@powerhousedao/reactor-api 6.2.0-dev.4 → 6.2.0-dev.5

package/dist/index.mjs

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5769db0f-d60a-5870-9d50-dc4f5aca8086")}catch(e){}}();
-import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-BFkbSO_H.mjs";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="64b14acf-bb9d-528e-b2b6-b3fa2097026f")}catch(e){}}();
+import { a as isSubgraphClass, c as loadDocumentModels, d as BaseSubgraph, f as AuthorizationPolicy, i as buildGraphqlOperations, l as loadProcessors, n as buildGraphQlDriveDocument, o as debounce, p as createAuthorizationService, r as buildGraphqlOperation, t as buildGraphQlDocument, u as loadSubgraphs } from "./utils-CtC8sjRo.mjs";
 import { AnalyticsQueryEngine } from "@powerhousedao/analytics-engine-core";
 import { AnalyticsModel, AnalyticsResolvers, typedefs } from "@powerhousedao/analytics-engine-graphql";
 import { gql } from "graphql-tag";
@@ -85,18 +85,14 @@ async function documentAccess(service, args) {
 async function userDocumentPermissions(service, userAddress) {
 	return service.getUserDocuments(userAddress);
 }
-async function grantDocumentPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantDocumentPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantPermission(args.documentId, args.userAddress, args.permission, grantedByAddress);
 }
-async function revokeDocumentPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeDocumentPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokePermission(args.documentId, args.userAddress);
 	return true;
 }
@@ -127,18 +123,14 @@ async function removeUserFromGroup(service, args) {
 async function getGroupMembers(service, groupId) {
 	return service.getGroupMembers(groupId);
 }
-async function grantGroupPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant permissions");
 	return service.grantGroupPermission(args.documentId, args.groupId, args.permission, grantedByAddress);
 }
-async function revokeGroupPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke permissions");
 	await service.revokeGroupPermission(args.documentId, args.groupId);
 	return true;
 }
@@ -155,56 +147,40 @@ async function operationPermissions(service, args) {
 async function canExecuteOperation(service, args, userAddress) {
 	return service.canExecuteOperation(args.documentId, args.operationType, userAddress);
 }
-async function grantOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantOperationPermission(args.documentId, args.operationType, args.userAddress, grantedByAddress);
 }
-async function revokeOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeOperationPermission(args.documentId, args.operationType, args.userAddress);
 	return true;
 }
-async function grantGroupOperationPermission(service, args, grantedByAddress, isGlobalAdmin) {
+async function grantGroupOperationPermission(service, authorizationService, args, grantedByAddress) {
 	if (!grantedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, grantedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to grant operation permissions");
 	return service.grantGroupOperationPermission(args.documentId, args.operationType, args.groupId, grantedByAddress);
 }
-async function revokeGroupOperationPermission(service, args, revokedByAddress, isGlobalAdmin) {
+async function revokeGroupOperationPermission(service, authorizationService, args, revokedByAddress) {
 	if (!revokedByAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (!await service.canManageDocument(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
-	}
+	if (!await authorizationService.canManage(args.documentId, revokedByAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to revoke operation permissions");
 	await service.revokeGroupOperationPermission(args.documentId, args.operationType, args.groupId);
 	return true;
 }
 async function documentProtection(service, args) {
 	return service.getDocumentProtection(args.documentId);
 }
-async function setDocumentProtection(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function setDocumentProtection(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to change protection");
 	await service.setDocumentProtection(args.documentId, args.protected);
 	return service.getDocumentProtection(args.documentId);
 }
-async function transferDocumentOwnership(service, authorizationService, args, userAddress, isGlobalAdmin) {
+async function transferDocumentOwnership(service, authorizationService, args, userAddress) {
 	if (!userAddress) throw new GraphQLError("Authentication required");
-	if (!isGlobalAdmin) {
-		if (authorizationService) {
-			if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-		} else if (!await service.canManageDocument(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
-	}
+	if (!await authorizationService.canManage(args.documentId, userAddress)) throw new GraphQLError("Forbidden: You must be an admin of this document to transfer ownership");
 	const previousOwner = await service.getDocumentOwner(args.documentId);
 	if (previousOwner) await service.revokePermission(args.documentId, previousOwner);
 	await service.setDocumentOwner(args.documentId, args.newOwnerAddress);
@@ -322,8 +298,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("setDocumentProtection(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await setDocumentProtection(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in setDocumentProtection: @error", error);
 					throw error;
@@ -333,8 +308,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("transferDocumentOwnership(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address, isGlobalAdmin);
