@rangka/core 0.0.1

package/dist/auth/core-models.d.ts

@@ -0,0 +1,110 @@
+export declare const userSchema: {
+    name: string;
+    label: string;
+    fields: {
+        email: import("@rangka/shared").StringFieldConfig;
+        password_hash: import("@rangka/shared").StringFieldConfig;
+        full_name: import("@rangka/shared").StringFieldConfig;
+        enabled: import("@rangka/shared").BooleanFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+};
+export declare const roleSchema: {
+    name: string;
+    label: string;
+    fields: {
+        name: import("@rangka/shared").StringFieldConfig;
+        inherits: import("@rangka/shared").JsonFieldConfig;
+        permissions: import("@rangka/shared").JsonFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+};
+export declare const userRoleSchema: {
+    name: string;
+    label: string;
+    fields: {
+        user_id: import("@rangka/shared").LinkFieldConfig;
+        role_id: import("@rangka/shared").LinkFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+};
+export declare const sessionSchema: {
+    name: string;
+    label: string;
+    fields: {
+        token: import("@rangka/shared").StringFieldConfig;
+        user_id: import("@rangka/shared").LinkFieldConfig;
+        expires_at: import("@rangka/shared").DatetimeFieldConfig;
+        created_at: import("@rangka/shared").DatetimeFieldConfig;
+    };
+    indexes: ({
+        fields: string[];
+        unique: true;
+    } | {
+        fields: string[];
+        unique?: undefined;
+    })[];
+};
+export declare const coreSchemas: ({
+    name: string;
+    label: string;
+    fields: {
+        email: import("@rangka/shared").StringFieldConfig;
+        password_hash: import("@rangka/shared").StringFieldConfig;
+        full_name: import("@rangka/shared").StringFieldConfig;
+        enabled: import("@rangka/shared").BooleanFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+} | {
+    name: string;
+    label: string;
+    fields: {
+        name: import("@rangka/shared").StringFieldConfig;
+        inherits: import("@rangka/shared").JsonFieldConfig;
+        permissions: import("@rangka/shared").JsonFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+} | {
+    name: string;
+    label: string;
+    fields: {
+        user_id: import("@rangka/shared").LinkFieldConfig;
+        role_id: import("@rangka/shared").LinkFieldConfig;
+    };
+    indexes: {
+        fields: string[];
+        unique: true;
+    }[];
+} | {
+    name: string;
+    label: string;
+    fields: {
+        token: import("@rangka/shared").StringFieldConfig;
+        user_id: import("@rangka/shared").LinkFieldConfig;
+        expires_at: import("@rangka/shared").DatetimeFieldConfig;
+        created_at: import("@rangka/shared").DatetimeFieldConfig;
+    };
+    indexes: ({
+        fields: string[];
+        unique: true;
+    } | {
+        fields: string[];
+        unique?: undefined;
+    })[];
+})[];
+//# sourceMappingURL=core-models.d.ts.map

package/dist/auth/core-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-models.d.ts","sourceRoot":"","sources":["../../src/auth/core-models.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU;;;;;;;;;;;;;CAUrB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;CASrB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;CAQzB,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;CAcxB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA0D,CAAC"}

package/dist/auth/core-models.js

@@ -0,0 +1,48 @@
+import { defineModel, field } from '@rangka/shared';
+export const userSchema = defineModel({
+    name: 'user',
+    label: 'User',
+    fields: {
+        email: field.string({ required: true }),
+        password_hash: field.string({ required: true }),
+        full_name: field.string({ required: true }),
+        enabled: field.boolean({ default: true }),
+    },
+    indexes: [{ fields: ['email'], unique: true }],
+});
+export const roleSchema = defineModel({
+    name: 'role',
+    label: 'Role',
+    fields: {
+        name: field.string({ required: true }),
+        inherits: field.json({}),
+        permissions: field.json({}),
+    },
+    indexes: [{ fields: ['name'], unique: true }],
+});
+export const userRoleSchema = defineModel({
+    name: 'user_role',
+    label: 'User Role',
+    fields: {
+        user_id: field.link('core.user', { required: true }),
+        role_id: field.link('core.role', { required: true }),
+    },
+    indexes: [{ fields: ['user_id', 'role_id'], unique: true }],
+});
+export const sessionSchema = defineModel({
+    name: 'session',
+    label: 'Session',
+    fields: {
+        token: field.string({ required: true }),
+        user_id: field.link('core.user', { required: true }),
+        expires_at: field.datetime({ required: true }),
+        created_at: field.datetime({ required: true }),
+    },
+    indexes: [
+        { fields: ['token'], unique: true },
+        { fields: ['user_id'] },
+        { fields: ['expires_at'] },
+    ],
+});
+export const coreSchemas = [userSchema, roleSchema, userRoleSchema, sessionSchema];
+//# sourceMappingURL=core-models.js.map

