@portaidentity/server 1.7.3 → 1.8.0

package/dist/rbac/role-service.js

@@ -1,26 +1,31 @@
 /**
  * Role service — business logic for role management.
  *
- * Orchestrates role CRUD operations with slug validation, uniqueness
- * checks, deletion guards, cache management, and audit logging.
- * Also handles role-permission assignment operations.
- *
- * All write operations follow the pattern:
- *   validate → DB operation → cache invalidate/re-cache → audit log
- *
- * Uses fire-and-forget audit logging — audit failures never block
- * the primary operation.
+ * Orchestrates application-scoped role CRUD and direct permission mappings.
+ * Authority reductions revoke affected database state in the request transaction;
+ * cache cleanup runs after commit. Canonical Porta Admin roles and mappings are
+ * protected from generic mutation.
  *
  * @see role-repository.ts — Database operations
  * @see mapping-repository.ts — Role-permission join table operations
  * @see cache.ts — Redis cache operations
  */
-import { insertRole, findRoleById as repoFindRoleById, findRoleBySlug as repoFindRoleBySlug, updateRole as repoUpdateRole, deleteRole as repoDeleteRole, listRolesByApplication as repoListRolesByApplication, roleSlugExists, countUsersWithRole, } from './role-repository.js';
-import { assignPermissionsToRole as repoAssignPermissions, removePermissionsFromRole as repoRemovePermissions, getPermissionsForRole as repoGetPermissionsForRole, } from './mapping-repository.js';
-import { getCachedRole, setCachedRole, invalidateRoleCache, invalidateAllUserRbacCaches, } from './cache.js';
-import { generateRoleSlug, validateRoleSlug } from './slugs.js';
+import { insertRole, findRoleById as repoFindRoleById, lockRoleById, findRoleBySlug as repoFindRoleBySlug, updateRole as repoUpdateRole, captureRoleForDeletion, deleteCapturedRole, listRolesByApplication as repoListRolesByApplication, roleSlugExists, } from './role-repository.js';
+import { assignPermissionsToRole as repoAssignPermissions, removePermissionsFromRole as repoRemovePermissions, getPermissionsForRole as repoGetPermissionsForRole, getUserIdsForRole, lockRolePermissionTargets, } from './mapping-repository.js';
+import { getCachedRole, setCachedRole } from './cache.js';
+import { generateRoleSlug, normalizeRbacSlug, validateRoleSlug } from './slugs.js';
 import { RoleNotFoundError, RbacValidationError } from './errors.js';
 import { writeAuditLog } from '../lib/audit-log.js';
+import { getDatabaseTransactionClient } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { registerAuthorityCleanup, registerDeletionCleanup } from '../lib/deletion-cleanup.js';
+import { revokeAffectedAuthorityInTransaction } from '../lib/authority-revocation.js';
+import { getApplicationBySlug } from '../applications/service.js';
+import { ALL_ADMIN_PERMISSIONS, ALL_ADMIN_ROLES, LEGACY_ADMIN_ROLE, } from '../lib/admin-permissions.js';
+const ROLE_DELETED_EVENT = 'role.deleted';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
+const ADMIN_ROLE_SLUGS = new Set([...ALL_ADMIN_ROLES.map((role) => role.slug), LEGACY_ADMIN_ROLE]);
+const ADMIN_PERMISSION_SLUGS = new Set(ALL_ADMIN_PERMISSIONS);
 // ---------------------------------------------------------------------------
 // Create
 // ---------------------------------------------------------------------------
@@ -37,11 +42,12 @@ import { writeAuditLog } from '../lib/audit-log.js';
  */
 export async function createRole(input, actorId) {
     // Generate slug from name if not provided
-    const slug = input.slug ?? generateRoleSlug(input.name);
+    const slug = normalizeRbacSlug(input.slug ?? generateRoleSlug(input.name));
     // Validate slug format
     if (!validateRoleSlug(slug)) {
-        throw new RbacValidationError(`Invalid role slug format: "${slug}". Must be 1-100 chars, lowercase alphanumeric and hyphens.`);
+        throw new RbacValidationError('Invalid role slug. Must be 1-100 characters without control characters.');
     }
+    await guardCanonicalAdminRole(input.applicationId, slug);
     // Check slug uniqueness within the application
     const exists = await roleSlugExists(input.applicationId, slug);
     if (exists) {
@@ -66,16 +72,17 @@ export async function createRole(input, actorId) {
 /**
  * Find a role by ID. Cache-first, falls back to DB.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @returns Role or null if not found
  */
-export async function findRoleById(id) {
+export async function findRoleById(applicationId, id) {
     // Try cache first
     const cached = await getCachedRole(id);
     if (cached)
-        return cached;
+        return cached.applicationId === applicationId ? cached : null;
     // Cache miss — query DB
-    const role = await repoFindRoleById(id);
+    const role = await repoFindRoleById(applicationId, id);
     if (role) {
         // Cache for future lookups
         await setCachedRole(role);
@@ -108,90 +115,125 @@ export async function listRolesByApplication(applicationId) {
  * Update a role by ID.
