@owlmeans/server-iam 0.1.18-rc.7 → 0.1.18

package/README.md

@@ -7,12 +7,14 @@ One-call OIDC RP wiring and IAM gate for OwlMeans servers — `appendIam()` and
 - `appendIam(context)` — registers the OIDC client, wrapping service, and IAM gate in a single call, replacing verbose manual wiring
 - `makeIamGate()` — produces a guard that asserts unscoped or resource-scoped permissions against the IAM backend (claims-first, UMA2 fallback)
 - Re-exports `hasPermission` from `@owlmeans/iam` for inline permission checks
+- `makeOrganizationScope(context, request)` — `.organizationOf(slug)` / `.organizationsOf()`: the organizations of a tenanted session, from its session record
+- `makeIamRuntimeClient(context, request)` — a typed client of the provider's runtime IAM API, acting as the request's subject
 - Designed for IAM consumers such as the viable target template backend
 
 ## Installation
 
 ```bash
-bun add @owlmeans/server-iam
+bun add @owlmeans/server-iam@^0.1.18
 ```
 
 ## Usage
@@ -20,12 +22,19 @@ bun add @owlmeans/server-iam
 ```typescript
 import { appendIam, makeIamGate } from '@owlmeans/server-iam'
 import { IAM_GATE } from '@owlmeans/server-iam'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
+import { route } from '@owlmeans/route'
+import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 
 // Wire IAM into a server context
 appendIam(context)
 
-// Gate a module with a permission check
-module.gate(IAM_GATE, { permission: 'manage-users' })
+// Gate a protocol with a permission check
+protocol(
+  route('users', '/users'),
+  contract(typed<User[]>()),
+  { guards: DEFAULT_GUARD, gate: { alias: IAM_GATE, params: ['manage-users@{entity}'] } },
+)
 ```
 
 Requires `@owlmeans/oidc` OIDC shared config and a running IAM provider configured via `@owlmeans/server-oidc-rp`.
@@ -38,7 +47,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "package": "@owlmeans/server-iam",
-  "version": "0.1.18-rc.6",
-  "generatedAt": "2026-08-18T14:48:00.502Z",
+  "version": "0.1.18",
+  "generatedAt": "2026-10-28T00:31:34.720Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-iam/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-iam
-description: "How to use @owlmeans/server-iam — one-call OIDC RP wiring (appendIam) and the IAM gate that asserts unscoped and resource-scoped permissions (claims-first, UMA2 fallback). Use when gating server endpoints in IAM consumers (e.g. the viable target template backend). Applies to files matching **/owlmeans.ts, **/gate*.ts, **/auth-guard*.ts."
+description: "How to use @owlmeans/server-iam — one-call OIDC RP wiring (appendIam), the IAM gate that asserts unbound, organization-bound and resource-scoped permissions (claims-first, UMA2 fallback), the session's organizations (makeOrganizationScope: organizationOf/organizationsOf), the request-bound runtime IAM client (makeIamRuntimeClient), plus the gate-param grammar it re-exports. Use when gating server endpoints, declaring gate params, acting in a tenanted client's organizations, managing members or grants from a target's server, or diagnosing a permission refusal. Applies to files matching **/owlmeans.ts, **/gate*.ts, **/auth-guard*.ts."
 metadata:
   applyTo: "**/owlmeans.ts, **/gate*.ts, **/auth-guard*.ts"
 ---
@@ -8,34 +8,91 @@ metadata:
 
 # Using `@owlmeans/server-iam`
 
+**Install:** `"@owlmeans/server-iam": "^0.1.18"` in `dependencies`
+
 Boilerplate-less server-side consumer of the OwlMeans IAM. One call wires the OIDC RP stack and the
-IAM gate; the consumer never knows which IAM backend (Keycloak or integrated) is active.
+IAM gate; the consumer never knows which IAM backend (Keycloak or integrated) is active. For a
+tenanted client it also reads the session's organizations and calls the provider's runtime IAM API
+as the signed-in subject.
