@os.io/nest-kit 0.0.1-alpha.0 → 0.0.1-alpha.2

package/dist/auth/auth.service.js

@@ -1,175 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Inject, Injectable } from '@nestjs/common';
-import { AUTH_MODULE_OPTIONS, AUTH_STRATEGIES, CACHE_SERVICE } from './auth.constants';
-import { JwtService } from './session/jwt.service';
-import { TokenBlacklistService } from './session/token-blacklist.service';
-import { DeviceSessionService } from './session/device-session.service';
-/**
- * Central authentication orchestrator.
- *
- * Delegates to the appropriate strategy based on `AuthMethod`,
- * manages token lifecycle, session tracking, and cache acceleration.
- */
-let AuthService = class AuthService {
-    options;
-    cache;
-    jwtService;
-    tokenBlacklist;
-    deviceSession;
-    strategyMap = new Map();
-    constructor(options, _strategies, cache, jwtService, tokenBlacklist, deviceSession) {
-        this.options = options;
-        this.cache = cache;
-        this.jwtService = jwtService;
-        this.tokenBlacklist = tokenBlacklist;
-        this.deviceSession = deviceSession;
-        for (const strategy of _strategies) {
-            this.strategyMap.set(strategy.type, strategy);
-        }
-    }
-    /**
-     * Authenticate using the given method.
-     *
-     * @param method  Authentication method (e.g. 'credentials', 'oauth')
-     * @param payload Strategy-specific payload
-     * @param context Optional execution context
-     */
-    async authenticate(method, payload, context) {
-        const strategy = this.strategyMap.get(method);
-        if (!strategy) {
-            throw new Error(`Authentication method "${method}" is not enabled`);
-        }
-        const result = await strategy.authenticate(payload, context);
-        // Track device session if multi-device is enabled
-        if (this.options.session?.multiDevice) {
-            await this.deviceSession.register({
-                deviceId: payload.deviceId ?? 'default',
-                userId: result.user.id,
-                userAgent: payload.userAgent,
-                ip: payload.ip,
-                lastActivity: Date.now(),
-            });
-        }
-        return result;
-    }
-    /**
-     * Validate an access token and return its decoded payload.
-     * Uses cache for fast-path validation when available.
-     *
-     * @param token Raw JWT access token
-     */
-    async validateToken(token) {
-        // Fast-path: check cache first
-        const cacheKey = `auth:token:${this.hash(token)}`;
-        const cached = await this.cache.get(cacheKey);
-        if (cached)
-            return cached;
-        const payload = await this.jwtService.verifyAccess(token);
-        // Check blacklist
-        const jti = payload.jti;
-        if (jti && (await this.tokenBlacklist.isBlacklisted(jti))) {
-            throw new Error('Token has been revoked');
-        }
-        // Cache the validated payload for 30 seconds
-        await this.cache.set(cacheKey, payload, 30);
-        return payload;
-    }
-    /**
-     * Refresh an expired access token using a refresh token.
-     * Implements refresh token rotation.
-     */
-    async refreshToken(refreshToken, deviceId) {
-        const payload = await this.jwtService.verifyRefresh(refreshToken);
-        const userId = payload.sub;
-        // Check family revocation
-        if (this.options.session?.rotation !== false) {
-            const familyId = payload.family ?? payload.jti;
-            if (familyId && (await this.tokenBlacklist.isFamilyRevoked(familyId))) {
-                throw new Error('Refresh token family has been revoked');
-            }
-        }
-        // In rotation mode, blacklist the current refresh token
-        if (this.options.session?.rotation !== false && payload.jti) {
-            const exp = payload.exp;
-            const ttl = exp ? Math.max(1, exp - Math.floor(Date.now() / 1000)) : 86400;
-            await this.tokenBlacklist.blacklistAccess(payload.jti, ttl);
-        }
-        const user = {
-            id: userId,
-            email: payload.email,
-            username: payload.username,
-            roles: payload.roles,
-            permissions: payload.permissions,
-            isAnonymous: payload.isAnonymous ?? false,
-            isMfaVerified: payload.isMfaVerified ?? false,
-        };
-        const tokens = await this.jwtService.signTokens(user);
-        // Update device session timestamp
-        if (deviceId) {
-            const session = await this.deviceSession.getSession(userId, deviceId);
-            if (session) {
-                session.lastActivity = Date.now();
-                await this.deviceSession.register(session);
-            }
-        }
-        return tokens;
-    }
-    /**
-     * Logout — blacklist the current access token and optionally
-     * remove a specific device session.
-     */
-    async logout(accessToken, deviceId) {
-        const payload = this.jwtService.decode(accessToken);
-        const jti = payload?.jti ?? this.hash(accessToken);
-        const exp = payload?.exp;
-        const ttl = exp ? Math.max(1, exp - Math.floor(Date.now() / 1000)) : 3600;
-        await this.tokenBlacklist.blacklistAccess(jti, ttl);
-        const userId = payload?.sub;
-        if (userId && deviceId) {
-            await this.deviceSession.removeSession(userId, deviceId);
-        }
-    }
-    /**
-     * Logout from all devices — revoke all sessions for a user.
-     */
-    async logoutAll(userId) {
-        await this.deviceSession.removeAllUserSessions(userId);
-    }
-    /**
-     * Get all active sessions for a user (multi-device view).
-     */
-    async getUserSessions(userId) {
-        return this.deviceSession.getUserSessions(userId);
-    }
-    hash(value) {
-        let hash = 0;
-        for (let i = 0; i < value.length; i++) {
-            const char = value.charCodeAt(i);
-            hash = (hash << 5) - hash + char;
-            hash |= 0;
-        }
-        return Math.abs(hash).toString(16);
-    }
-};
-AuthService = __decorate([
-    Injectable(),
-    __param(0, Inject(AUTH_MODULE_OPTIONS)),
-    __param(1, Inject(AUTH_STRATEGIES)),
-    __param(2, Inject(CACHE_SERVICE)),
-    __metadata("design:paramtypes", [Object, Array, Object, JwtService,
-        TokenBlacklistService,
-        DeviceSessionService])
-], AuthService);
-export { AuthService };
-//# sourceMappingURL=auth.service.js.map

