@oneunit/auth 2.0.0

package/dist/rbac.js

@@ -0,0 +1,240 @@
+import { ForbiddenError, ValidationError } from "./errors.js";
+import { isPlainObject, toArray, unique } from "./utils.js";
+function normalizeName(value) {
+    return String(value).trim();
+}
+function asSet(values) {
+    return new Set(unique(toArray(values).map((item) => normalizeName(item)).filter(Boolean)));
+}
+export class RBAC {
+    roles = new Map();
+    permissions = new Set();
+    rolePermissions = new Map();
+    roleParents = new Map();
+    defaultRole;
+    constructor(options = {}) {
+        this.defaultRole = options.defaultRole ?? null;
+        if (Array.isArray(options.permissions)) {
+            for (const permission of options.permissions) {
+                this.addPermission(permission);
+            }
+        }
+        if (isPlainObject(options.roles)) {
+            for (const [role, config] of Object.entries(options.roles)) {
+                this.addRole(role, config);
+            }
+        }
+        else if (Array.isArray(options.roles)) {
+            for (const role of options.roles) {
+                this.addRole(role);
+            }
+        }
+    }
+    addPermission(permission) {
+        const name = normalizeName(permission);
+        if (!name) {
+            throw new ValidationError("Permission name is required");
+        }
+        this.permissions.add(name);
+        return this;
+    }
+    addRole(role, config = {}) {
+        const name = normalizeName(typeof role === "string" ? role : role?.name);
+        if (!name) {
+            throw new ValidationError("Role name is required");
+        }
+        const definition = isPlainObject(config) ? config : {};
+        const permissions = asSet(definition.permissions ?? definition.perms);
+        const inherits = unique(toArray(definition.inherits ?? definition.parents ?? definition.parent).map(normalizeName).filter(Boolean));
+        for (const permission of permissions) {
+            this.permissions.add(permission);
+        }
+        this.roles.set(name, {
+            name,
+            description: typeof definition.description === "string" ? definition.description : "",
+        });
+        this.rolePermissions.set(name, new Set([
+            ...(this.rolePermissions.get(name) ?? []),
+            ...permissions,
+        ]));
+        this.roleParents.set(name, unique([
+            ...(this.roleParents.get(name) ?? []),
+            ...inherits,
+        ]));
+        return this;
+    }
+    grant(role, permissions) {
+        const name = this.requireRole(role);
+        const granted = asSet(permissions);
+        const current = this.rolePermissions.get(name) ?? new Set();
+        for (const permission of granted) {
+            this.permissions.add(permission);
+            current.add(permission);
+        }
+        this.rolePermissions.set(name, current);
+        return this;
+    }
+    revoke(role, permissions) {
+        const name = this.requireRole(role);
+        const current = this.rolePermissions.get(name) ?? new Set();
+        for (const permission of asSet(permissions)) {
+            current.delete(permission);
+        }
+        this.rolePermissions.set(name, current);
+        return this;
+    }
+    inherit(role, parents) {
+        const name = this.requireRole(role);
+        const next = unique([
+            ...(this.roleParents.get(name) ?? []),
+            ...toArray(parents).map(normalizeName).filter(Boolean),
+        ]);
+        this.roleParents.set(name, next);
+        return this;
+    }
+    hasRole(role) {
+        return this.roles.has(normalizeName(role));
+    }
+    requireRole(role) {
+        const name = normalizeName(role);
+        if (!this.roles.has(name)) {
+            throw new ValidationError(`Unknown role: ${role}`);
+        }
+        return name;
+    }
+    getRoles() {
+        return [...this.roles.keys()];
+    }
+    getPermissions(role) {
+        if (role === undefined) {
+            return [...this.permissions];
+        }
+        return [...this.resolvePermissions(role)];
+    }
+    resolveParents(role, seen = new Set()) {
+        const name = normalizeName(role);
+        if (!this.roles.has(name) || seen.has(name)) {
+            return [];
