@openora/core 0.4.0

package/dist/react/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/react/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4C,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAA2B,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACL,cAAc,GAIf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAI1B,MAAM,8BAA8B,CAAC"}

package/dist/server/auth/__tests__/admin-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-guard.test.d.ts.map

package/dist/server/auth/__tests__/admin-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-guard.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/admin-guard.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/admin-guard.test.js

@@ -0,0 +1,133 @@
+import { describe, it, expect, vi } from 'vitest';
+import { mock, mockDb } from '../../../testing/mock.js';
+import { AdminGuard } from '../admin-guard.js';
+describe('AdminGuard - unauthorized access logging', () => {
+    it('emits identity.user.unauthorized_access when dynamic permission check fails', async () => {
+        const drizzle = mockDb({
+            execute: vi.fn().mockResolvedValue({
+                rows: [{ id: 'u1', role: 'admin' }],
+            }),
+        });
+        const sessions = mock({
+            resolveUserId: vi.fn().mockResolvedValue('u1'),
+        });
+        const permissionResolver = mock({
+            getGrants: vi.fn().mockResolvedValue([]),
+        });
+        const events = mock({
+            emit: vi.fn(),
+        });
+        const guard = new AdminGuard(drizzle, sessions, permissionResolver, events);
+        const context = {
+            request: {
+                headers: {
+                    'x-real-ip': '127.0.0.1',
+                    'user-agent': 'Mozilla/5.0',
+                },
+            },
+        };
+        await expect(guard.assert(context, 'admin', 'delete')).rejects.toThrow(expect.objectContaining({ code: 'FORBIDDEN' }));
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unauthorized_access', expect.objectContaining({
+            userId: 'u1',
+            resource: 'admin',
+            action: 'delete',
+            ip: '127.0.0.1',
+            userAgent: 'Mozilla/5.0',
+            role: 'admin',
+        }));
+    });
+    it('emits identity.user.unauthorized_access when static role permission check fails', async () => {
+        const drizzle = mockDb({
+            execute: vi.fn().mockResolvedValue({
+                rows: [{ id: 'u1', role: 'support' }],
+            }),
+        });
+        const sessions = mock({
+            resolveUserId: vi.fn().mockResolvedValue('u1'),
+        });
+        const events = mock({
+            emit: vi.fn(),
+        });
+        const guard = new AdminGuard(drizzle, sessions, undefined, events);
+        const context = {
+            request: {
+                headers: {
+                    'x-forwarded-for': '192.168.1.1, 10.0.0.1',
+                    'user-agent': 'Mozilla/5.0',
+                },
+            },
+        };
+        await expect(guard.assert(context, 'admin', 'delete')).rejects.toThrow(expect.objectContaining({ code: 'FORBIDDEN' }));
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unauthorized_access', expect.objectContaining({
+            userId: 'u1',
+            resource: 'admin',
+            action: 'delete',
+            ip: '192.168.1.1',
+            userAgent: 'Mozilla/5.0',
+            role: 'support',
+        }));
+    });
+    it('emits identity.user.unauthorized_access when user has no static role (e.g. player role)', async () => {
+        const drizzle = mockDb({
+            execute: vi.fn().mockResolvedValue({
+                rows: [{ id: 'u1', role: 'player' }],
+            }),
+        });
+        const sessions = mock({
+            resolveUserId: vi.fn().mockResolvedValue('u1'),
+        });
+        const events = mock({
+            emit: vi.fn(),
+        });
+        const guard = new AdminGuard(drizzle, sessions, undefined, events);
+        const context = {
+            request: {
+                headers: {
+                    'x-real-ip': '127.0.0.1',
+                    'user-agent': 'Mozilla/5.0',
+                },
+            },
+        };
+        await expect(guard.assert(context, 'admin', 'delete')).rejects.toThrow(expect.objectContaining({ code: 'FORBIDDEN' }));
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unauthorized_access', expect.objectContaining({
+            userId: 'u1',
+            resource: 'admin',
+            action: 'delete',
+            ip: '127.0.0.1',
+            userAgent: 'Mozilla/5.0',
+            role: 'player',
+        }));
+    });
+    it('emits identity.user.unauthorized_access with default admin:access when coarse check fails for player role', async () => {
+        const drizzle = mockDb({
+            execute: vi.fn().mockResolvedValue({
+                rows: [{ id: 'u1', role: 'player' }],
+            }),
+        });
+        const sessions = mock({
+            resolveUserId: vi.fn().mockResolvedValue('u1'),
+        });
+        const events = mock({
+            emit: vi.fn(),
+        });
+        const guard = new AdminGuard(drizzle, sessions, undefined, events);
+        const context = {
+            request: {
+                headers: {
+                    'x-real-ip': '127.0.0.1',
+                    'user-agent': 'Mozilla/5.0',
+                },
+            },
+        };
+        await expect(guard.assert(context)).rejects.toThrow(expect.objectContaining({ code: 'FORBIDDEN' }));
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unauthorized_access', expect.objectContaining({
+            userId: 'u1',
+            resource: 'admin',
+            action: 'access',
+            ip: '127.0.0.1',
+            userAgent: 'Mozilla/5.0',
+            role: 'player',
+        }));
+    });
+});
+//# sourceMappingURL=admin-guard.test.js.map

