@owlmeans/iam 0.1.5

package/build/consts.d.ts

@@ -0,0 +1,5 @@
+export declare const DEFAULT_ALIAS = "iam-service";
+export declare const IAM_MODE_KEYCLOAK = "keycloak";
+export declare const IAM_MODE_INTEGRATED = "integrated";
+export type IamMode = typeof IAM_MODE_KEYCLOAK | typeof IAM_MODE_INTEGRATED;
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA"}

package/build/consts.js

@@ -0,0 +1,4 @@
+export const DEFAULT_ALIAS = 'iam-service';
+export const IAM_MODE_KEYCLOAK = 'keycloak';
+export const IAM_MODE_INTEGRATED = 'integrated';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA"}

package/build/errors.d.ts

@@ -0,0 +1,14 @@
+import { ResilientError } from '@owlmeans/error';
+export declare class IamError extends ResilientError {
+    static typeName: string;
+    constructor(message?: string);
+}
+export declare class IamClientError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
+export declare class IamResourceError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;gBAErD,OAAO,SAAU;CAI9B;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;gBAE3D,OAAO,SAAU;CAI9B;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;gBAE7D,OAAO,SAAU;CAI9B"}

package/build/errors.js

@@ -0,0 +1,26 @@
+import { ResilientError } from '@owlmeans/error';
+export class IamError extends ResilientError {
+    static typeName = `Iam${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(IamError.typeName, `iam:${message}`);
+        this.type = IamError.typeName;
+    }
+}
+export class IamClientError extends IamError {
+    static typeName = `IamClient${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`client:${message}`);
+        this.type = IamClientError.typeName;
+    }
+}
+export class IamResourceError extends IamError {
+    static typeName = `IamResource${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`resource:${message}`);
+        this.type = IamResourceError.typeName;
+    }
+}
+ResilientError.registerErrorClass(IamError);
+ResilientError.registerErrorClass(IamClientError);
+ResilientError.registerErrorClass(IamResourceError);
+//# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;;AAGH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;;AAGH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;;AAGH,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,4 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -0,0 +1,3 @@
+export * from './consts.js';
+export * from './errors.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,39 @@
+import type { InitializedService } from '@owlmeans/context';
+import type { OidcProviderConfig } from '@owlmeans/oidc';
+export interface IamClient {
+    id?: string;
+    clientId: string;
+    secret?: string;
+    name?: string;
+    /** The entity realm this client belongs to — replaces the old (client as any)._realm hack */
+    realm?: string;
+}
+export interface IamCredentialsPair {
+    token: string;
+    realm: string;
+}
+export interface IamPermissionArgs {
+    /** Action name. When absent the permission is unscoped (project-wide). */
+    permission?: string;
+}
+export interface IamResourceSpec {
+    name: string;
+    displayName?: string;
+}
+/** Unified IAM provider interface — all platform/agent code calls only this, never a backend directly */
+export interface IamService extends InitializedService {
+    getEntityAdminConfig: (entityId: string) => Promise<OidcProviderConfig>;
+    getCredentialsPair: (entityId: string) => Promise<IamCredentialsPair>;
+    ensureClient: (entityId: string, clientId: string) => Promise<IamClient>;
+    /**
+     * Ensures a permission/resource exists in the entity's client.
+     * Returns the canonical resource name (e.g. "res--action" or "res").
+     */
+    ensurePermission: (entityId: string, clientId: string, resource?: string, args?: IamPermissionArgs) => Promise<string>;
+    /**
+     * Idempotent: creates a resource, a client role for it, and assigns that role to
+     * the entity-owner role. Used by payment provisioning for account/project/wl resources.
+     */
+    ensureResourceOwnership: (entityId: string, clientId: string, resource: IamResourceSpec) => Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,UAAW,SAAQ,kBAAkB;IAEpD,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAGrE,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IAExE;;;OAGG;IACH,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,iBAAiB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAA;IAEpB;;;OAGG;IACH,uBAAuB,EAAE,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,eAAe,KACtB,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@owlmeans/iam",
+  "version": "0.1.5",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 2 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/context": "^0.1.5",
+    "@owlmeans/error": "^0.1.5",
+    "@owlmeans/oidc": "^0.1.5"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.3.0",
+    "nodemon": "^3.1.11",
+    "npm-check": "^6.0.1",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,6 @@
+export const DEFAULT_ALIAS = 'iam-service'
+
+export const IAM_MODE_KEYCLOAK = 'keycloak'
+export const IAM_MODE_INTEGRATED = 'integrated'
+
+export type IamMode = typeof IAM_MODE_KEYCLOAK | typeof IAM_MODE_INTEGRATED