+        }
+        seen.add(name);
+        const parents = [];
+        for (const parent of this.roleParents.get(name) ?? []) {
+            parents.push(parent, ...this.resolveParents(parent, seen));
+        }
+        return unique(parents);
+    }
+    resolvePermissions(role) {
+        const name = normalizeName(role);
+        const resolved = new Set(this.rolePermissions.get(name) ?? []);
+        for (const parent of this.resolveParents(name)) {
+            for (const permission of this.rolePermissions.get(parent) ?? []) {
+                resolved.add(permission);
+            }
+        }
+        return resolved;
+    }
+    subjectRoles(subject) {
+        if (!subject) {
+            return this.defaultRole ? [this.defaultRole] : [];
+        }
+        if (typeof subject === "string") {
+            return [normalizeName(subject)];
+        }
+        const roles = unique([
+            ...toArray(subject.roles),
+            ...toArray(subject.role),
+        ].map(normalizeName).filter(Boolean));
+        if (roles.length === 0 && this.defaultRole) {
+            return [this.defaultRole];
+        }
+        return roles;
+    }
+    subjectPermissions(subject) {
+        const record = typeof subject === "object" && subject ? subject : undefined;
+        const direct = asSet(record?.permissions);
+        const resolved = new Set(direct);
+        for (const role of this.subjectRoles(subject)) {
+            for (const permission of this.resolvePermissions(role)) {
+                resolved.add(permission);
+            }
+        }
+        return resolved;
+    }
+    can(subject, permission) {
+        if (!permission) {
+            return false;
+        }
+        const needed = asSet(permission);
+        const owned = this.subjectPermissions(subject);
+        for (const item of needed) {
+            if (owned.has(item) || owned.has("*")) {
+                continue;
+            }
+            if (![...owned].some((granted) => matchPermission(granted, item))) {
+                return false;
+            }
+        }
+        return needed.size > 0;
+    }
+    cannot(subject, permission) {
+        return !this.can(subject, permission);
+    }
+    authorize(subject, permission) {
+        if (!this.can(subject, permission)) {
+            throw new ForbiddenError(`Missing permission: ${toArray(permission).join(", ")}`);
+        }
+        return true;
+    }
+    hasAnyRole(subject, roles) {
+        const owned = new Set(this.subjectRoles(subject));
+        return toArray(roles).some((role) => owned.has(normalizeName(role)));
+    }
+    hasAllRoles(subject, roles) {
+        const owned = new Set(this.subjectRoles(subject));
+        const needed = toArray(roles).map(normalizeName).filter(Boolean);
+        return needed.length > 0 && needed.every((role) => owned.has(role));
+    }
+    snapshot() {
+        const roles = {};
+        for (const name of this.roles.keys()) {
+            roles[name] = {
+                description: this.roles.get(name)?.description ?? "",
+                permissions: [...(this.rolePermissions.get(name) ?? [])],
+                inherits: [...(this.roleParents.get(name) ?? [])],
+            };
+        }
+        return {
+            defaultRole: this.defaultRole,
+            permissions: [...this.permissions],
+            roles,
+        };
+    }
+}
+export function matchPermission(granted, needed) {
+    if (granted === needed || granted === "*") {
+        return true;
+    }
+    if (!granted.includes("*")) {
+        return false;
+    }
+    // A `**` segment spans any depth ("posts.**" matches "posts.a.b"), while a `*`
+    // segment stays within one level ("posts.*" matches "posts.create" only).
+    const pattern = granted
+        .split(".")
+        .map((part) => {
+        if (part === "**")
+            return ".*";
+        if (part === "*")
+            return "[^.]+";
+        return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    })
+        .join("\\.");
+    return new RegExp(`^${pattern}$`).test(needed);
+}
+export function createRBAC(options = {}) {
+    return new RBAC(options);
+}
+export function defineRoles(roles) {
+    return createRBAC({ roles });
+}
+//# sourceMappingURL=rbac.js.map