package/dist/auth/core-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-models.js","sourceRoot":"","sources":["../../src/auth/core-models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;IACpC,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,MAAM,EAAE;QACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC1C;IACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;IACpC,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;KAC5B;IACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;IACxC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE;QACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACrD;IACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAC5D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;IACvC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAC/C;IACD,OAAO,EAAE;QACP,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QACnC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;QACvB,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE;KAC3B;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC"}

package/dist/auth/core-module.d.ts

@@ -0,0 +1,5 @@
+import type { DiscoveredApp } from '../boot/types.js';
+import type { ResolvedModel } from '../schema/types.js';
+export declare function getCoreModels(): ResolvedModel[];
+export declare function getCoreApp(): DiscoveredApp;
+//# sourceMappingURL=core-module.d.ts.map

package/dist/auth/core-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-module.d.ts","sourceRoot":"","sources":["../../src/auth/core-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,oBAAoB,CAAC;AAoCvE,wBAAgB,aAAa,IAAI,aAAa,EAAE,CAE/C;AAED,wBAAgB,UAAU,IAAI,aAAa,CAiB1C"}

package/dist/auth/core-module.js

@@ -0,0 +1,48 @@
+import { coreSchemas } from './core-models.js';
+function schemaToResolvedModel(schema) {
+    const fields = [
+        {
+            name: 'id',
+            config: { type: 'string', required: true },
+            provenance: { source: 'base' },
+        },
+        ...Object.entries(schema.fields).map(([name, config]) => ({
+            name,
+            config,
+            provenance: { source: 'base' },
+        })),
+    ];
+    return {
+        qualifiedName: `core.${schema.name}`,
+        app: 'core',
+        module: 'core',
+        name: schema.name,
+        label: schema.label,
+        auditLog: false,
+        traits: [],
+        fields,
+        indexes: schema.indexes,
+    };
+}
+export function getCoreModels() {
+    return coreSchemas.map(schemaToResolvedModel);
+}
+export function getCoreApp() {
+    return {
+        packageInfo: {
+            packageName: '@rangka/core',
+            path: '__builtin__',
+            rangka: { type: 'app', entrypoint: 'index.js' },
+        },
+        config: {
+            name: 'core',
+            label: 'Core',
+        },
+        schemas: coreSchemas.map((s) => ({
+            module: 'core',
+            schema: s,
+        })),
+        extensions: [],
+    };
+}
+//# sourceMappingURL=core-module.js.map

package/dist/auth/core-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-module.js","sourceRoot":"","sources":["../../src/auth/core-module.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,SAAS,qBAAqB,CAAC,MAK9B;IACC,MAAM,MAAM,GAAoB;QAC9B;YACE,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAiB;YACzD,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC/B;QACD,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,EAAE,MAAM,EAAE,MAAe,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,QAAQ,MAAM,CAAC,IAAI,EAAE;QACpC,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE;QACV,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,WAAW,EAAE;YACX,WAAW,EAAE,cAAc;YAC3B,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;SAChD;QACD,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;SACd;QACD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;QACH,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC"}

package/dist/auth/debug.d.ts

@@ -0,0 +1,20 @@
+import type { DatabaseClient } from '../db/client.js';
+import type { PermissionRegistry } from './permission-registry.js';
+import type { SchemaRegistry } from '../schema/registry.js';
+export interface DebugResult {
+    user: {
+        email: string;
+        id: string;
+        enabled: boolean;
+    };
+    roles: string[];
+    inheritanceChains: Record<string, string[]>;
+    effectivePermissions: Record<string, Record<string, boolean>>;
+    fieldRestrictions: Record<string, {
+        hidden: string[];
+        readOnly: string[];
+    }>;
+}
+export declare function debugPermissions(email: string, db: DatabaseClient, permissionRegistry: PermissionRegistry, _schemaRegistry: SchemaRegistry): Promise<DebugResult>;
+export declare function formatDebugResult(result: DebugResult): string;
+//# sourceMappingURL=debug.d.ts.map