 
 ## Public API surface
 
 | Symbol | Kind | Purpose |
 |--------|------|---------|
 | `appendIam(context)` | fn | Registers `makeOidcClientService()`, `makeOidcWrappingService()`, `makeIamGate()` (under `OIDC_GATE`), and the OIDC guard |
-| `makeIamGate(alias?)` | fn | The IAM `GateService` — claims-first assertion with UMA2 fallback |
-| `parseGateParam(param)` | fn | Splits `'perm@requestParam'` into `{ permission, resourceParam? }` |
-| `RESOURCE_PARAM_SEPARATOR` | const | `'@'` |
+| `makeIamGate(alias?, opts?)` | fn | The IAM `GateService` — claims-first assertion with UMA2 fallback |
+| `IamGateOptions` | type | `{ strictResourceScope?: boolean }` — refuse a scoped param on the fallback path instead of widening it |
+| `gateParamHelper` (`.parseGateParam` / `.parseGateSelector` / `.formatGateParam`) / `gateValidationHelper.validateGateParams` / `resolveGateResource` | helper / fn | Re-exports from `@owlmeans/iam`, which owns the grammar |
+| `RESOURCE_PARAM_SEPARATOR` / `RESOURCE_SOURCE_SEPARATOR` / `RESOURCE_PATH_SEPARATOR` | const | `'@'`, `':'` and `'.'`, re-exported |
+| `GateParamSource` / `GateParamErrorCode` / `GateResolutionFailure` | enum | Re-exported; the sources a selector may name, and why one failed |
 | `hasPermission` | fn | Re-export from `@owlmeans/iam` |
+| `makeOrganizationScope(context, request).organizationOf(entitySlug)` | scope | One organization of the request's subject as a `ResolvedEntity` (`{ id: entityKey, slug, iamKey: entityKey }`); one the subject is not in is `AuthForbidden(ORGANIZATION_REFUSAL)` |
+| `makeOrganizationScope(context, request).organizationsOf()` | scope | Every organization of the request's subject, as `ResolvedEntity[]` |
+| `makeIamRuntimeClient(context, request)` | fn | The request-bound `IamRuntimeClient` of the provider's runtime IAM API — see "The runtime IAM client" |
+| `IamRuntimeClient` | type | `organizations.{list,create,update}`, `members.{list,add,update,remove}`, `permissions.list`, `grants.{list,assign,revoke}` |
+| `ORGANIZATION_REFUSAL` / `ORGANIZATION_OWNER_REFUSAL` | const | Re-exported from `@owlmeans/oidc`: the `AuthForbidden` reasons of a non-member and of a non-owner |
+| `SERVER_IAM_SERVICE` | const | `'server-iam-service'` — exported and referenced nowhere; the gate registers under `OIDC_GATE`, not under this |
+| Every `@owlmeans/iam` type | type | Re-exported wholesale, so a server needs one IAM import |
+
+The grammar lives in **`@owlmeans/iam`**, not here — the browser, both IAM adapters and
+code-generation tooling all have to read the same rules. This package re-exports it because it is the
+documented import path for a server, so one IAM import covers the gate and its grammar.
+
+`appendIam` reads the provider configuration from `cfg.oidc.providers`, so populate that before
+calling it. It is the IAM-flavoured replacement for wiring `@owlmeans/server-oidc-rp` by hand: the
+one difference is the gate, which is `makeIamGate()` rather than `makeOidcGate()`.
 
 ## Gate-param syntax
 
 ```
-<permission>                      → unscoped (project-wide): 'article--modify'
-<permission>@<requestParam>       → resource-scoped: 'department--modify@departmentId'
+<permission>                  → unscoped (project-wide): 'article--modify'
+<permission>@<bareKey>        → bare form:      'department--modify@departmentId'
+<permission>@<source>:<path>  → qualified form: 'order--modify@body:order.id'
 ```
 
-- `{entity}` substitution applies to the permission part in both forms.
-- For the resource-scoped form the gate resolves `req.params[requestParam] ?? req.query[requestParam]`
-  at assert time and requires the grant's `resources[]` to contain it (an unscoped grant always passes).
-- Params are **any-of**: one granted param is enough.
+Sources: `params`, `query`, `body`, `headers`, `auth`.
+
+- **The bare form is lenient and flat**; the qualified form is strict and nested. `@a.b` in the bare
+  form is the literal key `"a.b"` — a query key may legally contain a dot, and splitting it would
+  change what already-deployed selectors mean. Dotted paths exist only after a `source:`.
+- The separator is `:` and not a dot on purpose. With a dotted-only form, a route that gains a param
+  named like a source keyword silently changes a selector's meaning: `/report/:query` with
+  `@query.id` flips from "the route param named `query.id`" to "the query string's `id`" — an
+  authorization lookup redirected to attacker-supplied input by an unrelated route rename.
+- The bare form searches `params` then `query`. That query fallback is legacy and deliberately kept:
+  removing it would silently deny deployed apps whose selector names a query key.
+- `headers:` lowercases its first segment and unwraps a single-element array; a repeated header is
+  refused rather than silently narrowed to one of its values.
