@neohm/nestend 5.0.2 → 6.1.0

package/dist/auth/services/tenant.membership.service.js

@@ -21,6 +21,7 @@ const tenant_user_entity_1 = require("../entities/tenant.user.entity");
 const user_entity_1 = require("../entities/user.entity");
 const user_type_enum_1 = require("../enums/user.type.enum");
 const access_revocation_1 = require("../utilities/access.revocation");
+const role_catalogue_1 = require("../utilities/role.catalogue");
 const tenant_access_1 = require("../utilities/tenant.access");
 const auth_service_1 = require("./auth.service");
 let TenantMembershipService = TenantMembershipService_1 = class TenantMembershipService {
@@ -86,13 +87,16 @@ let TenantMembershipService = TenantMembershipService_1 = class TenantMembership
             tenant_id: await this.landingTenant(row),
         });
     }
-    async setMemberRoles(userId, tenantId, roleIds, actorId, guardAdmin = true) {
+    async setMemberRoles(userId, tenantId, roleIds, actorId, guardAdmin = true, authority) {
         await this.assertLiveRoles(roleIds);
         await this.dataSource.transaction(async (trx) => {
             await this.requireMembership(trx, userId, tenantId);
+            const next = authority
+                ? await this.withinAuthority(trx, authority, userId, tenantId, roleIds)
+                : roleIds;
             if (guardAdmin)
-                await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, userId, roleIds);
-            await tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, roleIds, actorId);
+                await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, userId, next);
+            await tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, next, actorId);
         });
         return tenant_access_1.TenantAccess.activeRoles(this.dataSource.manager, userId, tenantId);
     }
@@ -106,6 +110,21 @@ let TenantMembershipService = TenantMembershipService_1 = class TenantMembership
         });
         return { id: membership.id, deleted: true, deleted_by: actorId };
     }
+    async withinAuthority(manager, authority, userId, tenantId, roleIds) {
+        const held = await role_catalogue_1.RoleCatalogue.heldRoleIds(manager, userId, tenantId);
+        const visible = (roleId) => !!authority.hierarchy.role(roleId);
+        const forbidden = authority.forbiddenChanges(held.filter(visible), roleIds.filter(visible));
+        if (forbidden.length)
+            throw new common_1.BadRequestException({
+                message: 'Validation failed',
+                errors: {
+                    role_ids: forbidden.map((roleId) => `You may not grant or revoke role '${roleId}'`),
+                },
+            });
+        return [
+            ...new Set([...roleIds, ...held.filter((roleId) => !visible(roleId))]),
+        ];
+    }
     async assertLiveRoles(roleIds) {
         const unique = [...new Set(roleIds)];
         if (!unique.length)

package/dist/auth/services/tenant.membership.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAIwB;AACxB,qCAAoE;AACpE,+EAA2E;AAC3E,qFAAgF;AAEhF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,4DAAmD;AAOnD,sEAAkE;AAClE,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QAEF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uCAAiB,CAAC,oCAAoC,CAAC,CAAC;QAEpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACxE,MAAM,4BAAY,CAAC,cAAc,CAC/B,GAAG,EACH,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,4BAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,IAAI,UAAU;gBACvB,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAChB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3D,MAAM,4BAAY,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qCAAgB,EAAE;YACzD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAAC,eAAuB,EAAE,MAAc;QAClE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,GACL,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG9D,CAAC,GAAG,CAAC;QACR,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,KAAK,MAAM;YACpB,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuQnC"}
+{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAIwB;AACxB,qCAAoE;AACpE,+EAA2E;AAC3E,qFAAgF;AAEhF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,4DAAmD;AAOnD,sEAAkE;AAElE,gEAA4D;AAC5D,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QAEF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uCAAiB,CAAC,oCAAoC,CAAC,CAAC;QAEpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAQD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI,EACjB,SAA0B;QAE1B,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,SAAS;gBACpB,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;gBACvE,CAAC,CAAC,OAAO,CAAC;YACZ,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,4BAAY,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,4BAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAOO,KAAK,CAAC,eAAe,CAC3B,OAAsB,EACtB,SAAyB,EACzB,MAAc,EACd,QAAgB,EAChB,OAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,8BAAa,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,SAAS,CAAC,gBAAgB,CAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EACpB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CACxB,CAAC;QACF,IAAI,SAAS,CAAC,MAAM;YAClB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,SAAS,CAAC,GAAG,CACrB,CAAC,MAAM,EAAE,EAAE,CAAC,qCAAqC,MAAM,GAAG,CAC3D;iBACF;aACF,CAAC,CAAC;QACL,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,IAAI,UAAU;gBACvB,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAChB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3D,MAAM,4BAAY,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qCAAgB,EAAE;YACzD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAAC,eAAuB,EAAE,MAAc;QAClE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,GACL,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG9D,CAAC,GAAG,CAAC;QACR,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,KAAK,MAAM;YACpB,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvSY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuSnC"}