package/dist/auth/debug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../../src/auth/debug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7E;AAMD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,cAAc,EAClB,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,CAAC,CAYtB;AAiFD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CA0C7D"}

package/dist/auth/debug.js

@@ -0,0 +1,118 @@
+const TRACKED_ACTIONS = ['read', 'write', 'create', 'delete'];
+// Looks up a user by email and resolves their full permission picture:
+// roles, inheritance chains, effective model permissions, and field restrictions.
+export async function debugPermissions(email, db, permissionRegistry, _schemaRegistry) {
+    const user = await findUserByEmail(db, email);
+    const roleNames = await getUserRoleNames(db, user.id);
+    const resolved = permissionRegistry.resolvePermissionsForRoles(roleNames);
+    return {
+        user: { email: user.email, id: user.id, enabled: user.enabled },
+        roles: roleNames,
+        inheritanceChains: buildInheritanceChains(roleNames, permissionRegistry),
+        effectivePermissions: buildEffectivePermissions(resolved),
+        fieldRestrictions: buildFieldRestrictions(resolved),
+    };
+}
+async function findUserByEmail(db, email) {
+    const user = (await db
+        .selectFrom('core.user')
+        .selectAll()
+        .where('email', '=', email)
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        .executeTakeFirst());
+    if (!user)
+        throw new Error(`User not found: ${email}`);
+    return user;
+}
+async function getUserRoleNames(db, userId) {
+    const userRoles = await db
+        .selectFrom('core.user_role')
+        .selectAll()
+        .where('user_id', '=', userId)
+        .execute();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const roleIds = userRoles.map((ur) => ur.role_id);
+    if (roleIds.length === 0)
+        return [];
+    const roles = await db.selectFrom('core.role').selectAll().where('id', 'in', roleIds).execute();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return roles.map((r) => r.name);
+}
+function buildInheritanceChains(roleNames, permissionRegistry) {
+    const chains = {};
+    for (const name of roleNames) {
+        chains[name] = permissionRegistry.getInheritanceChain(name);
+    }
+    return chains;
+}
+function buildEffectivePermissions(resolved) {
+    const permissions = {};
+    for (const [model, modelPerms] of Object.entries(resolved.models)) {
+        const granted = {};
+        for (const action of TRACKED_ACTIONS) {
+            if (modelPerms[action])
+                granted[action] = true;
+        }
+        permissions[model] = granted;
+    }
+    return permissions;
+}
+function buildFieldRestrictions(resolved) {
+    const restrictions = {};
+    for (const [model, modelPerms] of Object.entries(resolved.models)) {
+        if (!modelPerms.fieldPermissions)
+            continue;
+        const hidden = [];
+        const readOnly = [];
+        for (const [field, fieldPerm] of Object.entries(modelPerms.fieldPermissions)) {
+            if (fieldPerm.read === false)
+                hidden.push(field);
+            else if (fieldPerm.write === false)
+                readOnly.push(field);
+        }
+        if (hidden.length > 0 || readOnly.length > 0) {
+            restrictions[model] = { hidden, readOnly };
+        }
+    }
+    return restrictions;
+}
+export function formatDebugResult(result) {
+    const lines = [];
+    lines.push(`User: ${result.user.email} (${result.user.id})`);
+    lines.push(`Enabled: ${result.user.enabled}`);
+    lines.push(`Roles: ${result.roles.join(', ') || '(none)'}`);
+    lines.push('');
+    if (Object.keys(result.inheritanceChains).length > 0) {
+        lines.push('Role Inheritance:');
+        for (const [role, chain] of Object.entries(result.inheritanceChains)) {
+            if (chain.length > 0) {
+                lines.push(`  ${role} ← ${chain.join(' ← ')}`);
+            }
+            else {
+                lines.push(`  ${role} (no inheritance)`);
+            }
+        }
+        lines.push('');
+    }
+    lines.push('Effective Permissions:');
+    for (const [model, perms] of Object.entries(result.effectivePermissions)) {
+        const actions = Object.entries(perms)
+            .filter(([, v]) => v)
+            .map(([k]) => k);
+        lines.push(`  ${model}: ${actions.join(', ') || '(none)'}`);
+    }
+    lines.push('');
+    if (Object.keys(result.fieldRestrictions).length > 0) {
+        lines.push('Field Restrictions:');
+        for (const [model, restrictions] of Object.entries(result.fieldRestrictions)) {
+            if (restrictions.hidden.length > 0) {
+                lines.push(`  ${model} [hidden]: ${restrictions.hidden.join(', ')}`);
+            }
+            if (restrictions.readOnly.length > 0) {
+                lines.push(`  ${model} [read-only]: ${restrictions.readOnly.join(', ')}`);
+            }
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=debug.js.map