+- `auth:` is the only source that is neither attacker-controlled nor subject to `removeAdditional`.
+  Prefer it whenever the rule is "bound to their own profile or entity".
+- A resolved id must satisfy the grant's `resources[]` — **and a grant carrying no `resources` at all
+  covers every id**. That is the all-resources form of the same permission, not a separate one.
+- Params are **any-of**: one granted param is enough. Which is why a malformed or unresolvable param
+  can only contribute `false` and never throw — otherwise one bad sibling would refuse a request the
+  subject is legitimately entitled to.
+
+**The `@` belongs to the gate and nowhere else.** It is never part of a permission's stored NAME. A
+definition or grant written as `enquiry--view@enquiryId` is a key nothing looks up, so the permission
+reads as granted in every screen and every request is still refused, with nothing logged.
+`ensurePermission` refuses such a name; `gateValidationHelper.validateGateParams` catches the mirror-image mistake at
+generation time.
+
+### `gateValidationHelper.validateGateParams(params, audit?)`
+
+Reports what is provable from an entrypoint's own declaration: a selector naming a route param the
+path does not carry, or a `body`/`query`/`headers` key the `Filter` does not declare **while that
+schema sets `additionalProperties: false`**. That qualifier matters — the server's AJV runs
+`removeAdditional`, which strips only what a schema closes, so without it the check would fire on
+every unfiltered endpoint and be ignored within a week. It never decides a request; the gate runs it
+once per alias and only logs.
+
+The route half of the audit comes from `entrypoint.mount()`, which needs a service with a resolvable
+address. An entrypoint that has none is still audited against its filter — the route-param check is
+simply skipped rather than the whole audit being lost.
 
 ```ts
 // module declaration
-gate(OIDC_GATE, ['department--modify@depId'])
+{ gate: { alias: OIDC_GATE, params: ['department--modify@depId'] } }
 
 // or imperative
 await ctx.service<GateService>(OIDC_GATE).assert(req, res, ['article--modify'])
@@ -46,10 +103,76 @@ await ctx.service<GateService>(OIDC_GATE).assert(req, res, ['article--modify'])
 1. `req.auth == null` → `AuthForbidden('auth')`.
 2. **Claims mode** — when `req.auth.permissions` is a valid `PermissionSet[]` (minted into the id_token
    by the integrated IAM provider and mapped into `Auth` by `@owlmeans/server-oidc-rp`), params are
-   asserted locally via `hasPermission`.
+   asserted locally via `hasPermission`, with `entitySlug: req.entity?.slug ?? authHelper.entitySlugOf(auth)` —
+   the organization the request acts in.
 3. **Fallback** — otherwise `@…` suffixes are stripped and the check delegates to the UMA2 gate model
-   from `@owlmeans/server-oidc-rp` (`createGateModel().loadPermissions`) — byte-equivalent to the old
-   `makeOidcGate`, which keeps Keycloak-backed deployments unchanged.
+   from `@owlmeans/server-oidc-rp` (`createGateModel().loadPermissions`) — exactly the check
+   `makeOidcGate` performs, which is what a Keycloak-backed deployment gets.
+
+In claims mode all four permission kinds (`iam` skill, "Permission kinds") are decided locally by
+`hasPermission`; a bound set reaching the gate is a leak the relying party should have stripped, and
+it counts only when the request acts in exactly its organization.
+
+Which branch runs is decided per request by the token alone: a conforming `permissions` claim selects
+claims mode, its absence selects the fallback. Nothing configures it, and there is no environment
+variable behind it.
+
+**The fallback path does not enforce resource scoping**, so one declaration means two different
+things depending on which backend answered. It cannot be fixed by denying — a Keycloak-backed adapter
+throws `IamUnsupported('resource-scoped-grant')`, so a scoped grant cannot exist there and denying
+would lock every user out of every scoped endpoint. The gate logs each such param once per alias;
+`makeIamGate(alias, { strictResourceScope: true })` opts into denial where the refusals are the
+intended outcome.
+
+A denial distinguishes its reasons in the log: a param that failed **structurally** (unparseable,
+source absent, value not a scalar) is reported separately from one that resolved fine and simply was
+not granted. The HTTP answer is identical — `AuthForbidden('permission')` either way — because the
+caller must never learn which.
+
+## `{entity}` in a permission name
+
+A gate param may carry the literal `{entity}`, which is substituted at assertion time with the
+organization entity's **stable id** — `req.entity.id`, resolved once at the server boundary — falling
+back to the token's `entitySlug` and then to `-`. So `my-service-account-{entity}` asserts a
+per-organization permission without the declaration knowing which organization it is for.
