@nmnmcc/ability 0.2.0 → 0.3.0

package/dist/internal/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","names":[],"sources":["../../src/internal/resource.ts"],"sourcesContent":["import * as Predicate from \"effect/Predicate\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Resource from \"../Resource.ts\"\n\n/** @internal */\nexport const TypeId = \"~@nmnmcc/ability/Resource\" as const\n\nconst fieldRefs = (fields: Schema.Struct.Fields) => {\n\tconst refs: Record<string, Resource.FieldRef<string>> = {}\n\tfor (const key of Object.keys(fields)) {\n\t\trefs[key] = Object.freeze({ _tag: \"Field\", field: key })\n\t}\n\treturn Object.freeze(refs)\n}\n\nconst hasFields = (\n\tschema: unknown,\n): schema is { readonly fields: Schema.Struct.Fields } =>\n\tPredicate.hasProperty(schema, \"fields\") && Predicate.isObject(schema.fields)\n\n/**\n * Gives the paths of all data fields. A nested struct gives one path for each\n * of its own fields, with a dot between the names.\n */\nconst collectFieldPaths = (\n\tfields: Schema.Struct.Fields,\n\tprefix: string,\n\toutput: Array<string>,\n): void => {\n\tfor (const key of Object.keys(fields)) {\n\t\tconst schema = fields[key]\n\t\tconst path = prefix === \"\" ? key : `${prefix}.${key}`\n\t\tif (hasFields(schema)) {\n\t\t\tcollectFieldPaths(schema.fields, path, output)\n\t\t} else {\n\t\t\toutput.push(path)\n\t\t}\n\t}\n}\n\nconst makeDescriptor = (\n\tkind: string,\n\toptions: Resource.Options<ReadonlyArray<string>, Schema.Struct.Fields>,\n\tschema: Schema.Top,\n): Resource.Descriptor => {\n\tconst fieldPaths: Array<string> = []\n\tcollectFieldPaths(options.fields, \"\", fieldPaths)\n\treturn Object.freeze({\n\t\tkind,\n\t\tactions: Object.freeze([...options.actions]),\n\t\tpath:\n\t\t\toptions.path === undefined\n\t\t\t\t? undefined\n\t\t\t\t: Object.freeze([...options.path(fieldRefs(options.fields))]),\n\t\tfieldPaths: Object.freeze(fieldPaths),\n\t\tschema,\n\t})\n}\n\n/** @internal */\nexport const Class =\n\t(identifier?: string) =>\n\t(\n\t\tkind: string,\n\t\toptions: Resource.Options<ReadonlyArray<string>, Schema.Struct.Fields>,\n\t) => {\n\t\tconst Base = Schema.TaggedClass<any>(identifier)(kind, options.fields)\n\t\tconst descriptor = makeDescriptor(kind, options, Base)\n\t\treturn class extends Base {\n\t\t\tstatic readonly [TypeId] = descriptor\n\t\t\tstatic readonly kind = kind\n\t\t\tstatic readonly actions = descriptor.actions\n\t\t}\n\t}\n\n/** @internal */\nexport const make = (\n\tkind: string,\n\toptions: Resource.Options<ReadonlyArray<string>, Schema.Struct.Fields>,\n) => {\n\tconst schema = Schema.TaggedStruct(kind, options.fields)\n\tconst descriptor = makeDescriptor(kind, options, schema)\n\treturn Object.freeze({\n\t\t[TypeId]: descriptor,\n\t\tkind,\n\t\tactions: descriptor.actions,\n\t\tschema,\n\t\tmake: (input: object) => schema.make(input as never),\n\t})\n}\n\n/** @internal */\nexport const isResource = (u: unknown): u is Resource.Any =>\n\tPredicate.hasProperty(u, TypeId)\n\n/** @internal */\nexport const