+					return await transferDocumentOwnership(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in transferDocumentOwnership: @error", error);
 					throw error;
@@ -344,8 +318,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantDocumentPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantDocumentPermission: @error", error);
 					throw error;
@@ -355,8 +328,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeDocumentPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeDocumentPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeDocumentPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeDocumentPermission: @error", error);
 					throw error;
@@ -406,8 +378,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantGroupPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupPermission: @error", error);
 					throw error;
@@ -417,8 +388,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupPermission: @error", error);
 					throw error;
@@ -428,8 +398,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantOperationPermission: @error", error);
 					throw error;
@@ -439,8 +408,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeOperationPermission: @error", error);
 					throw error;
@@ -450,8 +418,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("grantGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await grantGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await grantGroupOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in grantGroupOperationPermission: @error", error);
 					throw error;
@@ -461,8 +428,7 @@ var AuthSubgraph = class extends BaseSubgraph {
 				this.logger.debug("revokeGroupOperationPermission(@args)", args);
 				if (!this.documentPermissionService) throw new GraphQLError("DocumentPermissionService not available");
 				try {
-					const isGlobalAdmin = ctx.isAdmin?.(ctx.user?.address ?? "") ?? false;
-					return await revokeGroupOperationPermission(this.documentPermissionService, args, ctx.user?.address, isGlobalAdmin);
+					return await revokeGroupOperationPermission(this.documentPermissionService, this.authorizationService, args, ctx.user?.address);
 				} catch (error) {
 					this.logger.error("Error in revokeGroupOperationPermission: @error", error);
 					throw error;
@@ -624,24 +590,6 @@ var AuthService = class {
 		}
 	}
 	/**
-	* Get additional context fields for GraphQL
-	*/
-	getAdditionalContextFields() {
-		if (!this.config.enabled) return { isAdmin: () => true };
-		return { isAdmin: (address) => this.config.enabled && this.config.admins?.includes(address.toLowerCase()) };
-	}
-	/**
-	* Get user context for GraphQL
-	*/
-	getUserContext(user) {
-		if (!user) return {};
-		return { user: {
-			address: user.address.toLowerCase(),
-			chainId: user.chainId,
-			networkId: user.networkId
-		} };
-	}
-	/**
 	* Verify that the credential still exists on the Renown API
 	*/
 	async verifyCredentialExists(address, chainId, appId) {
@@ -2847,7 +2795,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						search: { type: documentType },
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2868,7 +2816,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						view,
 						paging
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -2911,9 +2859,7 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 				createDocument: async (_, args, ctx) => {
 					const { parentIdentifier, name, slug, preferredEditor, initialState } = args;
 					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					else this.assertCanCreate(ctx);
 					let createdDoc;
 					if (initialState || preferredEditor) createdDoc = await createDocumentWithInitialState(this.reactorClient, {
 						documentType,
@@ -2928,27 +2874,24 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 						parentIdentifier,
 						name
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && createdDoc?.id) await this.documentPermissionService?.initializeDocumentProtection(createdDoc.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					if (!initialState && !preferredEditor && name && createdDoc.name !== name) return toGqlPhDocument(await this.reactorClient.execute(createdDoc.id, "main", [setName(name)]));
 					return createdDoc;
 				},
 				createEmptyDocument: async (_, args, ctx) => {
 					const { parentIdentifier } = args;
 					if (parentIdentifier) await this.assertCanWrite(parentIdentifier, ctx);
-					else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, {
 						documentType,
 						parentIdentifier
 					}, this.graphqlManager.reactorDriveClient);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				},
 				...operations.reduce((mutations, op) => {
 					mutations[camelCase(op.name)] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
 						await this.assertCanExecuteOperation(docId, op.name, ctx);
 						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
@@ -2961,7 +2904,6 @@ var DocumentModelSubgraph = class extends BaseSubgraph {
 					};
 					mutations[`${camelCase(op.name)}Async`] = async (_, args, ctx) => {
 						const { docId, input } = args;
-						if (!this.authorizationService) await this.assertCanWrite(docId, ctx);
 						await this.assertCanExecuteOperation(docId, op.name, ctx);
 						if ((await this.reactorClient.get(docId)).header.documentType !== documentType) throw new GraphQLError(`Document with id ${docId} is not of type ${documentType}`);
 						const action = this.documentModel.actions[camelCase(op.name)];
@@ -3160,6 +3102,7 @@ var GraphQLManager = class {
 	* it for reactor-drive parents.