package/dist/auth/types/api.key.types.d.ts

@@ -1,9 +1,11 @@
 import { ApiKeyEntity } from '../entities/api.key.entity';
 import { ScopeEntity } from '../entities/scope.entity';
+import { SystemRoleEntity } from '../entities/system.role.entity';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
 export interface GenerateApiKeyOptions {
     tenantId?: string;
     scopeIds?: string[];
+    roleIds?: string[];
     expiresAt?: Date;
     createdBy?: string;
 }
@@ -15,12 +17,16 @@ export interface ApiKeyContextValue {
     apiKey: ApiKeyEntity;
     tenant?: TenantEntity;
     scopes: string[];
+    roles: string[];
+    permissions: string[];
 }
+export type ApiKeyGrant = Pick<ApiKeyContextValue, 'scopes' | 'roles' | 'permissions'>;
 export interface ApiKeyAccess {
     tenant: TenantEntity;
 }
 export type ApiKeyDetail = Omit<ApiKeyEntity, 'key_hash'> & {
     scopes: ScopeEntity[];
+    roles: SystemRoleEntity[];
     key?: string;
 };
 export interface KeyScopeGrant {

package/dist/auth/types/api.key.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/api.key.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAGD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IAErB,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAGD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;CACtB;AAOD,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG;IAC1D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"api.key.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/api.key.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAGD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IAErB,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,kBAAkB,EAClB,QAAQ,GAAG,OAAO,GAAG,aAAa,CACnC,CAAC;AAGF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;CACtB;AAOD,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG;IAC1D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/auth/types/auth.types.d.ts

@@ -112,6 +112,8 @@ export interface PendingInvitation {
 export interface CurrentUserProfile {
     user: UserEntity;
     roles: SystemRoleEntity[];
+    permissions: string[];
+    grantable_scopes: string[];
     organization: string | null;
     organizations: OrganizationSummary[];
     invitations: PendingInvitation[];

package/dist/auth/types/auth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGxE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,aAAa,GACb,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,QAAQ,GACR,oBAAoB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAElB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAG5E,MAAM,WAAW,eAAe;IAE9B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGxE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,aAAa,GACb,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,QAAQ,GACR,oBAAoB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAElB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAG5E,MAAM,WAAW,eAAe;IAE9B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}

package/dist/auth/types/rbac.types.d.ts

@@ -0,0 +1,39 @@
+export interface HierarchyRole {
+    id: string;
+    identifier: string;
+    name?: string;
+    description?: string;
+    scope_id: string | null;
+    priority: number;
+}
+export interface HierarchyScope {
+    id: string;
+    identifier: string;
+    parent_id: string | null;
+}
+export interface HierarchyGrant {
+    role_id: string;
+    permission: string;
+    scope_id: string;
+}
+export interface RoleCatalogueData {
+    roles: HierarchyRole[];
+    scopes: HierarchyScope[];
+    grants?: HierarchyGrant[];
+    permissions?: {
+        identifier: string;
+        scope_id: string;
+    }[];
+}
+export interface EffectiveAccess {
+    roles: string[];
+    permissions: string[];
+    grantable_scopes: string[];
+    is_global_admin: boolean;
+}
+export interface RoleCatalogueLoadOptions {
+    tenantId?: string | null;
+    scopeIds?: Set<string>;
+    withPermissions?: boolean;
+}
+//# sourceMappingURL=rbac.types.d.ts.map