package/dist/auth/auth.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../packages/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAyB,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IAIA;IACA;IACA;IACA;IAXF,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpE,YAEmB,OAA0B,EAE3C,WAA4B,EAEX,KAAoB,EACpB,UAAsB,EACtB,cAAqC,EACrC,aAAmC;QAPnC,YAAO,GAAP,OAAO,CAAmB;QAI1B,UAAK,GAAL,KAAK,CAAe;QACpB,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAuB;QACrC,kBAAa,GAAb,aAAa,CAAsB;QAEpD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,MAAkB,EAClB,OAAgC,EAChC,OAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE7D,kDAAkD;QAClD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAChC,QAAQ,EAAG,OAAO,CAAC,QAAmB,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,SAA+B;gBAClD,EAAE,EAAE,OAAO,CAAC,EAAwB;gBACpC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;aACzB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,kBAAkB;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,6CAA6C;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAE5C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,YAAoB,EAAE,QAAiB;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAa,CAAC;QAErC,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;YAC/C,IAAI,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,QAAkB,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC3E,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAa,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,OAAO,CAAC,KAA2B;YAC1C,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,KAAK,EAAE,OAAO,CAAC,KAA6B;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAmC;YACxD,WAAW,EAAG,OAAO,CAAC,WAAuB,IAAI,KAAK;YACtD,aAAa,EAAG,OAAO,CAAC,aAAyB,IAAI,KAAK;SAC3D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,kCAAkC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,GAAG,GAAI,OAAO,EAAE,GAAc,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,GAAyB,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,OAAO,EAAE,GAAyB,CAAC;QAClD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YACjC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;CACF,CAAA;AAtKY,WAAW;IADvB,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,MAAM,CAAC,eAAe,CAAC,CAAA;IAEvB,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;4DAEO,UAAU;QACN,qBAAqB;QACtB,oBAAoB;GAZ3C,WAAW,CAsKvB"}