package/dist/auth/debug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.js","sourceRoot":"","sources":["../../src/auth/debug.ts"],"names":[],"mappings":"AAYA,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAEvE,uEAAuE;AACvE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,EAAkB,EAClB,kBAAsC,EACtC,eAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAE1E,OAAO;QACL,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;QAC/D,KAAK,EAAE,SAAS;QAChB,iBAAiB,EAAE,sBAAsB,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACxE,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,CAAC;QACzD,iBAAiB,EAAE,sBAAsB,CAAC,QAAQ,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAkB,EAAE,KAAa;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE;SACnB,UAAU,CAAC,WAAW,CAAC;SACvB,SAAS,EAAE;SACX,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;QAC3B,8DAA8D;SAC7D,gBAAgB,EAAE,CAAQ,CAAC;IAE9B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAkB,EAAE,MAAc;IAChE,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,SAAS,EAAE;SACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;SAC7B,OAAO,EAAE,CAAC;IAEb,8DAA8D;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IAChG,8DAA8D;IAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAmB,EACnB,kBAAsC;IAEtC,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAChC,QAAsE;IAEtE,MAAM,WAAW,GAA4C,EAAE,CAAC;IAEhE,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACjD,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAsE;IAEtE,MAAM,YAAY,GAA6D,EAAE,CAAC;IAElF,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,gBAAgB;YAAE,SAAS;QAE3C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7E,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;iBAC5C,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7E,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,cAAc,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,iBAAiB,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/auth/field-permissions.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { ResolvedModel } from '../schema/types.js';
+import type { ModelPermissions } from '@rangka/shared';
+export interface ResolvedFieldPermissions {
+    hidden: Set<string>;
+    readOnly: Set<string>;
+}
+export declare function resolveFieldPermissions(model: ResolvedModel, modelPermissionsMap: Record<string, ModelPermissions>): ResolvedFieldPermissions;
+export declare function createFieldWriteGuard(model: ResolvedModel): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+export declare function createFieldStripHook(model: ResolvedModel): (request: FastifyRequest, _reply: FastifyReply, payload: unknown) => Promise<unknown>;
+//# sourceMappingURL=field-permissions.d.ts.map

package/dist/auth/field-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-permissions.d.ts","sourceRoot":"","sources":["../../src/auth/field-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvB;AAID,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,EACpB,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACpD,wBAAwB,CAkB1B;AAGD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,IAEtD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAsBjB;AAGD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,IAErD,SAAS,cAAc,EACvB,QAAQ,YAAY,EACpB,SAAS,OAAO,KACf,OAAO,CAAC,OAAO,CAAC,CA2BpB"}