  *
  * If the slug is being changed, validates the new slug format and
- * checks uniqueness within the application. Invalidates and re-caches
- * the role after update.
+ * checks uniqueness within the application. An actual slug change revokes
+ * authority for users assigned to the role; metadata-only changes do not.
  *
+ * @param applicationId - Parent application UUID
  * @param id - Role UUID
  * @param input - Fields to update
  * @param actorId - Optional UUID of the admin performing the action
- * @returns Updated role
+ * @returns Updated role and whether the actor must authenticate again
  * @throws RoleNotFoundError if role doesn't exist
  * @throws RbacValidationError if new slug is invalid or already exists
  */
-export async function updateRole(id, input, actorId) {
-    // Verify role exists (needed for applicationId if slug is changing)
-    const existing = await repoFindRoleById(id);
+export async function updateRole(applicationId, id, input, actorId) {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction)
+        throw new Error('Role update requires an active database transaction');
+    const existing = await lockRoleById(applicationId, id);
     if (!existing) {
         throw new RoleNotFoundError(id);
     }
+    await guardCanonicalAdminRole(existing.applicationId, existing.slug);
+    const normalizedInput = input.slug === undefined ? input : { ...input, slug: normalizeRbacSlug(input.slug) };
+    const changed = (input.name !== undefined && input.name !== existing.name) ||
+        (normalizedInput.slug !== undefined && normalizedInput.slug !== existing.slug) ||
+        (input.description !== undefined && input.description !== existing.description);
+    if (!changed)
+        return { role: existing, reauthenticationRequired: false };
     // If slug is changing, validate format and uniqueness
-    if (input.slug !== undefined && input.slug !== existing.slug) {
-        if (!validateRoleSlug(input.slug)) {
-            throw new RbacValidationError(`Invalid role slug format: "${input.slug}". Must be 1-100 chars, lowercase alphanumeric and hyphens.`);
+    const requestedSlug = normalizedInput.slug;
+    const slugChanged = requestedSlug !== undefined && requestedSlug !== existing.slug;
+    if (slugChanged) {
+        await guardCanonicalAdminRole(applicationId, requestedSlug);
+        if (!validateRoleSlug(requestedSlug)) {
+            throw new RbacValidationError('Invalid role slug. Must be 1-100 characters without control characters.');
         }
-        const slugTaken = await roleSlugExists(existing.applicationId, input.slug, id);
+        const slugTaken = await roleSlugExists(applicationId, requestedSlug, id);
         if (slugTaken) {
-            throw new RbacValidationError(`Role slug "${input.slug}" already exists for this application.`);
+            throw new RbacValidationError(`Role slug "${requestedSlug}" already exists for this application.`);
         }
     }
-    // Perform the update
-    const updated = await repoUpdateRole(id, input);
-    // Invalidate old cache and store updated role
-    await invalidateRoleCache(id);
-    await setCachedRole(updated);
-    // Audit log (fire-and-forget)
-    void writeAuditLog({
-        eventType: 'role.updated',
-        eventCategory: 'admin',
-        actorId,
-        metadata: { roleId: id, changes: input },
+    const userIds = slugChanged ? await getUserIdsForRole(applicationId, id) : [];
+    const revoked = slugChanged
+        ? await revokeAffectedAuthorityInTransaction(userIds)
+        : { grantIds: [] };
+    const updated = await repoUpdateRole(applicationId, id, normalizedInput);
+    if (slugChanged) {
+        await writeAuditLogInTransaction(transaction, {
+            eventType: 'role.updated',
+            eventCategory: 'admin',
+            actorId,
+            metadata: { applicationId, roleId: id, changes: normalizedInput },
+        });
+    }
+    else {
+        void writeAuditLog({
+            eventType: 'role.updated',
+            eventCategory: 'admin',
+            actorId,