package/dist/auth/types/rbac.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/rbac.types.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAEhB,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAE1B,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1D;AAGD,MAAM,WAAW,eAAe;IAE9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAGD,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEvB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/dist/auth/types/rbac.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rbac.types.js.map

package/dist/auth/types/rbac.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.types.js","sourceRoot":"","sources":["../../../src/auth/types/rbac.types.ts"],"names":[],"mappings":""}

package/dist/auth/utilities/grant.authority.d.ts

@@ -0,0 +1,14 @@
+import { HierarchyRole } from '../types/rbac.types';
+import { RoleHierarchy } from './role.hierarchy';
+export declare class GrantAuthority {
+    readonly hierarchy: RoleHierarchy;
+    readonly heldRoleIds: string[];
+    private readonly impersonating;
+    constructor(hierarchy: RoleHierarchy, heldRoleIds: string[], impersonating?: boolean);
+    get actsAsGlobalAdmin(): boolean;
+    canGrant(roleId: string): boolean;
+    grantableRoles(): HierarchyRole[];
+    get any(): boolean;
+    forbiddenChanges(before: Iterable<string>, after: Iterable<string>): string[];
+}
+//# sourceMappingURL=grant.authority.d.ts.map

package/dist/auth/utilities/grant.authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.authority.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/grant.authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOjD,qBAAa,cAAc;IAEvB,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFrB,SAAS,EAAE,aAAa,EACxB,WAAW,EAAE,MAAM,EAAE,EACb,aAAa,UAAQ;IAGxC,IAAI,iBAAiB,IAAI,OAAO,CAI/B;IAGD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IASjC,cAAc,IAAI,aAAa,EAAE;IAMjC,IAAI,GAAG,IAAI,OAAO,CAEjB;IAGD,gBAAgB,CACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EACxB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,MAAM,EAAE;CASZ"}

package/dist/auth/utilities/grant.authority.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantAuthority = void 0;
+class GrantAuthority {
+    constructor(hierarchy, heldRoleIds, impersonating = false) {
+        this.hierarchy = hierarchy;
+        this.heldRoleIds = heldRoleIds;
+        this.impersonating = impersonating;
+    }
+    get actsAsGlobalAdmin() {
+        return (this.impersonating || this.hierarchy.holdsGlobalAdmin(this.heldRoleIds));
+    }
+    canGrant(roleId) {
+        if (!this.hierarchy.role(roleId))
+            return false;
+        return (this.actsAsGlobalAdmin ||
+            this.hierarchy.canGrant(this.heldRoleIds, roleId));
+    }
+    grantableRoles() {
+        if (this.actsAsGlobalAdmin)
+            return this.hierarchy.allRoles();
+        return this.hierarchy.grantableRoles(this.heldRoleIds);
+    }
+    get any() {
+        return this.grantableRoles().length > 0;
+    }
+    forbiddenChanges(before, after) {
+        const was = new Set(before);
+        const will = new Set(after);
+        const changed = [
+            ...[...will].filter((roleId) => !was.has(roleId)),
+            ...[...was].filter((roleId) => !will.has(roleId)),
+        ];
+        return changed.filter((roleId) => !this.canGrant(roleId));
+    }
+}
+exports.GrantAuthority = GrantAuthority;
+//# sourceMappingURL=grant.authority.js.map

package/dist/auth/utilities/grant.authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.authority.js","sourceRoot":"","sources":["../../../src/auth/utilities/grant.authority.ts"],"names":[],"mappings":";;;AAQA,MAAa,cAAc;IACzB,YACW,SAAwB,EACxB,WAAqB,EACb,gBAAgB,KAAK;QAF7B,cAAS,GAAT,SAAS,CAAe;QACxB,gBAAW,GAAX,WAAW,CAAU;QACb,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ,IAAI,iBAAiB;QACnB,OAAO,CACL,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CACxE,CAAC;IACJ,CAAC;IAGD,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CACL,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAClD,CAAC;IACJ,CAAC;IAGD,cAAc;QACZ,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAGD,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC;IAGD,gBAAgB,CACd,MAAwB,EACxB,KAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjD,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SAClD,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AA9CD,wCA8CC"}

