@rangka/core 0.0.1

package/dist/auth/permission-registry.d.ts

@@ -0,0 +1,27 @@
+import type { RolesConfig } from '@rangka/shared';
+import type { RegisteredRole, ResolvedPermissions } from './types.js';
+export declare class PermissionRegistry {
+    private readonly roles;
+    private resolvedInheritance;
+    private version;
+    registerRoles(config: RolesConfig, app: string): void;
+    getRole(name: string): RegisteredRole | undefined;
+    getAllRoles(): RegisteredRole[];
+    getVersion(): number;
+    getInheritanceChain(roleName: string): string[];
+    resolvePermissionsForRoles(roleNames: string[]): ResolvedPermissions;
+    private applyModelPermissions;
+    private collectPages;
+    private rebuildInheritanceChains;
+}
+export declare class DuplicateRoleError extends Error {
+    readonly role: string;
+    readonly existingApp: string;
+    readonly newApp: string;
+    constructor(role: string, existingApp: string, newApp: string);
+}
+export declare class RoleInheritanceCycleError extends Error {
+    readonly cycle: string[];
+    constructor(cycle: string[]);
+}
+//# sourceMappingURL=permission-registry.d.ts.map

package/dist/auth/permission-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-registry.d.ts","sourceRoot":"","sources":["../../src/auth/permission-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAgC,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAItE,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,OAAO,CAAa;IAE5B,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAYrD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,WAAW,IAAI,cAAc,EAAE;IAI/B,UAAU,IAAI,MAAM;IAIpB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAM/C,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,mBAAmB;IAmBpE,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,wBAAwB;CAqCjC;AAmCD,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBAFd,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM;CAOjC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;aACtB,KAAK,EAAE,MAAM,EAAE;gBAAf,KAAK,EAAE,MAAM,EAAE;CAI5C"}

package/dist/auth/permission-registry.js

@@ -0,0 +1,148 @@
+const MODEL_ACTIONS = ['read', 'write', 'create', 'delete'];
+export class PermissionRegistry {
+    roles = new Map();
+    resolvedInheritance = new Map();
+    version = 0;
+    registerRoles(config, app) {
+        for (const [name, roleConfig] of Object.entries(config)) {
+            if (this.roles.has(name)) {
+                const existing = this.roles.get(name);
+                throw new DuplicateRoleError(name, existing.app, app);
+            }
+            this.roles.set(name, { name, config: roleConfig, app });
+        }
+        this.rebuildInheritanceChains();
+        this.version++;
+    }
+    getRole(name) {
+        return this.roles.get(name);
+    }
+    getAllRoles() {
+        return Array.from(this.roles.values());
+    }
+    getVersion() {
+        return this.version;
+    }
+    getInheritanceChain(roleName) {
+        return this.resolvedInheritance.get(roleName) ?? [];
+    }
+    // Collects permissions from the given roles (and their ancestors) into a single resolved set.
+    // Later roles in the array can only grant — they never revoke what an earlier role granted.
+    resolvePermissionsForRoles(roleNames) {
+        const models = {};
+        const pages = new Set();
+        for (const roleName of roleNames) {
+            const rolesToApply = [...this.getInheritanceChain(roleName), roleName];
+            for (const name of rolesToApply) {
+                const role = this.roles.get(name);
+                if (!role)
+                    continue;
+                this.applyModelPermissions(role.config, models);
+                this.collectPages(role.config, pages);
+            }
+        }
+        return { models, pages: Array.from(pages), version: this.version };
+    }
+    applyModelPermissions(roleConfig, target) {
+        if (!roleConfig.models)
+            return;
+        for (const [model, sourcePerms] of Object.entries(roleConfig.models)) {
+            if (!target[model])
+                target[model] = {};
+            mergeModelPermissions(target[model], sourcePerms);
+        }
+    }
+    collectPages(roleConfig, pages) {
+        if (!roleConfig.pages)
+            return;
+        for (const page of roleConfig.pages) {
+            pages.add(page);
+        }
+    }
+    // Walks each role's `extends` chain and caches the full ancestor list.
+    // Detects cycles and missing parents.
+    rebuildInheritanceChains() {
+        const resolved = new Map();
+        const inProgress = new Set();
+        const resolve = (name) => {
+            if (resolved.has(name))
+                return resolved.get(name);
+            if (inProgress.has(name)) {
+                throw new RoleInheritanceCycleError([...inProgress, name]);
+            }
+            inProgress.add(name);
+            const role = this.roles.get(name);
+            if (!role?.config.extends) {
+                inProgress.delete(name);
+                resolved.set(name, []);
+                return [];
+            }
+            const parentName = role.config.extends;
+            if (!this.roles.has(parentName)) {
+                throw new Error(`Role "${name}" extends unknown role "${parentName}"`);
+            }
+            const ancestors = [...resolve(parentName), parentName];
+            inProgress.delete(name);
+            resolved.set(name, ancestors);
+            return ancestors;
+        };
+        for (const name of this.roles.keys()) {
+            resolve(name);
+        }
+        this.resolvedInheritance = resolved;
+    }
+}
+// Merges source permissions into target. true > 'own' > unset/false.
+function mergeModelPermissions(target, source) {
+    for (const action of MODEL_ACTIONS) {
+        const src = source[action];
+        if (!src)
+            continue;
+        // true is the most permissive — never downgrade from true to 'own'
+        if (target[action] === true)
+            continue;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        target[action] = src;
+    }
+    if (!source.fieldPermissions)
+        return;
+    if (!target.fieldPermissions)
+        target.fieldPermissions = {};
+    for (const [field, sourceField] of Object.entries(source.fieldPermissions)) {
+        const targetField = target.fieldPermissions[field];
+        if (!targetField) {
+            target.fieldPermissions[field] = { ...sourceField };
+            continue;
+        }
+        // Grants always win; denials only apply if not already granted
+        if (sourceField.read === true)
+            targetField.read = true;
+        else if (sourceField.read === false && targetField.read === undefined)
+            targetField.read = false;
+        if (sourceField.write === true)
+            targetField.write = true;
+        else if (sourceField.write === false && targetField.write === undefined)
+            targetField.write = false;
+    }
+}
+export class DuplicateRoleError extends Error {
+    role;
+    existingApp;
+    newApp;
+    constructor(role, existingApp, newApp) {
+        super(`Duplicate role "${role}": already registered by "${existingApp}", cannot register from "${newApp}"`);
+        this.role = role;
+        this.existingApp = existingApp;
+        this.newApp = newApp;
+        this.name = 'DuplicateRoleError';
+    }
+}
+export class RoleInheritanceCycleError extends Error {
+    cycle;
+    constructor(cycle) {
+        super(`Role inheritance cycle detected: ${cycle.join(' → ')}`);
+        this.cycle = cycle;
+        this.name = 'RoleInheritanceCycleError';
+    }
+}
+//# sourceMappingURL=permission-registry.js.map