+            metadata: { applicationId, roleId: id, changes: normalizedInput },
+        });
+    }
+    await registerAuthorityCleanup({
+        userIds,
+        grantIds: revoked.grantIds,
+        roleIds: [id],
+        revokeOidcState: slugChanged,
     });
-    return updated;
+    return {
+        role: updated,
+        reauthenticationRequired: slugChanged && actorId !== undefined && userIds.includes(actorId),
+    };
 }
 // ---------------------------------------------------------------------------
 // Delete
 // ---------------------------------------------------------------------------
 /**
- * Delete a role by ID.
+ * Delete a role through its authoritative application parent.
  *
- * By default (force=false), refuses to delete roles that have users
- * assigned. Pass force=true to delete regardless — CASCADE will
- * remove user_roles and role_permissions entries.
- *
- * @param id - Role UUID
- * @param force - If true, delete even if users are assigned
- * @param actorId - Optional UUID of the admin performing the action
- * @throws RoleNotFoundError if role doesn't exist
- * @throws RbacValidationError if users are assigned and force is false
+ * @param applicationId - Parent application UUID.
+ * @param roleId - Child role UUID.
+ * @param actorId - Actor identifier used for audit attribution when applicable.
+ * @returns Whether the actor must authenticate again
+ * @throws RoleNotFoundError when the selected role does not exist within the requested boundary.
  */
-export async function deleteRole(id, force = false, actorId) {
-    // Verify role exists
-    const existing = await repoFindRoleById(id);
-    if (!existing) {
-        throw new RoleNotFoundError(id);
-    }
-    // Deletion guard: check for assigned users
-    if (!force) {
-        const userCount = await countUsersWithRole(id);
-        if (userCount > 0) {
-            throw new RbacValidationError(`Cannot delete role "${existing.slug}": ${userCount} user(s) still assigned. Use force=true to override.`);
-        }
-    }
-    // Delete the role (CASCADE handles related records)
-    await repoDeleteRole(id);
-    // Invalidate caches
-    await invalidateRoleCache(id);
-    // User caches may be stale if role had users (force=true case)
-    if (force) {
-        await invalidateAllUserRbacCaches();
-    }
-    // Audit log (fire-and-forget)
-    void writeAuditLog({
-        eventType: 'role.deleted',
-        eventCategory: 'admin',
+export async function deleteRole(applicationId, roleId, actorId) {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction)
+        throw new Error('Role deletion requires an active database transaction');
+    const capture = await captureRoleForDeletion(applicationId, roleId);
+    if (!capture)
+        throw new RoleNotFoundError(roleId);
+    await guardCanonicalAdminRole(capture.role.applicationId, capture.role.slug);
+    const revoked = await revokeAffectedAuthorityInTransaction(capture.userIds);
+    await writeAuditLogInTransaction(transaction, {
         actorId,
-        metadata: { roleId: id, slug: existing.slug, force },
+        eventType: ROLE_DELETED_EVENT,
+        eventCategory: 'admin',
+        metadata: {
+            applicationId,
+            roleId,
+            slug: capture.role.slug,
+        },
+    });
+    await deleteCapturedRole(applicationId, roleId);
+    await registerDeletionCleanup({
+        resource: 'role',
+        targetId: roleId,
+        parentId: applicationId,
+        userIds: capture.userIds,
+        clientIds: [],
+        publicClientIds: [],
+        grantIds: revoked.grantIds,
+        roleIds: [roleId],
+        permissionIds: capture.permissionIds,
+        claimIds: [],
+        applicationIds: [applicationId],
     });
+    return {
+        reauthenticationRequired: actorId !== undefined && capture.userIds.includes(actorId),
+    };
 }
 // ---------------------------------------------------------------------------
 // Role-Permission management
@@ -199,58 +241,130 @@ export async function deleteRole(id, force = false, actorId) {
 /**
  * Assign permissions to a role.
