@owlmeans/server-iam 0.1.5 → 0.1.7

package/build/append.d.ts

@@ -0,0 +1,19 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
+import type { WithSharedConfig } from '@owlmeans/oidc';
+type IamServerConfig = ServerConfig & WithSharedConfig;
+type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerContext<C>;
+/**
+ * One-call OIDC RP setup for a server context.
+ *
+ * Replaces the explicit wiring pattern in the target template:
+ *   context.registerService(makeOidcClientService())
+ *   context.registerService(makeOidcWrappingService())
+ *   context.registerService(makeOidcGate())
+ *   appendOidcGuard(context)
+ *
+ * The OIDC provider config (discovery URL, clientId, secret) is read from
+ * context.cfg.oidc.providers[] — populate it before calling appendIam().
+ */
+export declare const appendIam: <C extends IamServerConfig, T extends IamServerContext<C>>(context: T) => T;
+export {};
+//# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAItD,KAAK,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAA;AACtD,KAAK,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;AAErF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAChF,SAAS,CAAC,KACT,CAQF,CAAA"}

package/build/append.js

@@ -0,0 +1,24 @@
+import { appendOidcGuard, makeOidcClientService, makeOidcWrappingService } from '@owlmeans/server-oidc-rp';
+import { makeIamGate } from './gate.js';
+/**
+ * One-call OIDC RP setup for a server context.
+ *
+ * Replaces the explicit wiring pattern in the target template:
+ *   context.registerService(makeOidcClientService())
+ *   context.registerService(makeOidcWrappingService())
+ *   context.registerService(makeOidcGate())
+ *   appendOidcGuard(context)
+ *
+ * The OIDC provider config (discovery URL, clientId, secret) is read from
+ * context.cfg.oidc.providers[] — populate it before calling appendIam().
+ */
+export const appendIam = (context) => {
+    context.registerService(makeOidcClientService());
+    context.registerService(makeOidcWrappingService());
+    // IAM gate under the OIDC_GATE alias: claims-first (integrated mode),
+    // UMA2 fallback byte-equivalent to makeOidcGate (keycloak mode)
+    context.registerService(makeIamGate());
+    appendOidcGuard(context);
+    return context;
+};
+//# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAKvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EACP,EAAE;IACL,OAAO,CAAC,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAA;IAChD,OAAO,CAAC,eAAe,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAClD,sEAAsE;IACtE,gEAAgE;IAChE,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;IACtC,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/gate.d.ts

@@ -0,0 +1,27 @@
+import type { GateService } from '@owlmeans/entrypoint';
+/**
+ * Gate-param syntax:
+ *   <permission>                — unscoped (project-wide) check, e.g. 'article--modify'
+ *   <permission>@<requestParam> — resource-scoped: the resource id is resolved from
+ *                                 req.params[requestParam] ?? req.query[requestParam]
+ *                                 and must be listed in the grant's resources[]
+ * '{entity}' substitution applies to the permission part in both forms.
+ */
+export declare const RESOURCE_PARAM_SEPARATOR = "@";
+export interface ParsedGateParam {
+    permission: string;
+    resourceParam?: string;
+}
+export declare const parseGateParam: (param: string) => ParsedGateParam;
+/**
+ * IAM gate: claims-first with UMA2 fallback. Registered under the OIDC_GATE alias by
+ * appendIam() so target code never knows which IAM backend is active.
+ *
+ * 1. When the Auth carries a valid PermissionSet[] claim (integrated IAM mode),
+ *    params are asserted locally against it — both unscoped and resource-scoped forms.
+ * 2. Otherwise (Keycloak mode — its tokens never produce a conforming claim) the
+ *    @-suffixes are stripped and the check delegates to the UMA2 gate model from
+ *    @owlmeans/server-oidc-rp, byte-equivalent to makeOidcGate.
+ */
+export declare const makeIamGate: (alias?: string) => GateService;
+//# sourceMappingURL=gate.d.ts.map

package/build/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,sBAAsB,CAAA;AAQxE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,eAO9C,CAAA;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GAAI,QAAO,MAAkB,KAAG,WAgDvD,CAAA"}