package/dist/auth/utilities/role.catalogue.d.ts

@@ -0,0 +1,10 @@
+import { EntityManager } from 'typeorm';
+import { RoleCatalogueLoadOptions } from '../types/rbac.types';
+import { RoleHierarchy } from './role.hierarchy';
+export declare class RoleCatalogue {
+    static load(manager: EntityManager, options?: RoleCatalogueLoadOptions): Promise<RoleHierarchy>;
+    static heldRoleIds(manager: EntityManager, userId: string, tenantId: string | null | undefined): Promise<string[]>;
+    static keyRoleIds(manager: EntityManager, apiKeyId: string): Promise<string[]>;
+    private static scopeFilter;
+}
+//# sourceMappingURL=role.catalogue.d.ts.map

package/dist/auth/utilities/role.catalogue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.catalogue.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/role.catalogue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD,qBAAa,aAAa;WAKX,IAAI,CACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,aAAa,CAAC;WAyDZ,WAAW,CACtB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAAC,MAAM,EAAE,CAAC;WAUP,UAAU,CACrB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC;mBAQC,WAAW;CAcjC"}

package/dist/auth/utilities/role.catalogue.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleCatalogue = void 0;
+const api_key_role_entity_1 = require("../entities/api.key.role.entity");
+const permission_entity_1 = require("../entities/permission.entity");
+const role_permission_entity_1 = require("../entities/role.permission.entity");
+const scope_entity_1 = require("../entities/scope.entity");
+const system_role_entity_1 = require("../entities/system.role.entity");
+const user_role_entity_1 = require("../entities/user.role.entity");
+const role_hierarchy_1 = require("./role.hierarchy");
+const scope_cascade_1 = require("./scope.cascade");
+class RoleCatalogue {
+    static async load(manager, options = {}) {
+        const [roles, scopes, grants, permissions, tenantScopeIds] = await Promise.all([
+            manager.find(system_role_entity_1.SystemRoleEntity, {
+                where: { is_active: true },
+                select: {
+                    id: true,
+                    identifier: true,
+                    name: true,
+                    description: true,
+                    scope_id: true,
+                    priority: true,
+                },
+            }),
+            manager.find(scope_entity_1.ScopeEntity, {
+                select: { id: true, identifier: true, parent_id: true },
+            }),
+            options.withPermissions
+                ? manager.find(role_permission_entity_1.RolePermissionEntity, {
+                    relations: { permission: true },
+                })
+                : Promise.resolve([]),
+            options.withPermissions
+                ? manager.find(permission_entity_1.PermissionEntity, {
+                    select: { identifier: true, scope_id: true },
+                })
+                : Promise.resolve([]),
+            RoleCatalogue.scopeFilter(manager, options),
+        ]);
+        return new role_hierarchy_1.RoleHierarchy({
+            roles: roles.map((role) => ({
+                ...role,
+                scope_id: role.scope_id ?? null,
+            })),
+            scopes: scopes.map((scope) => ({
+                ...scope,
+                parent_id: scope.parent_id ?? null,
+            })),
+            grants: grants
+                .filter((grant) => !!grant.permission)
+                .map((grant) => ({
+                role_id: grant.role_id,
+                permission: grant.permission.identifier,
+                scope_id: grant.permission.scope_id,
+            })),
+            permissions: permissions.map(({ identifier, scope_id }) => ({
+                identifier,
+                scope_id,
+            })),
+        }, tenantScopeIds);
+    }
+    static async heldRoleIds(manager, userId, tenantId) {
+        if (!tenantId)
+            return [];
+        const grants = await manager.find(user_role_entity_1.UserRoleEntity, {
+            where: { user_id: userId, tenant_id: tenantId },
+            select: { role_id: true },
+        });
+        return grants.map((grant) => grant.role_id);
+    }
+    static async keyRoleIds(manager, apiKeyId) {
+        const grants = await manager.find(api_key_role_entity_1.ApiKeyRoleEntity, {
+            where: { api_key_id: apiKeyId },
+            select: { role_id: true },
+        });
+        return grants.map((grant) => grant.role_id);
+    }
+    static async scopeFilter(manager, options) {
+        if (options.scopeIds)
+            return options.scopeIds;
+        if (options.tenantId === undefined)
+            return undefined;
+        if (!options.tenantId)
+            return new Set();
+        const scopes = await scope_cascade_1.ScopeCascade.tenantEffective(manager, options.tenantId);
+        return new Set(scopes.map((scope) => scope.id));
+    }
+}
+exports.RoleCatalogue = RoleCatalogue;
+//# sourceMappingURL=role.catalogue.js.map