descriptor = (resource: Resource.Any): Resource.Descriptor =>\n\tresource[TypeId]\n"],"mappings":";;;;AAKA,MAAa,SAAS;AAEtB,MAAM,aAAa,WAAiC;CACnD,MAAM,OAAkD,CAAC;CACzD,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GACnC,KAAK,OAAO,OAAO,OAAO;EAAE,MAAM;EAAS,OAAO;CAAI,CAAC;CAExD,OAAO,OAAO,OAAO,IAAI;AAC1B;AAEA,MAAM,aACL,WAEA,UAAU,YAAY,QAAQ,QAAQ,KAAK,UAAU,SAAS,OAAO,MAAM;;;;;AAM5E,MAAM,qBACL,QACA,QACA,WACU;CACV,KAAK,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG;EACtC,MAAM,SAAS,OAAO;EACtB,MAAM,OAAO,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;EAChD,IAAI,UAAU,MAAM,GACnB,kBAAkB,OAAO,QAAQ,MAAM,MAAM;OAE7C,OAAO,KAAK,IAAI;CAElB;AACD;AAEA,MAAM,kBACL,MACA,SACA,WACyB;CACzB,MAAM,aAA4B,CAAC;CACnC,kBAAkB,QAAQ,QAAQ,IAAI,UAAU;CAChD,OAAO,OAAO,OAAO;EACpB;EACA,SAAS,OAAO,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;EAC3C,MACC,QAAQ,SAAS,KAAA,IACd,KAAA,IACA,OAAO,OAAO,CAAC,GAAG,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC,CAAC;EAC9D,YAAY,OAAO,OAAO,UAAU;EACpC;CACD,CAAC;AACF;;AAGA,MAAa,SACX,gBAEA,MACA,YACI;CACJ,MAAM,OAAO,OAAO,YAAiB,UAAU,CAAC,CAAC,MAAM,QAAQ,MAAM;CACrE,MAAM,aAAa,eAAe,MAAM,SAAS,IAAI;CACrD,OAAO,cAAc,KAAK;EACzB,QAAiB,UAAU;EAC3B,OAAgB,OAAO;EACvB,OAAgB,UAAU,WAAW;CACtC;AACD;;AAGD,MAAa,QACZ,MACA,YACI;CACJ,MAAM,SAAS,OAAO,aAAa,MAAM,QAAQ,MAAM;CACvD,MAAM,aAAa,eAAe,MAAM,SAAS,MAAM;CACvD,OAAO,OAAO,OAAO;GACnB,SAAS;EACV;EACA,SAAS,WAAW;EACpB;EACA,OAAO,UAAkB,OAAO,KAAK,KAAc;CACpD,CAAC;AACF;;AAGA,MAAa,cAAc,MAC1B,UAAU,YAAY,GAAG,MAAM;;AAGhC,MAAa,cAAc,aAC1B,SAAS"}

package/dist/internal/rule.js

@@ -0,0 +1,131 @@
+import { descriptor, isResource } from "./resource.js";
+import { builder as builder$1 } from "./condition.js";
+import * as Equal from "effect/Equal";
+import * as Hash from "effect/Hash";
+import * as Predicate from "effect/Predicate";
+import * as Formatter from "effect/Formatter";
+import * as Inspectable from "effect/Inspectable";
+import * as Pipeable from "effect/Pipeable";
+// src/internal/rule.ts
+/** @internal */
+const TypeId = "~@nmnmcc/ability/Rule";
+/** @internal */
+const toData = (rule) => {
+	const data = {
+		_tag: rule._tag,
+		actions: rule.actions,
+		resources: rule.resources
+	};
+	if (rule.when !== void 0) data.when = rule.when;
+	if (rule.fields !== void 0) data.fields = rule.fields;
+	if (rule.reason !== void 0) data.reason = rule.reason;
+	if (rule.id !== void 0) data.id = rule.id;
+	if (rule.meta !== void 0) data.meta = rule.meta;
+	return data;
+};
+function* ruleIterator(rule) {
+	yield rule;
+	return rule;
+}
+const Proto = {
+	...Pipeable.Prototype,
+	[TypeId]: TypeId,
+	[Symbol.iterator]() {
+		return ruleIterator(this);
+	},
+	[Equal.symbol](that) {
+		return isRule(that) && Equal.equals(toData(this), toData(that));
+	},
+	[Hash.symbol]() {
+		return Hash.structure(toData(this));
+	},
+	toJSON() {
+		return toData(this);
+	},
+	toString() {
+		return Formatter.format(toData(this), { space: 2 });
+	},
+	[Inspectable.NodeInspectSymbol]() {
+		return toData(this);
+	}
+};
+/**
+* Makes a rule from plain data. It does not check the data.