+
+Grants are stored against the id wherever one is resolvable. The slug fallback exists for deployments
+with no organization store of their own, where the slug *is* the identifier; a deployment that has a
+store must not grant against slugs, because a rename would then orphan every grant.
+
+## Organizations of the session
+
+A relying party of a tenanted client has no organization registry of its own: the provider's
+`organizations` claim, kept in the session record (`@owlmeans/server-oidc-rp`), is the only source,
+re-read on every validation. `makeOrganizationScope(context, request).organizationsOf()` answers all of it and `.organizationOf(slug)` one entry by
+slug, as `ResolvedEntity` values keyed by the frozen `entityKey` — use them for a handler that acts in
+an organization its URL names rather than the session's acting one (which the guard already attaches
+as `req.entity`). A session of a client without the scope acts in none and has none to offer; an
+unauthenticated request or a session that is gone is `AuthorizationError` (401).
+
+## The runtime IAM client
+
+`makeIamRuntimeClient(context, request)` calls the provider's runtime IAM API (`makeIamRuntimeProtocols` in
+`@owlmeans/iam`) as that request's subject:
+
+- **Base** — the provider's discovery field `IAM_API_METADATA` (`owlmeans_iam_api`), read through
+  the OIDC client service's adapter `getMetadata()` for the session's client, and cached per context
+  and client; a failed lookup is forgotten. A provider that advertises none (Keycloak) is
+  `IamClientError('runtime-api:<client>')`.
+- **Bearer** — the provider access token of the request's session record, read afresh on every call
+  so a token the guard just refreshed is the one sent. A record without one is
+  `AuthForbidden('record')`, and nothing is sent.
+- **Transport** — plain `fetch` over `IAM_RUNTIME_ROUTES`: the API is another service's tree, and a
+  relying party binds none of it.
+- **Refusals** — a development server's marshalled error is rebuilt into its class. A production body
+  is only an incident id, so the status and the route decide: a 403 from an owner route is
+  `AuthForbidden(ORGANIZATION_OWNER_REFUSAL)`, from any other route `AuthForbidden(ORGANIZATION_REFUSAL)`;
+  a 401 is `AuthorizationError('iam-runtime')`; anything else `IamError('runtime:status:<n>')`. The
+  incident id travels on the error.
+
+`members.add` is find-or-create by e-mail and idempotent — that is the provider's job, so a caller
+never checks for an existing member first. Owner and member rights are decided by the provider from
+the token; nothing sent here can widen them.
 
 ## Rules
 
@@ -57,7 +180,10 @@ await ctx.service<GateService>(OIDC_GATE).assert(req, res, ['article--modify'])
   `OIDC_GATE` alias and the IAM gate already covers the UMA2 path.
 - Never branch on the IAM backend in consumer code — the gate's claims/fallback split is the only seam.
 - The OIDC provider entry must request the `permissions` scope (`extraScopes`) for claims mode to
-  engage; without it the gate transparently uses the fallback.
+  engage; without it the gate transparently uses the fallback. A tenanted client also requests
+  `organizations`.
+- Reach the runtime IAM API only through `makeIamRuntimeClient`; never forward the browser's wrapped token or
+  build a bearer from anything but the session record.
 
 ## Related instructions
 

package/build/append.d.ts

@@ -1,7 +1,4 @@
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
-import type { WithSharedConfig } from '@owlmeans/oidc';
-type IamServerConfig = ServerConfig & WithSharedConfig;
-type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerContext<C>;
+import type { IamServerConfig, IamServerContext } from './types.local.js';
 /**
  * One-call OIDC RP setup for a server context.
  *
@@ -15,5 +12,4 @@ type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerConte
  * context.cfg.oidc.providers[] — populate it before calling appendIam().