package/dist/server/auth/__tests__/admin-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-guard.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/admin-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACjC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACpC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAkB;YACrC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAI,CAA0B;YACvD,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,WAAW,EAAE,WAAW;oBACxB,YAAY,EAAE,aAAa;iBAC5B;aACF;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,OAAO;SACd,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACjC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aACtC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAkB;YACrC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,iBAAiB,EAAE,uBAAuB;oBAC1C,YAAY,EAAE,aAAa;iBAC5B;aACF;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,aAAa;YACjB,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,SAAS;SAChB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACjC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACrC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAkB;YACrC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,WAAW,EAAE,WAAW;oBACxB,YAAY,EAAE,aAAa;iBAC5B;aACF;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,QAAQ;SACf,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;QACzH,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACjC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aACrC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAkB;YACrC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,WAAW,EAAE,WAAW;oBACxB,YAAY,EAAE,aAAa;iBAC5B;aACF;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjD,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,QAAQ;SACf,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/__tests__/session-resolver.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-resolver.test.d.ts.map

package/dist/server/auth/__tests__/session-resolver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.test.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.test.ts"],"names":[],"mappings":""}

package/dist/server/auth/__tests__/session-resolver.test.js

@@ -0,0 +1,27 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { mockDb } from '../../../testing/mock.js';
+import { SessionResolver } from '../session-resolver.js';
+const { getSessionMock } = vi.hoisted(() => ({
+    getSessionMock: vi.fn().mockResolvedValue(null),
+}));
+vi.mock('../auth.js', () => ({
+    createAuth: vi.fn(() => ({ api: { getSession: getSessionMock } })),
+}));
+beforeEach(() => {
+    getSessionMock.mockClear();
+    getSessionMock.mockResolvedValue(null);
+});
+describe('SessionResolver.resolveUserId', () => {
+    it('returns undefined when there is no session', async () => {
+        const resolver = new SessionResolver(mockDb({}));
+        const userId = await resolver.resolveUserId(new Headers());
+        expect(userId).toBeUndefined();
+    });
+    it('returns the user id when a session resolves', async () => {
+        getSessionMock.mockResolvedValueOnce({ user: { id: 'u1' } });
+        const resolver = new SessionResolver(mockDb({}));
+        const userId = await resolver.resolveUserId(new Headers());
+        expect(userId).toBe('u1');
+    });
+});
+//# sourceMappingURL=session-resolver.test.js.map

package/dist/server/auth/__tests__/session-resolver.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/session-resolver.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3B,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;CACnE,CAAC,CAAC,CAAC;AAEJ,UAAU,CAAC,GAAG,EAAE;IACd,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,cAAc,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/admin-guard.d.ts