+*
+* @internal
+*/
+const make = (data) => {
+	const rule = Object.create(Proto);
+	Object.assign(rule, toData(data));
+	rule.actions = Object.freeze([...data.actions]);
+	rule.resources = Object.freeze([...data.resources]);
+	if (data.fields !== void 0) rule.fields = Object.freeze([...data.fields]);
+	return Object.freeze(rule);
+};
+/** @internal */
+const isRule = (u) => Predicate.hasProperty(u, TypeId);
+const toArray = (value) => Array.isArray(value) ? value : [value];
+const kindName = (target) => isResource(target) ? descriptor(target).kind : target;
+const makeFromOptions = (tag) => (action, resource, options) => {
+	const data = {
+		_tag: tag,
+		actions: toArray(action),
+		resources: toArray(resource).map(kindName)
+	};
+	if (options?.when !== void 0) data.when = options.when(builder$1());
+	if (options?.fields !== void 0) data.fields = options.fields;
+	if (options?.reason !== void 0) data.reason = options.reason;
+	if (options?.id !== void 0) data.id = options.id;
+	if (options?.meta !== void 0) data.meta = options.meta;
+	return make(data);
+};
+const sharedBuilder = Object.freeze({
+	allow: makeFromOptions("Allow"),
+	deny: makeFromOptions("Deny")
+});
+/** @internal */
+const builder = (_domain) => sharedBuilder;
+const patternCache = /* @__PURE__ */ new Map();
+const compilePattern = (pattern) => {
+	const cached = patternCache.get(pattern);
+	if (cached !== void 0) return cached;
+	let source = "";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				source += ".*";
+				index = index + 2;
+				continue;
+			}
+			source += "[^.]*";
+		} else source += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+		index = index + 1;
+	}
+	const regex = new RegExp(`^${source}$`);
+	patternCache.set(pattern, regex);
+	return regex;
+};
+/** @internal */
+const matchesFieldPattern = (pattern, field) => pattern.includes("*") ? compilePattern(pattern).test(field) : pattern === field;
+/**
+* Tests the parts of a rule that do not need the resource value: the action,
+* the kind and the field.
+*
+* A rule with fields covers a request with no field only when it is an allow
+* rule. So "may update some fields" is a yes. A deny rule for some fields does
+* not stop a request for the whole value.
+*
+* @internal
+*/
+const matchesTarget = (rule, action, kind, field) => {
+	if (!rule.actions.includes("*") && !rule.actions.includes(action)) return false;
+	if (!rule.resources.includes("*") && !rule.resources.includes(kind)) return false;
+	if (rule.fields === void 0) return true;
+	if (field === void 0) return rule._tag === "Allow";
+	return rule.fields.some((pattern) => matchesFieldPattern(pattern, field));
+};
+export { TypeId, builder, isRule, make, matchesFieldPattern, matchesTarget, toData };
+
+//# sourceMappingURL=rule.js.map

package/dist/internal/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","names":["conditionBuilder"],"sources":["../../src/internal/rule.ts"],"sourcesContent":["import * as Equal from \"effect/Equal\"\nimport * as Formatter from \"effect/Formatter\"\nimport * as Hash from \"effect/Hash\"\nimport * as Inspectable from \"effect/Inspectable\"\nimport * as Pipeable from \"effect/Pipeable\"\nimport * as Predicate from \"effect/Predicate\"\nimport type * as Condition from \"../Condition.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Rule from \"../Rule.ts\"\nimport { builder as conditionBuilder } from \"./condition.ts\"\nimport { isResource, descriptor } from \"./resource.ts\"\n\n/** @internal */\nexport const TypeId = \"~@nmnmcc/ability/Rule\" as const\n\n/**\n * The plain data of a rule.\n *\n * @internal\n */\nexport interface RuleData {\n\treadonly _tag: \"Allow\" | \"Deny\"\n\treadonly actions: ReadonlyArray<string>\n\treadonly resources: ReadonlyArray<string>\n\treadonly when?: Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n}\n\n/** @internal */\nexport const toData = (rule: RuleData): RuleData => {\n\tconst data: {\n\t\t-readonly [K in keyof RuleData]: RuleData[K]\n\t} = {\n\t\t_tag: rule._tag,\n\t\tactions: rule.actions,\n\t\tresources: rule.resources,\n\t}\n\tif (rule.when !