package/dist/auth/permission-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-registry.js","sourceRoot":"","sources":["../../src/auth/permission-registry.ts"],"names":[],"mappings":"AAGA,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAErE,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IACxD,mBAAmB,GAA0B,IAAI,GAAG,EAAE,CAAC;IACvD,OAAO,GAAW,CAAC,CAAC;IAE5B,aAAa,CAAC,MAAmB,EAAE,GAAW;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;gBACvC,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,mBAAmB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,0BAA0B,CAAC,SAAmB;QAC5C,MAAM,MAAM,GAAqC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YAEvE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;IAEO,qBAAqB,CAC3B,UAAsB,EACtB,MAAwC;QAExC,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,OAAO;QAE/B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACvC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,UAAsB,EAAE,KAAkB;QAC7D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,sCAAsC;IAC9B,wBAAwB;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAY,EAAE;YACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;YAEnD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,yBAAyB,CAAC,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAErB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,2BAA2B,UAAU,GAAG,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;YACvD,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC;IACtC,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,qBAAqB,CAAC,MAAwB,EAAE,MAAwB;IAC/E,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,mEAAmE;QACnE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;YAAE,SAAS;QACtC,8DAA8D;QAC9D,MAAM,CAAC,MAAM,CAAC,GAAG,GAAU,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO;IAErC,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,MAAM,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAE3D,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,+DAA+D;QAC/D,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI;YAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC;aAClD,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC;QAEhG,IAAI,WAAW,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC;aACpD,IAAI,WAAW,CAAC,KAAK,KAAK,KAAK,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS;YACrE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHlB,YACkB,IAAY,EACZ,WAAmB,EACnB,MAAc;QAE9B,KAAK,CACH,mBAAmB,IAAI,6BAA6B,WAAW,4BAA4B,MAAM,GAAG,CACrG,CAAC;QANc,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAQ;QACnB,WAAM,GAAN,MAAM,CAAQ;QAK9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACtB;IAA5B,YAA4B,KAAe;QACzC,KAAK,CAAC,oCAAoC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QADrC,UAAK,GAAL,KAAK,CAAU;QAEzC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF"}