  *
- * Delegates to the mapping repository for bulk insert. Invalidates
- * all user RBAC caches since user permissions may have changed.
+ * Validates every permission against the role's application and schedules
+ * cache invalidation only for users assigned to the role.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to assign
  * @param actorId - Optional UUID of the admin performing the action
  */
-export async function assignPermissionsToRole(roleId, permissionIds, actorId) {
+export async function assignPermissionsToRole(applicationId, roleId, permissionIds, actorId) {
     if (permissionIds.length === 0)
         return;
-    await repoAssignPermissions(roleId, permissionIds);
-    // Invalidate all user RBAC caches — permissions through roles may have changed
-    await invalidateAllUserRbacCaches();
+    if (!getDatabaseTransactionClient()) {
+        throw new Error('Role permission assignment requires an active database transaction');
+    }
+    const targets = await requireRolePermissionTargets(applicationId, roleId, permissionIds);
+    await guardCanonicalAdminRole(targets.role.applicationId, targets.role.slug);
+    await guardCanonicalAdminPermissions(applicationId, targets.permissions);
+    const insertedPermissionIds = await repoAssignPermissions(applicationId, roleId, permissionIds);
+    if (insertedPermissionIds.length === 0)
+        return;
+    const userIds = await getUserIdsForRole(applicationId, roleId);
+    await registerAuthorityCleanup({
+        userIds,
+        grantIds: [],
+        roleIds: [],
+        revokeOidcState: false,
+    });
     // Audit log (fire-and-forget)
     void writeAuditLog({
         eventType: 'role.permissions.assigned',
         eventCategory: 'admin',
         actorId,
-        metadata: { roleId, permissionIds },
+        metadata: { applicationId, roleId, permissionIds: insertedPermissionIds },
     });
 }
 /**
  * Remove permissions from a role.
  *
- * Delegates to the mapping repository. Invalidates all user RBAC
- * caches since user permissions may have changed.
+ * Validates every permission against the role's application. An actual
+ * removal revokes affected authority; an absent mapping is a committed no-op.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to remove
  * @param actorId - Optional UUID of the admin performing the action
  */
-export async function removePermissionsFromRole(roleId, permissionIds, actorId) {
+export async function removePermissionsFromRole(applicationId, roleId, permissionIds, actorId) {
     if (permissionIds.length === 0)
-        return;
-    await repoRemovePermissions(roleId, permissionIds);
-    // Invalidate all user RBAC caches
-    await invalidateAllUserRbacCaches();
-    // Audit log (fire-and-forget)
-    void writeAuditLog({
+        return { reauthenticationRequired: false };
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction) {
+        throw new Error('Role permission removal requires an active database transaction');
+    }
+    const targets = await requireRolePermissionTargets(applicationId, roleId, permissionIds);
+    await guardCanonicalAdminRole(targets.role.applicationId, targets.role.slug);
+    await guardCanonicalAdminPermissions(applicationId, targets.permissions);
+    if (targets.assignedPermissionIds.length === 0) {
+        return { reauthenticationRequired: false };
+    }
+    const userIds = await getUserIdsForRole(applicationId, roleId);
+    const revoked = await revokeAffectedAuthorityInTransaction(userIds);
+    const removedPermissionIds = await repoRemovePermissions(applicationId, roleId, [
+        ...targets.assignedPermissionIds,
+    ]);
+    await writeAuditLogInTransaction(transaction, {
         eventType: 'role.permissions.removed',
         eventCategory: 'admin',
         actorId,
-        metadata: { roleId, permissionIds },
+        metadata: { applicationId, roleId, permissionIds: removedPermissionIds },
+    });
+    await registerAuthorityCleanup({
+        userIds,
+        grantIds: revoked.grantIds,
+        roleIds: [],
+        revokeOidcState: true,
     });
+    return {
+        reauthenticationRequired: actorId !== undefined && userIds.includes(actorId),
+    };
 }
 /**
  * Get all permissions assigned to a role.