@@ -0,0 +1,23 @@
+import { type Token, type AdminPermissionResolver } from '@openora/core/contracts';
+import { DrizzleService } from '../db/index.js';
+import { SessionResolver } from './session-resolver.js';
+import { type ResourceName, type ActionOf } from './permissions.js';
+import type { EventBus } from '../kernel/index.js';
+export declare const ADMIN_GUARD: Token<AdminGuard>;
+export declare class AdminGuard {
+    private readonly drizzle;
+    private readonly sessions;
+    private readonly permissionResolver?;
+    private readonly events?;
+    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined);
+    assert(context: unknown): Promise<{
+        userId: string;
+        role: string;
+    }>;
+    assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<{
+        userId: string;
+        role: string;
+    }>;
+    private emitUnauthorized;
+}
+//# sourceMappingURL=admin-guard.d.ts.map

package/dist/server/auth/admin-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,KAAK,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAEzE,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAJP,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA;IAG9B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAwE5C,OAAO,CAAC,gBAAgB;CAmBzB"}

package/dist/server/auth/admin-guard.js

@@ -0,0 +1,95 @@
+import { ORPCError } from '@orpc/server';
+import { createToken } from '@openora/core/contracts';
+import { sql } from 'drizzle-orm';
+import { roles } from './permissions.js';
+export const ADMIN_GUARD = createToken('ADMIN_GUARD');
+export class AdminGuard {
+    drizzle;
+    sessions;
+    permissionResolver;
+    events;
+    // Uses the shared SessionResolver (one better-auth init for the whole app) rather than a second createAuth over the same DB.
+    constructor(drizzle, sessions, 
+    // When bound (iam module loaded), grants come from DB; otherwise falls back to static roles.
+    permissionResolver, events) {
+        this.drizzle = drizzle;
+        this.sessions = sessions;
+        this.permissionResolver = permissionResolver;
+        this.events = events;
+    }
+    async assert(context, resource, action) {
+        const request = context.request;
+        if (!request || typeof request.headers !== 'object') {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Missing request context' });
+        }
+        const headers = new Headers();
+        for (const [k, v] of Object.entries(request.headers)) {
+            if (v === undefined)
+                continue;
+            headers.set(k, Array.isArray(v) ? v.join(', ') : v);
+        }
+        const userId = await this.sessions.resolveUserId(headers);
+        if (!userId) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Authentication required' });
+        }
+        const result = await this.drizzle.db.execute(sql `SELECT id, role FROM "user" WHERE id = ${userId} LIMIT 1`);
+        const userRecord = result.rows[0];
+        if (!userRecord) {
+            if (resource !== undefined && action !== undefined) {
+                this.emitUnauthorized(userId, undefined, resource, action, headers);
+            }
+            else {
+                this.emitUnauthorized(userId, undefined, 'admin', 'access', headers);
+            }
+            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+        }
+        const userRole = roles[userRecord.role];
+        if (!userRole) {
+            if (resource !== undefined && action !== undefined) {
+                this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
+            }
+            else {
+                this.emitUnauthorized(userId, userRecord.role, 'admin', 'access', headers);
+            }
+            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+        }
+        if (resource !== undefined && action !== undefined) {
+            const grants = this.permissionResolver
+                ? await this.permissionResolver.getGrants(userId)
+                : null;
+            if (grants !== null) {
+                const allowed = grants.some((g) => g.resource === resource && g.action === action);
+                if (!allowed) {
+                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
+                    throw new ORPCError('FORBIDDEN', {
+                        message: `Missing permission: ${String(resource)}:${String(action)}`,
+                    });
+                }
+            }
+            else {
+                // Bootstrap path: seed admin has user.role='admin' but no DB assignment row. DB revocation is NOT authoritative while a static role still grants - revoke the static role to fully deny.
+                const check = userRole.authorize({ [resource]: [action] });
+                if (!check.success) {
+                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
+                    throw new ORPCError('FORBIDDEN', {
+                        message: `Missing permission: ${String(resource)}:${String(action)}`,
+                    });
+                }
+            }
+        }
+        return { userId, role: userRecord.role };
+    }
+    emitUnauthorized(userId, role, resource, action, headers) {
+        const ip = headers.get('x-forwarded-for')?.split(',')[0]?.trim() || headers.get('x-real-ip') || null;
+        const userAgent = headers.get('user-agent') || null;
+        this.events?.emit('identity.user.unauthorized_access', {
+            userId,
+            resource,
+            action,
+            ip,
+            userAgent,
+            role,
+        });
+    }
+}
+//# sourceMappingURL=admin-guard.js.map