 	*/
 	reactorDriveClient;
+	authorizationService;
 	constructor(path, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, logger, httpAdapter, gatewayAdapter, authConfig, documentPermissionService, featureFlags = DefaultFeatureFlags, port = 4001, authorizationService, reactorDriveClient) {
 		this.path = path;
 		this.httpServer = httpServer;
@@ -3175,6 +3118,7 @@ var GraphQLManager = class {
 		this.documentPermissionService = documentPermissionService;
 		this.featureFlags = featureFlags;
 		this.port = port;
+		if (!authorizationService) throw new Error("GraphQLManager requires an authorizationService");
 		this.authorizationService = authorizationService;
 		this.reactorDriveClient = reactorDriveClient;
 		if (this.authConfig) this.authService = new AuthService(this.authConfig);
@@ -3297,6 +3241,14 @@ var GraphQLManager = class {
 	getBasePath() {
 		return this.path;
 	}
+	/**
+	* Get the authorization service shared with subgraphs. Use this when
+	* constructing a subgraph instance externally for
+	* {@link registerSubgraphInstance}.
+	*/
+	getAuthorizationService() {
+		return this.authorizationService;
+	}
 	async registerSubgraph(subgraph, supergraph = "", core = false) {
 		const subgraphInstance = new subgraph({
 			relationalDb: this.relationalDb,
@@ -3356,8 +3308,7 @@ var GraphQLManager = class {
 				db: this.relationalDb,
 				...this.getAdditionalContextFields(),
 				driveId,
-				user: authCtx?.user,
-				isAdmin: authCtx ? (addr) => !authCtx.auth_enabled ? true : authCtx.admins.includes(addr.toLowerCase()) : () => true
+				user: authCtx?.user
 			});
 		};
 	}
@@ -3501,8 +3452,8 @@ var GraphQLManager = class {
 };
 //#endregion
 //#region src/graphql/packages/resolvers.ts
-function requireAdmin(ctx) {
-	if (!(ctx.isAdmin?.(ctx.user?.address ?? "") ?? false)) throw new GraphQLError("Admin access required");
+function requireAdmin(authorizationService, ctx) {
+	if (!authorizationService.isSupremeAdmin(ctx.user?.address)) throw new GraphQLError("Admin access required");
 }
 function formatPackageInfo(info) {
 	return {
@@ -3520,16 +3471,16 @@ async function installedPackage(service, args) {
 	const pkg = await service.getInstalledPackage(args.name);
 	return pkg ? formatPackageInfo(pkg) : null;
 }
-async function installPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function installPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	const result = await service.installPackage(args.name, args.registryUrl ?? void 0);
 	return {
 		package: formatPackageInfo(result.package),
 		documentModelsLoaded: result.documentModelsLoaded
 	};
 }
-async function uninstallPackage(service, args, ctx) {
-	requireAdmin(ctx);
+async function uninstallPackage(service, authorizationService, args, ctx) {
+	requireAdmin(authorizationService, ctx);
 	return service.uninstallPackage(args.name);
 }
 //#endregion
@@ -3575,7 +3526,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			installPackage: async (_parent, args, ctx) => {
 				this.logger.debug("installPackage(@args)", args);
 				try {
-					return await installPackage(this.packageManagementService, args, ctx);
+					return await installPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in installPackage: @error", error);
 					throw error;
@@ -3584,7 +3535,7 @@ var PackagesSubgraph = class extends BaseSubgraph {
 			uninstallPackage: async (_parent, args, ctx) => {
 				this.logger.debug("uninstallPackage(@args)", args);
 				try {
-					return await uninstallPackage(this.packageManagementService, args, ctx);
+					return await uninstallPackage(this.packageManagementService, this.authorizationService, args, ctx);
 				} catch (error) {