  */
 export declare const appendIam: <C extends IamServerConfig, T extends IamServerContext<C>>(context: T) => T;
-export {};
 //# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAItD,KAAK,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAA;AACtD,KAAK,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;AAErF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,CAAC,CAAC,WACvE,CAAC,KACT,CAQF,CAAA"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,CAAC,CAAC,WACvE,CAAC,KACT,CAQF,CAAA"}

package/build/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAKvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EACP,EAAE;IACL,OAAO,CAAC,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,eAAe,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAClD,sEAAsE;IACtE,gEAAgE;IAChE,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;IACtC,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAIvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EACP,EAAE;IACL,OAAO,CAAC,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,eAAe,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAClD,sEAAsE;IACtE,gEAAgE;IAChE,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;IACtC,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/consts.local.d.ts

@@ -0,0 +1,3 @@
+/** `@owlmeans/server-api`'s incident header; a production error body is nothing but this id. */
+export declare const INCIDENT_ID_HEADER = "x-incident-id";
+//# sourceMappingURL=consts.local.d.ts.map

package/build/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,kBAAkB,CAAA"}

package/build/consts.local.js

@@ -0,0 +1,3 @@
+/** `@owlmeans/server-api`'s incident header; a production error body is nothing but this id. */
+export const INCIDENT_ID_HEADER = 'x-incident-id';
+//# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAA"}

package/build/gate.d.ts

@@ -1,27 +1,26 @@
 import type { GateService } from '@owlmeans/entrypoint';
+import type { IamGateOptions } from './types.js';
 /**
- * Gate-param syntax:
- *   <permission>                — unscoped (project-wide) check, e.g. 'article--modify'
- *   <permission>@<requestParam> — resource-scoped: the resource id is resolved from
- *                                 req.params[requestParam] ?? req.query[requestParam]
- *                                 and must be listed in the grant's resources[]
- * '{entity}' substitution applies to the permission part in both forms.
+ * The gate-param grammar lives in `@owlmeans/iam` so the browser, the adapters and code-generation
+ * tooling can all read it. Re-exported here because this module was its home and is the documented
+ * import path.
  */
-export declare const RESOURCE_PARAM_SEPARATOR = "@";
-export interface ParsedGateParam {
-    permission: string;
-    resourceParam?: string;
-}
-export declare const parseGateParam: (param: string) => ParsedGateParam;
+export { RESOURCE_PARAM_SEPARATOR, RESOURCE_SOURCE_SEPARATOR, RESOURCE_PATH_SEPARATOR, GateParamSource, GateParamErrorCode, GateResolutionFailure, gateParamHelper, gateValidationHelper, resolveGateResource } from '@owlmeans/iam';
+export type { ParsedGateParam, GateResourceSelector, GateParamAudit, GateParamHelper, GateValidationHelper } from '@owlmeans/iam';
 /**
  * IAM gate: claims-first with UMA2 fallback. Registered under the OIDC_GATE alias by
  * appendIam() so target code never knows which IAM backend is active.
  *
  * 1. When the Auth carries a valid PermissionSet[] claim (integrated IAM mode),
- *    params are asserted locally against it — both unscoped and resource-scoped forms.
+ *    params are asserted locally against it — both unscoped and resource-scoped forms, and a set
+ *    bound to an organization only for the organization the request acts in.
  * 2. Otherwise (Keycloak mode — its tokens never produce a conforming claim) the
  *    @-suffixes are stripped and the check delegates to the UMA2 gate model from
  *    @owlmeans/server-oidc-rp, byte-equivalent to makeOidcGate.
+ *
+ * Params are OR'd: holding any one of them admits the request. That is why a malformed or
+ * unresolvable param can only contribute `false` and never throw — a sibling that would otherwise
+ * have passed must not be refused because of it.
  */
-export declare const makeIamGate: (alias?: string) => GateService;
+export declare const makeIamGate: (alias?: string, opts?: IamGateOptions) => GateService;
 //# sourceMappingURL=gate.d.ts.map

package/build/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,sBAAsB,CAAA;AAQxE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAO9C,CAAA;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,WAAW,MAAM,KAAe,WAgDvD,CAAA"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAqC,MAAM,sBAAsB,CAAA;AAM1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;GAIG;AACH,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC5E,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAC1D,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAC3D,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAejI;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,WAAW,MAAM,SAAqB,cAAc,KAAG,WAkK9E,CAAA"}

package/build/gate.js

@@ -1,73 +1,166 @@
 import { createLazyService } from '@owlmeans/context';
+import { authHelper, AuthForbidden } from '@owlmeans/auth';
 import { OIDC_GATE } from '@owlmeans/oidc';
-import { AuthForbidden } from '@owlmeans/auth';
 import { createGateModel, extractPermissionSets } from '@owlmeans/server-oidc-rp';
-import { hasPermission } from '@owlmeans/iam';
+import { hasPermission, gateParamHelper, gateValidationHelper, resolveGateResource, GateResolutionFailure } from '@owlmeans/iam';
+import { logger, logThrottle } from '@owlmeans/log';
 /**
- * Gate-param syntax:
- *   <permission>                — unscoped (project-wide) check, e.g. 'article--modify'
- *   <permission>@<requestParam> — resource-scoped: the resource id is resolved from
- *                                 req.params[requestParam] ?? req.query[requestParam]
- *                                 and must be listed in the grant's resources[]
- * '{entity}' substitution applies to the permission part in both forms.
