8 @@ Initialize the global permissions manager (singleton).
 
 ```typescript
 const permissions = createPermissions({
-  provider: "openfga",
+  provider: "casl",
   roles: customRoles,
-  openFgaApiUrl: "http://openfga:8080",
-  openFgaStoreId: "abc123",
-  openFgaAuthToken: process.env.OPENFGA_AUTH_TOKEN,
 });
 ```
 
@@ -406,16 +362,6 @@ const provider = new CASLProvider();
 provider.clearCache();
 ```
 
-### OpenFGA connection errors
-
-Verify `OPENFGA_API_URL` is reachable:
-
-```bash
-curl http://openfga:8080/health
-```
-
-Check logs for `OpenFGA check error` messages.
-
 ## License
 
 MIT

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,MAAM,EACN,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,QAAQ,EACR,cAAc,EACf,MAAM,SAAS,CAAC;AAIjB,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAyB;gBAEjC,MAAM,CAAC,EAAE,gBAAgB;IAyBrC,OAAO,CAAC,cAAc;IAmBtB,eAAe,IAAI,sBAAsB;IAIzC,GAAG,CACD,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO;IAIV,MAAM,CACJ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO;IAIV,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE;IAI/C,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI;IAI5C,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO;IAIpD,WAAW,IAAI,kBAAkB;CAGlC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAG/E;AAED,wBAAgB,cAAc,IAAI,kBAAkB,CAKnD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,MAAM,EACN,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,QAAQ,EACR,cAAc,EACf,MAAM,SAAS,CAAC;AAIjB,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAyB;gBAEjC,MAAM,CAAC,EAAE,gBAAgB;IAUrC,OAAO,CAAC,cAAc;IAetB,eAAe,IAAI,sBAAsB;IAIzC,GAAG,CACD,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO;IAIV,MAAM,CACJ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO;IAIV,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE;IAI/C,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI;IAI5C,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO;IAIpD,WAAW,IAAI,kBAAkB;CAGlC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAG/E;AAED,wBAAgB,cAAc,IAAI,kBAAkB,CAKnD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/factory.js

@@ -1,6 +1,5 @@
 import { logger } from "@nebutra/logger";
 import { CASLProvider } from "./providers/casl";
-import { OpenFGAProvider } from "./providers/openfga";
 import { getDefaultRoles } from "./roles";
 let permissionsInstance = null;
 export class PermissionsManager {
@@ -10,23 +9,8 @@ export class PermissionsManager {
         const detectedType = this.detectProvider(config?.provider);
         this.providerType = detectedType;
         const roles = config?.roles || getDefaultRoles();
-        if (detectedType === "openfga") {
-            // exactOptionalPropertyTypes: only set keys that have defined values so
-            // the optional `?:` modifier on OpenFGAProviderConfig stays satisfied.