package/dist/auth/scope-filters.d.ts

@@ -0,0 +1,3 @@
+import type { ScopeFilter } from './types.js';
+export declare function applyScopeFiltersToQuery(query: any, scopeFilters: ScopeFilter[]): any;
+//# sourceMappingURL=scope-filters.d.ts.map

package/dist/auth/scope-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-filters.d.ts","sourceRoot":"","sources":["../../src/auth/scope-filters.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,GAAG,CAOrF"}

package/dist/auth/scope-filters.js

@@ -0,0 +1,9 @@
+export function applyScopeFiltersToQuery(query, scopeFilters) {
+    let result = query;
+    for (const filter of scopeFilters) {
+        const operator = filter.operator === 'in' ? 'in' : '=';
+        result = result.where(filter.field, operator, filter.value);
+    }
+    return result;
+}
+//# sourceMappingURL=scope-filters.js.map

package/dist/auth/scope-filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-filters.js","sourceRoot":"","sources":["../../src/auth/scope-filters.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,wBAAwB,CAAC,KAAU,EAAE,YAA2B;IAC9E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACvD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/scope-registry.d.ts

@@ -0,0 +1,31 @@
+import type { ModuleConfig, ScopeDefinition } from '@rangka/shared';
+import type { SchemaRegistry } from '../schema/registry.js';
+export interface ResolvedScope {
+    name: string;
+    definition: ScopeDefinition;
+    module: string;
+}
+export interface ModelScopeBinding {
+    scopeName: string;
+    column: string;
+    scopeModel: string;
+}
+export declare class ScopeResolutionError extends Error {
+    constructor(message: string);
+}
+export declare class ScopeRegistry {
+    private readonly scopes;
+    private readonly modelBindings;
+    constructor(modules: ModuleConfig[], schemaRegistry: SchemaRegistry);
+    getScope(name: string): ResolvedScope | undefined;
+    getAllScopes(): ResolvedScope[];
+    getModelBinding(qualifiedName: string): ModelScopeBinding | undefined;
+    isModelScoped(qualifiedName: string): boolean;
+    private registerScopes;
+    private resolveModelBindings;
+    private resolveBinding;
+    private parseScopeName;
+    private parseExplicitField;
+    private findLinkColumn;
+}
+//# sourceMappingURL=scope-registry.d.ts.map

package/dist/auth/scope-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-registry.d.ts","sourceRoot":"","sources":["../../src/auth/scope-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAe,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,eAAe,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;gBAE/D,OAAO,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,cAAc;IAKnE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,YAAY,IAAI,aAAa,EAAE;IAI/B,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIrE,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IAI7C,OAAO,CAAC,cAAc;IActB,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,cAAc;CAwBvB"}