 					this.logger.error("Error in uninstallPackage: @error", error);
 					throw error;
@@ -4082,7 +4033,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 				try {
 					await this.assertCanRead(args.targetIdentifier, ctx);
 					const result = await documentIncomingRelationships(this.reactorClient, args);
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4103,7 +4054,7 @@ var ReactorSubgraph = class extends BaseSubgraph {
 						...args,
 						search: args.search ?? {}
 					});
-					if (!this.hasGlobalAdminAccess(ctx) && this.documentPermissionService) {
+					if (!this.authorizationService.isSupremeAdmin(ctx.user?.address)) {
 						const filteredItems = [];
 						for (const item of result.items) if (await this.canReadDocument(item.id, ctx)) filteredItems.push(item);
 						return {
@@ -4159,12 +4110,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					} else this.assertCanCreate(ctx);
 					const result = await createDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createDocument(@args): @Error", args, error);
@@ -4177,12 +4126,10 @@ var ReactorSubgraph = class extends BaseSubgraph {
 					if (args.parentIdentifier) {
 						const parent = await document(this.reactorClient, { identifier: args.parentIdentifier });
 						await this.assertCanWrite(parent.document.id, ctx);
-					} else if (this.authorizationService) {
-						if (!ctx.user?.address) throw new GraphQLError("Forbidden: authentication required to create documents");
-					} else if (!this.hasGlobalAdminAccess(ctx)) throw new GraphQLError("Forbidden: insufficient permissions to create documents");
+					} else this.assertCanCreate(ctx);
 					const result = await createEmptyDocument(this.reactorClient, args, this.graphqlManager.reactorDriveClient);
 					if (result?.id && isDriveContainerType(result.documentType)) this.graphqlManager.driveOwnershipCache.add(result.id);
-					if (this.authorizationService && ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
+					if (ctx.user?.address && result?.id) await this.documentPermissionService?.initializeDocumentProtection(result.id, ctx.user.address, this.authorizationService.config.defaultProtection);
 					return result;
 				} catch (error) {
 					this.logger.error("Error in createEmptyDocument(@args): @Error", args, error);
@@ -4192,7 +4139,6 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocument: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocument(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
 					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
 					return await mutateDocument(this.reactorClient, args);
 				} catch (error) {
@@ -4203,7 +4149,6 @@ var ReactorSubgraph = class extends BaseSubgraph {
 			mutateDocumentAsync: async (_parent, args, ctx) => {
 				this.logger.debug("mutateDocumentAsync(@args)", args);
 				try {
-					if (!this.authorizationService) await this.assertCanWrite(args.documentIdentifier, ctx);
 					await this.assertCanExecuteOperations(args.documentIdentifier, args.actions, ctx);
 					return await mutateDocumentAsync(this.reactorClient, args);
 				} catch (error) {
@@ -4375,10 +4320,10 @@ const ADMIN_USERS = getAdminUsers();
 //#endregion
 //#region src/graphql/system/version.ts
 function getVersion() {
-	return "6.2.0-dev.4";
+	return "6.2.0-dev.5";
 }
 function getGitHash() {
-	return "79386a1a3182a6350dbd6c359927889a9f1f9c2d";
+	return "23ce3521986ce3f860a9c2fe19790906de027ff2";
 }
 function getGitUrl() {
 	return buildTreeUrl(getGitHash());
@@ -4999,107 +4944,6 @@ async function runMigrations(db) {
 	}
 }
 //#endregion
-//#region src/services/authorization.service.ts
-/**
-* Central authorization service — single source of truth for all permission checks.