package/dist/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAE5D,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,MAAe;IAC5B,OAAO,IAAI,GAAG,CACZ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,IAAI;IACf,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,WAAW,CAAgB;IAE3B,YAAY,UAAuB,EAAE;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAE/C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAA6B,EAAE,SAAyB,EAAE;QAChE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,CACrB,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC3G,CAAC;QAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,IAAI;YACJ,WAAW,EAAE,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;SACtF,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,WAAW;SACf,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,GAAG,QAAQ;SACZ,CAAC,CAAC,CAAC;QAEJ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,WAA8B;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACpE,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,WAA8B;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACpE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,OAA0B;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,IAAa;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAO,IAAI,GAAG,EAAU;QACnD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,kBAAkB,CAAC,IAAY;QAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,YAAY,CAAC,OAAqC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SACzB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB,CAAC,OAAqC;QACtD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,OAAgD,EAAE,UAA6B;QACjF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,OAAgD,EAAE,UAA6B;QACpF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,CAAC,OAAgD,EAAE,UAA6B;QACvF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,cAAc,CAAC,uBAAuB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,OAAgD,EAAE,KAAwB;QACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,WAAW,CAAC,OAAgD,EAAE,KAAwB;QACpF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,QAAQ;QAKN,MAAM,KAAK,GAAuF,EAAE,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG;gBACZ,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE;gBACpD,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxD,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;YAClC,KAAK;SACN,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc;IAC7D,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,OAAO,CAAC;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC;SACD,IAAI,CAAC,KAAK,CAAC,CAAC;IAEf,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAuB,EAAE;IAClD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA2B;IACrD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/dist/roles.d.ts

@@ -0,0 +1,2 @@
+export { RBAC, createRBAC, defineRoles, matchPermission } from "./rbac.js";
+//# sourceMappingURL=roles.d.ts.map

package/dist/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}

package/dist/roles.js

@@ -0,0 +1,2 @@
+export { RBAC, createRBAC, defineRoles, matchPermission } from "./rbac.js";
+//# sourceMappingURL=roles.js.map

package/dist/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC"}

package/dist/token.d.ts

@@ -0,0 +1,2 @@
+export { encode, decode, decodeUnsafe, encodeAccessToken, encodeRefreshToken } from "./jwt.js";
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/dist/token.js