== undefined) data.when = rule.when\n\tif (rule.fields !== undefined) data.fields = rule.fields\n\tif (rule.reason !== undefined) data.reason = rule.reason\n\tif (rule.id !== undefined) data.id = rule.id\n\tif (rule.meta !== undefined) data.meta = rule.meta\n\treturn data\n}\n\nfunction* ruleIterator<A>(rule: A): Generator<A, A, unknown> {\n\tyield rule\n\treturn rule\n}\n\nconst Proto = {\n\t...Pipeable.Prototype,\n\t[TypeId]: TypeId,\n\t[Symbol.iterator](this: Rule.Any) {\n\t\treturn ruleIterator(this)\n\t},\n\t[Equal.symbol](this: RuleData, that: unknown): boolean {\n\t\treturn isRule(that) && Equal.equals(toData(this), toData(that))\n\t},\n\t[Hash.symbol](this: RuleData): number {\n\t\treturn Hash.structure(toData(this))\n\t},\n\ttoJSON(this: RuleData) {\n\t\treturn toData(this)\n\t},\n\ttoString(this: RuleData) {\n\t\treturn Formatter.format(toData(this), { space: 2 })\n\t},\n\t[Inspectable.NodeInspectSymbol](this: RuleData) {\n\t\treturn toData(this)\n\t},\n}\n\n/**\n * Makes a rule from plain data. It does not check the data.\n *\n * @internal\n */\nexport const make = (data: RuleData): Rule.Any => {\n\tconst rule = Object.create(Proto) as {\n\t\t-readonly [K in keyof RuleData]: RuleData[K]\n\t}\n\tObject.assign(rule, toData(data))\n\trule.actions = Object.freeze([...data.actions])\n\trule.resources = Object.freeze([...data.resources])\n\tif (data.fields !== undefined) rule.fields = Object.freeze([...data.fields])\n\treturn Object.freeze(rule) as Rule.Any\n}\n\n/** @internal */\nexport const isRule = (u: unknown): u is Rule.Any =>\n\tPredicate.hasProperty(u, TypeId)\n\nconst toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>\n\tArray.isArray(value) ? value : [value as A]\n\nconst kindName = (target: unknown): string =>\n\tisResource(target) ? descriptor(target).kind : (target as string)\n\nconst makeFromOptions =\n\t(tag: \"Allow\" | \"Deny\") =>\n\t(\n\t\taction: string | ReadonlyArray<string>,\n\t\tresource: unknown,\n\t\toptions?: {\n\t\t\treadonly when?: (builder: unknown) => Condition.Ast\n\t\t\treadonly fields?: ReadonlyArray<string>\n\t\t\treadonly reason?: string\n\t\t\treadonly id?: string\n\t\t\treadonly meta?: unknown\n\t\t},\n\t): Rule.Any => {\n\t\tconst data: {\n\t\t\t-readonly [K in keyof RuleData]: RuleData[K]\n\t\t} = {\n\t\t\t_tag: tag,\n\t\t\tactions: toArray(action),\n\t\t\tresources: toArray(resource).map(kindName),\n\t\t}\n\t\tif (options?.when !== undefined)\n\t\t\tdata.when = options.when(conditionBuilder())\n\t\tif (options?.fields !== undefined) data.fields = options.fields\n\t\tif (options?.reason !== undefined) data.reason = options.reason\n\t\tif (options?.id !== undefined) data.id = options.id\n\t\tif (options?.meta !== undefined) data.meta = options.meta\n\t\treturn make(data)\n\t}\n\nconst sharedBuilder = Object.freeze({\n\tallow: makeFromOptions(\"Allow\"),\n\tdeny: makeFromOptions(\"Deny\"),\n})\n\n/** @internal */\nexport const builder = (_domain: Domain.Any): any => sharedBuilder\n\nconst patternCache = new Map<string, RegExp>()\n\nconst compilePattern = (pattern: string): RegExp => {\n\tconst cached = patternCache.get(pattern)\n\tif (cached !== undefined) {\n\t\treturn cached\n\t}\n\tlet source = \"\"\n\tlet index = 0\n\twhile (index < pattern.length) {\n\t\tconst char = pattern[index]!\n\t\tif (char === \"*\") {\n\t\t\tif (pattern[index + 1] === \"*\") {\n\t\t\t\tsource += \".*\"\n\t\t\t\tindex = index + 2\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tsource += \"[^.]*\"\n\t\t} else {\n\t\t\tsource += char.