-*
-* Authorization model:
-* 1. Supreme admin (ADMINS env) → ALLOW ALL
-* 2. Is document protected?
-*    a. NOT protected:
-*       - READ: anyone (even anonymous) → ALLOW
-*       - WRITE: authenticated user → ALLOW
-*    b. PROTECTED:
-*       - READ: requires explicit READ/WRITE/ADMIN grant (direct or via group/parent)
-*       - WRITE: requires explicit WRITE/ADMIN grant (direct or via group/parent)
-* 3. Operation restricted? → Check OperationUserPermission
-* 4. Document owner = implicit ADMIN
-* 5. Drive protected = all children effectively protected
-*/
-var AuthorizationService = class {
-	config;
-	constructor(documentPermissionService, config) {
-		this.documentPermissionService = documentPermissionService;
-		this.config = config;
-	}
-	/**
-	* Check if a user is a supreme admin (from ADMINS env var).
-	*/
-	isSupremeAdmin(userAddress) {
-		if (!userAddress) return false;
-		return this.config.admins.includes(userAddress.toLowerCase());
-	}
-	/**
-	* Check if a user can read a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can read (even anonymous)
-	* - Protected → requires READ/WRITE/ADMIN grant (direct, group, or parent inheritance)
-	* - Owner → yes (implicit ADMIN)
-	*/
-	async canRead(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canRead(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canReadDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can write to a document.
-	*
-	* - Supreme admin → yes
-	* - Not protected → anyone can write (even anonymous)
-	* - Protected → requires authentication + WRITE/ADMIN grant
-	* - Owner → yes (implicit ADMIN)
-	*/
-	async canWrite(documentId, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!(getParentIds ? await this.documentPermissionService.isProtectedWithAncestors(documentId, getParentIds) : await this.documentPermissionService.isDocumentProtected(documentId))) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		if (getParentIds) return this.documentPermissionService.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canWriteDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can manage a document (change permissions, protection, transfer ownership).
-	*
-	* - Supreme admin → yes
-	* - Owner → yes
-	* - Has ADMIN grant → yes
-	*/
-	async canManage(documentId, userAddress, _getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!userAddress) return false;
-		const owner = await this.documentPermissionService.getDocumentOwner(documentId);
-		if (owner && owner === userAddress.toLowerCase()) return true;
-		return this.documentPermissionService.canManageDocument(documentId, userAddress);
-	}
-	/**
-	* Check if a user can execute a specific operation.
-	* If the operation is not restricted, falls through to the standard write check.
-	* If the operation is restricted, requires an explicit OperationUserPermission grant.
-	*/
-	async canExecuteOperation(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (!await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.canWrite(documentId, userAddress, getParentIds);
-		return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-	}
-	/**
-	* Combined check for mutations: can the user write + execute the operation?
-	* This enables READ-only users with operation grants to execute specific operations.
-	* For restricted operations, only the operation grant is checked (bypasses write check),
-	* allowing READ-only users with an explicit operation grant to execute that operation.
-	*/
-	async canMutate(documentId, operationType, userAddress, getParentIds) {
-		if (this.isSupremeAdmin(userAddress)) return true;
-		if (await this.documentPermissionService.isOperationRestricted(documentId, operationType)) return this.documentPermissionService.canExecuteOperation(documentId, operationType, userAddress?.toLowerCase());
-		return this.canWrite(documentId, userAddress, getParentIds);
-	}
-};
-//#endregion
 //#region src/services/document-permission.service.ts
 /**
 * Service for managing document-level permissions.