@@ -0,0 +1,2 @@
+export { encode, decode, decodeUnsafe, encodeAccessToken, encodeRefreshToken } from "./jwt.js";
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,383 @@
+export interface AuthErrorOptions {
+    code?: string;
+    status?: number;
+    cause?: unknown;
+}
+export interface JwtSignOptions {
+    expiresIn?: string | number;
+    expiresInSeconds?: number;
+    subject?: string | number;
+    audience?: string | string[];
+    issuer?: string;
+    jwtid?: string;
+    notBefore?: string | number;
+    header?: Record<string, unknown>;
+    algorithm?: string;
+    keyid?: string;
+}
+export interface JwtVerifyOptions {
+    algorithms?: string[];
+    audience?: string | string[];
+    issuer?: string;
+    subject?: string;
+    clockTolerance?: number;
+    ignoreExpiration?: boolean;
+    complete?: boolean;
+    /**
+     * Token `typ` to accept. Access tokens are rejected when set to "refresh" so a
+     * long-lived refresh token cannot be replayed as a bearer credential.
+     */
+    acceptTokenType?: "access" | "refresh";
+}
+export type JwtPayload = Record<string, unknown> & {
+    sub?: string;
+    iat?: number;
+    exp?: number;
+    nbf?: number;
+    aud?: string | string[];
+    iss?: string;
+    jti?: string;
+    typ?: string;
+    userId?: string | number;
+    email?: string;
+    username?: string;
+    name?: string;
+    roles?: string[];
+    permissions?: string[];
+};
+export type Secret = string | Buffer;
+export interface RoleDefinition {
+    name?: string;
+    description?: string;
+    permissions?: string | string[];
+    perms?: string | string[];
+    inherits?: string | string[];
+    parents?: string | string[];
+    parent?: string | string[];
+}
+export interface StoredRole {
+    name: string;
+    description: string;
+}
+export interface RBACOptions {
+    defaultRole?: string | null;
+    permissions?: string[];
+    roles?: Record<string, RoleDefinition> | Array<string | RoleDefinition>;
+}
+export interface AuthSubject {
+    id?: string | number;
+    role?: string;
+    roles?: string | string[];
+    permissions?: string | string[];
+    [key: string]: unknown;
+}
+export interface PasswordOptions {
+    saltBytes?: number;
+    keyLength?: number;
+    cost?: number;
+    blockSize?: number;
+    parallelism?: number;
+    salt?: string | Buffer;
+}
+export interface OAuthProfile {
+    provider?: string;
+    id?: string | number;
+    email?: string;
+    emailVerified?: boolean;
+    username?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+    avatar?: string;
+    profileUrl?: string;
+    locale?: string;
+    raw?: unknown;
+    [key: string]: unknown;
+}
+export interface OAuthTokens {
+    access_token?: string;
+    refresh_token?: string;
+    id_token?: string;
+    token_type?: string;
+    expires_in?: number;
+    scope?: string;
+    [key: string]: unknown;
+}
+export type TokenAuthMethod = "body" | "basic";
+export interface OAuthProviderConfig {
+    clientId?: string;
+    clientSecret?: string;
+    redirectUri?: string;
+    scopes?: string[];
+    pkce?: boolean;
+    extraAuthParams?: Record<string, unknown>;
+    extraTokenParams?: Record<string, unknown>;
+    userInfoHeaders?: Record<string, string>;
+    tokenAuthMethod?: TokenAuthMethod;
+    provider?: OAuthProvider | (Pick<OAuthProvider, "id"> & Partial<OAuthProvider>);
+    [key: string]: unknown;
+}
+export interface AuthorizationUrlOptions {
+    state?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+    extraParams?: Record<string, unknown>;
+}
+export interface AuthorizationUrlResult {
+    url: string;
+    state?: string;
+    codeVerifier?: string;
+}
+export interface ExchangeCodeOptions {
+    code?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+}
+export interface OAuthProvider {
+    id: string;
+    name: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    userInfoUrl?: string;
+    scopes: string[];
+    pkce: boolean;
+    tokenAuthMethod: string;
+    createAuthorizationUrl(config: OAuthProviderConfig, options?: AuthorizationUrlOptions): AuthorizationUrlResult;
+    exchangeCode(config: OAuthProviderConfig, options?: ExchangeCodeOptions): Promise<OAuthTokens>;
+    fetchProfile(config: OAuthProviderConfig, tokens: OAuthTokens): Promise<OAuthProfile>;
