@restorecommerce/acs-client 0.4.19 → 0.5.3

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 0.5.3 (November 23rd, 2021)
+
+- fix filter value from condition for postgres DB
+
+## 0.5.2 (November 22nd, 2021)
+
+- fix for resource namespace for filter mapping
+
+## 0.5.1 (November 19th, 2021)
+
+- fix for resource namespace when creating request target resources
+
+## 0.5.0 (November 18th, 2021)
+
+- modified accessRequest to match the ABAC doc with subject, resource and action
+- added support for multiple entities for both isAllowed and whatIsAllowed
+
 ## [0.4.19](https://github.com/restorecommerce/libs/compare/@restorecommerce/acs-client@0.4.18...@restorecommerce/acs-client@0.4.19) (2021-11-08)
 
 **Note:** Version bump only for package @restorecommerce/acs-client

package/lib/acs/authz.d.ts

@@ -1,10 +1,10 @@
-import { AuthZContext, Attribute, AuthZAction, AuthZTarget, AuthZWhatIsAllowedTarget, IAuthZ, NoAuthTarget, NoAuthWhatIsAllowedTarget, Request, Resource, Subject, DecisionResponse, PolicySetRQResponse } from './interfaces';
+import { AuthZContext, Attribute, AuthZAction, AuthZTarget, AuthZWhatIsAllowedTarget, IAuthZ, NoAuthTarget, NoAuthWhatIsAllowedTarget, Request, Subject, DecisionResponse, PolicySetRQResponse, ACSClientContext, Resource } from './interfaces';
 export declare type Authorizer = ACSAuthZ;
 export declare let authZ: Authorizer;
 export declare const createActionTarget: (action: any) => Attribute[];
 export declare const createSubjectTarget: (subject: Subject) => Attribute[];
-export declare const createResourceTarget: (resources: Resource[], action: AuthZAction | AuthZAction[]) => Attribute[];
-export declare const createResourceTargetWhatIsAllowed: (resources: Resource[]) => Attribute[];
+export declare const formatResourceType: (type: string, namespacePrefix?: string) => string;
+export declare const createResourceTarget: (resource: Resource[], action: AuthZAction) => Attribute[];
 export declare class UnAuthZ implements IAuthZ {
     acs: any;
     /**
@@ -12,8 +12,9 @@ export declare class UnAuthZ implements IAuthZ {
      * @param acs Access Control Service definition (gRPC)
      */
     constructor(acs: any);
-    isAllowed(request: Request<NoAuthTarget, AuthZContext>, useCache: any): Promise<DecisionResponse>;
-    whatIsAllowed(request: Request<NoAuthWhatIsAllowedTarget, AuthZContext>, useCache: any): Promise<PolicySetRQResponse>;
+    private encode;
+    isAllowed(request: Request<NoAuthTarget, AuthZContext>, ctx: ACSClientContext, useCache: boolean): Promise<DecisionResponse>;
+    whatIsAllowed(request: Request<NoAuthWhatIsAllowedTarget, AuthZContext>, ctx: ACSClientContext, useCache: boolean): Promise<PolicySetRQResponse>;
 }
 /**
  * General authorizer. Marshalls data and requests access to the Access Control Service (ACS).
