@nifrajs/auth 2.9.1 → 2.11.0

package/README.md

@@ -2,6 +2,9 @@
 
 Session primitives for nifra - signed-cookie + server-store sessions, CSRF, and route guards. Bring your own identity (Better Auth / Lucia / OAuth); nifra owns the session.
 
+`Authorizer`/`requireAuthorization` provide a small public policy seam. The application or data layer
+must decide ownership and permissions; Nifra stores no policy, tenant, or subject data.
+
 Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework - one core, five UI libraries, every runtime. Scaffold a new app with `bun create nifra`.
 
 ## Install

package/dist/authorization.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Public authorization seam. Nifra supplies the control-flow contract; the application or data layer
+ * supplies the actual policy. No subject/resource data is persisted or interpreted here.
+ */
+export interface AuthorizationRequest<Subject = unknown, Resource = unknown> {
+    readonly subject: Subject;
+    readonly action: string;
+    readonly resource?: Resource;
+}
+export type Authorizer<Subject = unknown, Resource = unknown> = (request: AuthorizationRequest<Subject, Resource>) => boolean | Promise<boolean>;
+/** Evaluate a policy, failing closed for any non-true result. */
+export declare function isAuthorized<Subject, Resource>(authorizer: Authorizer<Subject, Resource>, request: AuthorizationRequest<Subject, Resource>): Promise<boolean>;
+/** Require an application/data-layer policy to allow an action; denied requests throw a 403 Response. */
+export declare function requireAuthorization<Subject, Resource>(authorizer: Authorizer<Subject, Resource>, request: AuthorizationRequest<Subject, Resource>): Promise<void>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,oBAAoB,CAAC,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAC7B;AAED,MAAM,MAAM,UAAU,CAAC,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,IAAI,CAC9D,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAC7C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE/B,iEAAiE;AACjE,wBAAsB,YAAY,CAAC,OAAO,EAAE,QAAQ,EAClD,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAC/C,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,yGAAyG;AACzG,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAC1D,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/authorization.js

@@ -0,0 +1,11 @@
+/** Evaluate a policy, failing closed for any non-true result. */
+export async function isAuthorized(authorizer, request) {
+    return (await authorizer(request)) === true;
+}
+/** Require an application/data-layer policy to allow an action; denied requests throw a 403 Response. */
+export async function requireAuthorization(authorizer, request) {
+    if (await isAuthorized(authorizer, request))
+        return;
+    throw Response.json({ ok: false, error: "forbidden" }, { status: 403 });
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAcA,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAyC,EACzC,OAAgD;IAEhD,OAAO,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAA;AAC7C,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAyC,EACzC,OAAgD;IAEhD,IAAI,MAAM,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;QAAE,OAAM;IACnD,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AACzE,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@
  * pluggable-store + prod-guard discipline as the ISR cache. **Bring your own identity** (Better Auth,
  * Lucia, your own OAuth/password logic); nifra owns the session cookie, store, CSRF, and route guards.
  */
+export { type AuthorizationRequest, type Authorizer, isAuthorized, requireAuthorization, } from "./authorization.js";
 export { type CsrfOptions, csrf } from "./csrf.js";
 export { type GuardOptions, requireSession, requireUser } from "./guards.js";
 export { createSessions, type Session, type SessionContext, type SessionCookieOptions, type SessionManager, type SessionOptions, } from "./session.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,KAAK,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,eAAe,EACpB,cAAc,EACd,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,KAAK,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,KAAK,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,KAAK,eAAe,EACpB,cAAc,EACd,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -3,6 +3,7 @@
  * pluggable-store + prod-guard discipline as the ISR cache. **Bring your own identity** (Better Auth,
  * Lucia, your own OAuth/password logic); nifra owns the session cookie, store, CSRF, and route guards.
  */
+export { isAuthorized, requireAuthorization, } from "./authorization.js";
 export { csrf } from "./csrf.js";
 export { requireSession, requireUser } from "./guards.js";
 export { createSessions, } from "./session.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAqB,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,cAAc,GAMf,MAAM,cAAc,CAAA;AACrB,OAAO,EAEL,cAAc,EACd,kBAAkB,GAInB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,YAAY,EACZ,oBAAoB,GACrB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAqB,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,cAAc,GAMf,MAAM,cAAc,CAAA;AACrB,OAAO,EAEL,cAAc,EACd,kBAAkB,GAInB,MAAM,YAAY,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/auth",
-  "version": "2.9.1",
+  "version": "2.11.0",
   "description": "Session primitives for nifra - signed-cookie + server-store sessions, CSRF, and route guards. Bring your own identity (Better Auth / Lucia / OAuth); nifra owns the session.",
   "keywords": [
     "bun",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@nifrajs/core": "^2.9.1"
+    "@nifrajs/core": "^2.11.0"
   },
   "devDependencies": {
     "@nifrajs/core": "workspace:*"

package/src/authorization.ts

@@ -0,0 +1,30 @@
+/**
+ * Public authorization seam. Nifra supplies the control-flow contract; the application or data layer
+ * supplies the actual policy. No subject/resource data is persisted or interpreted here.
+ */
+export interface AuthorizationRequest<Subject = unknown, Resource = unknown> {
+  readonly subject: Subject
+  readonly action: string
+  readonly resource?: Resource
+}
+
+export type Authorizer<Subject = unknown, Resource = unknown> = (
+  request: AuthorizationRequest<Subject, Resource>,
+) => boolean | Promise<boolean>
+
+/** Evaluate a policy, failing closed for any non-true result. */
+export async function isAuthorized<Subject, Resource>(
+  authorizer: Authorizer<Subject, Resource>,
+  request: AuthorizationRequest<Subject, Resource>,
+): Promise<boolean> {
+  return (await authorizer(request)) === true
+}
+
+/** Require an application/data-layer policy to allow an action; denied requests throw a 403 Response. */
+export async function requireAuthorization<Subject, Resource>(
+  authorizer: Authorizer<Subject, Resource>,
+  request: AuthorizationRequest<Subject, Resource>,
+): Promise<void> {
+  if (await isAuthorized(authorizer, request)) return
+  throw Response.json({ ok: false, error: "forbidden" }, { status: 403 })
+}

package/src/index.ts

@@ -3,6 +3,13 @@
  * pluggable-store + prod-guard discipline as the ISR cache. **Bring your own identity** (Better Auth,
  * Lucia, your own OAuth/password logic); nifra owns the session cookie, store, CSRF, and route guards.
  */
+
+export {
+  type AuthorizationRequest,
+  type Authorizer,
+  isAuthorized,
+  requireAuthorization,
+} from "./authorization.ts"
 export { type CsrfOptions, csrf } from "./csrf.ts"
 export { type GuardOptions, requireSession, requireUser } from "./guards.ts"
 export {