package/build/gate.js

@@ -0,0 +1,76 @@
+import { createLazyService } from '@owlmeans/context';
+import { OIDC_GATE } from '@owlmeans/oidc';
+import { AuthForbidden } from '@owlmeans/auth';
+import { createGateModel, extractPermissionSets } from '@owlmeans/server-oidc-rp';
+import { hasPermission } from '@owlmeans/iam';
+/**
+ * Gate-param syntax:
+ *   <permission>                — unscoped (project-wide) check, e.g. 'article--modify'
+ *   <permission>@<requestParam> — resource-scoped: the resource id is resolved from
+ *                                 req.params[requestParam] ?? req.query[requestParam]
+ *                                 and must be listed in the grant's resources[]
+ * '{entity}' substitution applies to the permission part in both forms.
+ */
+export const RESOURCE_PARAM_SEPARATOR = '@';
+export const parseGateParam = (param) => {
+    const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR);
+    if (idx < 0) {
+        return { permission: param };
+    }
+    return { permission: param.slice(0, idx), resourceParam: param.slice(idx + 1) };
+};
+const resolveResourceId = (req, resourceParam) => {
+    const params = req.params;
+    const query = req.query;
+    const value = params?.[resourceParam] ?? query?.[resourceParam];
+    return value != null ? `${value}` : undefined;
+};
+/**
+ * IAM gate: claims-first with UMA2 fallback. Registered under the OIDC_GATE alias by
+ * appendIam() so target code never knows which IAM backend is active.
+ *
+ * 1. When the Auth carries a valid PermissionSet[] claim (integrated IAM mode),
+ *    params are asserted locally against it — both unscoped and resource-scoped forms.
+ * 2. Otherwise (Keycloak mode — its tokens never produce a conforming claim) the
+ *    @-suffixes are stripped and the check delegates to the UMA2 gate model from
+ *    @owlmeans/server-oidc-rp, byte-equivalent to makeOidcGate.
+ */
+export const makeIamGate = (alias = OIDC_GATE) => {
+    const service = createLazyService(alias, {
+        assert: async (req, _, params) => {
+            await service.ready();
+            const ctx = service.assertCtx();
+            if (req.auth == null) {
+                throw new AuthForbidden('auth');
+            }
+            const auth = req.auth;
+            const sets = extractPermissionSets(auth.permissions);
+            if (sets != null) {
+                const granted = params.some(param => {
+                    const { permission, resourceParam } = parseGateParam(param);
+                    const fixed = permission.replaceAll('{entity}', auth.entityId ?? '-');
+                    if (resourceParam != null) {
+                        const resourceId = resolveResourceId(req, resourceParam);
+                        if (resourceId == null) {
+                            return false;
+                        }
+                        return hasPermission(auth, fixed, { resourceId });
+                    }
+                    return hasPermission(auth, fixed);
+                });
+                if (!granted) {
+                    throw new AuthForbidden('permission');
+                }
+                return;
+            }
+            const stripped = params.map(param => parseGateParam(param).permission);
+            const model = createGateModel(ctx);
+            const permissions = await model.loadPermissions(auth, stripped);
+            if (permissions.length < 1) {
+                throw new AuthForbidden('permission');
+            }
+        }
+    });
+    return service;
+};
+//# sourceMappingURL=gate.js.map

package/build/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAO3C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACnD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAA;AACjF,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,GAAoB,EAAE,aAAqB,EAAsB,EAAE;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,MAA6C,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4C,CAAA;IAC9D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,aAAa,CAAC,CAAA;IAE/D,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/C,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,SAAS,EAAe,EAAE;IACpE,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAA;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAEpD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAClC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAA;oBAErE,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;wBACxD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;4BACvB,OAAO,KAAK,CAAA;wBACd,CAAC;wBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;oBACnD,CAAC;oBAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;gBACvC,CAAC;gBAED,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAE/D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,3 +1,6 @@
 export type * from '@owlmeans/iam';
+export { hasPermission } from '@owlmeans/iam';
 export * from './consts.js';
+export * from './append.js';
+export * from './gate.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,eAAe,CAAA;AAClC,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,eAAe,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA"}

package/build/index.js

@@ -1,2 +1,5 @@
+export { hasPermission } from '@owlmeans/iam';
 export * from './consts.js';
+export * from './append.js';
+export * from './gate.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-iam",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,8 +22,13 @@
     }
   },
   "dependencies": {
-    "@owlmeans/context": "^0.1.5",
-    "@owlmeans/iam": "^0.1.5"
+    "@owlmeans/auth": "^0.1.7",
+    "@owlmeans/context": "^0.1.7",
+    "@owlmeans/entrypoint": "^0.1.7",
+    "@owlmeans/iam": "^0.1.7",
+    "@owlmeans/oidc": "^0.1.7",
+    "@owlmeans/server-context": "^0.1.7",
+    "@owlmeans/server-oidc-rp": "^0.1.7"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/append.ts