package/dist/server/auth/admin-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAA4C,MAAM,yBAAyB,CAAC;AAEhG,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAG3E,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IANnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;QAJjB,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;IACjC,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB;gBACpC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACnF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yLAAyL;gBACzL,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,OAAgB;QAEhB,MAAM,EAAE,GACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;YACrD,MAAM;YACN,QAAQ;YACR,MAAM;YACN,EAAE;YACF,SAAS;YACT,IAAI;SACL,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/server/auth/auth.d.ts

@@ -0,0 +1,15 @@
+import type { Auth as BetterAuthType } from 'better-auth';
+import type { DrizzleDb } from '../db/index.js';
+export type SendEmail = (args: {
+    to: string;
+    subject: string;
+    body: string;
+}) => Promise<void> | void;
+export type AuthOptions = {
+    db: DrizzleDb;
+    schema?: Record<string, unknown>;
+    sendEmail?: SendEmail;
+};
+export declare function createAuth(options: AuthOptions): BetterAuthType;
+export type Auth = BetterAuthType;
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAGF,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAqD/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}

package/dist/server/auth/auth.js

@@ -0,0 +1,61 @@
+import { randomUUID } from 'node:crypto';
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import { organization, admin as adminPlugin, twoFactor } from 'better-auth/plugins';
+import { ac, roles } from './permissions.js';
+// Explicit return type avoids TS2883 (Zod v4 $strip portability issue with admin plugin).
+export function createAuth(options) {
+    const sendEmail = options.sendEmail ?? (() => { });
+    return betterAuth({
+        database: drizzleAdapter(options.db, {
+            provider: 'pg',
+            schema: options.schema,
+        }),
+        advanced: {
+            database: {
+                generateId: () => randomUUID(),
+            },
+        },
+        session: {
+            expiresIn: 30 * 24 * 60 * 60,
+            updateAge: 24 * 60 * 60,
+        },
+        user: {
+            // Surfaces `theme`/`language` on the session/`me` user and lets `updateUser`
+            // write them, so every user (player + admin) syncs a UI theme + locale. Both
+            // are validated at the route (theme against the enum, language against
+            // PlatformConfig.supportedLanguages).
+            additionalFields: {
+                theme: { type: 'string', required: false, input: true, defaultValue: 'system' },
+                language: { type: 'string', required: false, input: true, defaultValue: 'en' },
+            },
+        },
+        emailAndPassword: {
+            enabled: true,
+            rememberMeDuration: 30 * 24 * 60 * 60,
+            sendResetPassword: async ({ user, url, token }) => {
+                await sendEmail({
+                    to: user.email,
+                    subject: 'Reset your password',
+                    body: `Reset your password using this link: ${url}\n\nReset token: ${token}`,
+                });
+            },
+        },
+        emailVerification: {
+            sendVerificationEmail: async ({ user, url, token }) => {
+                await sendEmail({
+                    to: user.email,
+                    subject: 'Verify your email',
+                    body: `Verify your email using this link: ${url}\n\nVerification token: ${token}`,
+                });
+            },
+        },
+        // Without this, better-auth's admin plugin defaults new signups to its own
+        // 'user' role, which UserRoleSchema (player|admin) rejects everywhere downstream.
+        plugins: [organization(), adminPlugin({ ac, roles, defaultRole: 'player' }), twoFactor()],
+        // Library boundary: better-auth infers an options-specific instantiation that isn't
+        // assignable to its own exported `Auth` alias. No way to narrow without matching the
+        // full generic - the one sanctioned cast, see conventions.
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgB7C,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACrC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,wCAAwC,GAAG,oBAAoB,KAAK,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,sCAAsC,GAAG,2BAA2B,KAAK,EAAE;iBAClF,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzF,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,9 @@
+export type { AuthOptions, Auth, SendEmail } from './auth.js';
+export { createAuth } from './auth.js';
+export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { ac, roles, statement } from './permissions.js';
+export type { RoleName, ResourceName, ActionOf } from './permissions.js';
+export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
+export type { PermissionLevel } from './permission-levels.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/index.js