-            const openFgaConfig = {};
-            if (config?.openFgaApiUrl !== undefined)
-                openFgaConfig.apiUrl = config.openFgaApiUrl;
-            if (config?.openFgaAuthToken !== undefined)
-                openFgaConfig.authToken = config.openFgaAuthToken;
-            if (config?.openFgaStoreId !== undefined)
-                openFgaConfig.storeId = config.openFgaStoreId;
-            this.provider = new OpenFGAProvider(openFgaConfig, roles);
-            logger.info("Initialized OpenFGA permissions provider");
-        }
-        else {
-            this.provider = new CASLProvider(roles);
-            logger.info("Initialized CASL permissions provider");
-        }
+        this.provider = new CASLProvider(roles);
+        logger.info("Initialized CASL permissions provider");
     }
     detectProvider(explicit) {
         if (explicit) {
@@ -34,13 +18,10 @@ export class PermissionsManager {
         }
         if (process.env.PERMISSIONS_PROVIDER) {
             const provider = process.env.PERMISSIONS_PROVIDER;
-            if (["casl", "openfga"].includes(provider)) {
+            if (provider === "casl") {
                 return provider;
             }
         }
-        if (process.env.OPENFGA_API_URL) {
-            return "openfga";
-        }
         return "casl";
     }
     getProviderType() {

package/dist/index.d.ts

@@ -2,7 +2,6 @@ export { createPermissions, getPermissions, PermissionsManager, resetPermissions
 export { attachPermissionContext, type RequirePermissionOptions, requirePermission, } from "./middleware";
 export { canPlatform, isPlatformStaffRole, normalizePlatformStaffRole, PLATFORM_STAFF_ROLES, type PlatformAbility, type PlatformAction, type PlatformResource, type PlatformStaffRole, platformAbilityFor, platformRoleHierarchy, } from "./platform";
 export { buildAbilityFor, CASLProvider, createCASLProvider, createPrismaAbility, getPrismaQuery, } from "./providers/casl";
-export { createOpenFGAProvider, type OpenFGACheckRequest, type OpenFGACheckResponse, type OpenFGAListObjectsRequest, OpenFGAProvider, type OpenFGAProviderConfig, type OpenFGATuple, type OpenFGAWriteRequest, } from "./providers/openfga";
 export { Can, Cannot, type CannotProps, type CanProps, PermissionProvider as PermissionProviderComponent, type PermissionProviderProps, type UsePermissionOptions, usePermission, usePermissionContext, } from "./react";
 export { DEFAULT_ROLES, getDefaultRoles, getRoleDefinition, getRoleHierarchy, } from "./roles";
 export { type AbilityOptions, type Action, ForbiddenError, type PermissionConfig, type PermissionContext, type PermissionProvider, type PermissionProviderType, type PermissionRule, type Resource, type Role, type RoleDefinition, } from "./types";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,GAAG,EACH,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,kBAAkB,IAAI,2BAA2B,EACjD,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,aAAa,EACb,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,cAAc,GACpB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,GAAG,EACH,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,kBAAkB,IAAI,2BAA2B,EACjD,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,aAAa,EACb,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,MAAM,EACX,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,cAAc,GACpB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -2,7 +2,6 @@ export { createPermissions, getPermissions, PermissionsManager, resetPermissions
 export { attachPermissionContext, requirePermission, } from "./middleware";
 export { canPlatform, isPlatformStaffRole, normalizePlatformStaffRole, PLATFORM_STAFF_ROLES, platformAbilityFor, platformRoleHierarchy, } from "./platform";
 export { buildAbilityFor, CASLProvider, createCASLProvider, createPrismaAbility, getPrismaQuery, } from "./providers/casl";
-export { createOpenFGAProvider, OpenFGAProvider, } from "./providers/openfga";
 export { Can, Cannot, PermissionProvider as PermissionProviderComponent, usePermission, usePermissionContext, } from "./react";
 export { DEFAULT_ROLES, getDefaultRoles, getRoleDefinition, getRoleHierarchy, } from "./roles";
 export { ForbiddenError, } from "./types";

package/dist/types.d.ts

@@ -28,13 +28,10 @@ export interface PermissionProvider {
     defineRole(definition: RoleDefinition): void;
     buildAbilityFor(context: PermissionContext): unknown;
 }
-export type PermissionProviderType = "casl" | "openfga";
+export type PermissionProviderType = "casl";
 export interface PermissionConfig {
     provider?: PermissionProviderType;
     roles?: RoleDefinition[];
-    openFgaApiUrl?: string;
-    openFgaStoreId?: string | undefined;