package/dist/auth/scope-registry.js

@@ -0,0 +1,78 @@
+export class ScopeResolutionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ScopeResolutionError';
+    }
+}
+export class ScopeRegistry {
+    scopes = new Map();
+    modelBindings = new Map();
+    constructor(modules, schemaRegistry) {
+        this.registerScopes(modules);
+        this.resolveModelBindings(schemaRegistry);
+    }
+    getScope(name) {
+        return this.scopes.get(name);
+    }
+    getAllScopes() {
+        return Array.from(this.scopes.values());
+    }
+    getModelBinding(qualifiedName) {
+        return this.modelBindings.get(qualifiedName);
+    }
+    isModelScoped(qualifiedName) {
+        return this.modelBindings.has(qualifiedName);
+    }
+    registerScopes(modules) {
+        for (const mod of modules) {
+            if (!mod.scopes)
+                continue;
+            for (const [name, definition] of Object.entries(mod.scopes)) {
+                if (this.scopes.has(name)) {
+                    throw new ScopeResolutionError(`Scope "${name}" declared by module "${mod.name}" conflicts with existing scope from module "${this.scopes.get(name).module}"`);
+                }
+                this.scopes.set(name, { name, definition, module: mod.name });
+            }
+        }
+    }
+    resolveModelBindings(schemaRegistry) {
+        for (const model of schemaRegistry.getAllModels()) {
+            if (!model.scope)
+                continue;
+            const binding = this.resolveBinding(model, schemaRegistry);
+            this.modelBindings.set(model.qualifiedName, binding);
+        }
+    }
+    resolveBinding(model, schemaRegistry) {
+        const scopeName = this.parseScopeName(model.scope);
+        const explicitField = this.parseExplicitField(model.scope);
+        const scope = this.scopes.get(scopeName);
+        if (!scope) {
+            throw new ScopeResolutionError(`Model "${model.qualifiedName}" references scope "${scopeName}" which is not defined by any module`);
+        }
+        const column = explicitField ?? this.findLinkColumn(model, scope, schemaRegistry);
+        return { scopeName, column, scopeModel: scope.definition.model };
+    }
+    parseScopeName(scopeConfig) {
+        if (typeof scopeConfig === 'string')
+            return scopeConfig;
+        return scopeConfig.name;
+    }
+    parseExplicitField(scopeConfig) {
+        if (typeof scopeConfig === 'string')
+            return undefined;
+        return scopeConfig.field;
+    }
+    findLinkColumn(model, scope, schemaRegistry) {
+        const relationships = schemaRegistry.getRelationshipsForModel(model.qualifiedName);
+        const matchingLinks = relationships.filter((r) => r.type === 'link' && r.to === scope.definition.model);
+        if (matchingLinks.length === 0) {
+            throw new ScopeResolutionError(`Model "${model.qualifiedName}" is scoped by "${scope.name}" but has no link field to "${scope.definition.model}"`);
+        }
+        if (matchingLinks.length > 1) {
+            throw new ScopeResolutionError(`Model "${model.qualifiedName}" has multiple link fields to "${scope.definition.model}" (${matchingLinks.map((l) => l.field).join(', ')}). Specify which field to use: scope: { name: '${scope.name}', field: '<field_name>' }`);
+        }
+        return matchingLinks[0].field;
+    }
+}
+//# sourceMappingURL=scope-registry.js.map

package/dist/auth/scope-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-registry.js","sourceRoot":"","sources":["../../src/auth/scope-registry.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IACP,MAAM,GAA+B,IAAI,GAAG,EAAE,CAAC;IAC/C,aAAa,GAAmC,IAAI,GAAG,EAAE,CAAC;IAE3E,YAAY,OAAuB,EAAE,cAA8B;QACjE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,aAAqB;QACjC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAEO,cAAc,CAAC,OAAuB;QAC5C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,SAAS;YAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,oBAAoB,CAC5B,UAAU,IAAI,yBAAyB,GAAG,CAAC,IAAI,gDAAgD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM,GAAG,CAChI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,cAA8B;QACzD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,KAAoB,EAAE,cAA8B;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,CAC5B,UAAU,KAAK,CAAC,aAAa,uBAAuB,SAAS,sCAAsC,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACnE,CAAC;IAEO,cAAc,CAAC,WAAwB;QAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC;QACxD,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;IAEO,kBAAkB,CAAC,WAAwB;QACjD,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,WAAW,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEO,cAAc,CACpB,KAAoB,EACpB,KAAoB,EACpB,cAA8B;QAE9B,MAAM,aAAa,GAAG,cAAc,CAAC,wBAAwB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAC5D,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,oBAAoB,CAC5B,UAAU,KAAK,CAAC,aAAa,mBAAmB,KAAK,CAAC,IAAI,+BAA+B,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CACnH,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAC5B,UAAU,KAAK,CAAC,aAAa,kCAAkC,KAAK,CAAC,UAAU,CAAC,KAAK,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,KAAK,CAAC,IAAI,4BAA4B,CAChO,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChC,CAAC;CACF"}

package/dist/auth/scopes.d.ts

@@ -0,0 +1,16 @@
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { ResolvedModel } from '../schema/types.js';
+import type { DatabaseClient } from '../db/client.js';
+import type { ScopeFilter, RequestContext } from './types.js';
+import type { ScopeRegistry } from './scope-registry.js';
+export { applyScopeFiltersToQuery } from './scope-filters.js';
+export interface ScopeHookContext {
+    model: ResolvedModel;
+    scopeRegistry: ScopeRegistry;
+    db: DatabaseClient;
+    filterProviders?: FilterProvider[];
+}
+export type FilterProvider = (model: ResolvedModel, authCtx: RequestContext, request: FastifyRequest) => ScopeFilter[] | Promise<ScopeFilter[]>;
+export declare function createScopeHook(ctx: ScopeHookContext): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+export declare function createScopeWriteGuard(ctx: ScopeHookContext): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/auth/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,aAAa,CAAC;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,EAAE,EAAE,cAAc,CAAC;IACnB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,KACpB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAE5C,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,IAInB,SAAS,cAAc,EAAE,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAoC9F;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,IAKvD,SAAS,cAAc,EACvB,QAAQ,YAAY,KACnB,OAAO,CAAC,IAAI,CAAC,CA6BjB"}