package/dist/auth/utilities/role.catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.catalogue.js","sourceRoot":"","sources":["../../../src/auth/utilities/role.catalogue.ts"],"names":[],"mappings":";;;AACA,yEAAmE;AACnE,qEAAiE;AACjE,+EAA0E;AAC1E,2DAAuD;AACvD,uEAAkE;AAClE,mEAA8D;AAE9D,qDAAiD;AACjD,mDAA+C;AAG/C,MAAa,aAAa;IAKxB,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAAsB,EACtB,UAAoC,EAAE;QAEtC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,GACxD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,qCAAgB,EAAE;gBAC7B,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC1B,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,0BAAW,EAAE;gBACxB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;aACxD,CAAC;YACF,OAAO,CAAC,eAAe;gBACrB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,6CAAoB,EAAE;oBACjC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;iBAChC,CAAC;gBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAA4B,CAAC;YACjD,OAAO,CAAC,eAAe;gBACrB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAgB,EAAE;oBAC7B,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C,CAAC;gBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAwB,CAAC;YAC7C,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;SAC5C,CAAC,CAAC;QAEL,OAAO,IAAI,8BAAa,CACtB;YACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,IAAI;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;aAChC,CAAC,CAAC;YACH,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7B,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACnC,CAAC,CAAC;YACH,MAAM,EAAE,MAAM;iBACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;iBACrC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACf,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;aACpC,CAAC,CAAC;YACL,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1D,UAAU;gBACV,QAAQ;aACT,CAAC,CAAC;SACJ,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAAsB,EACtB,MAAc,EACd,QAAmC;QAEnC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iCAAc,EAAE;YAChD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,OAAsB,EACtB,QAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,sCAAgB,EAAE;YAClD,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;YAC/B,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,WAAW,CAC9B,OAAsB,EACtB,OAAiC;QAEjC,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAErD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,eAAe,CAC/C,OAAO,EACP,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AAxGD,sCAwGC"}

package/dist/auth/utilities/role.hierarchy.d.ts

@@ -0,0 +1,33 @@
+import { EffectiveAccess, HierarchyRole, HierarchyScope, RoleCatalogueData } from '../types/rbac.types';
+export declare class RoleHierarchy {
+    private readonly roles;
+    private readonly roleById;
+    private readonly roleByIdentifier;
+    private readonly scopeById;
+    private readonly topPriority;
+    private readonly grantsByRole;
+    private readonly permissions;
+    constructor(data: RoleCatalogueData, tenantScopeIds?: Set<string>);
+    knowsRole(identifier: string): boolean;
+    knowsPermission(permission: string): boolean;
+    role(roleId: string): HierarchyRole | undefined;
+    scope(scopeId: string): HierarchyScope | undefined;
+    allRoles(): HierarchyRole[];
+    effective(heldRoleIds: Iterable<string>): HierarchyRole[];
+    static isGlobalAdmin(role: Pick<HierarchyRole, 'identifier'>): boolean;
+    holdsGlobalAdmin(heldRoleIds: Iterable<string>): boolean;
+    covers(held: HierarchyRole, required: HierarchyRole): boolean;
+    satisfiesRole(heldRoleIds: Iterable<string>, identifier: string): boolean;
+    coveredRoles(heldRoleIds: Iterable<string>): HierarchyRole[];
+    permissionsOf(heldRoleIds: Iterable<string>): Set<string>;
+    holdsPermission(heldRoleIds: Iterable<string>, permission: string): boolean;
+    isTopRole(role: Pick<HierarchyRole, 'identifier' | 'scope_id' | 'priority'>): boolean;
+    administers(heldRoleIds: Iterable<string>, scopeId: string): boolean;
+    canGrant(heldRoleIds: Iterable<string>, roleId: string): boolean;
+    grantableRoles(heldRoleIds: Iterable<string>): HierarchyRole[];
+    hasGrantAuthority(heldRoleIds: Iterable<string>): boolean;
+    grantableScopes(heldRoleIds: Iterable<string>): HierarchyScope[];
+    access(heldRoleIds: Iterable<string>, actsAsGlobalAdmin?: boolean): EffectiveAccess;
+    private scopesWithRoles;
+}
+//# sourceMappingURL=role.hierarchy.d.ts.map