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\")\n\t\t}\n\t\tindex = index + 1\n\t}\n\tconst regex = new RegExp(`^${source}$`)\n\tpatternCache.set(pattern, regex)\n\treturn regex\n}\n\n/** @internal */\nexport const matchesFieldPattern = (pattern: string, field: string): boolean =>\n\tpattern.includes(\"*\")\n\t\t? compilePattern(pattern).test(field)\n\t\t: pattern === field\n\n/**\n * Tests the parts of a rule that do not need the resource value: the action,\n * the kind and the field.\n *\n * A rule with fields covers a request with no field only when it is an allow\n * rule. So \"may update some fields\" is a yes. A deny rule for some fields does\n * not stop a request for the whole value.\n *\n * @internal\n */\nexport const matchesTarget = (\n\trule: RuleData,\n\taction: string,\n\tkind: string,\n\tfield: string | undefined,\n): boolean => {\n\tif (!rule.actions.includes(\"*\") && !rule.actions.includes(action)) {\n\t\treturn false\n\t}\n\tif (!rule.resources.includes(\"*\") && !rule.resources.includes(kind)) {\n\t\treturn false\n\t}\n\tif (rule.fields === undefined) {\n\t\treturn true\n\t}\n\tif (field === undefined) {\n\t\treturn rule._tag === \"Allow\"\n\t}\n\treturn rule.fields.some((pattern) => matchesFieldPattern(pattern, field))\n}\n"],"mappings":";;;;;;;;;;AAaA,MAAa,SAAS;;AAmBtB,MAAa,UAAU,SAA6B;CACnD,MAAM,OAEF;EACH,MAAM,KAAK;EACX,SAAS,KAAK;EACd,WAAW,KAAK;CACjB;CACA,IAAI,KAAK,SAAS,KAAA,GAAW,KAAK,OAAO,KAAK;CAC9C,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,KAAK;CAClD,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,KAAK;CAClD,IAAI,KAAK,OAAO,KAAA,GAAW,KAAK,KAAK,KAAK;CAC1C,IAAI,KAAK,SAAS,KAAA,GAAW,KAAK,OAAO,KAAK;CAC9C,OAAO;AACR;AAEA,UAAU,aAAgB,MAAmC;CAC5D,MAAM;CACN,OAAO;AACR;AAEA,MAAM,QAAQ;CACb,GAAG,SAAS;EACX,SAAS;CACV,CAAC,OAAO,YAA0B;EACjC,OAAO,aAAa,IAAI;CACzB;CACA,CAAC,MAAM,QAAwB,MAAwB;EACtD,OAAO,OAAO,IAAI,KAAK,MAAM,OAAO,OAAO,IAAI,GAAG,OAAO,IAAI,CAAC;CAC/D;CACA,CAAC,KAAK,UAAgC;EACrC,OAAO,KAAK,UAAU,OAAO,IAAI,CAAC;CACnC;CACA,SAAuB;EACtB,OAAO,OAAO,IAAI;CACnB;CACA,WAAyB;EACxB,OAAO,UAAU,OAAO,OAAO,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;CACnD;CACA,CAAC,YAAY,qBAAmC;EAC/C,OAAO,OAAO,IAAI;CACnB;AACD;;;;;;AAOA,MAAa,QAAQ,SAA6B;CACjD,MAAM,OAAO,OAAO,OAAO,KAAK;CAGhC,OAAO,OAAO,MAAM,OAAO,IAAI,CAAC;CAChC,KAAK,UAAU,OAAO,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;CAC9C,KAAK,YAAY,OAAO,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;CAClD,IAAI,KAAK,WAAW,KAAA,GAAW,KAAK,SAAS,OAAO,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC;CAC3E,OAAO,OAAO,OAAO,IAAI;AAC1B;;AAGA,MAAa,UAAU,MACtB,UAAU,YAAY,GAAG,MAAM;AAEhC,MAAM,WAAc,UACnB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAU;AAE3C,MAAM,YAAY,WACjB,WAAW,MAAM,IAAI,WAAW,MAAM,CAAC,CAAC,OAAQ;AAEjD,MAAM,mBACJ,SAEA,QACA,UACA,YAOc;CACd,MAAM,OAEF;EACH,MAAM;EACN,SAAS,QAAQ,MAAM;EACvB,WAAW,QAAQ,QAAQ,CAAC,CAAC,IAAI,QAAQ;CAC1C;CACA,IAAI,SAAS,SAAS,KAAA,GACrB,KAAK,OAAO,QAAQ,KAAKA,UAAiB,CAAC;CAC5C,IAAI,SAAS,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;CACzD,IAAI,SAAS,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;CACzD,IAAI,SAAS,OAAO,KAAA,GAAW,KAAK,KAAK,QAAQ;CACjD,IAAI,SAAS,SAAS,KAAA,GAAW,KAAK,OAAO,QAAQ;CACrD,OAAO,KAAK,IAAI;AACjB;AAED,MAAM,gBAAgB,OAAO,OAAO;CACnC,OAAO,gBAAgB,OAAO;CAC9B,MAAM,gBAAgB,MAAM;AAC7B,CAAC;;AAGD,MAAa,WAAW,YAA6B;AAErD,MAAM,+BAAe,IAAI,IAAoB;AAE7C,MAAM,kBAAkB,YAA4B;CACnD,MAAM,SAAS,aAAa,IAAI,OAAO;CACvC,IAAI,WAAW,KAAA,GACd,OAAO;CAER,IAAI,SAAS;CACb,IAAI,QAAQ;CACZ,OAAO,QAAQ,QAAQ,QAAQ;EAC9B,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK;GACjB,IAAI,QAAQ,QAAQ,OAAO,KAAK;IAC/B,UAAU;IACV,QAAQ,QAAQ;IAChB;GACD;GACA,UAAU;EACX,OACC,UAAU,KAAK,QAAQ,sBAAsB,MAAM;EAEpD,QAAQ,QAAQ;CACjB;CACA,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,EAAE;CACtC,aAAa,IAAI,SAAS,KAAK;CAC/B,OAAO;AACR;;AAGA,MAAa,uBAAuB,SAAiB,UACpD,QAAQ,SAAS,GAAG,IACjB,eAAe,OAAO,CAAC,CAAC,KAAK,KAAK,IAClC,YAAY;;;;;;;;;;;AAYhB,MAAa,iBACZ,MACA,QACA,MACA,UACa;CACb,IAAI,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,KAAK,QAAQ,SAAS,MAAM,GAC/D,OAAO;CAER,IAAI,CAAC,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,KAAK,UAAU,SAAS,IAAI,GACjE,OAAO;CAER,IAAI,KAAK,WAAW,KAAA,GACnB,OAAO;CAER,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,SAAS;CAEtB,OAAO,KAAK,OAAO,MAAM,YAAY,oBAAoB,SAAS,KAAK,CAAC;AACzE"}