package/dist/auth/authorization/index.d.ts

@@ -1,3 +0,0 @@
-export * from './rbac';
-export * from './pbac';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC"}

package/dist/auth/authorization/index.js

@@ -1,3 +0,0 @@
-export * from './rbac';
-export * from './pbac';
-//# sourceMappingURL=index.js.map

package/dist/auth/authorization/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC"}

package/dist/auth/authorization/pbac/index.d.ts

@@ -1,6 +0,0 @@
-export { PbacService } from './pbac.service';
-export { PbacGuard } from './pbac.guard';
-export { RequirePolicy } from './pbac.decorator';
-export type { PolicyDecoratorOptions } from './pbac.decorator';
-export type { PolicyStatement, PolicyDocument, PolicyContext, PolicyEffect } from './pbac.types';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/pbac/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/dist/auth/authorization/pbac/index.js

@@ -1,4 +0,0 @@
-export { PbacService } from './pbac.service';
-export { PbacGuard } from './pbac.guard';
-export { RequirePolicy } from './pbac.decorator';
-//# sourceMappingURL=index.js.map

package/dist/auth/authorization/pbac/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/authorization/pbac/pbac.decorator.d.ts

@@ -1,18 +0,0 @@
-export interface PolicyDecoratorOptions {
-    /** Action being performed (e.g. 'document:read') */
-    action: string;
-    /** Resource being accessed (e.g. 'org:123:doc:456') */
-    resource: string | ((req: unknown) => string);
-}
-/**
- * Require a policy check on a route handler.
- * Works with the PbacGuard.
- *
- * @example
- * ```typescript
- * @RequirePolicy({ action: 'document:delete', resource: 'org:*' })
- * @RequirePolicy({ action: 'document:read', resource: (req) => req.params.docId })
- * ```
- */
-export declare const RequirePolicy: (options: PolicyDecoratorOptions) => import("@nestjs/common").CustomDecorator<string>;
-//# sourceMappingURL=pbac.decorator.d.ts.map

package/dist/auth/authorization/pbac/pbac.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.decorator.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.decorator.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,sBAAsB,qDACtB,CAAC"}

package/dist/auth/authorization/pbac/pbac.decorator.js

@@ -1,14 +0,0 @@
-import { SetMetadata } from '@nestjs/common';
-import { METADATA_POLICY } from '../../auth.constants';
-/**
- * Require a policy check on a route handler.
- * Works with the PbacGuard.
- *
- * @example
- * ```typescript
- * @RequirePolicy({ action: 'document:delete', resource: 'org:*' })
- * @RequirePolicy({ action: 'document:read', resource: (req) => req.params.docId })
- * ```
- */
-export const RequirePolicy = (options) => SetMetadata(METADATA_POLICY, options);
-//# sourceMappingURL=pbac.decorator.js.map

package/dist/auth/authorization/pbac/pbac.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.decorator.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AASvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA+B,EAAE,EAAE,CAC/D,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC"}

package/dist/auth/authorization/pbac/pbac.guard.d.ts

@@ -1,19 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { PbacService } from './pbac.service';
-/**
- * Guard that enforces Policy-Based Access Control.
- *
- * Reads the required policy from the `@RequirePolicy()` decorator
- * and evaluates it against the user's assigned policies.
- *
- * This guard is independent — you can use it with or without RBAC on
- * different routes in the same application.
- */
-export declare class PbacGuard implements CanActivate {
-    private readonly reflector;
-    private readonly pbacService;
-    constructor(reflector: Reflector, pbacService: PbacService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=pbac.guard.d.ts.map

package/dist/auth/authorization/pbac/pbac.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.guard.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAM7C;;;;;;;;GAQG;AACH,qBACa,SAAU,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW;IAGrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAgC/D"}