  *
+ * @param applicationId - Parent application UUID
  * @param roleId - Role UUID
  * @returns Array of permissions
  */
-export async function getPermissionsForRole(roleId) {
-    return repoGetPermissionsForRole(roleId);
+export async function getPermissionsForRole(applicationId, roleId) {
+    const role = await repoFindRoleById(applicationId, roleId);
+    if (!role)
+        throw new RoleNotFoundError(roleId);
+    return repoGetPermissionsForRole(applicationId, roleId);
+}
+/** Reject generic mutations of canonical Porta Admin role definitions and mappings. */
+async function guardCanonicalAdminRole(applicationId, roleSlug) {
+    if (!ADMIN_ROLE_SLUGS.has(roleSlug))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin roles cannot be modified');
+    }
+}
+/** Reject mappings involving canonical Porta Admin permission definitions. */
+async function guardCanonicalAdminPermissions(applicationId, permissions) {
+    if (!permissions.some((permission) => ADMIN_PERMISSION_SLUGS.has(permission.slug)))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin permissions cannot be modified');
+    }
+}
+/** Lock and validate every target in one application-scoped mapping request. */
+async function requireRolePermissionTargets(applicationId, roleId, permissionIds) {
+    const requestedPermissionIds = [...new Set(permissionIds)].sort();
+    const targets = await lockRolePermissionTargets(applicationId, roleId, requestedPermissionIds);
+    if (!targets.role)
+        throw new RoleNotFoundError(roleId);
+    if (targets.permissions.length !== requestedPermissionIds.length) {
+        throw new RbacValidationError('Every permission must belong to the selected application');
+    }
+    return {
+        role: targets.role,
+        permissions: targets.permissions,
+        assignedPermissionIds: targets.assignedPermissionIds,
+    };
 }
 //# sourceMappingURL=role-service.js.map

package/dist/rbac/role-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/rbac/role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,UAAU,EACV,YAAY,IAAI,gBAAgB,EAChC,cAAc,IAAI,kBAAkB,EACpC,UAAU,IAAI,cAAc,EAC5B,UAAU,IAAI,cAAc,EAC5B,sBAAsB,IAAI,0BAA0B,EACpD,cAAc,EACd,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,IAAI,qBAAqB,EAChD,yBAAyB,IAAI,qBAAqB,EAClD,qBAAqB,IAAI,yBAAyB,GACnD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB,EAAE,OAAgB;IACvE,0CAA0C;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAExD,uBAAuB;IACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,IAAI,6DAA6D,CAChG,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAC3B,cAAc,IAAI,wCAAwC,CAC3D,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,qBAAqB;IACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAE1B,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KAClF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,2BAA2B;QAC3B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,IAAY;IACtE,OAAO,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,OAAO,0BAA0B,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,KAAsB,EACtB,OAAgB;IAEhB,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,sDAAsD;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,KAAK,CAAC,IAAI,6DAA6D,CACtG,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,mBAAmB,CAC3B,cAAc,KAAK,CAAC,IAAI,wCAAwC,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEhD,8CAA8C;IAC9C,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAE7B,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,KAAK,GAAY,KAAK,EACtB,OAAgB;IAEhB,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,QAAQ,CAAC,IAAI,MAAM,SAAS,sDAAsD,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IAEzB,oBAAoB;IACpB,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC9B,+DAA+D;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,2BAA2B,EAAE,CAAC;IACtC,CAAC;IAED,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,aAAuB,EACvB,OAAgB;IAEhB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,MAAM,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAEnD,+EAA+E;IAC/E,MAAM,2BAA2B,EAAE,CAAC;IAEpC,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,2BAA2B;QACtC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAAuB,EACvB,OAAgB;IAEhB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,MAAM,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAEnD,kCAAkC;IAClC,MAAM,2BAA2B,EAAE,CAAC;IAEpC,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,0BAA0B;QACrC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/rbac/role-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,UAAU,EACV,YAAY,IAAI,gBAAgB,EAChC,YAAY,EACZ,cAAc,IAAI,kBAAkB,EACpC,UAAU,IAAI,cAAc,EAC5B,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,IAAI,0BAA0B,EACpD,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,IAAI,qBAAqB,EAChD,yBAAyB,IAAI,qBAAqB,EAClD,qBAAqB,IAAI,yBAAyB,EAClD,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AAErC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACnG,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAEtE,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB,EAAE,OAAgB;IACvE,0CAA0C;IAC1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,uBAAuB;IACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,uBAAuB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAEzD,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,cAAc,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IAED,iCAAiC;IACjC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,qBAAqB;IACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAE1B,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KAClF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,EAAU;IAClE,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,EAAE,CAAC;QACT,2BAA2B;QAC3B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,IAAY;IACtE,OAAO,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,OAAO,0BAA0B,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,EAAU,EACV,KAAsB,EACtB,OAAgB;IAEhB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,uBAAuB,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAErE,MAAM,eAAe,GACnB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;QAC1D,CAAC,eAAe,CAAC,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;QAC9E,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAEzE,sDAAsD;IACtD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC;IAC3C,MAAM,WAAW,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,QAAQ,CAAC,IAAI,CAAC;IACnF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,uBAAuB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,mBAAmB,CAC3B,cAAc,aAAa,wCAAwC,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC,MAAM,oCAAoC,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;IAEzE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,0BAA0B,CAAC,WAAW,EAAE;YAC5C,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,OAAO;YACtB,OAAO;YACP,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,aAAa,CAAC;YACjB,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,OAAO;YACtB,OAAO;YACP,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,wBAAwB,CAAC;QAC7B,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,CAAC,EAAE,CAAC;QACb,eAAe,EAAE,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,OAAO;QACb,wBAAwB,EAAE,WAAW,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,MAAc,EACd,OAAgB;IAEhB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,0BAA0B,CAAC,WAAW,EAAE;QAC5C,OAAO;QACP,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,aAAa;YACb,MAAM;YACN,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;SACxB;KACF,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,uBAAuB,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,CAAC,aAAa,CAAC;KAChC,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB,EAAE,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,MAAc,EACd,aAAuB,EACvB,OAAgB;IAEhB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzF,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,8BAA8B,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,MAAM,qBAAqB,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAChG,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,wBAAwB,CAAC;QAC7B,OAAO;QACP,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IAEH,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,2BAA2B;QACtC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,qBAAqB,EAAE;KAC1E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAAqB,EACrB,MAAc,EACd,aAAuB,EACvB,OAAgB;IAEhB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzF,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,8BAA8B,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,oBAAoB,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE;QAC9E,GAAG,OAAO,CAAC,qBAAqB;KACjC,CAAC,CAAC;IACH,MAAM,0BAA0B,CAAC,WAAW,EAAE;QAC5C,SAAS,EAAE,0BAA0B;QACrC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC;QAC7B,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IACH,OAAO;QACL,wBAAwB,EAAE,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,yBAAyB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,uBAAuB,CAAC,aAAqB,EAAE,QAAgB;IAC5E,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IAC5C,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,8BAA8B,CAC3C,aAAqB,EACrB,WAAkC;IAElC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO;IAC3F,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,4BAA4B,CACzC,aAAqB,EACrB,MAAc,EACd,aAAgC;IAMhC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,mBAAmB,CAAC,0DAA0D,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC;AACJ,CAAC"}

package/dist/rbac/slugs.d.ts

@@ -3,21 +3,19 @@
  *
  * Two types of slugs are used in the RBAC module:
  *
- * 1. **Role slugs** — kebab-case identifiers (e.g., "crm-editor").
- *    Same format as organization/application slugs. Auto-generated
- *    from role names or provided manually.
- *
- * 2. **Permission slugs** — colon-separated namespaced identifiers
- *    following the `module:resource:action` format (e.g., "crm:contacts:read").