package/dist/auth/utilities/role.hierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.hierarchy.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/role.hierarchy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EAEf,aAAa,EACb,cAAc,EACd,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAU7B,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;IACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;gBAO9B,IAAI,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;IAoCjE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKtC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAK5C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAKlD,QAAQ,IAAI,aAAa,EAAE;IAK3B,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,aAAa,EAAE;IASzD,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,OAAO;IAItE,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO;IAOxD,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO;IAgB7D,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IASzE,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,aAAa,EAAE;IAQ5D,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IAczD,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAM3E,SAAS,CACP,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC,GAChE,OAAO;IAMV,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAgBpE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAShE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,aAAa,EAAE;IAM9D,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO;IAKzD,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE;IAWhE,MAAM,CACJ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC7B,iBAAiB,UAAQ,GACxB,eAAe;IAgBlB,OAAO,CAAC,eAAe;CAUxB"}

package/dist/auth/utilities/role.hierarchy.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleHierarchy = void 0;
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+class RoleHierarchy {
+    constructor(data, tenantScopeIds) {
+        this.topPriority = new Map();
+        this.grantsByRole = new Map();
+        const inTenant = (scopeId) => !scopeId || !tenantScopeIds || tenantScopeIds.has(scopeId);
+        this.roles = data.roles.filter((role) => inTenant(role.scope_id));
+        this.roleById = new Map(this.roles.map((role) => [role.id, role]));
+        this.roleByIdentifier = new Map(this.roles.map((role) => [role.identifier, role]));
+        this.scopeById = new Map(data.scopes.map((scope) => [scope.id, scope]));
+        for (const role of this.roles) {
+            if (!role.scope_id)
+                continue;
+            const top = this.topPriority.get(role.scope_id);
+            if (top === undefined || role.priority < top)
+                this.topPriority.set(role.scope_id, role.priority);
+        }
+        const grants = (data.grants ?? []).filter((grant) => inTenant(grant.scope_id));
+        for (const grant of grants) {
+            const list = this.grantsByRole.get(grant.role_id) ?? [];
+            list.push(grant);
+            this.grantsByRole.set(grant.role_id, list);
+        }
+        this.permissions = new Set([
+            ...grants.map((grant) => grant.permission),
+            ...(data.permissions ?? [])
+                .filter((permission) => inTenant(permission.scope_id))
+                .map((permission) => permission.identifier),
+        ]);
+    }
+    knowsRole(identifier) {
+        return this.roleByIdentifier.has(identifier);
+    }
+    knowsPermission(permission) {
+        return this.permissions.has(permission);
+    }
+    role(roleId) {
+        return this.roleById.get(roleId);
+    }
+    scope(scopeId) {
+        return this.scopeById.get(scopeId);
+    }
+    allRoles() {
+        return [...this.roles];
+    }
+    effective(heldRoleIds) {
+        const held = new Map();
+        for (const roleId of heldRoleIds) {
+            const role = this.roleById.get(roleId);
+            if (role)
+                held.set(role.id, role);
+        }
+        return [...held.values()];
+    }
+    static isGlobalAdmin(role) {
+        return role.identifier === String(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+    }