package/dist/auth/authorization/pbac/pbac.guard.js

@@ -1,60 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Injectable } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { PbacService } from './pbac.service';
-import { METADATA_POLICY } from '../../auth.constants';
-/**
- * Guard that enforces Policy-Based Access Control.
- *
- * Reads the required policy from the `@RequirePolicy()` decorator
- * and evaluates it against the user's assigned policies.
- *
- * This guard is independent — you can use it with or without RBAC on
- * different routes in the same application.
- */
-let PbacGuard = class PbacGuard {
-    reflector;
-    pbacService;
-    constructor(reflector, pbacService) {
-        this.reflector = reflector;
-        this.pbacService = pbacService;
-    }
-    async canActivate(context) {
-        const policyMeta = this.reflector.getAllAndOverride(METADATA_POLICY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (!policyMeta)
-            return true;
-        const request = context.switchToHttp().getRequest();
-        const user = request.user;
-        if (!user)
-            return false;
-        const action = policyMeta.action;
-        const resource = typeof policyMeta.resource === 'function'
-            ? policyMeta.resource(request)
-            : policyMeta.resource;
-        const policies = await this.pbacService.getUserPolicies(user.id);
-        const ctx = {
-            user: user,
-            resource: { id: resource, ...request.params },
-            environment: {},
-        };
-        return this.pbacService.evaluate(policies, action, resource, ctx);
-    }
-};
-PbacGuard = __decorate([
-    Injectable(),
-    __metadata("design:paramtypes", [Reflector,
-        PbacService])
-], PbacGuard);
-export { PbacGuard };
-//# sourceMappingURL=pbac.guard.js.map

package/dist/auth/authorization/pbac/pbac.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.guard.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAiC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAKvD;;;;;;;;GAQG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAyB,eAAe,EAAE;YAC3F,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAI7C,CAAC;QACL,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GACZ,OAAO,UAAU,CAAC,QAAQ,KAAK,UAAU;YACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC9B,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,GAAG,GAAkB;YACzB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE;YAC7C,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;AAtCY,SAAS;IADrB,UAAU,EAAE;qCAGmB,SAAS;QACP,WAAW;GAHhC,SAAS,CAsCrB"}

package/dist/auth/authorization/pbac/pbac.service.d.ts

@@ -1,44 +0,0 @@
-import type { ICacheService } from '../../interfaces';
-import type { PolicyContext, PolicyEffect, PolicyDocument } from './pbac.types';
-/**
- * Policy-Based Access Control service.
- *
- * Evaluates user-assigned policies against the current request context.
- * Supports wildcard matching and simple condition evaluation.
- */
-export declare class PbacService {
-    private readonly cache;
-    private defaultEffect;
-    constructor(cache: ICacheService);
-    /**
-     * Configure the default effect when no policy matches.
-     */
-    setDefaultEffect(effect: PolicyEffect): void;
-    /**
-     * Evaluate a list of policy documents for a given action + resource.
-     *
-     * Returns `true` if access is granted, `false` otherwise.
-     *
-     * Evaluation logic (AWS IAM style):
-     *   1. An explicit `deny` overrides everything.
-     *   2. If any statement matches with `allow`, access is granted.
-     *   3. If no statement matches, the default effect applies.
-     */
-    evaluate(policies: PolicyDocument[], action: string, resource: string, context: PolicyContext): boolean;
-    /**
-     * Fetch policies for a user, using cache when possible.
-     */
-    getUserPolicies(userId: string): Promise<PolicyDocument[]>;
-    /**
-     * Invalidate cached policies for a user.
-     */
-    invalidateUser(userId: string): Promise<void>;
-    private matchAction;
-    private matchResource;
-    private wildcardMatch;
-    private evaluateCondition;
-    private resolveCondition;
-    private eq;
-    private resolveValue;
-}
-//# sourceMappingURL=pbac.service.d.ts.map

package/dist/auth/authorization/pbac/pbac.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.service.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAmB,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;GAKG;AACH,qBACa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,aAAa,CAAwB;gBAI1B,KAAK,EAAE,aAAa;IAGvC;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI5C;;;;;;;;;OASG;IACH,QAAQ,CACN,QAAQ,EAAE,cAAc,EAAE,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO;IAoBV;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAOhE;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,EAAE;IAWV,OAAO,CAAC,YAAY;CAWrB"}