@@ -5735,6 +5579,13 @@ const initAnalyticsStoreSql = [
 //#region src/server.ts
 const defaultLogger = childLogger(["reactor-api", "server"]);
 const DEFAULT_PORT = 4e3;
+/**
+* Doc-perms require auth: with auth off no `user` is ever resolved, so every
+* authorization check fails closed. Refuse to boot rather than run broken.
+*/
+function assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested) {
+	if (!authEnabled && documentPermissionsRequested) throw new Error("Document permissions require authentication: AUTH_ENABLED is false but document permissions were requested (DOCUMENT_PERMISSIONS_ENABLED=true or a documentPermissionService was provided). Enable authentication (AUTH_ENABLED=true, or auth.enabled in the config file) or disable document permissions.");
+}
 function createReadinessGate() {
 	let ready = false;
 	return {
@@ -5782,7 +5633,7 @@ function makeDbClosers(knexInstance, pglite) {
 /**
 * Sets up the subgraph manager and registers subgraphs
 */
-async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, auth, documentPermissionService, enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient) {
+async function setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, subgraphs, logger, authorizationService, auth, documentPermissionService, enableDocumentModelSubgraphs, port, reactorDriveClient) {
 	const graphqlManager = new GraphQLManager(config.basePath, httpServer, wsServer, client, relationalDb, analyticsStore, syncManager, logger, httpAdapter, await createGatewayAdapter("apollo", logger), {
 		enabled: auth?.enabled ?? false,
 		admins: auth?.admins ?? []
@@ -5875,10 +5726,10 @@ async function _setupCommonInfrastructure(options) {
 	if (ADMINS !== void 0) admins = ADMINS.split(",").map((a) => a.toLowerCase());
 	let defaultProtection = false;
 	if (DEFAULT_PROTECTION !== void 0) defaultProtection = DEFAULT_PROTECTION.toLowerCase() === "true";
-	const { USERS, GUESTS, FREE_ENTRY } = process.env;
-	if (USERS || GUESTS || FREE_ENTRY) console.warn("[DEPRECATION WARNING] The USERS, GUESTS, and FREE_ENTRY environment variables are no longer supported. Access control is now managed per-document via the DocumentProtection system. Use DEFAULT_PROTECTION=true for strict mode, or manage protection per document via the GraphQL API. See the auth documentation for migration guidance.");
 	let skipCredentialVerification = false;
 	if (SKIP_CREDENTIAL_VERIFICATION !== void 0) skipCredentialVerification = SKIP_CREDENTIAL_VERIFICATION === "true";
+	const documentPermissionsRequested = options.documentPermissionService !== void 0 || DOCUMENT_PERMISSIONS_ENABLED === "true";
+	assertAuthRequiredForDocumentPermissions(authEnabled, documentPermissionsRequested);
 	const logger = options.logger ?? defaultLogger;
 	httpAdapter.getRoute("/health", () => new Response("OK", { status: 200 }));
 	const readiness = createReadinessGate();
@@ -5914,14 +5765,13 @@ async function _setupCommonInfrastructure(options) {
 		documentPermissionService = new DocumentPermissionService(db, { defaultProtection });
 		logger.info("Document permission service initialized");
 	}
-	let authorizationService;
-	if (documentPermissionService) {
-		authorizationService = new AuthorizationService(documentPermissionService, {
-			admins,
-			defaultProtection
-		});
-		logger.info("Authorization service initialized");
-	}
+	const policy = documentPermissionService ? AuthorizationPolicy.DOCUMENT_PERMISSIONS : authEnabled ? AuthorizationPolicy.ADMIN_ONLY : AuthorizationPolicy.OPEN;
+	const authorizationService = createAuthorizationService({
+		admins,
+		defaultProtection,
+		policy
+	}, documentPermissionService);