+ * The gate-param grammar lives in `@owlmeans/iam` so the browser, the adapters and code-generation
+ * tooling can all read it. Re-exported here because this module was its home and is the documented
+ * import path.
  */
-export const RESOURCE_PARAM_SEPARATOR = '@';
-export const parseGateParam = (param) => {
-    const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR);
-    if (idx < 0) {
-        return { permission: param };
-    }
-    return { permission: param.slice(0, idx), resourceParam: param.slice(idx + 1) };
-};
-const resolveResourceId = (req, resourceParam) => {
-    const params = req.params;
-    const query = req.query;
-    const value = params?.[resourceParam] ?? query?.[resourceParam];
-    return value != null ? `${value}` : undefined;
-};
+export { RESOURCE_PARAM_SEPARATOR, RESOURCE_SOURCE_SEPARATOR, RESOURCE_PATH_SEPARATOR, GateParamSource, GateParamErrorCode, GateResolutionFailure, gateParamHelper, gateValidationHelper, resolveGateResource } from '@owlmeans/iam';
+/**
+ * Structural faults are logged once per alias+param+reason.
+ *
+ * A gate on a hot endpoint runs on every request, and a misconfiguration is by definition permanent,
+ * so an un-deduplicated log turns one typo into the incident.
+ */
+const reported = new Set();
+const log = logger('server-iam:gate');
+/** Aliases whose declarations have already been checked. */
+const audited = new Set();
 /**
  * IAM gate: claims-first with UMA2 fallback. Registered under the OIDC_GATE alias by
  * appendIam() so target code never knows which IAM backend is active.
  *
  * 1. When the Auth carries a valid PermissionSet[] claim (integrated IAM mode),
- *    params are asserted locally against it — both unscoped and resource-scoped forms.
+ *    params are asserted locally against it — both unscoped and resource-scoped forms, and a set
+ *    bound to an organization only for the organization the request acts in.
  * 2. Otherwise (Keycloak mode — its tokens never produce a conforming claim) the
  *    @-suffixes are stripped and the check delegates to the UMA2 gate model from
  *    @owlmeans/server-oidc-rp, byte-equivalent to makeOidcGate.
+ *
+ * Params are OR'd: holding any one of them admits the request. That is why a malformed or
+ * unresolvable param can only contribute `false` and never throw — a sibling that would otherwise
+ * have passed must not be refused because of it.
  */
-export const makeIamGate = (alias = OIDC_GATE) => {
+export const makeIamGate = (alias = OIDC_GATE, opts) => {
+    const reportOnce = (key, message, data) => {
+        if (reported.has(key)) {
+            return;
+        }
+        reported.add(key);
+        log.error(message, data);
+    };
+    /**
+     * A refusal of the gate. Logged once a minute per route, reason and subject — a hot endpoint
+     * refuses on every request, and one line per window says the same thing.
+     */
+    const forbidden = (req, reason, params) => {
+        const auth = req.auth;
+        if (logThrottle(`access.forbidden\0${req.alias ?? ''}\0${reason}\0${auth?.userId ?? ''}`, 60_000)) {
+            log.warn('Access forbidden', {
+                alias: req.alias, reason, params, userId: auth?.userId, entitySlug: req.entity?.slug ?? (auth != null ? authHelper.entitySlugOf(auth) : undefined),
+            }, { event: 'access.forbidden' });
+        }
+        return new AuthForbidden(reason);
+    };
+    /**
+     * Check an entrypoint's gate params against what it declares, once, the first time it is reached.
+     *
+     * Structurally unable to affect the outcome: it only ever logs. A selector naming a key the
+     * entrypoint's filter does not declare is stripped by validation before the gate runs, so the
+     * endpoint denies every request with a clean build and nothing else to go on — this is the line that
+     * says why.
+     */
+    const auditEntrypoint = (ctx, req, params) => {
+        if (req.alias == null || audited.has(req.alias)) {
+            return;
+        }
+        audited.add(req.alias);
+        try {
+            const entrypoint = ctx.entrypoint(req.alias);
+            if (entrypoint == null) {
+                return;
+            }
+            let routePath;
+            try {
+                routePath = entrypoint.mount();
+            }
+            catch {
+                // The mount needs a service with an address; an entrypoint that has none still has a filter
+                // worth auditing.