@@ -0,0 +1,31 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { WithSharedConfig } from '@owlmeans/oidc'
+import { appendOidcGuard, makeOidcClientService, makeOidcWrappingService } from '@owlmeans/server-oidc-rp'
+import { makeIamGate } from './gate.js'
+
+type IamServerConfig = ServerConfig & WithSharedConfig
+type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerContext<C>
+
+/**
+ * One-call OIDC RP setup for a server context.
+ *
+ * Replaces the explicit wiring pattern in the target template:
+ *   context.registerService(makeOidcClientService())
+ *   context.registerService(makeOidcWrappingService())
+ *   context.registerService(makeOidcGate())
+ *   appendOidcGuard(context)
+ *
+ * The OIDC provider config (discovery URL, clientId, secret) is read from
+ * context.cfg.oidc.providers[] — populate it before calling appendIam().
+ */
+export const appendIam = <C extends IamServerConfig, T extends IamServerContext<C>>(
+  context: T
+): T => {
+  context.registerService(makeOidcClientService())
+  context.registerService(makeOidcWrappingService())
+  // IAM gate under the OIDC_GATE alias: claims-first (integrated mode),
+  // UMA2 fallback byte-equivalent to makeOidcGate (keycloak mode)
+  context.registerService(makeIamGate())
+  appendOidcGuard<C, T>(context)
+  return context
+}

package/src/gate.ts

@@ -0,0 +1,100 @@
+import { createLazyService } from '@owlmeans/context'
+import type { GateService, AbstractRequest } from '@owlmeans/entrypoint'
+import { OIDC_GATE } from '@owlmeans/oidc'
+import { AuthForbidden } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import { createGateModel, extractPermissionSets } from '@owlmeans/server-oidc-rp'
+import type { Config, Context } from '@owlmeans/server-oidc-rp'
+import { hasPermission } from '@owlmeans/iam'
+
+/**
+ * Gate-param syntax:
+ *   <permission>                — unscoped (project-wide) check, e.g. 'article--modify'
+ *   <permission>@<requestParam> — resource-scoped: the resource id is resolved from
+ *                                 req.params[requestParam] ?? req.query[requestParam]
+ *                                 and must be listed in the grant's resources[]
+ * '{entity}' substitution applies to the permission part in both forms.
+ */
+export const RESOURCE_PARAM_SEPARATOR = '@'
+
+export interface ParsedGateParam {
+  permission: string
+  resourceParam?: string
+}
+
+export const parseGateParam = (param: string): ParsedGateParam => {
+  const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR)
+  if (idx < 0) {
+    return { permission: param }
+  }
+
+  return { permission: param.slice(0, idx), resourceParam: param.slice(idx + 1) }
+}
+
+const resolveResourceId = (req: AbstractRequest, resourceParam: string): string | undefined => {
+  const params = req.params as Record<string, unknown> | undefined
+  const query = req.query as Record<string, unknown> | undefined
+  const value = params?.[resourceParam] ?? query?.[resourceParam]
+
+  return value != null ? `${value}` : undefined
+}
+
+/**
+ * IAM gate: claims-first with UMA2 fallback. Registered under the OIDC_GATE alias by
+ * appendIam() so target code never knows which IAM backend is active.
+ *
+ * 1. When the Auth carries a valid PermissionSet[] claim (integrated IAM mode),
+ *    params are asserted locally against it — both unscoped and resource-scoped forms.
+ * 2. Otherwise (Keycloak mode — its tokens never produce a conforming claim) the
+ *    @-suffixes are stripped and the check delegates to the UMA2 gate model from
+ *    @owlmeans/server-oidc-rp, byte-equivalent to makeOidcGate.
+ */
+export const makeIamGate = (alias: string = OIDC_GATE): GateService => {
+  const service: GateService = createLazyService<GateService>(alias, {
+    assert: async (req, _, params) => {
+      await service.ready()
+      const ctx = service.assertCtx<Config, Context>()
+
+      if (req.auth == null) {
+        throw new AuthForbidden('auth')
+      }
+
+      const auth = req.auth as Auth
+      const sets = extractPermissionSets(auth.permissions)
+
+      if (sets != null) {
+        const granted = params.some(param => {
+          const { permission, resourceParam } = parseGateParam(param)
+          const fixed = permission.replaceAll('{entity}', auth.entityId ?? '-')
+
+          if (resourceParam != null) {
+            const resourceId = resolveResourceId(req, resourceParam)
+            if (resourceId == null) {
+              return false
+            }
+
+            return hasPermission(auth, fixed, { resourceId })
+          }
+
+          return hasPermission(auth, fixed)
+        })
+
+        if (!granted) {
+          throw new AuthForbidden('permission')
+        }
+
+        return
+      }
+
+      const stripped = params.map(param => parseGateParam(param).permission)
+      const model = createGateModel(ctx)
+      const permissions = await model.loadPermissions(auth, stripped)
+
+      if (permissions.length < 1) {
+        throw new AuthForbidden('permission')
+      }
+    }
+  })
+
+  return service
+}