+    holdsGlobalAdmin(heldRoleIds) {
+        return this.effective(heldRoleIds).some((role) => RoleHierarchy.isGlobalAdmin(role));
+    }
+    covers(held, required) {
+        if (RoleHierarchy.isGlobalAdmin(held) || held.id === required.id)
+            return true;
+        if (!held.scope_id || !required.scope_id)
+            return false;
+        if (held.priority > required.priority)
+            return false;
+        return (held.scope_id === required.scope_id ||
+            held.scope_id === this.scopeById.get(required.scope_id)?.parent_id);
+    }
+    satisfiesRole(heldRoleIds, identifier) {
+        const required = this.roleByIdentifier.get(identifier);
+        if (!required)
+            return false;
+        return this.effective(heldRoleIds).some((role) => this.covers(role, required));
+    }
+    coveredRoles(heldRoleIds) {
+        const held = this.effective(heldRoleIds);
+        return this.roles.filter((candidate) => held.some((role) => this.covers(role, candidate)));
+    }
+    permissionsOf(heldRoleIds) {
+        const ids = [...heldRoleIds];
+        if (this.holdsGlobalAdmin(ids))
+            return new Set(this.permissions);
+        const reached = new Set();
+        for (const role of this.coveredRoles(ids))
+            for (const grant of this.grantsByRole.get(role.id) ?? [])
+                reached.add(grant.permission);
+        return reached;
+    }
+    holdsPermission(heldRoleIds, permission) {
+        if (!this.knowsPermission(permission))
+            return false;
+        return this.permissionsOf(heldRoleIds).has(permission);
+    }
+    isTopRole(role) {
+        if (!role.scope_id)
+            return RoleHierarchy.isGlobalAdmin(role);
+        return this.topPriority.get(role.scope_id) === role.priority;
+    }
+    administers(heldRoleIds, scopeId) {
+        const held = this.effective(heldRoleIds);
+        if (held.some((role) => RoleHierarchy.isGlobalAdmin(role)))
+            return true;
+        const parentId = this.scopeById.get(scopeId)?.parent_id;
+        return held.some((role) => !!role.scope_id &&
+            (role.scope_id === scopeId || role.scope_id === parentId) &&
+            this.isTopRole(role));
+    }
+    canGrant(heldRoleIds, roleId) {
+        const target = this.roleById.get(roleId);
+        if (!target)
+            return false;
+        const ids = [...heldRoleIds];
+        if (this.holdsGlobalAdmin(ids))
+            return true;
+        return !!target.scope_id && this.administers(ids, target.scope_id);
+    }
+    grantableRoles(heldRoleIds) {
+        const ids = [...heldRoleIds];
+        return this.roles.filter((role) => this.canGrant(ids, role.id));
+    }
+    hasGrantAuthority(heldRoleIds) {
+        return this.grantableRoles(heldRoleIds).length > 0;
+    }
+    grantableScopes(heldRoleIds) {
+        const ids = [...heldRoleIds];
+        return this.scopesWithRoles().filter((scope) => this.administers(ids, scope.id));
+    }
+    access(heldRoleIds, actsAsGlobalAdmin = false) {
+        const ids = [...heldRoleIds];
+        const isGlobalAdmin = actsAsGlobalAdmin || this.holdsGlobalAdmin(ids);
+        const scopes = isGlobalAdmin
+            ? this.scopesWithRoles()
+            : this.grantableScopes(ids);
+        return {
+            roles: this.effective(ids).map((role) => role.identifier),
+            permissions: [
+                ...(isGlobalAdmin ? this.permissions : this.permissionsOf(ids)),
+            ].sort(),
+            grantable_scopes: scopes.map((scope) => scope.identifier).sort(),
+            is_global_admin: isGlobalAdmin,
+        };
+    }
+    scopesWithRoles() {
+        const scopeIds = new Set(this.roles
+            .map((role) => role.scope_id)
+            .filter((scopeId) => !!scopeId));
+        return [...scopeIds]
+            .map((scopeId) => this.scopeById.get(scopeId))
+            .filter((scope) => !!scope);
+    }
+}
+exports.RoleHierarchy = RoleHierarchy;
+//# sourceMappingURL=role.hierarchy.js.map