package/dist/auth/scopes.js

@@ -0,0 +1,93 @@
+import { getAuthContext } from './session.js';
+import { BadRequestError, ForbiddenError } from '../errors.js';
+import { isNil } from '../helpers/coerce.js';
+export { applyScopeFiltersToQuery } from './scope-filters.js';
+export function createScopeHook(ctx) {
+    const { model, scopeRegistry, db, filterProviders } = ctx;
+    const binding = scopeRegistry.getModelBinding(model.qualifiedName);
+    return async function scopeHook(request, _reply) {
+        const authCtx = getAuthContext(request);
+        if (!authCtx.permissions || !authCtx.user)
+            return;
+        const filters = [];
+        if (binding) {
+            const activeValue = resolveActiveScopeValue(request, binding.scopeName, authCtx.user);
+            if (!activeValue) {
+                throw new BadRequestError('MISSING_SCOPE', `Active scope value for "${binding.scopeName}" is required. Set it via X-Active-Scope header or user default.`);
+            }
+            const exists = await validateScopeValueExists(db, binding.scopeModel, activeValue);
+            if (!exists) {
+                throw new BadRequestError('INVALID_SCOPE', `Scope value "${activeValue}" does not exist in "${binding.scopeModel}".`);
+            }
+            filters.push({ field: binding.column, operator: 'eq', value: activeValue });
+        }
+        if (filterProviders) {
+            for (const provider of filterProviders) {
+                const extra = await provider(model, authCtx, request);
+                filters.push(...extra);
+            }
+        }
+        authCtx.scopeFilters = filters;
+        request.authContext = authCtx;
+    };
+}
+export function createScopeWriteGuard(ctx) {
+    const { model, scopeRegistry } = ctx;
+    const binding = scopeRegistry.getModelBinding(model.qualifiedName);
+    return async function scopeWriteGuard(request, _reply) {
+        if (request.method === 'GET')
+            return;
+        if (!binding)
+            return;
+        const authCtx = getAuthContext(request);
+        if (!authCtx.scopeFilters?.length)
+            return;
+        const body = request.body;
+        if (!body)
+            return;
+        const scopeFilter = authCtx.scopeFilters.find((f) => f.field === binding.column);
+        if (!scopeFilter)
+            return;
+        const fieldValue = body[binding.column];
+        if (request.method === 'POST') {
+            if (isNil(fieldValue)) {
+                body[binding.column] = scopeFilter.value;
+                return;
+            }
+        }
+        if (fieldValue !== undefined && fieldValue !== scopeFilter.value) {
+            throw new ForbiddenError('SCOPE_VIOLATION', `Cannot write to scope "${binding.scopeName}": ${binding.column} must be "${scopeFilter.value}".`);
+        }
+    };
+}
+function resolveActiveScopeValue(request, scopeName, user) {
+    const headerValue = parseScopeHeader(request);
+    if (headerValue?.[scopeName]) {
+        return String(headerValue[scopeName]);
+    }
+    const defaultField = `default_${scopeName}`;
+    if (user[defaultField]) {
+        return String(user[defaultField]);
+    }
+    return undefined;
+}
+function parseScopeHeader(request) {
+    const header = request.headers['x-active-scope'];
+    if (!header || typeof header !== 'string')
+        return undefined;
+    try {
+        return JSON.parse(header);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function validateScopeValueExists(db, scopeModel, value) {
+    const result = await db
+        .selectFrom(scopeModel)
+        .where('id', '=', value)
+        .selectAll()
+        .executeTakeFirst();
+    return result !== undefined;
+}
+//# sourceMappingURL=scopes.js.map