-    openFgaAuthToken?: string | undefined;
 }
 export interface AbilityOptions {
     resolveAction?: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,MAAM,GACd,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,SAAS,GACT,WAAW,GACX,MAAM,GACN,SAAS,GACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,aAAa,GACb,eAAe,GACf,YAAY,GACZ,UAAU,GACV,MAAM,CAAC;AAEX,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAEhG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC;IACzB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CACD,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IACX,MAAM,CACJ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IACX,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9C,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAE9B,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;IAClB,OAAO,CAAC,EAAE,iBAAiB;gBAF3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,iBAAiB,YAAA;CAKrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,MAAM,GACd,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,SAAS,GACT,WAAW,GACX,MAAM,GACN,SAAS,GACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,aAAa,GACb,eAAe,GACf,YAAY,GACZ,UAAU,GACV,MAAM,CAAC;AAEX,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAEhG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC;IACzB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CACD,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IACX,MAAM,CACJ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;IACX,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9C,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAE9B,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,QAAQ;IAClB,OAAO,CAAC,EAAE,iBAAiB;gBAF3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,iBAAiB,YAAA;CAKrC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebutra/permissions",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "private": false,
   "license": "MIT",
   "type": "module",
@@ -9,15 +9,14 @@
     "status": "foundation",
     "productionReady": false,
     "requires": [
-      "CASL (in-process, no external creds)",
-      "or OPENFGA_API_URL + OPENFGA_STORE_ID for Zanzibar-style"
+      "CASL (in-process, no external creds)"
     ],
     "gaps": [
-      "OpenFGA model and tuple lifecycle management remain external"
+      "Policies are evaluated in-process only; there is no external relationship store for cross-service authorization"
     ],
     "featureId": "permissions",
     "category": "iam",
-    "summary": "RBAC/ABAC engine — CASL (in-process) + OpenFGA (Zanzibar)"
+    "summary": "RBAC/ABAC engine — CASL (in-process)"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -30,10 +29,6 @@
       "types": "./dist/providers/casl.d.ts",
       "import": "./dist/providers/casl.js"
     },
-    "./openfga": {
-      "types": "./dist/providers/openfga.d.ts",
-      "import": "./dist/providers/openfga.js"
-    },
     "./react": {
       "types": "./dist/react.d.ts",
       "import": "./dist/react.js"
@@ -55,7 +50,7 @@
     "@casl/ability": "^6.7.0",
     "@casl/prisma": "^1.5.1",
     "zod": "^4.3.6",
-    "@nebutra/logger": "2.0.0"
+    "@nebutra/logger": "3.0.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",

package/dist/providers/openfga.d.ts

@@ -1,58 +0,0 @@
-import type { Action, PermissionContext, PermissionProvider, PermissionRule, Resource, RoleDefinition } from "../types";
-export interface OpenFGATuple {
-    user: string;
-    relation: string;
-    object: string;
-}
-export interface OpenFGAProviderConfig {
-    apiUrl?: string | undefined;
-    storeId?: string | undefined;
-    authToken?: string | undefined;
-}
-export interface OpenFGACheckRequest {
-    tuple_key: {
-        user: string;
-        relation: string;
-        object: string;
-    };
-}
-export interface OpenFGACheckResponse {
-    allowed: boolean;
-}
-export interface OpenFGAWriteRequest {
-    writes?: {
-        tuple_keys: OpenFGATuple[];
-    };
-    deletes?: {
-        tuple_keys: OpenFGATuple[];
-    };
-}
-export interface OpenFGAListObjectsRequest {
-    user: string;
-    relation: string;
-    type: string;
-}
-export declare class OpenFGAProvider implements PermissionProvider {
-    private apiUrl;
-    private storeId;
-    private authToken;
-    private roleDefinitions;
-    constructor(config?: string | OpenFGAProviderConfig, roles?: RoleDefinition[]);
-    defineRole(definition: RoleDefinition): void;
-    getRulesForRole(role: string): PermissionRule[];
-    private endpoint;
-    private headers;
-    check(user: string, relation: string, object: string): Promise<boolean>;
-    write(tuples: OpenFGATuple[]): Promise<void>;