+            }
+            const audit = {
+                ...(routePath != null ? { routePath } : {}),
+                ...(entrypoint.filter != null ? { filter: entrypoint.filter } : {})
+            };
+            for (const issue of gateValidationHelper.validateGateParams(params, audit)) {
+                log.error('Gate param is misconfigured', {
+                    param: issue.param, alias: req.alias, code: issue.code, detail: issue.detail,
+                });
+            }
+        }
+        catch {
+            // An entrypoint that cannot be looked up is not this gate's problem to report.
+        }
+    };
     const service = createLazyService(alias, {
         assert: async (req, _, params) => {
             await service.ready();
             const ctx = service.assertCtx();
             if (req.auth == null) {
-                throw new AuthForbidden('auth');
+                throw forbidden(req, 'auth', params);
             }
             const auth = req.auth;
             const sets = extractPermissionSets(auth.permissions);
             if (sets != null) {
+                auditEntrypoint(ctx, req, params);
+                // Why a param failed, kept aside so a denial can say whether the gate was misconfigured or
+                // the subject simply lacks the grant. The two look identical from the outside and are
+                // repaired in completely different places.
+                const structural = [];
+                // The organization the request acts in. A relying party of a tenanted client attaches it
+                // through the guard; otherwise it is the token's. A set bound to any other organization
+                // never satisfies the check.
+                const entitySlug = req.entity?.slug ?? authHelper.entitySlugOf(auth);
                 const granted = params.some(param => {
-                    const { permission, resourceParam } = parseGateParam(param);
-                    const fixed = permission.replaceAll('{entity}', auth.entityId ?? '-');
-                    if (resourceParam != null) {
-                        const resourceId = resolveResourceId(req, resourceParam);
-                        if (resourceId == null) {
+                    const { permission, resource, error } = gateParamHelper.parseGateParam(param);
+                    // Grants are stored against the entity's stable id wherever one is resolvable; the
+                    // slug is only a fallback for deployments with no organization store of their own,
+                    // where the slug IS the identifier.
+                    const fixed = permission.replaceAll('{entity}', req.entity?.id ?? authHelper.entitySlugOf(auth) ?? '-');
+                    if (error != null) {
+                        structural.push(`"${param}" does not parse [${error.code}]: ${error.detail}`);
+                        return false;
+                    }
+                    if (resource != null) {
+                        const resolution = resolveGateResource(req, resource);
+                        if (resolution.id == null) {
+                            if (resolution.reason !== GateResolutionFailure.NotProvided) {
+                                structural.push(`"${param}" resolved no resource id [${resolution.reason}]`
+                                    + ` from ${resource.sources.join(', ')}`);
+                            }
                             return false;
                         }
-                        return hasPermission(auth, fixed, { resourceId });
+                        return hasPermission(auth, fixed, { resourceId: resolution.id, entitySlug });
                     }
-                    return hasPermission(auth, fixed);
+                    return hasPermission(auth, fixed, { entitySlug });
                 });
                 if (!granted) {
-                    throw new AuthForbidden('permission');
+                    structural.forEach(detail => reportOnce(`${req.alias}\0${detail}`, 'Gate refused a request it could not evaluate', { alias: req.alias, detail }));
+                    throw forbidden(req, 'permission', params);
                 }
                 return;
             }
-            const stripped = params.map(param => parseGateParam(param).permission);
+            // UMA2 fallback. Resource scoping is NOT enforced here: a Keycloak-backed deployment cannot
+            // store a resource-scoped grant, so a scoped param widens to a project-wide check and the same
+            // declaration means two different things depending on which backend is active.