package/package.json

@@ -1,73 +1,62 @@
 {
-  "name": "@nmnmcc/ability",
-  "version": "0.2.0",
-  "description": "Authorization primitives for Effect programs, backed by CASL.",
-  "license": "Apache-2.0",
-  "type": "module",
-  "packageManager": "yarn@4.14.1",
-  "sideEffects": false,
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/nmnmcc/ability.git"
-  },
-  "bugs": {
-    "url": "https://github.com/nmnmcc/ability/issues"
-  },
-  "homepage": "https://github.com/nmnmcc/ability#readme",
-  "files": [
-    "dist"
-  ],
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    },
-    "./Ability": {
-      "types": "./dist/Ability.d.ts",
-      "import": "./dist/Ability.js",
-      "default": "./dist/Ability.js"
-    },
-    "./AbilityExtra": {
-      "types": "./dist/AbilityExtra.d.ts",
-      "import": "./dist/AbilityExtra.js",
-      "default": "./dist/AbilityExtra.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "scripts": {
-    "build": "tsdown",
-    "prepack": "yarn build",
-    "prepublishOnly": "yarn typecheck && yarn test-types && yarn test",
-    "release:check": "yarn typecheck && yarn test-types && yarn test && yarn pack --dry-run",
-    "format": "prettier . -w",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "test-types": "tstyche",
-    "npm": "YARN_NPM_REGISTRY_SERVER=https://registry.npmjs.org yarn npm"
-  },
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  },
-  "devDependencies": {
-    "@casl/ability": "^6.8.1",
-    "@effect/language-service": "^0.85.1",
-    "@effect/vitest": "4.0.0-beta.59",
-    "@types/node": "^25.6.0",
-    "effect": "^4.0.0-beta.59",
-    "prettier": "^3.8.3",
-    "tsdown": "^0.21.10",
-    "tstyche": "^7.1.0",
-    "tsx": "^4.21.0",
-    "typescript": "^6.0.3",
-    "vitest": "4.1.4"
-  },
-  "peerDependencies": {
-    "@casl/ability": "^6.8.1",
-    "effect": "^4.0.0-beta.59"
-  }
-}
+	"name": "@nmnmcc/ability",
+	"version": "0.3.0",
+	"description": "Typed, composable authorization policies for Effect programs.",
+	"license": "Apache-2.0",
+	"type": "module",
+	"packageManager": "pnpm@12.15.0",
+	"sideEffects": false,
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/nmnmcc/ability.git"
+	},
+	"bugs": {
+		"url": "https://github.com/nmnmcc/ability/issues"
+	},
+	"homepage": "https://github.com/nmnmcc/ability#readme",
+	"files": [
+		"dist",
+		"src"
+	],
+	"exports": {
+		".": "./dist/index.js",
+		"./Authorizer": "./dist/Authorizer.js",
+		"./Condition": "./dist/Condition.js",
+		"./Decision": "./dist/Decision.js",
+		"./Domain": "./dist/Domain.js",
+		"./HttpApi": "./dist/HttpApi.js",
+		"./Policy": "./dist/Policy.js",
+		"./Principal": "./dist/Principal.js",
+		"./Resource": "./dist/Resource.js",
+		"./Rule": "./dist/Rule.js"
+	},
+	"scripts": {
+		"prepare": "effect-tsgo patch --typescript --no-oxlint",
+		"build": "tsdown",
+		"prepack": "pnpm build",
+		"prepublishOnly": "pnpm typecheck && pnpm test-types && pnpm test",
+		"release:check": "pnpm typecheck && pnpm test-types && pnpm test && pnpm pack --dry-run",
+		"format": "prettier . -w",
+		"test": "vitest run",
+		"typecheck": "tsc -p tsconfig.json --noEmit",
+		"test-types": "tstyche"
+	},
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://registry.npmjs.org"
+	},
+	"devDependencies": {
+		"@effect/tsgo": "0.56.0",
+		"@effect/vitest": "4.0.6",
+		"@types/node": "26.6.5",
+		"effect": "4.0.6",
+		"prettier": "3.9.10",
+		"tsdown": "0.23.1",
+		"tstyche": "7.2.5",
+		"typescript": "7.0.2",
+		"vitest": "5.0.5"
+	},
+	"peerDependencies": {
+		"effect": "^4.0.6"
+	}
+}

package/src/Authorizer.ts

@@ -0,0 +1,330 @@
+/**
+ * An authorizer is an Effect service that makes decisions for the principal
+ * of the current request.