-    delete(tuples: OpenFGATuple[]): Promise<void>;
-    listObjects(user: string, relation: string, type: string): Promise<string[]>;
-    can(_context: PermissionContext, _action: Action, _resource: Resource, _subject?: unknown): boolean;
-    cannot(context: PermissionContext, action: Action, resource: Resource, subject?: unknown): boolean;
-    canAsync(context: PermissionContext, action: Action, resource: Resource, subject?: unknown): Promise<boolean>;
-    private formatUser;
-    private formatObject;
-    private extractSubjectId;
-    buildAbilityFor(_context: PermissionContext): unknown;
-}
-export declare function createOpenFGAProvider(config?: string | OpenFGAProviderConfig, roles?: RoleDefinition[]): OpenFGAProvider;
-//# sourceMappingURL=openfga.d.ts.map

package/dist/providers/openfga.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"openfga.d.ts","sourceRoot":"","sources":["../../src/providers/openfga.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,MAAM,EACN,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,YAAY,EAAE,CAAC;KAC5B,CAAC;IACF,OAAO,CAAC,EAAE;QACR,UAAU,EAAE,YAAY,EAAE,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,eAAe,CAA0C;gBAErD,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB,EAAE,KAAK,CAAC,EAAE,cAAc,EAAE;IAgB7E,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI;IAI5C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE;IAK/C,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,OAAO;IAUT,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkCvE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B5C,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B7C,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgClF,GAAG,CACD,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,QAAQ,EACnB,QAAQ,CAAC,EAAE,OAAO,GACjB,OAAO;IAOV,MAAM,CACJ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO;IAIJ,QAAQ,CACZ,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC;IAWnB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,YAAY;IAoBpB,OAAO,CAAC,gBAAgB;IAoBxB,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO;CAGtD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB,EACvC,KAAK,CAAC,EAAE,cAAc,EAAE,GACvB,eAAe,CAEjB"}

package/dist/providers/openfga.js

@@ -1,212 +0,0 @@
-import { logger } from "@nebutra/logger";
-export class OpenFGAProvider {
-    apiUrl;
-    storeId;
-    authToken;
-    roleDefinitions = new Map();
-    constructor(config, roles) {
-        const resolvedConfig = typeof config === "string" ? { apiUrl: config } : config;
-        this.apiUrl = resolvedConfig?.apiUrl || process.env.OPENFGA_API_URL || "http://localhost:8080";
-        const resolvedStoreId = resolvedConfig?.storeId || process.env.OPENFGA_STORE_ID;
-        if (resolvedStoreId !== undefined)
-            this.storeId = resolvedStoreId;
-        const resolvedAuthToken = resolvedConfig?.authToken || process.env.OPENFGA_AUTH_TOKEN;
-        if (resolvedAuthToken !== undefined)
-            this.authToken = resolvedAuthToken;
-        if (roles) {
-            for (const role of roles) {
-                this.roleDefinitions.set(role.role, role);
-            }
-        }
-    }
-    defineRole(definition) {
-        this.roleDefinitions.set(definition.role, definition);
-    }
-    getRulesForRole(role) {
-        const definition = this.roleDefinitions.get(role);
-        return definition?.rules || [];
-    }
-    endpoint(path) {
-        if (!this.storeId) {
-            logger.error("OpenFGA store id is required", { path });
-            return null;
-        }
-        const apiUrl = this.apiUrl.replace(/\/+$/, "");
-        const storeId = encodeURIComponent(this.storeId);
-        return `${apiUrl}/stores/${storeId}/${path}`;
-    }
-    headers() {
-        const headers = { "Content-Type": "application/json" };
-        if (this.authToken) {
-            headers.Authorization = `Bearer ${this.authToken}`;
-        }
-        return headers;
-    }
-    async check(user, relation, object) {
-        const request = {
-            tuple_key: {
-                object,
-                relation,
-                user,
-            },
-        };
-        const endpoint = this.endpoint("check");
-        if (!endpoint) {
-            return false;
-        }
-        try {
-            const response = await fetch(endpoint, {
-                method: "POST",
-                headers: this.headers(),
-                body: JSON.stringify(request),
-            });
-            if (!response.ok) {
-                logger.error("OpenFGA check failed", { status: response.status, user, relation, object });
-                return false;
-            }
-            const data = await response.json();