+}
+export type ProfileMapValue = string | ((source: Record<string, unknown>) => unknown);
+export interface ProviderDefinition {
+    id: string;
+    name?: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    userInfoUrl?: string;
+    scopes?: string[];
+    profileMap?: Record<string, ProfileMapValue>;
+    tokenAuthMethod?: TokenAuthMethod;
+    pkce?: boolean;
+    extraAuthParams?: Record<string, unknown>;
+    extraTokenParams?: Record<string, unknown>;
+    userInfoHeaders?: Record<string, string>;
+    parseProfile?: (tokens: OAuthTokens, config: OAuthProviderConfig) => OAuthProfile | Promise<OAuthProfile>;
+}
+export interface StateStore {
+    set(key: string, value: unknown, ttlSeconds?: number): Promise<void> | void;
+    get(key: string): Promise<unknown> | unknown;
+    delete(key: string): Promise<void> | void;
+}
+export interface OAuthOptions {
+    redirectUri?: string;
+    stateStore?: StateStore;
+    providers?: Record<string, OAuthProviderConfig>;
+}
+export interface OAuthAuthorizeOptions {
+    state?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+    extraParams?: Record<string, unknown>;
+    metadata?: unknown;
+    ttlSeconds?: number;
+}
+export interface OAuthStateRecord {
+    provider: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+    createdAt: number;
+    metadata?: unknown;
+}
+export interface UserRecord {
+    id: string | number;
+    email?: string;
+    username?: string;
+    name?: string;
+    avatar?: string;
+    roles?: string[];
+    role?: string;
+    permissions?: string[];
+    passwordHash?: string;
+    provider?: string;
+    providerId?: string | number;
+    [key: string]: unknown;
+}
+export interface UserStore {
+    findById?(id: string | number): Promise<UserRecord | null | undefined> | UserRecord | null | undefined;
+    findByEmail?(email: string): Promise<UserRecord | null | undefined> | UserRecord | null | undefined;
+    findByUsername?(username: string): Promise<UserRecord | null | undefined> | UserRecord | null | undefined;
+    findByCredentials?(identifier: string): Promise<UserRecord | null | undefined> | UserRecord | null | undefined;
+    findByProvider?(provider: string, providerId: string | number): Promise<UserRecord | null | undefined> | UserRecord | null | undefined;
+    create?(input: Record<string, unknown>): Promise<UserRecord> | UserRecord;
+    createFromProvider?(provider: string, profile: OAuthProfile, tokens: OAuthTokens): Promise<UserRecord> | UserRecord;
+    linkProvider?(userId: string | number, provider: string, profile: OAuthProfile): Promise<unknown> | unknown;
+    updatePassword?(userId: string | number, passwordHash: string): Promise<unknown> | unknown;
+}
+export interface RefreshRecord {
+    id: string;
+    userId: string | number;
+    tokenHash: string;
+    expiresAt: number;
+}
+export interface RefreshStore {
+    save(record: RefreshRecord): Promise<void> | void;
+    get(id: string): Promise<RefreshRecord | null | undefined> | RefreshRecord | null | undefined;
+    /**
+     * Atomically look up and remove a record. Preferred over get()+revoke(), which
+     * lets one refresh token be redeemed twice concurrently. When omitted, Auth
+     * falls back to get() followed by revoke() and requires revoke() to exist.
+     */
+    consume?(id: string): Promise<RefreshRecord | null | undefined> | RefreshRecord | null | undefined;
+    revoke?(id: string): Promise<void> | void;
+}
+export interface LoginOptions {
+    extractors?: string[];
+    additionalClaims?: Record<string, unknown>;
+    accessTokenTtl?: string | number;
+    refreshTokenTtl?: string | number;
+    refresh?: boolean;
+    roles?: string[];
+}
+export interface LoginResult {
+    token: string;
+    accessToken: string;
+    refreshToken: string | null;
+    payload: JwtPayload;
+    user: {
+        id: string | number;
+        email?: string;
+        username?: string;
+        name?: string;
+        roles: string[];
+        permissions: string[];
+    };
+    oauth?: {
+        provider: string;
+        tokens: OAuthTokens;
+        profile: OAuthProfile;
+        state: unknown;
+    };
+}
+export interface AuthOptions {
+    secret: Secret;
+    refreshSecret?: Secret;