@@ -32,14 +33,14 @@ export declare class ACSAuthZ implements IAuthZ {
      * @param useCache
      * @returns {DecisionResponse}
      */
-    isAllowed(request: Request<AuthZTarget, AuthZContext>, useCache: any): Promise<DecisionResponse>;
+    isAllowed(request: Request<AuthZTarget, AuthZContext>, ctx: ACSClientContext, useCache: any): Promise<DecisionResponse>;
     /**
     * Perform request to access-control-srv
     * @param request - authZRequest containing subject, resource and action
     * @returns {PolicySetRQ}
     * @param resource
     */
-    whatIsAllowed(request: Request<AuthZWhatIsAllowedTarget, AuthZContext>, useCache: any): Promise<PolicySetRQResponse>;
+    whatIsAllowed(request: Request<AuthZWhatIsAllowedTarget, AuthZContext>, ctx: ACSClientContext, useCache: boolean): Promise<PolicySetRQResponse>;
     private encode;
     prepareRequest(request: Request<AuthZTarget | AuthZWhatIsAllowedTarget, AuthZContext>): any;
 }

package/lib/acs/authz.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.initAuthZ = exports.ACSAuthZ = exports.UnAuthZ = exports.createResourceTargetWhatIsAllowed = exports.createResourceTarget = exports.createSubjectTarget = exports.createActionTarget = exports.authZ = void 0;
+exports.initAuthZ = exports.ACSAuthZ = exports.UnAuthZ = exports.createResourceTarget = exports.formatResourceType = exports.createSubjectTarget = exports.createActionTarget = exports.authZ = void 0;
 const _ = require("lodash");
 const interfaces_1 = require("./interfaces");
 const grpc_client_1 = require("@restorecommerce/grpc-client");
@@ -81,66 +81,67 @@ const formatResourceType = (type, namespacePrefix) => {
         return `${prefix}.${suffix}`;
     }
 };
-const createResourceTarget = (resources, action) => {
+exports.formatResourceType = formatResourceType;
+const createResourceTarget = (resource, action) => {
     const flattened = [];
-    resources.forEach((resource) => {
+    resource.forEach((resourceObj) => {
         if (action != interfaces_1.AuthZAction.EXECUTE) {
-            const resourceType = formatResourceType(resource.type, resource.namespace);
+            let resourcenameNameSpace = resourceObj.resource;
+            let resourceInstance = resourceObj.id;
+            let resourceProperty = resourceObj.property;
+            let resourceNameSpace, resourceName;
+            if (resourcenameNameSpace && resourcenameNameSpace.indexOf('.') > -1) {
+                resourceNameSpace = resourcenameNameSpace.slice(0, resourcenameNameSpace.lastIndexOf('.'));
+                // resource name from `.` till end, when no end index is specified for
+                // slice api it returns till end of string
+                resourceName = resourcenameNameSpace.slice(resourcenameNameSpace.lastIndexOf('.') + 1);
+            }
+            else {
+                resourceName = resourcenameNameSpace;
+            }
+            // entity - urn:restorecommerce:acs:names:model:entity
+            const resourceType = exports.formatResourceType(resourceName, resourceNameSpace);
             if (resourceType) {
                 flattened.push({
                     id: urns.entity,
                     value: urns.model + `:${resourceType}`
                 });
             }
-            if (resource.instance && resource.instance.id) {
+            // resource-id - urn:oasis:names:tc:xacml:1.0:resource:resource-id
+            if (resourceInstance && typeof resourceInstance === 'string') {
                 flattened.push({
                     id: urns.resourceID,
-                    value: resource.instance.id
+                    value: resourceInstance
                 });
             }
-            if (resource.fields) {
-                resource.fields.forEach((field) => {
+            else if (resourceInstance && _.isArray(resourceInstance) && resourceInstance.length > 0) {
+                resourceInstance.forEach((instance) => {
                     flattened.push({
-                        id: urns.property,
-                        value: urns.model + `:${resourceType}#${field}`
+                        id: urns.resourceID,
+                        value: instance
                     });
                 });
             }
-        }
-        else {
-            resources.forEach((resource) => {
-                flattened.push({
-                    id: urns.operation,
-                    value: resource.type
-                });
-            });
-        }
-    });
-    return flattened;
-};
-exports.createResourceTarget = createResourceTarget;
-const createResourceTargetWhatIsAllowed = (resources) => {