+	logger.info(`Authorization service initialized (policy: ${policy})`);
 	const attachmentStoragePath = resolveAttachmentStoragePath(options);
 	await mkdir(attachmentStoragePath, { recursive: true });
 	const { db: attachmentDb, knex: attachmentKnex, pglite: attachmentPglite } = getDbClient(options.dbPath, options.pgliteFactory);
@@ -6012,7 +5862,7 @@ async function _setupAPI(reactorClient, syncManager, reactorProcessorManager, ht
 	const graphqlManager = await setupGraphQLManager(httpAdapter, authFetchMiddleware, httpServer, wsServer, reactorClient, relationalDb, analyticsStore, syncManager, {
 		extended: subgraphs,
 		core: coreSubgraphs
-	}, logger.child(["graphql-manager"]), auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, authorizationService, reactorDriveClient);
+	}, logger.child(["graphql-manager"]), authorizationService, auth, documentPermissionService, options.enableDocumentModelSubgraphs, port, reactorDriveClient);
 	setupEventListeners(packages, graphqlManager, reactorProcessorManager, hostModule, documentModelRegistry);
 	if (mcpServerEnabled) {
 		await setupMcpServer({
@@ -6193,7 +6043,7 @@ var PackageManagementService = class {
 	}
 };
 //#endregion
-export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
+export { ADMIN_USERS, ActionContextInputSchema, ActionInputSchema, AddRelationshipDocument, AnalyticsSubgraph, AuthService, AuthSubgraph, BaseSubgraph, ChannelMetaInputSchema, CreateDocumentDocument, CreateEmptyDocumentDocument, DeleteDocumentDocument, DeleteDocumentsDocument, DocumentChangeType, DocumentChangeTypeSchema, DocumentChangesDocument, DocumentOperationsFilterInputSchema, DocumentPermissionService, FindDocumentsDocument, GetDocumentDocument, GetDocumentIncomingRelationshipsDocument, GetDocumentModelsDocument, GetDocumentOperationsDocument, GetDocumentOutgoingRelationshipsDocument, GetDocumentWithOperationsDocument, GetJobStatusDocument, GraphQLManager, HttpDocumentModelLoader, HttpPackageLoader, ImportPackageLoader, InMemoryPackageStorage, JobChangesDocument, MoveRelationshipDocument, MutateDocumentAsyncDocument, MutateDocumentDocument, OperationContextInputSchema, OperationInputSchema, OperationWithContextInputSchema, OperationsFilterInputSchema, PackageManagementService, PackageManager, PackagesSubgraph, PagingInputSchema, PhDocumentFieldsFragmentDoc, PollSyncEnvelopesDocument, PropagationMode, PropagationModeSchema, PushSyncEnvelopesDocument, ReactorSignerAppInputSchema, ReactorSignerInputSchema, ReactorSignerUserInputSchema, ReactorSubgraph, RemoteCursorInputSchema, RemoteFilterInputSchema, RemoveRelationshipDocument, RenameDocumentDocument, SearchFilterInputSchema, SetPreferredEditorDocument, SyncEnvelopeInputSchema, SyncEnvelopeType, SyncEnvelopeTypeSchema, SystemSubgraph, TouchChannelDocument, TouchChannelInputSchema, ViewFilterInputSchema, assertAuthRequiredForDocumentPermissions, buildGraphQlDocument, buildGraphQlDriveDocument, buildGraphqlOperation, buildGraphqlOperations, buildSubgraphSchemaModule, createAuthFetchMiddleware, createGatewayAdapter, createHttpAdapter, createMergedSchema, createReactorGraphQLClient, createSchema, definedNonNullAnySchema, driveIdFromUrl, extractSubgraphsFromModule, generateDocumentModelSchema, getAuthContext, getDbClient, getDocumentModelSchemaName, getDocumentModelTypeDefs, getGitHash, getGitUrl, getSdk, getUniqueDocumentModels, getVersion, initAnalyticsStoreSql, initializeAndStartAPI, isDefinedNonNullAny, isExpectedLoaderMiss, isSubgraphClass, parseDriveUrl, renderGraphqlPlayground };
 
 //# sourceMappingURL=index.mjs.map
-//# debugId=5769db0f-d60a-5870-9d50-dc4f5aca8086
+//# debugId=64b14acf-bb9d-528e-b2b6-b3fa2097026f