+    issuer?: string;
+    audience?: string | string[];
+    algorithm?: string;
+    expiresIn?: string | number;
+    accessTokenTtl?: string | number;
+    refreshTokenTtl?: string | number;
+    clockTolerance?: number;
+    /**
+     * Copy a `permissions` array from the user record into the access token.
+     * Off by default: permissions should come from RBAC roles, otherwise one
+     * attacker-writable database field grants arbitrary access.
+     */
+    trustUserPermissions?: boolean;
+    userStore?: UserStore;
+    refreshStore?: RefreshStore;
+    rbac?: import("./rbac.js").RBAC | RBACOptions;
+    roles?: RBACOptions | Record<string, RoleDefinition> | Array<string | RoleDefinition>;
+    oauth?: import("./oauth.js").OAuth | OAuthOptions;
+    providers?: Record<string, OAuthProviderConfig>;
+    redirectUri?: string;
+    onLogin?: (result: LoginResult) => unknown;
+    onLink?: (event: {
+        user: UserRecord;
+        provider: string;
+        profile: OAuthProfile;
+    }) => unknown;
+}
+export type AuthHookName = "beforeLogin" | "afterLogin" | "afterVerify";
+export type AuthHookHandler = (payload: unknown, auth: unknown) => unknown;
+export interface RequestLike {
+    headers?: Record<string, string | string[] | undefined> | {
+        get?(name: string): string | null;
+    };
+    cookies?: Record<string, string>;
+    query?: string | Record<string, string | string[] | undefined>;
+    getHeader?(name: string): string;
+    getQuery?(): string;
+    forEach?(cb: (key: string, value: string) => void): void;
+    [key: string]: unknown;
+}
+export interface ExtractTokenOptions {
+    cookie?: string;
+    optional?: boolean;
+    passthrough?: boolean;
+    audience?: string | string[];
+    issuer?: string;
+    clockTolerance?: number;
+    acceptTokenType?: "access" | "refresh";
+}
+export interface UwsHttpResponse {
+    cork?(cb: () => void): void;
+    writeStatus?(status: string): this | void;
+    writeHeader?(key: string, value: string): this | void;
+    end?(body?: string | ArrayBuffer | Uint8Array): void;
+    onAborted?(cb: () => void): void;
+    [key: string]: unknown;
+}
+export interface UwsHttpRequest {
+    getHeader?(name: string): string;
+    getMethod?(): string;
+    getUrl?(): string;
+    getQuery?(): string;
+    forEach?(cb: (key: string, value: string) => void): void;
+    [key: string]: unknown;
+}
+export interface UwsRequestSnapshot {
+    method?: string;
+    url?: string;
+    query?: string | Record<string, string>;
+    headers: Record<string, string>;
+    cookies?: Record<string, string>;
+    res?: UwsHttpResponse;
+    user?: JwtPayload | null;
+    token?: string | null;
+}
+export type UwsHandler = (res: UwsHttpResponse, req: UwsHttpRequest, request?: UwsRequestSnapshot) => unknown;
+export interface ExpressRequestLike {
+    auth?: unknown;
+    user?: JwtPayload | null;
+    token?: string | null;
+    headers?: Record<string, string | undefined>;
+    cookies?: Record<string, string>;
+    query?: Record<string, string | undefined>;
+    [key: string]: unknown;
+}
+export interface ExpressResponseLike {
+    status?(code: number): ExpressResponseLike;
+    send?(body: unknown): unknown;
+    code?(code: number): ExpressResponseLike;
+    body?: unknown;
+    [key: string]: unknown;
+}
+export type ExpressNext = (error?: unknown) => void;
+export type ExpressHandler = (req: ExpressRequestLike, res: ExpressResponseLike, next?: ExpressNext) => unknown;
+export interface KoaContextLike {
+    request?: RequestLike;
+    state: {
+        user?: JwtPayload | null;
+        token?: string | null;
+        [key: string]: unknown;
+    };
+    status: number;
+    body: unknown;
+}
+export interface FastifyLike {
+    decorate(name: string, value: unknown): void;
+    decorateRequest(name: string, value: unknown): void;
+    [key: string]: unknown;
+}
+export interface FastifyRequestLike {
+    user?: JwtPayload | null;
+    headers?: Record<string, string | undefined>;
+    cookies?: Record<string, string>;
+    query?: Record<string, string | undefined>;
+    [key: string]: unknown;
+}
+export interface FastifyReplyLike {
+    code(status: number): FastifyReplyLike;
+    send(body: unknown): unknown;
+}
+//# sourceMappingURL=types.d.ts.map