+ *
+ * You make the service class, in the same way as `Context.Service`. Give the
+ * services that the principal and the decider need as `requires`, and their
+ * errors as `error`:
+ *
+ * ```ts
+ * class Auth extends Authorizer.Service<Auth, { requires: Identity }>()(
+ *   "app/Auth",
+ *   App,
+ * ) {}
+ * ```
+ *
+ * Then give a layer with {@link layer}. It says where the principal comes
+ * from and how to load its policy. The policy of each principal is loaded
+ * once and kept in a cache for a short time.
+ *
+ * Then use the service in a handler:
+ *
+ * ```ts
+ * yield* Auth.check({ action: "update", resource: bot })
+ * ```
+ *
+ * A "no" answer goes into the error channel as {@link Forbidden}. When the
+ * policy can not be loaded, the check fails with {@link PolicyUnavailable}.
+ * So the check fails closed: an error is never a "yes".
+ *
+ * When no rule gives an answer, the authorizer asks the decider, if there is
+ * one. A decider may answer at once, or fail with {@link Pending} when a person
+ * or a Bot must answer later.
+ *
+ * @stability stable
+ * @since 0.3.0
+ */
+import type * as Context from "effect/Context"
+import type * as Duration from "effect/Duration"
+import type * as Effect from "effect/Effect"
+import type * as Layer from "effect/Layer"
+import type * as Condition from "./Condition.ts"
+import type * as Decision from "./Decision.ts"
+import type * as Domain from "./Domain.ts"
+import * as internal from "./internal/authorizer.ts"
+import type * as Policy from "./Policy.ts"
+
+/**
+ * The error when a policy says no.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export const Forbidden: typeof internal.Forbidden = internal.Forbidden
+
+/**
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export type Forbidden = internal.Forbidden
+
+/**
+ * The error when the policy of the principal can not be loaded. The cause is
+ * kept, but it is not shown to the client.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export const PolicyUnavailable: typeof internal.PolicyUnavailable =
+	internal.PolicyUnavailable
+
+/**
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export type PolicyUnavailable = internal.PolicyUnavailable
+
+/**
+ * The error when a decider must wait for an answer. `ticket` names the
+ * request that waits, so the client can come back for the answer.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export const Pending: typeof internal.Pending = internal.Pending
+
+/**
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export type Pending = internal.Pending
+
+/**
+ * The services and the errors of the principal and the decider of an
+ * authorizer.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Config {
+	readonly requires?: unknown
+	readonly error?: unknown
+}
+
+type RequiresOf<C> = C extends { readonly requires: infer R } ? R : never
+type ErrorOf<C> = C extends { readonly error: infer E } ? E : never
+
+/**
+ * What a check is about: an act on a resource value, or an act on a kind of
+ * resource. A check on a kind passes only when the policy allows the act on
+ * every value of the kind.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Target<D> = Policy.Target<D> | Policy.KindTarget<D>
+
+/**
+ * A request to the decider.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type DeciderRequest<D> = Policy.Request<D> | Policy.KindRequest<D>
+
+/**
+ * The options of a guard.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface GuardOptions<D, E2> {
+	/** The action that lets the principal see the resource. The default is `"read"`. */
+	readonly read?: Domain.AnyAction<D>
+	/** The error when the principal may not see the resource. */
+	readonly hide: () => E2
+}
+
+/**
+ * The service.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Authorizer<D extends Domain.Any, E, R> {
+	readonly domain: D
+	/** The principal of the current request. */
+	readonly principal: Effect.Effect<Domain.Principal<D>, E, R>
+	/** The policy of the principal of the current request. */
+	readonly policy: Effect.Effect<Policy.Policy<D, E>, PolicyUnavailable | E, R>
+	/** Gives the decision of the policy. It does not ask the decider. */
+	readonly decide: (
+		target: Policy.Target<D>,
+	) => Effect.Effect<Decision.Decision, PolicyUnavailable | E, R>
+	/** Succeeds when the principal may do the act, and fails when it may not. */
+	readonly check: (
+		target: Target<D>,
+	) => Effect.Effect<void, Forbidden | Pending | PolicyUnavailable | E, R>
+	/**
+	 * Checks the read action first, and fails with the error of `hide` when the
+	 * principal may not see the resource. Then it checks the act. Use it to
+	 * answer "not found" to a principal that may not know that a resource
+	 * exists.