package/src/errors.ts

@@ -0,0 +1,32 @@
+import { ResilientError } from '@owlmeans/error'
+
+export class IamError extends ResilientError {
+  public static override typeName = `Iam${ResilientError.typeName}`
+
+  constructor(message = 'error') {
+    super(IamError.typeName, `iam:${message}`)
+    this.type = IamError.typeName
+  }
+}
+
+export class IamClientError extends IamError {
+  public static override typeName = `IamClient${ResilientError.typeName}`
+
+  constructor(message = 'error') {
+    super(`client:${message}`)
+    this.type = IamClientError.typeName
+  }
+}
+
+export class IamResourceError extends IamError {
+  public static override typeName = `IamResource${ResilientError.typeName}`
+
+  constructor(message = 'error') {
+    super(`resource:${message}`)
+    this.type = IamResourceError.typeName
+  }
+}
+
+ResilientError.registerErrorClass(IamError)
+ResilientError.registerErrorClass(IamClientError)
+ResilientError.registerErrorClass(IamResourceError)

package/src/index.ts

@@ -0,0 +1,3 @@
+export type * from './types.js'
+export * from './consts.js'
+export * from './errors.js'

package/src/types.ts

@@ -0,0 +1,57 @@
+import type { InitializedService } from '@owlmeans/context'
+import type { OidcProviderConfig } from '@owlmeans/oidc'
+
+export interface IamClient {
+  id?: string
+  clientId: string
+  secret?: string
+  name?: string
+  /** The entity realm this client belongs to — replaces the old (client as any)._realm hack */
+  realm?: string
+}
+
+export interface IamCredentialsPair {
+  token: string
+  realm: string
+}
+
+export interface IamPermissionArgs {
+  /** Action name. When absent the permission is unscoped (project-wide). */
+  permission?: string
+}
+
+export interface IamResourceSpec {
+  name: string
+  displayName?: string
+}
+
+/** Unified IAM provider interface — all platform/agent code calls only this, never a backend directly */
+export interface IamService extends InitializedService {
+  // --- Admin config (backend → OIDC RP config, payment provisioning) ---
+  getEntityAdminConfig: (entityId: string) => Promise<OidcProviderConfig>
+  getCredentialsPair: (entityId: string) => Promise<IamCredentialsPair>
+
+  // --- Provisioning (agent → story development) ---
+  ensureClient: (entityId: string, clientId: string) => Promise<IamClient>
+
+  /**
+   * Ensures a permission/resource exists in the entity's client.
+   * Returns the canonical resource name (e.g. "res--action" or "res").
+   */
+  ensurePermission: (
+    entityId: string,
+    clientId: string,
+    resource?: string,
+    args?: IamPermissionArgs
+  ) => Promise<string>
+
+  /**
+   * Idempotent: creates a resource, a client role for it, and assigns that role to
+   * the entity-owner role. Used by payment provisioning for account/project/wl resources.
+   */
+  ensureResourceOwnership: (
+    entityId: string,
+    clientId: string,
+    resource: IamResourceSpec
+  ) => Promise<void>
+}

package/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/",
+    "outDir": "./build/"
+  },
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}