package/dist/auth/authorization/pbac/pbac.service.js

@@ -1,146 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Inject, Injectable } from '@nestjs/common';
-import { CACHE_SERVICE } from '../../auth.constants';
-/**
- * Policy-Based Access Control service.
- *
- * Evaluates user-assigned policies against the current request context.
- * Supports wildcard matching and simple condition evaluation.
- */
-let PbacService = class PbacService {
-    cache;
-    defaultEffect = 'deny';
-    constructor(cache) {
-        this.cache = cache;
-    }
-    /**
-     * Configure the default effect when no policy matches.
-     */
-    setDefaultEffect(effect) {
-        this.defaultEffect = effect;
-    }
-    /**
-     * Evaluate a list of policy documents for a given action + resource.
-     *
-     * Returns `true` if access is granted, `false` otherwise.
-     *
-     * Evaluation logic (AWS IAM style):
-     *   1. An explicit `deny` overrides everything.
-     *   2. If any statement matches with `allow`, access is granted.
-     *   3. If no statement matches, the default effect applies.
-     */
-    evaluate(policies, action, resource, context) {
-        let allowCount = 0;
-        for (const doc of policies) {
-            for (const stmt of doc.statements) {
-                if (!this.matchAction(stmt, action))
-                    continue;
-                if (!this.matchResource(stmt, resource))
-                    continue;
-                if (stmt.condition && !this.evaluateCondition(stmt.condition, context)) {
-                    continue;
-                }
-                if (stmt.effect === 'deny')
-                    return false;
-                if (stmt.effect === 'allow')
-                    allowCount += 1;
-            }
-        }
-        if (allowCount > 0)
-            return true;
-        return this.defaultEffect === 'allow';
-    }
-    /**
-     * Fetch policies for a user, using cache when possible.
-     */
-    async getUserPolicies(userId) {
-        const cacheKey = `pbac:policies:${userId}`;
-        const cached = await this.cache.get(cacheKey);
-        if (cached)
-            return cached;
-        return [];
-    }
-    /**
-     * Invalidate cached policies for a user.
-     */
-    async invalidateUser(userId) {
-        await this.cache.del(`pbac:policies:${userId}`);
-    }
-    matchAction(stmt, action) {
-        return stmt.actions.some((a) => this.wildcardMatch(a, action));
-    }
-    matchResource(stmt, resource) {
-        return stmt.resources.some((r) => this.wildcardMatch(r, resource));
-    }
-    wildcardMatch(pattern, value) {
-        const regexStr = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
-        return new RegExp(`^${regexStr}$`).test(value);
-    }
-    evaluateCondition(condition, context) {
-        // Simple condition evaluator — supports { "eq": { "user.department": "engineering" } }
-        // Extend this for production use with a proper expression engine.
-        try {
-            return this.resolveCondition(condition, context);
-        }
-        catch {
-            return false;
-        }
-    }
-    resolveCondition(node, context) {
-        if (typeof node !== 'object' || node === null)
-            return true;
-        const obj = node;
-        // Operator keys
-        if ('eq' in obj)
-            return this.eq(obj.eq, context);
-        if ('ne' in obj)
-            return !this.eq(obj.ne, context);
-        if ('and' in obj) {
-            const conditions = obj.and;
-            return conditions.every((c) => this.resolveCondition(c, context));
-        }
-        if ('or' in obj) {
-            const conditions = obj.or;
-            return conditions.some((c) => this.resolveCondition(c, context));
-        }
-        return true;
-    }
-    eq(mapping, context) {
-        if (typeof mapping !== 'object' || mapping === null)
-            return false;
-        const entries = Object.entries(mapping);
-        if (entries.length !== 1)
-            return false;
-        const [key, expected] = entries[0];
-        const actual = this.resolveValue(key, context);
-        return String(actual) === String(expected);
-    }
-    resolveValue(path, context) {
-        const parts = path.split('.');
-        let current = context;
-        for (const part of parts) {
-            if (typeof current !== 'object' || current === null)
-                return undefined;
-            current = current[part];
-        }
-        return current;
-    }
-};
-PbacService = __decorate([
-    Injectable(),
-    __param(0, Inject(CACHE_SERVICE)),
-    __metadata("design:paramtypes", [Object])
-], PbacService);
-export { PbacService };
-//# sourceMappingURL=pbac.service.js.map