@@ -0,0 +1,6 @@
+export { createAuth } from './auth.js';
+export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { ac, roles, statement } from './permissions.js';
+export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/permission-levels.d.ts

@@ -0,0 +1,13 @@
+import { type ResourceName } from './permissions.js';
+import { type PermissionLevel } from '@openora/core/contracts';
+export type { PermissionLevel };
+export declare const PERMISSION_LEVELS: readonly PermissionLevel[];
+export declare const SUPPORTED_LEVELS: readonly PermissionLevel[];
+export declare function levelRank(level: PermissionLevel): number;
+export declare function isLevelSufficient(have: PermissionLevel, required: PermissionLevel): boolean;
+export declare const readActions: Partial<Record<ResourceName, readonly string[]>>;
+/** Expands a (resource, level) cell to the action set AdminGuard checks - levels are stored, actions derived at the authz edge. */
+export declare function levelToActions(resource: string, level: PermissionLevel): readonly string[];
+/** Collapses a concrete action set to the closest level - used only for legacy/edge data; new writes are level-native. */
+export declare function actionsToLevel(resource: string, actions: readonly string[]): PermissionLevel;
+//# sourceMappingURL=permission-levels.d.ts.map

package/dist/server/auth/permission-levels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-levels.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,YAAY,EAAE,eAAe,EAAE,CAAC;AAGhC,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAE9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAsB,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE3F;AAID,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAKpB,CAAC;AAEtD,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAM1F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAQ5F"}

package/dist/server/auth/permission-levels.js

@@ -0,0 +1,42 @@
+import { statement } from './permissions.js';
+import { permissionLevels } from '@openora/core/contracts';
+// Caller can only grant a level <= their own per module (no-escalation invariant).
+export const PERMISSION_LEVELS = permissionLevels;
+export const SUPPORTED_LEVELS = PERMISSION_LEVELS;
+export function levelRank(level) {
+    return PERMISSION_LEVELS.indexOf(level);
+}
+export function isLevelSufficient(have, required) {
+    return levelRank(have) >= levelRank(required);
+}
+// `content` has no 'view' action (create/update/delete/publish only), so read level
+// maps to an empty set there - effectively read_write-or-nothing for that resource.
+export const readActions = Object.fromEntries(Object.keys(statement).map((resource) => {
+    const actions = statement[resource];
+    return [resource, actions.includes('view') ? ['view'] : []];
+}));
+/** Expands a (resource, level) cell to the action set AdminGuard checks - levels are stored, actions derived at the authz edge. */
+export function levelToActions(resource, level) {
+    const actions = statement[resource];
+    if (!actions)
+        return [];
+    if (level === 'no_access')
+        return [];
+    if (level === 'read_write')
+        return actions;
+    return readActions[resource] ?? (actions.includes('view') ? ['view'] : []);
+}
+/** Collapses a concrete action set to the closest level - used only for legacy/edge data; new writes are level-native. */
+export function actionsToLevel(resource, actions) {
+    const all = statement[resource];
+    if (!all || all.length === 0)
+        return 'no_access';
+    const has = new Set(actions);
+    if (all.every((a) => has.has(a)))
+        return 'read_write';
+    const read = readActions[resource] ?? [];
+    if (read.length > 0 && read.every((a) => has.has(a)))
+        return 'read';
+    return 'no_access';
+}
+//# sourceMappingURL=permission-levels.js.map

package/dist/server/auth/permission-levels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-levels.js","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAIjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAA+B,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAA+B,iBAAiB,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAyB;IAChF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAqD,MAAM,CAAC,WAAW,CAC5F,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACiD,CAAC;AAEtD,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAsB;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC3C,OAAO,WAAW,CAAC,QAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAwB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACpE,OAAO,WAAW,CAAC;AACrB,CAAC"}