-            return data.allowed === true;
-        }
-        catch (error) {
-            logger.error("OpenFGA check error", { error, user, relation, object });
-            return false;
-        }
-    }
-    async write(tuples) {
-        const request = {
-            writes: {
-                tuple_keys: tuples,
-            },
-        };
-        const endpoint = this.endpoint("write");
-        if (!endpoint) {
-            throw new Error("OpenFGA write failed: missing store id");
-        }
-        try {
-            const response = await fetch(endpoint, {
-                method: "POST",
-                headers: this.headers(),
-                body: JSON.stringify(request),
-            });
-            if (!response.ok) {
-                logger.error("OpenFGA write failed", { status: response.status });
-                throw new Error(`OpenFGA write failed: ${response.statusText}`);
-            }
-        }
-        catch (error) {
-            logger.error("OpenFGA write error", { error });
-            throw error;
-        }
-    }
-    async delete(tuples) {
-        const request = {
-            deletes: {
-                tuple_keys: tuples,
-            },
-        };
-        const endpoint = this.endpoint("write");
-        if (!endpoint) {
-            throw new Error("OpenFGA delete failed: missing store id");
-        }
-        try {
-            const response = await fetch(endpoint, {
-                method: "POST",
-                headers: this.headers(),
-                body: JSON.stringify(request),
-            });
-            if (!response.ok) {
-                logger.error("OpenFGA delete failed", { status: response.status });
-                throw new Error(`OpenFGA delete failed: ${response.statusText}`);
-            }
-        }
-        catch (error) {
-            logger.error("OpenFGA delete error", { error });
-            throw error;
-        }
-    }
-    async listObjects(user, relation, type) {
-        const request = {
-            relation,
-            type,
-            user,
-        };
-        const endpoint = this.endpoint("list-objects");
-        if (!endpoint) {
-            return [];
-        }
-        try {
-            const response = await fetch(endpoint, {
-                method: "POST",
-                headers: this.headers(),
-                body: JSON.stringify(request),
-            });
-            if (!response.ok) {
-                logger.error("OpenFGA listObjects failed", { status: response.status });
-                return [];
-            }
-            const data = await response.json();
-            return data.objects || [];
-        }
-        catch (error) {
-            logger.error("OpenFGA listObjects error", { error });
-            return [];
-        }
-    }
-    can(_context, _action, _resource, _subject) {
-        logger.warn("OpenFGAProvider.can() is synchronous wrapper - use checkAsync() for actual checks");
-        return false;
-    }
-    cannot(context, action, resource, subject) {
-        return !this.can(context, action, resource, subject);
-    }
-    async canAsync(context, action, resource, subject) {
-        const user = this.formatUser(context.userId);
-        const object = this.formatObject(resource, subject);
-        if (!user || !object) {
-            return false;
-        }
-        return this.check(user, action, object);
-    }
-    formatUser(userId) {
-        const trimmed = userId.trim();
-        if (!trimmed) {
-            return null;
-        }
-        return trimmed.includes(":") ? trimmed : `user:${trimmed}`;
-    }
-    formatObject(resource, subject) {
-        const objectId = this.extractSubjectId(subject);
-        if (!objectId) {
-            return null;
-        }
-        if (objectId.includes(":")) {
-            return objectId;
-        }
-        const objectType = String(resource).trim();
-        if (!objectType) {
-            return null;
-        }
-        return `${objectType}:${objectId}`;
-    }
-    extractSubjectId(subject) {
-        if (typeof subject === "string") {
-            const trimmed = subject.trim();
-            return trimmed || null;
-        }
-        if (subject === null || typeof subject !== "object" || Array.isArray(subject)) {
-            return null;
-        }
-        const id = subject.id;
-        if (typeof id !== "string") {
-            return null;
-        }
-        const trimmed = id.trim();
-        return trimmed || null;
-    }
-    buildAbilityFor(_context) {
-        return this;
-    }
-}
-export function createOpenFGAProvider(config, roles) {
-    return new OpenFGAProvider(config, roles);
-}