-    const flattened = [];
-    resources.forEach((resource) => {
-        const resourceType = formatResourceType(resource.type, resource.namespace);
-        if (resource.type.startsWith('mutation') || resource.type.startsWith('query')) {
-            resources.forEach((resource) => {
-                flattened.push({
-                    id: urns.operation,
-                    value: resource.type
+            // property - urn:restorecommerce:acs:names:model:property
+            if (resourceProperty && _.isArray(resourceProperty) && resourceProperty.length > 0) {
+                resourceProperty.forEach((property) => {
+                    flattened.push({
+                        id: urns.property,
+                        value: urns.model + `:${resourceType}#${property}`
+                    });
                 });
-            });
+            }
         }
         else {
             flattened.push({
-                id: urns.entity,
-                value: urns.model + `:${resourceType}`
+                id: urns.operation,
+                value: resourceObj.resource
             });
         }
     });
     return flattened;
 };
-exports.createResourceTargetWhatIsAllowed = createResourceTargetWhatIsAllowed;
+exports.createResourceTarget = createResourceTarget;
 class UnAuthZ {
     /**
      *
@@ -149,15 +150,30 @@ class UnAuthZ {
     constructor(acs) {
         this.acs = acs;
     }
-    isAllowed(request, useCache) {
+    encode(object) {
+        if (object) {
+            if (_.isArray(object)) {
+                return _.map(object, this.encode.bind(this));
+            }
+            else {
+                return {
+                    value: Buffer.from(JSON.stringify(object))
+                };
+            }
+        }
+    }
+    isAllowed(request, ctx, useCache) {
         return __awaiter(this, void 0, void 0, function* () {
             const authZRequest = {
                 target: {
                     action: exports.createActionTarget(request.target.action),
                     subject: exports.createSubjectTarget(request.target.subject),
-                    resources: exports.createResourceTarget(request.target.resources, request.target.action)
+                    resources: exports.createResourceTarget(request.target.resource, request.target.action)
                 },
-                context: request.context
+                context: {
+                    subject: this.encode(request.target.subject),
+                    resources: this.encode(ctx.resources)
+                }
             };
             let response;
             try {
@@ -185,15 +201,18 @@ class UnAuthZ {
             return response;
         });
     }
-    whatIsAllowed(request, useCache) {
+    whatIsAllowed(request, ctx, useCache) {
         return __awaiter(this, void 0, void 0, function* () {
             const authZRequest = {
                 target: {
                     action: exports.createActionTarget(request.target.action),
                     subject: exports.createSubjectTarget(request.target.subject),
-                    resources: exports.createResourceTarget(request.target.resources, request.target.action)
+                    resources: exports.createResourceTarget(request.target.resource, request.target.action)
                 },
-                context: request.context
+                context: {
+                    subject: this.encode(request.target.subject),
+                    resources: this.encode(ctx.resources)
+                }
             };
             let response;
             try {
@@ -240,7 +259,7 @@ class ACSAuthZ {
      * @param useCache
      * @returns {DecisionResponse}
      */
-    isAllowed(request, useCache) {
+    isAllowed(request, ctx, useCache) {
         return __awaiter(this, void 0, void 0, function* () {
             const authZRequest = this.prepareRequest(request);
             authZRequest.context = {
@@ -248,25 +267,13 @@ class ACSAuthZ {
                 resources: [],
                 security: this.encode(request.context.security)
             };
-            let resources = request.target.resources;
             const subject = { token: request.target.subject.token };
             let cachePrefix = 'ACSAuthZ';
             if (request.target.subject.id !== undefined) {
                 cachePrefix = request.target.subject.id + ':' + cachePrefix;
             }
-            if (request.target.action == 'CREATE' || request.target.action == 'MODIFY' || request.target.action == 'DELETE') {