- *    Each segment must be lowercase alphanumeric with hyphens.
- *    Minimum 3 segments required.
+ * Role and permission slugs are exact external claim values. Explicit values keep their case and
+ * printable characters after surrounding whitespace is removed. Generated role slugs retain the
+ * familiar kebab-case default.
  *
  * This module provides:
  * - `generateRoleSlug(name)` — Derive a role slug from a role name
- * - `validateRoleSlug(slug)` — Check role slug format (kebab-case, 1-100 chars)
- * - `validatePermissionSlug(slug)` — Check permission slug follows module:resource:action
+ * - `normalizeRbacSlug(slug)` — Remove surrounding whitespace before storage and comparison
+ * - `validateRoleSlug(slug)` — Check the role claim value safety bounds
+ * - `validatePermissionSlug(slug)` — Check the permission claim value safety bounds
  * - `parsePermissionSlug(slug)` — Decompose a permission slug into its parts
  */
+/** Removes surrounding whitespace while preserving the exact internal claim value. */
+export declare function normalizeRbacSlug(slug: string): string;
 /**
  * Generate a URL-safe slug from a role name.
  *
@@ -43,11 +41,8 @@ export declare function generateRoleSlug(name: string): string;
 /**
  * Validate a role slug format.
  *
- * Rules:
- * - 1–100 characters long
- * - Lowercase alphanumeric characters and hyphens only
- * - Cannot start or end with a hyphen
- * - Empty strings are invalid
+ * The trimmed value must contain 1–100 printable characters. Case and internal characters are
+ * preserved because this value is emitted directly to external applications.
  *
  * Does NOT check uniqueness — that's the repository/service layer's job.
  *
@@ -57,19 +52,13 @@ export declare function generateRoleSlug(name: string): string;
  * @example
  * validateRoleSlug('crm-editor')  // true
  * validateRoleSlug('admin')       // true
- * validateRoleSlug('CRM Editor')  // false (spaces, uppercase)
+ * validateRoleSlug('CRM Editor')  // true
  * validateRoleSlug('')            // false (empty)
  */
 export declare function validateRoleSlug(slug: string): boolean;
 /**
- * Validate a permission slug follows the module:resource:action format.
- *
- * Rules:
- * - Must have at least 3 segments separated by colons
- * - Each segment must be lowercase alphanumeric with hyphens
- * - Each segment must start and end with an alphanumeric character
- * - Empty segments are not allowed
- * - Total length must not exceed 150 characters (matches DB column)
+ * Validate a permission claim value. `module:resource:action` remains a useful convention, but is
+ * not mandatory for external applications that already use another identifier scheme.
  *
  * @param slug - Permission slug to validate
  * @returns true if the slug format is valid, false otherwise
@@ -78,8 +67,8 @@ export declare function validateRoleSlug(slug: string): boolean;
  * validatePermissionSlug('crm:contacts:read')     // true
  * validatePermissionSlug('admin:system:manage')    // true
  * validatePermissionSlug('crm:sub-module:items:write') // true (4+ segments OK)
- * validatePermissionSlug('contacts-read')          // false (no colons)
- * validatePermissionSlug('a:b')                    // false (only 2 segments)
+ * validatePermissionSlug('CAN_ADD_ORDER')          // true
+ * validatePermissionSlug('access-that-resource')   // true
  * validatePermissionSlug('')                       // false (empty)
  */
 export declare function validatePermissionSlug(slug: string): boolean;
@@ -97,7 +86,7 @@ export interface ParsedPermissionSlug {
  * both 3-segment slugs (crm:contacts:read) and 4+ segment slugs
  * (crm:sub-module:items:write → module="crm", resource="sub-module:items", action="write").
  *
- * Returns null if the slug is invalid (fails validatePermissionSlug).
+ * Returns null when the claim value does not use the conventional three-or-more-part colon form.
  *
  * @param slug - Permission slug to parse
  * @returns Parsed components or null if invalid

package/dist/rbac/slugs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../src/rbac/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA2BH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgB5D;AAMD,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAY7E"}
+{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../src/rbac/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAwBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAMD,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAW7E"}