package/src/index.ts

@@ -1,2 +1,5 @@
 export type * from '@owlmeans/iam'
+export { hasPermission } from '@owlmeans/iam'
 export * from './consts.js'
+export * from './append.js'
+export * from './gate.js'

package/tests/gate.spec.ts

@@ -0,0 +1,75 @@
+import { describe, expect, test } from 'bun:test'
+import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig } from '@owlmeans/context'
+import type { AbstractRequest, AbstractResponse, GateService } from '@owlmeans/entrypoint'
+import type { Auth } from '@owlmeans/auth'
+import { AuthForbidden, AuthRole } from '@owlmeans/auth'
+import { OIDC_GATE } from '@owlmeans/oidc'
+import { makeIamGate } from '@owlmeans/server-iam'
+
+const makeGate = async (): Promise<GateService> => {
+  const ctx = makeBasicContext<BasicConfig>({
+    ready: false,
+    service: 'server-iam-tests',
+    layer: Layer.Service,
+    type: AppType.Backend,
+  })
+  ctx.registerService(makeIamGate())
+  ctx.configure()
+  await ctx.init()
+
+  return ctx.service<GateService>(OIDC_GATE)
+}
+
+const makeRequest = (params: Record<string, string> = {}): AbstractRequest => ({
+  alias: 'test',
+  headers: {},
+  params,
+  query: {},
+  body: {},
+  path: '/',
+  auth: {
+    type: 'oidc-wrapped-token',
+    token: 'test',
+    userId: 'user-1',
+    role: AuthRole.User,
+    scopes: [],
+    entityId: 'entity-1',
+    isUser: true,
+    createdAt: new Date(),
+    permissions: [
+      { scope: 'my-project', permissions: { 'article--modify': true } },
+      {
+        scope: 'my-project',
+        permissions: { 'department--modify': true },
+        resources: ['dep-12345678']
+      }
+    ]
+  } satisfies Auth
+}) as unknown as AbstractRequest
+
+const res = {} as AbstractResponse<unknown>
+
+describe('@owlmeans/server-iam — makeIamGate (claims mode)', () => {
+  test('passes an unscoped permission param', async () => {
+    const gate = await makeGate()
+    await gate.assert(makeRequest(), res, ['article--modify'])
+  })
+
+  test('passes a resource-scoped param when the request resource id is granted', async () => {
+    const gate = await makeGate()
+    await gate.assert(makeRequest({ depId: 'dep-12345678' }), res, ['department--modify@depId'])
+  })
+
+  test('params are any-of — one granted param is enough', async () => {
+    const gate = await makeGate()
+    await gate.assert(makeRequest(), res, ['unknown--permission', 'article--modify'])
+  })
+
+  test('rejects a resource-scoped param for an ungranted resource id', async () => {
+    const gate = await makeGate()
+    expect(
+      gate.assert(makeRequest({ depId: 'dep-87654321' }), res, ['department--modify@depId'])
+    ).rejects.toBeInstanceOf(AuthForbidden)
+  })
+})