-                // insert temporary IDs into resources which are yet to be created if not present in input
-                let counter = 0;
-                resources = _.cloneDeep(request.target.resources).map((resource) => {
-                    if (_.isEmpty(resource.instance.id)) {
-                        resource.instance.id = String(counter++);
-                        resource.fields.push('id');
-                    }
-                    return resource;
-                });
-            }
             authZRequest.context.subject = this.encode(subject);
-            authZRequest.context.resources = this.encode(resources);
+            authZRequest.context.resources = this.encode(ctx.resources);
             // for isAllowed we use the subject, action and resource fields .i.e. reqeust Target
             // since the context resources contains the values which would change for each
             // resource being created and should not be used in key when generating hash
@@ -305,7 +312,7 @@ class ACSAuthZ {
     * @returns {PolicySetRQ}
     * @param resource
     */
-    whatIsAllowed(request, useCache) {
+    whatIsAllowed(request, ctx, useCache) {
         return __awaiter(this, void 0, void 0, function* () {
             const authZRequest = this.prepareRequest(request);
             authZRequest.context = {
@@ -313,14 +320,13 @@ class ACSAuthZ {
                 resources: [],
                 security: this.encode(request.context.security)
             };
-            let resources = request.target.resources;
             const subject = { token: request.target.subject.token };
             let cachePrefix = 'ACSAuthZ';
             if (request.target.subject.id !== undefined) {
                 cachePrefix = request.target.subject.id + ':' + cachePrefix;
             }
             authZRequest.context.subject = this.encode(subject);
-            authZRequest.context.resources = this.encode(resources);
+            authZRequest.context.resources = this.encode(ctx.resources);
             let response;
             try {
                 response = yield cache_1.getOrFill(authZRequest, (req) => __awaiter(this, void 0, void 0, function* () {
@@ -348,44 +354,26 @@ class ACSAuthZ {
         });
     }
     encode(object) {
-        if (_.isArray(object)) {
-            return _.map(object, this.encode.bind(this));
-        }
-        else {
-            return {
-                value: Buffer.from(JSON.stringify(object))
-            };
+        if (object) {
+            if (_.isArray(object)) {
+                return _.map(object, this.encode.bind(this));
+            }
+            else {
+                return {
+                    value: Buffer.from(JSON.stringify(object))
+                };
+            }
         }
     }
     prepareRequest(request) {
-        let { subject, resources, action } = request.target;
-        // this.reduceUserScope(subject);
+        let { subject, resource, action } = request.target;
         const authZRequest = {
             target: {
                 action: exports.createActionTarget(action),
                 subject: exports.createSubjectTarget(subject),
             },
         };
-        if (_.isArray(action)) {
-            // whatIsAllowed
-            authZRequest.target.resources = exports.createResourceTargetWhatIsAllowed(resources);
-        }
-        else {
-            // isAllowed
-            if (request.target.action == 'CREATE' || request.target.action == 'MODIFY'
-                || request.target.action == 'DELETE') {
-                // insert temporary IDs into resources which are yet to be created
-                let counter = 0;
-                resources = _.cloneDeep(request.target.resources).map((resource) => {
-                    if (_.isEmpty(resource.instance.id)) {
-                        resource.instance.id = String(counter++);
-                        resource.fields.push('id');
-                    }
-                    return resource;
-                });
-            }
-            authZRequest.target.resources = exports.createResourceTarget(resources, action);
-        }
+        authZRequest.target.resources = exports.createResourceTarget(resource, action);
         return authZRequest;
     }
 }