+            const scoped = params.filter(param => gateParamHelper.parseGateParam(param).resource != null);
+            scoped.forEach(param => reportOnce(`uma2\0${req.alias}\0${param}`, 'Gate param is resource-scoped, but resource scoping is not enforced in UMA2 mode — it is checked as a '
+                + 'project-wide permission', { param, alias: req.alias }));
+            const usable = opts?.strictResourceScope === true
+                ? params.filter(param => gateParamHelper.parseGateParam(param).resource == null)
+                : params;
+            if (usable.length < 1) {
+                throw forbidden(req, 'permission', params);
+            }
+            const stripped = usable.map(param => gateParamHelper.parseGateParam(param).permission);
             const model = createGateModel(ctx);
             const permissions = await model.loadPermissions(auth, stripped);
             if (permissions.length < 1) {
-                throw new AuthForbidden('permission');
+                throw forbidden(req, 'permission', params);
             }
         }
     });

package/build/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAO3C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACnD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAA;AACjF,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAE,aAAqB,EAAsB,EAAE;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,MAA6C,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4C,CAAA;IAC9D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,aAAa,CAAC,CAAA;IAE/D,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/C,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAW,SAAS,EAAe,EAAE;IACpE,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAA;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAEpD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAA;oBAErE,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;wBACxD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;4BACvB,OAAO,KAAK,CAAA;wBACd,CAAC;wBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;oBACnD,CAAC;oBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;gBACvC,CAAC;gBAED,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAE/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAa,MAAM,gBAAgB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAA6B,MAAM,0BAA0B,CAAA;AAC5G,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAuB,MAAM,eAAe,CAAA;AACrJ,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGnD;;;;GAIG;AACH,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC5E,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAC1D,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAC3D,MAAM,eAAe,CAAA;AAGtB;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAErC,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAW,SAAS,EAAE,IAAqB,EAAe,EAAE;IAC3F,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,OAAe,EAAE,IAA6B,EAAQ,EAAE;QACvF,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAM;QACR,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED;;;OAGG;IACH,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAE,MAAgB,EAAiB,EAAE;QAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAA;QACzC,IAAI,WAAW,CAAC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,MAAM,KAAK,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC3B,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;aACnJ,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAoB,EAAE,MAAgB,EAAQ,EAAE;QACrF,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAM;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAEtB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAmB,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9D,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAM;YACR,CAAC;YAED,IAAI,SAA6B,CAAA;YACjC,IAAI,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,CAAA;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,4FAA4F;gBAC5F,kBAAkB;YACpB,CAAC;YAED,MAAM,KAAK,GAAmB;gBAC5B,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG,CAAA;YAED,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;oBACvC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;iBAC7E,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YACtC,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAA;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAEpD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;gBAEjC,2FAA2F;gBAC3F,sFAAsF;gBACtF,2CAA2C;gBAC3C,MAAM,UAAU,GAAa,EAAE,CAAA;gBAE/B,yFAAyF;gBACzF,wFAAwF;gBACxF,6BAA6B;gBAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;gBAEpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;oBAC7E,mFAAmF;oBACnF,mFAAmF;oBACnF,oCAAoC;oBACpC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;oBAEvG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;wBAC7E,OAAO,KAAK,CAAA;oBACd,CAAC;oBAED,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;wBACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;wBACrD,IAAI,UAAU,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;4BAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,WAAW,EAAE,CAAC;gCAC5D,UAAU,CAAC,IAAI,CACb,IAAI,KAAK,8BAA8B,UAAU,CAAC,MAAM,GAAG;sCACzD,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAA;4BACH,CAAC;4BACD,OAAO,KAAK,CAAA;wBACd,CAAC;wBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;oBAC9E,CAAC;oBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;gBACnD,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CACrC,GAAG,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,EACzB,8CAA8C,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAC7E,CAAC,CAAA;oBAEF,MAAM,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;gBAC5C,CAAC;gBAED,OAAM;YACR,CAAC;YAED,4FAA4F;YAC5F,+FAA+F;YAC/F,+EAA+E;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;YAC7F,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAChC,SAAS,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,EAC9B,wGAAwG;kBACtG,yBAAyB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CACzD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,IAAI,EAAE,mBAAmB,KAAK,IAAI;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;gBAChF,CAAC,CAAC,MAAM,CAAA;YAEV,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;YACtF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAE/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,6 +1,12 @@
 export type * from '@owlmeans/iam';
 export { hasPermission } from '@owlmeans/iam';
+export { ORGANIZATION_REFUSAL, ORGANIZATION_OWNER_REFUSAL } from '@owlmeans/oidc';
 export * from './consts.js';
 export * from './append.js';
 export * from './gate.js';
+export type * from './types.js';
+export { makeOrganizationScope, organizationOf, organizationsOf } from './organization.js';
+export type * from './organization/types.js';
+export { makeIamRuntimeClient, iamRuntime } from './runtime.js';
+export type { IamRuntimeClient } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,eAAe,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,eAAe,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AACjF,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,mBAAmB,YAAY,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAC1F,mBAAmB,yBAAyB,CAAA;AAC5C,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}

package/build/index.js

@@ -1,5 +1,8 @@
 export { hasPermission } from '@owlmeans/iam';
+export { ORGANIZATION_REFUSAL, ORGANIZATION_OWNER_REFUSAL } from '@owlmeans/oidc';
 export * from './consts.js';
 export * from './append.js';
 export * from './gate.js';
+export { makeOrganizationScope, organizationOf, organizationsOf } from './organization.js';
+export { makeIamRuntimeClient, iamRuntime } from './runtime.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AACjF,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AAEzB,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}