package/dist/auth/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAe9D,MAAM,UAAU,eAAe,CAAC,GAAqB;IACnD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEnE,OAAO,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,MAAoB;QAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO;QAElD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,2BAA2B,OAAO,CAAC,SAAS,kEAAkE,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACnF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,gBAAgB,WAAW,wBAAwB,OAAO,CAAC,UAAU,IAAI,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC;QAC9B,OAAe,CAAC,WAAW,GAAG,OAAO,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAqB;IACzD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEnE,OAAO,KAAK,UAAU,eAAe,CACnC,OAAuB,EACvB,MAAoB;QAEpB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;YAAE,OAAO;QAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;gBACzC,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;YACjE,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,0BAA0B,OAAO,CAAC,SAAS,MAAM,OAAO,CAAC,MAAM,aAAa,WAAW,CAAC,KAAK,IAAI,CAClG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAuB,EACvB,SAAiB,EACjB,IAA6B;IAE7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,SAAS,EAAE,CAAC;IAC5C,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE5D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,EAAkB,EAClB,UAAkB,EAClB,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,UAAU,CAAC,UAAU,CAAC;SACtB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;SACvB,SAAS,EAAE;SACX,gBAAgB,EAAE,CAAC;IACtB,OAAO,MAAM,KAAK,SAAS,CAAC;AAC9B,CAAC"}

package/dist/auth/seed.d.ts

@@ -0,0 +1,3 @@
+import type { DatabaseClient } from '../db/client.js';
+export declare function seedCoreData(db: DatabaseClient): Promise<void>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/auth/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/auth/seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,wBAAsB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCpE"}

package/dist/auth/seed.js

@@ -0,0 +1,40 @@
+import { hashPassword } from './password.js';
+export async function seedCoreData(db) {
+    const existing = await db
+        .selectFrom('core.user')
+        .select('id')
+        .where('email', '=', 'system@rangka.local')
+        .executeTakeFirst();
+    if (existing)
+        return;
+    const adminRole = await db
+        .insertInto('core.role')
+        .values({
+        id: crypto.randomUUID(),
+        name: 'Administrator',
+        inherits: JSON.stringify([]),
+        permissions: JSON.stringify({}),
+    })
+        .returningAll()
+        .executeTakeFirstOrThrow();
+    const systemUser = await db
+        .insertInto('core.user')
+        .values({
+        id: crypto.randomUUID(),
+        email: 'system@rangka.local',
+        password_hash: hashPassword('admin'),
+        full_name: 'System Administrator',
+        enabled: true,
+    })
+        .returningAll()
+        .executeTakeFirstOrThrow();
+    await db
+        .insertInto('core.user_role')
+        .values({
+        id: crypto.randomUUID(),
+        user_id: systemUser.id,
+        role_id: adminRole.id,
+    })
+        .execute();
+}
+//# sourceMappingURL=seed.js.map

package/dist/auth/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/auth/seed.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAkB;IACnD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,UAAU,CAAC,WAAW,CAAC;SACvB,MAAM,CAAC,IAAI,CAAC;SACZ,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,CAAC;SAC1C,gBAAgB,EAAE,CAAC;IAEtB,IAAI,QAAQ;QAAE,OAAO;IAErB,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,UAAU,CAAC,WAAW,CAAC;SACvB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KAChC,CAAC;SACD,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,MAAM,EAAE;SACxB,UAAU,CAAC,WAAW,CAAC;SACvB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,KAAK,EAAE,qBAAqB;QAC5B,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC;QACpC,SAAS,EAAE,sBAAsB;QACjC,OAAO,EAAE,IAAI;KACd,CAAC;SACD,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAC;IAE7B,MAAM,EAAE;SACL,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,OAAO,EAAE,UAAU,CAAC,EAAE;QACtB,OAAO,EAAE,SAAS,CAAC,EAAE;KACtB,CAAC;SACD,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { DatabaseClient } from '../db/client.js';
+import type { PermissionRegistry } from './permission-registry.js';
+import type { RequestContext } from './types.js';
+export declare function generateToken(): string;
+export declare function createAuthHook(db: DatabaseClient, permissionRegistry: PermissionRegistry): (request: FastifyRequest, _reply: FastifyReply) => Promise<void>;
+export declare function getAuthContext(request: FastifyRequest): RequestContext;
+export interface SessionCreateBody {
+    email: string;
+    password: string;
+}
+export declare function createSessionHandler(db: DatabaseClient): (request: FastifyRequest, reply: FastifyReply) => Promise<never>;
+export declare function deleteSessionHandler(db: DatabaseClient): (request: FastifyRequest, reply: FastifyReply) => Promise<never>;
+export declare function regenerateSessionToken(db: DatabaseClient, userId: string): Promise<string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,YAAY,CAAC;AAKxE,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,IACxD,SAAS,cAAc,EAAE,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CA8B7F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAGtE;AAID,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,cAAc,IACvC,SAAS,cAAc,EAAE,OAAO,YAAY,oBAuB3D;AAGD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,cAAc,IACvC,SAAS,cAAc,EAAE,OAAO,YAAY,oBAS3D;AAGD,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG"}