+	 */
+	readonly guard: <E2>(
+		target: Policy.Target<D>,
+		options: GuardOptions<D, E2>,
+	) => Effect.Effect<void, E2 | Forbidden | Pending | PolicyUnavailable | E, R>
+	/**
+	 * Gives the condition on resource values that the principal may act on.
+	 * Change it into a query with `Condition.fold`.
+	 */
+	readonly filter: (
+		target: Policy.KindTarget<D>,
+	) => Effect.Effect<
+		Condition.Condition<E, never, Condition.Opaque>,
+		PolicyUnavailable | E,
+		R
+	>
+	/** Gives the fields of a value that the principal may use. */
+	readonly permittedFields: (
+		target: Omit<Policy.Target<D>, "field">,
+	) => Effect.Effect<ReadonlyArray<string>, PolicyUnavailable | E, R>
+	/**
+	 * Removes the cached policy of a principal, or of every principal. Call it
+	 * after a change to the rules or roles of a principal.
+	 */
+	readonly invalidate: (principal?: Domain.Principal<D>) => Effect.Effect<void>
+}
+
+/**
+ * The class made by {@link Service}. The static functions use the service
+ * from the context.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface ServiceClass<
+	Self,
+	Id extends string,
+	D extends Domain.Any,
+	E,
+	R,
+> extends Context.ServiceClass<Self, Id, Authorizer<D, E, R>> {
+	readonly domain: D
+	readonly decide: (
+		target: Policy.Target<D>,
+	) => Effect.Effect<Decision.Decision, PolicyUnavailable | E, R | Self>
+	readonly check: (
+		target: Target<D>,
+	) => Effect.Effect<
+		void,
+		Forbidden | Pending | PolicyUnavailable | E,
+		R | Self
+	>
+	readonly guard: <E2>(
+		target: Policy.Target<D>,
+		options: GuardOptions<D, E2>,
+	) => Effect.Effect<
+		void,
+		E2 | Forbidden | Pending | PolicyUnavailable | E,
+		R | Self
+	>
+	readonly filter: (
+		target: Policy.KindTarget<D>,
+	) => Effect.Effect<
+		Condition.Condition<E, never, Condition.Opaque>,
+		PolicyUnavailable | E,
+		R | Self
+	>
+	readonly permittedFields: (
+		target: Omit<Policy.Target<D>, "field">,
+	) => Effect.Effect<ReadonlyArray<string>, PolicyUnavailable | E, R | Self>
+}
+
+/**
+ * Any service class made by {@link Service}.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type AnyServiceClass = Context.Key<any, any> & {
+	readonly domain: Domain.Any
+}
+
+/**
+ * Makes an authorizer service class for a domain.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export const Service: <Self, C extends Config = {}>() => <
+	const Id extends string,
+	D extends Domain.Any,
+>(
+	id: Id,
+	domain: D,
+) => ServiceClass<Self, Id, D, ErrorOf<C>, RequiresOf<C>> =
+	internal.Service as never
+
+/**
+ * The options of {@link layer}.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Options<D extends Domain.Any, E, R, EL, RL, RP> {
+	/** Gives the principal of the current request. */
+	readonly principal: Effect.Effect<Domain.Principal<D>, E, R>
+	/**
+	 * Loads the policy of a principal. A failure becomes
+	 * {@link PolicyUnavailable}. The services of the predicates of the policy
+	 * are taken when the layer is built.
+	 */
+	readonly policy: (
+		principal: Domain.Principal<D>,
+	) => Effect.Effect<Policy.Policy<D, E, RP, any>, EL, RL>
+	/**
+	 * Answers when no rule gives an answer. Without a decider, such a request
+	 * fails with {@link Forbidden}.
+	 */
+	readonly decider?: (
+		request: DeciderRequest<D>,
+	) => Effect.Effect<Decision.Decision, Pending | E, R>
+	/**
+	 * How the policies are kept. The default keeps 1000 policies for 30 seconds.
+	 * Give `false` to load the policy for each check.
+	 */
+	readonly cache?:
+		| {
+				readonly capacity?: number
+				readonly timeToLive?: Duration.Input
+		  }
+		| false
+}
+
+/**
+ * Makes the layer of an authorizer.
+ *
+ * @stability stable
+ * @category layers
+ * @since 0.3.0
+ */
+export const layer: <
+	Self,
+	Id extends string,
+	D extends Domain.Any,
+	E,
+	R,
+	EL = never,
+	RL = never,
+	RP = never,
+>(
+	service: ServiceClass<Self, Id, D, E, R>,
+	options: Options<D, NoInfer<E>, NoInfer<R>, EL, RL, RP>,
+) => Layer.Layer<Self, never, RL | RP> = internal.layer as never