package/dist/auth/field-permissions.js

@@ -0,0 +1,82 @@
+import { getAuthContext } from './session.js';
+import { ForbiddenError } from '../errors.js';
+// Determines which fields should be hidden or read-only for a given model
+// based on the user's resolved permissions.
+export function resolveFieldPermissions(model, modelPermissionsMap) {
+    const hidden = new Set();
+    const readOnly = new Set();
+    const permissions = modelPermissionsMap[model.qualifiedName];
+    if (!permissions?.fieldPermissions) {
+        return { hidden, readOnly };
+    }
+    for (const [field, fieldPerm] of Object.entries(permissions.fieldPermissions)) {
+        if (fieldPerm.read === false) {
+            hidden.add(field);
+        }
+        else if (fieldPerm.write === false) {
+            readOnly.add(field);
+        }
+    }
+    return { hidden, readOnly };
+}
+// Hook that rejects writes to read-only fields with a 403 response.
+export function createFieldWriteGuard(model) {
+    return async function fieldWriteGuard(request, _reply) {
+        if (!isWriteMethod(request.method))
+            return;
+        const ctx = getAuthContext(request);
+        if (!ctx.permissions)
+            return;
+        const { readOnly } = resolveFieldPermissions(model, ctx.permissions.models);
+        if (readOnly.size === 0)
+            return;
+        const body = request.body;
+        if (!body)
+            return;
+        const violatedFields = Object.keys(body).filter((field) => readOnly.has(field));
+        if (violatedFields.length > 0) {
+            throw new ForbiddenError('FORBIDDEN', `Cannot write to read-only fields: ${violatedFields.join(', ')}`, { fields: violatedFields });
+        }
+    };
+}
+// Hook that strips hidden fields from response payloads before sending.
+export function createFieldStripHook(model) {
+    return async function fieldStripHook(request, _reply, payload) {
+        if (typeof payload !== 'string')
+            return payload;
+        const ctx = getAuthContext(request);
+        if (!ctx.permissions)
+            return payload;
+        const { hidden } = resolveFieldPermissions(model, ctx.permissions.models);
+        if (hidden.size === 0)
+            return payload;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let parsed;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch {
+            return payload;
+        }
+        if (Array.isArray(parsed?.data)) {
+            parsed.data = parsed.data.map((record) => stripFields(record, hidden));
+        }
+        else if (typeof parsed?.data === 'object' && parsed.data !== null) {
+            parsed.data = stripFields(parsed.data, hidden);
+        }
+        return JSON.stringify(parsed);
+    };
+}
+function isWriteMethod(method) {
+    return method === 'POST' || method === 'PUT' || method === 'PATCH';
+}
+function stripFields(record, hidden) {
+    const result = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (!hidden.has(key)) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=field-permissions.js.map

package/dist/auth/field-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-permissions.js","sourceRoot":"","sources":["../../src/auth/field-permissions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAO9C,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,UAAU,uBAAuB,CACrC,KAAoB,EACpB,mBAAqD;IAErD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,KAAK,UAAU,eAAe,CACnC,OAAuB,EACvB,MAAoB;QAEpB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO;QAE3C,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,qCAAqC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChE,EAAE,MAAM,EAAE,cAAc,EAAE,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,MAAoB,EACpB,OAAgB;QAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QAEhD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC;QAErC,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAEtC,8DAA8D;QAC9D,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAA+B,EAAE,EAAE,CAChE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAC5B,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,MAAmB;IAEnB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,15 @@
+export { hashPassword, verifyPassword } from './password.js';
+export { PermissionRegistry, DuplicateRoleError, RoleInheritanceCycleError, } from './permission-registry.js';
+export { createAuthHook, getAuthContext, createSessionHandler, deleteSessionHandler, regenerateSessionToken, generateToken, } from './session.js';
+export { createModelPermissionGuard, isOwnerOnly, modelHasCreatedBy } from './model-permissions.js';
+export { createScopeHook, createScopeWriteGuard, applyScopeFiltersToQuery } from './scopes.js';
+export type { ScopeHookContext, FilterProvider } from './scopes.js';
+export { ScopeRegistry, ScopeResolutionError } from './scope-registry.js';
+export type { ResolvedScope, ModelScopeBinding } from './scope-registry.js';
+export { createFieldWriteGuard, createFieldStripHook, resolveFieldPermissions, } from './field-permissions.js';
+export { debugPermissions, formatDebugResult } from './debug.js';
+export { getCoreModels, getCoreApp } from './core-module.js';
+export { coreSchemas } from './core-models.js';
+export { seedCoreData } from './seed.js';
+export type { AuthUser, AuthSession, RequestContext, ScopeFilter, ResolvedPermissions, RegisteredRole, PermissionCacheEntry, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC/F,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,YAAY,EACV,QAAQ,EACR,WAAW,EACX,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,12 @@
+export { hashPassword, verifyPassword } from './password.js';
+export { PermissionRegistry, DuplicateRoleError, RoleInheritanceCycleError, } from './permission-registry.js';
+export { createAuthHook, getAuthContext, createSessionHandler, deleteSessionHandler, regenerateSessionToken, generateToken, } from './session.js';
+export { createModelPermissionGuard, isOwnerOnly, modelHasCreatedBy } from './model-permissions.js';
+export { createScopeHook, createScopeWriteGuard, applyScopeFiltersToQuery } from './scopes.js';
+export { ScopeRegistry, ScopeResolutionError } from './scope-registry.js';
+export { createFieldWriteGuard, createFieldStripHook, resolveFieldPermissions, } from './field-permissions.js';
+export { debugPermissions, formatDebugResult } from './debug.js';
+export { getCoreModels, getCoreApp } from './core-module.js';
+export { coreSchemas } from './core-models.js';
+export { seedCoreData } from './seed.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/auth/model-permissions.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { ResolvedModel } from '../schema/types.js';
+import type { PermissionRegistry } from './permission-registry.js';
+import type { ResolvedPermissions } from './types.js';
+export declare function isOwnerOnly(permissions: ResolvedPermissions | undefined, model: string, action: 'read' | 'write' | 'delete'): boolean;
+export declare function modelHasCreatedBy(model: ResolvedModel): boolean;
+export declare function createModelPermissionGuard(model: ResolvedModel, _permissionRegistry: PermissionRegistry): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=model-permissions.d.ts.map