package/dist/auth/utilities/role.hierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.hierarchy.js","sourceRoot":"","sources":["../../../src/auth/utilities/role.hierarchy.ts"],"names":[],"mappings":";;;AAAA,gEAAuD;AAiBvD,MAAa,aAAa;IAcxB,YAAY,IAAuB,EAAE,cAA4B;QAThD,gBAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,iBAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;QASlE,MAAM,QAAQ,GAAG,CAAC,OAAsB,EAAE,EAAE,CAC1C,CAAC,OAAO,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAExE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG;gBAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CACzB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC;YACzB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;iBACrD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAGD,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAGD,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAGD,IAAI,CAAC,MAAc;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAGD,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAGD,SAAS,CAAC,WAA6B;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,IAAuC;QAC1D,OAAO,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,gBAAgB,CAAC,WAA6B;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAClC,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,IAAmB,EAAE,QAAuB;QACjD,IAAI,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;YAC9D,OAAO,IAAI,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,CACL,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACnC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CACnE,CAAC;IACJ,CAAC;IAOD,aAAa,CAAC,WAA6B,EAAE,UAAkB;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC5B,CAAC;IACJ,CAAC;IAGD,YAAY,CAAC,WAA6B;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACrC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IAGD,aAAa,CAAC,WAA6B;QACzC,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;gBACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAMD,eAAe,CAAC,WAA6B,EAAE,UAAkB;QAC/D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAGD,SAAS,CACP,IAAiE;QAEjE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;IAC/D,CAAC;IAGD,WAAW,CAAC,WAA6B,EAAE,OAAe;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;QACxD,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACvB,CAAC;IACJ,CAAC;IAMD,QAAQ,CAAC,WAA6B,EAAE,MAAc;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IAGD,cAAc,CAAC,WAA6B;QAC1C,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAGD,iBAAiB,CAAC,WAA6B;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,CAAC;IAGD,eAAe,CAAC,WAA6B;QAC3C,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAChC,CAAC;IACJ,CAAC;IAMD,MAAM,CACJ,WAA6B,EAC7B,iBAAiB,GAAG,KAAK;QAEzB,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QAC7B,MAAM,aAAa,GAAG,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,aAAa;YAC1B,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;YACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACzD,WAAW,EAAE;gBACX,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;aAChE,CAAC,IAAI,EAAE;YACR,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;YAChE,eAAe,EAAE,aAAa;SAC/B,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,IAAI,CAAC,KAAK;aACP,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACrD,CAAC;QACF,OAAO,CAAC,GAAG,QAAQ,CAAC;aACjB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC7C,MAAM,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;CACF;AAvOD,sCAuOC"}

package/dist/auth/utilities/scope.cascade.d.ts

@@ -6,6 +6,8 @@ export declare class ScopeCascade {
     static expand(manager: EntityManager, granted: ScopeEntity[]): Promise<ScopeEntity[]>;
     static tenantEffective(manager: EntityManager, tenantId: string): Promise<ScopeEntity[]>;
     static pruneTenantKeys(manager: EntityManager, tenantId: string, revokedBy?: string): Promise<number>;
+    static pruneTenantKeyRoles(manager: EntityManager, tenantId: string, revokedBy?: string): Promise<number>;
+    static retireKeyRoles(manager: EntityManager, grantIds: string[], revokedBy?: string): Promise<number>;
     static setTenantScopes(manager: EntityManager, tenantId: string, scopeIds: string[], actorId?: string): Promise<void>;
     static retire(manager: EntityManager, grantIds: string[], revokedBy?: string): Promise<number>;
 }

package/dist/auth/utilities/scope.cascade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.cascade.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/scope.cascade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,qBAAa,YAAY;IAKvB,MAAM,CAAC,aAAa,CAClB,SAAS,EAAE,aAAa,EAAE,EAC1B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,GAClD,MAAM,EAAE;WAcE,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,WAAW,EAAE,CAAC;WAgBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,EAAE,CAAC;WAiBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;WAkBL,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAyCH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;CAWnB"}
+{"version":3,"file":"scope.cascade.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/scope.cascade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAOvD,qBAAa,YAAY;IAKvB,MAAM,CAAC,aAAa,CAClB,SAAS,EAAE,aAAa,EAAE,EAC1B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,GAClD,MAAM,EAAE;WAcE,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,WAAW,EAAE,CAAC;WAgBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,EAAE,CAAC;WAiBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;WAuBL,mBAAmB,CAC9B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;WAsCL,cAAc,CACzB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;WAgBL,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAyCH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;CAWnB"}