package/lib/acs/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/acs/authz.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4BAA4B;AAC5B,6CAIsB;AACtB,8DAA0D;AAC1D,sCAA8C;AAC9C,sCAA+B;AAC/B,mCAAgD;AAChD,gEAAuD;AAIvD,MAAM,IAAI,GAAG,YAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEpC,MAAM,kBAAkB,GAAG,CAAC,MAAW,EAAe,EAAE;IAC7D,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACrB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,KAAK,IAAI,UAAU,IAAI,MAAM,EAAE;YAC7B,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,IAAI,CAAC,QAAQ;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE;aACtC,CAAC,CAAC;SACJ;QACD,OAAO,UAAU,CAAC;KACnB;SACI;QACH,OAAO,CAAC;gBACN,EAAE,EAAE,IAAI,CAAC,QAAQ;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE;aAC1D,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAlBW,QAAA,kBAAkB,sBAkB7B;AAEK,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAe,EAAE;IACnE,IAAI,OAAO,CAAC,eAAe,EAAE;QAC3B,OAAO,CAAC;gBACN,EAAE,EAAE,IAAI,CAAC,oBAAoB;gBAC7B,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;KACJ;IACD,IAAI,SAAS,GAAG;QACd;YACE,EAAE,EAAE,IAAI,CAAC,SAAS;YAClB,KAAK,EAAE,OAAO,CAAC,EAAE;SAClB;KAAC,CAAC;IAEL,IAAI,OAAO,CAAC,KAAK,EAAE;QACjB,IAAI,UAAU,GAAG;YACf;gBACE,EAAE,EAAE,IAAI,CAAC,iBAAiB;gBAC1B,KAAK,EAAE,IAAI,CAAC,QAAQ;aACrB;YACD;gBACE,EAAE,EAAE,IAAI,CAAC,mBAAmB;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC;QACF,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;KAC1C;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AA3BW,QAAA,mBAAmB,uBA2B9B;AAEF,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,eAAwB,EAAU,EAAE;IAC5E,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,eAAe,EAAE;QACnB,OAAO,GAAG,eAAe,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;KACjD;SAAM;QACL,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;KAC9B;AACH,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,CAAC,SAAqB,EAAE,MAAmC,EAAE,EAAE;IACjG,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7B,IAAI,MAAM,IAAI,wBAAW,CAAC,OAAO,EAAE;YACjC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3E,IAAI,YAAY,EAAE;gBAChB,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,MAAM;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE;iBACvC,CAAC,CAAC;aACJ;YACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC7C,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,UAAU;oBACnB,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;iBAC5B,CAAC,CAAC;aACJ;YAED,IAAI,QAAQ,CAAC,MAAM,EAAE;gBACnB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChC,SAAS,CAAC,IAAI,CAAC;wBACb,EAAE,EAAE,IAAI,CAAC,QAAQ;wBACjB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,IAAI,KAAK,EAAE;qBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;aACJ;SACF;aAAM;YACL,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC7B,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,SAAS;oBAClB,KAAK,EAAE,QAAQ,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;SACJ;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AArCW,QAAA,oBAAoB,wBAqC/B;AAEK,MAAM,iCAAiC,GAAG,CAAC,SAAqB,EAAE,EAAE;IACzE,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7B,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3E,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;YAC7E,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC7B,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,SAAS;oBAClB,KAAK,EAAE,QAAQ,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;SACJ;aACI;YACH,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,IAAI,CAAC,MAAM;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE;aACvC,CAAC,CAAC;SACJ;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAtBW,QAAA,iCAAiC,qCAsB5C;AAEF,MAAa,OAAO;IAElB;;;OAGG;IACH,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEK,SAAS,CAAC,OAA4C,EAAE,QAAQ;;YACpE,MAAM,YAAY,GAAG;gBACnB,MAAM,EAAE;oBACN,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjD,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpD,SAAS,EAAE,4BAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;iBACjF;gBACD,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;YAEF,IAAI,QAA0B,CAAC;YAC/B,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC,CAAA,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;aACnC;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;gBAC3E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAElB,CAAC;KAAA;IAEK,aAAa,CAAC,OAAyD,EAC3E,QAAQ;;YACR,MAAM,YAAY,GAAG;gBACnB,MAAM,EAAE;oBACN,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjD,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpD,SAAS,EAAE,4BAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;iBACjF;gBACD,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;YACF,IAAI,QAA6B,CAAC;YAClC,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC,CAAA,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;aACvC;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;gBAC/E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;CACF;AApFD,0BAoFC;AAED;;GAEG;AACH,MAAa,QAAQ;IAGnB;;;OAGG;IACH,YAAY,GAAQ,EAAE,GAAS;QAC7B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACG,SAAS,CAAC,OAA2C,EAAE,QAAQ;;YACnE,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,GAAG;gBACrB,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;aAChD,CAAC;YACF,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACzC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,WAAW,GAAG,UAAU,CAAC;YAE7B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE;gBAC3C,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,WAAW,CAAC;aAC7D;YAED,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE;gBAC/G,0FAA0F;gBAC1F,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACjE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;wBACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBAC5B;oBACD,OAAO,QAAQ,CAAC;gBAClB,CAAC,CAAC,CAAC;aACJ;YACD,YAAY,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAExD,oFAAoF;YACpF,8EAA8E;YAC9E,4EAA4E;YAC5E,IAAI,QAAQ,GAAG;gBACb,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC;YACF,IAAI,QAA0B,CAAC;YAC/B,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,QAAQ,EAAE,CAAO,GAAG,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC,CAAA,EAAE,QAAQ,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;aAC1C;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;gBAC3E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;;;;MAKE;IACI,aAAa,CAAC,OAAwD,EAC1E,QAAQ;;YACR,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,GAAG;gBACrB,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;aAChD,CAAC;YACF,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACzC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAExD,IAAI,WAAW,GAAG,UAAU,CAAC;YAE7B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE;gBAC3C,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,WAAW,CAAC;aAC7D;YAED,YAAY,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,QAA6B,CAAC;YAClC,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC,CAAA,EAAE,QAAQ,EAAE,WAAW,GAAG,gBAAgB,CAAC,CAAC;aAC9C;YAAC,OAAM,GAAG,EAAE;gBACX,gBAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;gBAC/E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAEO,MAAM,CAAC,MAAW;QACxB,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACrB,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC9C;aAAM;YACL,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;aAC3C,CAAC;SACH;IACH,CAAC;IAED,cAAc,CAAC,OAAsE;QACnF,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACpD,iCAAiC;QAEjC,MAAM,YAAY,GAAQ;YACxB,MAAM,EAAE;gBACN,MAAM,EAAE,0BAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC;aACtC;SACF,CAAC;QACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACrB,gBAAgB;YAChB,YAAY,CAAC,MAAM,CAAC,SAAS,GAAG,yCAAiC,CAAC,SAAS,CAAC,CAAC;SAC9E;aAAM;YACL,YAAY;YACZ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ;mBACrE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE;gBACtC,kEAAkE;gBAClE,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACjE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;wBACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;wBACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBAC5B;oBACD,OAAO,QAAQ,CAAC;gBAClB,CAAC,CAAC,CAAC;aACJ;YAED,YAAY,CAAC,MAAM,CAAC,SAAS,GAAG,4BAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;SACzE;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AA/KD,4BA+KC;AAED,MAAM,SAAS,GAAG;IAChB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC;AAEF,MAAM,aAAa,GAAG,CAAO,GAAQ,EACnC,OAAY,EAAE,MAAW,EAAE,SAAiB,EAAgB,EAAE;IAC9D,IAAI,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE;QACrC,2CAA2C;QAC3C,gBAAM,CAAC,IAAI,CAAC,kBAAkB,SAAS,+BAA+B,CAAC,CAAC;QACxE,MAAM,kBAAU,EAAE,CAAC;KACpB;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,SAAS,GAAG,CAAO,MAAY,EAA4B,EAAE;IACxE,IAAI,CAAC,aAAK,EAAE;QACV,IAAI,MAAM,EAAE;YACV,qBAAY,CAAC,MAAM,CAAC,CAAC;SACtB;QACD,MAAM,QAAQ,GAAG,YAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,YAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,wCAAwC;QACxC,IAAI,QAAQ,CAAC,OAAO,EAAE;YACpB,MAAM,gBAAgB,GAAG,YAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,aAAa,EAAE,gBAAM,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACjC,aAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1B,iEAAiE;YACjE,wEAAwE;YACxE,IAAI,QAAQ,IAAI,QAAQ,CAAC,aAAa,EAAE;gBACtC,MAAM,MAAM,GAAG,IAAI,qBAAM,CAAC,QAAQ,EAAE,gBAAM,CAAC,CAAC;gBAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,KAAK,IAAI,UAAU,IAAI,QAAQ,CAAC,aAAa,EAAE;oBAC7C,IAAI,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oBAClD,IAAI,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC/C,IAAI,QAAQ,CAAC,MAAM,EAAE;wBACnB,KAAK,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE;4BACrC,MAAM,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;yBAC1C;qBACF;iBACF;aACF;YACD,OAAO,aAAK,CAAC;SACd;KACF;IACD,OAAO,aAAK,CAAC;AACf,CAAC,CAAA,CAAC;AAjCW,QAAA,SAAS,aAiCpB"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/acs/authz.