package/dist/auth/model-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-permissions.d.ts","sourceRoot":"","sources":["../../src/auth/model-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAMtD,wBAAgB,WAAW,CACzB,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAClC,OAAO,CAIT;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAE/D;AAcD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,aAAa,EACpB,mBAAmB,EAAE,kBAAkB,IAGrC,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CAgBjB"}

package/dist/auth/model-permissions.js

@@ -0,0 +1,35 @@
+import { getAuthContext } from './session.js';
+import { ForbiddenError } from '../errors.js';
+export function isOwnerOnly(permissions, model, action) {
+    if (!permissions)
+        return false;
+    const modelPerms = permissions.models[model];
+    return modelPerms?.[action] === 'own';
+}
+export function modelHasCreatedBy(model) {
+    return model.fields.some((f) => f.name === 'created_by');
+}
+const METHOD_TO_ACTION = {
+    GET: 'read',
+    POST: 'create',
+    PUT: 'write',
+    PATCH: 'write',
+    DELETE: 'delete',
+};
+function resolveAction(method) {
+    return METHOD_TO_ACTION[method] ?? 'read';
+}
+export function createModelPermissionGuard(model, _permissionRegistry) {
+    return async function modelPermissionGuard(request, _reply) {
+        const ctx = getAuthContext(request);
+        if (!ctx.permissions) {
+            throw new ForbiddenError('FORBIDDEN', 'No permissions resolved');
+        }
+        const action = resolveAction(request.method);
+        const modelPerms = ctx.permissions.models[model.qualifiedName];
+        if (!modelPerms || !modelPerms[action]) {
+            throw new ForbiddenError('FORBIDDEN', `Insufficient permission: ${action} on ${model.qualifiedName}`);
+        }
+    };
+}
+//# sourceMappingURL=model-permissions.js.map

package/dist/auth/model-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-permissions.js","sourceRoot":"","sources":["../../src/auth/model-permissions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C,MAAM,UAAU,WAAW,CACzB,WAA4C,EAC5C,KAAa,EACb,MAAmC;IAEnC,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,gBAAgB,GAA+B;IACnD,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,OAAO;IACZ,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAoB,EACpB,mBAAuC;IAEvC,OAAO,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,MAAoB;QAEpB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE/D,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,4BAA4B,MAAM,OAAO,KAAK,CAAC,aAAa,EAAE,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/password.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): string;
+export declare function verifyPassword(password: string, stored: string): boolean;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAMA,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASxE"}

package/dist/auth/password.js

@@ -0,0 +1,19 @@
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 64;
+const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
+export function hashPassword(password) {
+    const salt = randomBytes(SALT_LENGTH);
+    const hash = scryptSync(password, salt, KEY_LENGTH, SCRYPT_PARAMS);
+    return `${salt.toString('hex')}:${hash.toString('hex')}`;
+}
+export function verifyPassword(password, stored) {
+    const [saltHex, hashHex] = stored.split(':');
+    if (!saltHex || !hashHex)
+        return false;
+    const salt = Buffer.from(saltHex, 'hex');
+    const storedHash = Buffer.from(hashHex, 'hex');
+    const computedHash = scryptSync(password, salt, KEY_LENGTH, SCRYPT_PARAMS);
+    return timingSafeEqual(storedHash, computedHash);
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAE/C,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACnE,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAE3E,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC"}