package/dist/auth/authorization/pbac/pbac.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.service.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IAJX,aAAa,GAAiB,MAAM,CAAC;IAE7C,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;OAEG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CACN,QAA0B,EAC1B,MAAc,EACd,QAAgB,EAChB,OAAsB;QAEtB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;oBAAE,SAAS;gBAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAClD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;oBACvE,SAAS;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACzC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;oBAAE,UAAU,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,iBAAiB,MAAM,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,WAAW,CAAC,IAAqB,EAAE,MAAc;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,aAAa,CAAC,IAAqB,EAAE,QAAgB;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,KAAa;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,SAAkC,EAAE,OAAsB;QAClF,uFAAuF;QACvF,kEAAkE;QAClE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,IAAa,EAAE,OAAsB;QAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE3D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAE5C,gBAAgB;QAChB,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,CAAC,GAAgB,CAAC;YACxC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,GAAG,CAAC,EAAe,CAAC;YACvC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,EAAE,CAAC,OAAgB,EAAE,OAAsB;QACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAsB;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACtE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AApIY,WAAW;IADvB,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAJb,WAAW,CAoIvB"}

package/dist/auth/authorization/pbac/pbac.types.d.ts

@@ -1,47 +0,0 @@
-/**
- * Policy effect — the outcome of evaluating a policy statement.
- */
-export type PolicyEffect = 'allow' | 'deny';
-/**
- * A single policy statement (akin to AWS IAM).
- *
- * @example
- * ```typescript
- * const policy: PolicyStatement = {
- *   effect: 'deny',
- *   actions: ['document:delete'],
- *   resources: ['org:*'],
- *   condition: { department: { ne: { ref: 'user.department' } } },
- * };
- * ```
- */
-export interface PolicyStatement {
-    /** Whether this statement allows or denies access */
-    effect: PolicyEffect;
-    /** Actions this statement applies to (supports wildcard: 'document:*') */
-    actions: string[];
-    /** Resources this statement applies to (supports wildcard) */
-    resources: string[];
-    /** Optional conditions that must be satisfied */
-    condition?: Record<string, unknown>;
-}
-/**
- * A complete policy document assigned to a user or role.
- */
-export interface PolicyDocument {
-    /** Policy identifier */
-    id?: string;
-    /** Policy name */
-    name?: string;
-    /** List of statements */
-    statements: PolicyStatement[];
-}
-/**
- * Evaluation context passed to condition functions.
- */
-export interface PolicyContext {
-    user: Record<string, unknown>;
-    resource: Record<string, unknown>;
-    environment: Record<string, unknown>;
-}
-//# sourceMappingURL=pbac.types.d.ts.map

package/dist/auth/authorization/pbac/pbac.types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.types.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,MAAM,EAAE,YAAY,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wBAAwB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC"}

package/dist/auth/authorization/pbac/pbac.types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=pbac.types.js.map

package/dist/auth/authorization/pbac/pbac.types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pbac.types.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.types.ts"],"names":[],"mappings":""}

package/dist/auth/authorization/rbac/index.d.ts

@@ -1,4 +0,0 @@
-export { RbacService } from './rbac.service';
-export { RbacGuard } from './rbac.guard';
-export { Roles } from './rbac.decorator';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/rbac/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/authorization/rbac/index.js

@@ -1,4 +0,0 @@
-export { RbacService } from './rbac.service';
-export { RbacGuard } from './rbac.guard';
-export { Roles } from './rbac.decorator';
-//# sourceMappingURL=index.js.map

package/dist/auth/authorization/rbac/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC"}