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4BAA4B;AAC5B,6CAIsB;AACtB,8DAA0D;AAC1D,sCAA8C;AAC9C,sCAA+B;AAC/B,mCAAgD;AAChD,gEAAuD;AAIvD,MAAM,IAAI,GAAG,YAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEpC,MAAM,kBAAkB,GAAG,CAAC,MAAW,EAAe,EAAE;IAC7D,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACrB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,KAAK,IAAI,UAAU,IAAI,MAAM,EAAE;YAC7B,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,IAAI,CAAC,QAAQ;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE;aACtC,CAAC,CAAC;SACJ;QACD,OAAO,UAAU,CAAC;KACnB;SACI;QACH,OAAO,CAAC;gBACN,EAAE,EAAE,IAAI,CAAC,QAAQ;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE;aAC1D,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAlBW,QAAA,kBAAkB,sBAkB7B;AAEK,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAe,EAAE;IACnE,IAAI,OAAO,CAAC,eAAe,EAAE;QAC3B,OAAO,CAAC;gBACN,EAAE,EAAE,IAAI,CAAC,oBAAoB;gBAC7B,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;KACJ;IACD,IAAI,SAAS,GAAG;QACd;YACE,EAAE,EAAE,IAAI,CAAC,SAAS;YAClB,KAAK,EAAE,OAAO,CAAC,EAAE;SAClB;KAAC,CAAC;IAEL,IAAI,OAAO,CAAC,KAAK,EAAE;QACjB,IAAI,UAAU,GAAG;YACf;gBACE,EAAE,EAAE,IAAI,CAAC,iBAAiB;gBAC1B,KAAK,EAAE,IAAI,CAAC,QAAQ;aACrB;YACD;gBACE,EAAE,EAAE,IAAI,CAAC,mBAAmB;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF,CAAC;QACF,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;KAC1C;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AA3BW,QAAA,mBAAmB,uBA2B9B;AAEK,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,eAAwB,EAAU,EAAE;IACnF,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,eAAe,EAAE;QACnB,OAAO,GAAG,eAAe,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;KACjD;SAAM;QACL,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;KAC9B;AACH,CAAC,CAAC;AAZW,QAAA,kBAAkB,sBAY7B;AAEK,MAAM,oBAAoB,GAAG,CAAC,QAAoB,EAAE,MAAmB,EAAE,EAAE;IAChF,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QAC/B,IAAI,MAAM,IAAI,wBAAW,CAAC,OAAO,EAAE;YACjC,IAAI,qBAAqB,GAAG,WAAW,CAAC,QAAQ,CAAC;YACjD,IAAI,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC;YACtC,IAAI,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC;YAC5C,IAAI,iBAAiB,EAAE,YAAY,CAAC;YAEpC,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE;gBACpE,iBAAiB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3F,sEAAsE;gBACtE,0CAA0C;gBAC1C,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;aACxF;iBAAM;gBACL,YAAY,GAAG,qBAAqB,CAAC;aACtC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,0BAAkB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;YACzE,IAAI,YAAY,EAAE;gBAChB,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,MAAM;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE;iBACvC,CAAC,CAAC;aACJ;YAED,kEAAkE;YAClE,IAAI,gBAAgB,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE;gBAC5D,SAAS,CAAC,IAAI,CAAC;oBACb,EAAE,EAAE,IAAI,CAAC,UAAU;oBACnB,KAAK,EAAE,gBAAgB;iBACxB,CAAC,CAAC;aACJ;iBAAM,IAAI,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE;gBACzF,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACpC,SAAS,CAAC,IAAI,CAAC;wBACb,EAAE,EAAE,IAAI,CAAC,UAAU;wBACnB,KAAK,EAAE,QAAQ;qBAChB,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;aACJ;YAED,0DAA0D;YAC1D,IAAI,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE;gBAClF,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACpC,SAAS,CAAC,IAAI,CAAC;wBACb,EAAE,EAAE,IAAI,CAAC,QAAQ;wBACjB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,IAAI,QAAQ,EAAE;qBACnD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;aACJ;SACF;aAAM;YACL,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS;gBAClB,KAAK,EAAE,WAAW,CAAC,QAAQ;aAC5B,CAAC,CAAC;SACJ;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AA5DW,QAAA,oBAAoB,wBA4D/B;AAEF,MAAa,OAAO;IAElB;;;OAGG;IACH,YAAY,GAAQ;QAClB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,MAAW;QACxB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBACrB,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aAC9C;iBAAM;gBACL,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;iBAC3C,CAAC;aACH;SACF;IACH,CAAC;IAEK,SAAS,CAAC,OAA4C,EAAE,GAAqB,EAAE,QAAiB;;YACpG,MAAM,YAAY,GAAG;gBACnB,MAAM,EAAE;oBACN,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjD,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpD,SAAS,EAAE,4BAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;iBAChF;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACtC;aACF,CAAC;YAEF,IAAI,QAA0B,CAAC;YAC/B,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC,CAAA,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;aACnC;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;gBAC3E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAElB,CAAC;KAAA;IAEK,aAAa,CAAC,OAAyD,EAC3E,GAAqB,EAAE,QAAiB;;YACxC,MAAM,YAAY,GAAG;gBACnB,MAAM,EAAE;oBACN,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjD,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpD,SAAS,EAAE,4BAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;iBAChF;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;iBACtC;aACF,CAAC;YACF,IAAI,QAA6B,CAAC;YAClC,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC,CAAA,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;aACvC;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;gBAC/E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;CACF;AAtGD,0BAsGC;AAED;;GAEG;AACH,MAAa,QAAQ;IAGnB;;;OAGG;IACH,YAAY,GAAQ,EAAE,GAAS;QAC7B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACG,SAAS,CAAC,OAA2C,EAAE,GAAqB,EAAE,QAAQ;;YAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,GAAG;gBACrB,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;aAChD,CAAC;YACF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,WAAW,GAAG,UAAU,CAAC;YAE7B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE;gBAC3C,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,WAAW,CAAC;aAC7D;YAED,YAAY,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAE5D,oFAAoF;YACpF,8EAA8E;YAC9E,4EAA4E;YAC5E,IAAI,QAAQ,GAAG;gBACb,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC;YACF,IAAI,QAA0B,CAAC;YAC/B,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,QAAQ,EAAE,CAAO,GAAG,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC,CAAA,EAAE,QAAQ,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;aAC1C;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;gBAC3E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAED;;;;;MAKE;IACI,aAAa,CAAC,OAAwD,EAC1E,GAAqB,EAAE,QAAiB;;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,GAAG;gBACrB,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;aAChD,CAAC;YACF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAExD,IAAI,WAAW,GAAG,UAAU,CAAC;YAE7B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE;gBAC3C,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,WAAW,CAAC;aAC7D;YAED,YAAY,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAE5D,IAAI,QAA6B,CAAC;YAClC,IAAI;gBACF,QAAQ,GAAG,MAAM,iBAAS,CAAC,YAAY,EAAE,CAAO,GAAG,EAAE,EAAE;oBACrD,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC,CAAA,EAAE,QAAQ,EAAE,WAAW,GAAG,gBAAgB,CAAC,CAAC;aAC9C;YAAC,OAAO,GAAG,EAAE;gBACZ,gBAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;gBAC/E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;iBAChB;gBACD,QAAQ,GAAG;oBACT,QAAQ,EAAE,qBAAQ,CAAC,IAAI;oBACvB,gBAAgB,EAAE;wBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB;iBACF,CAAC;aACH;YAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACvB,gBAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;aACpD;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;KAAA;IAEO,MAAM,CAAC,MAAW;QACxB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBACrB,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aAC9C;iBAAM;gBACL,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;iBAC3C,CAAC;aACH;SACF;IACH,CAAC;IAED,cAAc,CAAC,OAAsE;QACnF,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACnD,MAAM,YAAY,GAAQ;YACxB,MAAM,EAAE;gBACN,MAAM,EAAE,0BAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,2BAAmB,CAAC,OAAO,CAAC;aACtC;SACF,CAAC;QACF,YAAY,CAAC,MAAM,CAAC,SAAS,GAAG,4BAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AA9ID,4BA8IC;AAED,MAAM,SAAS,GAAG;IAChB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,cAAc;IACd,aAAa;CACd,CAAC;AAEF,MAAM,aAAa,GAAG,CAAO,GAAQ,EACnC,OAAY,EAAE,MAAW,EAAE,SAAiB,EAAgB,EAAE;IAC9D,IAAI,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE;QACrC,2CAA2C;QAC3C,gBAAM,CAAC,IAAI,CAAC,kBAAkB,SAAS,+BAA+B,CAAC,CAAC;QACxE,MAAM,kBAAU,EAAE,CAAC;KACpB;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,SAAS,GAAG,CAAO,MAAY,EAA4B,EAAE;IACxE,IAAI,CAAC,aAAK,EAAE;QACV,IAAI,MAAM,EAAE;YACV,qBAAY,CAAC,MAAM,CAAC,CAAC;SACtB;QACD,MAAM,QAAQ,GAAG,YAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,YAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,wCAAwC;QACxC,IAAI,QAAQ,CAAC,OAAO,EAAE;YACpB,MAAM,gBAAgB,GAAG,YAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,aAAa,EAAE,gBAAM,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACjC,aAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1B,iEAAiE;YACjE,wEAAwE;YACxE,IAAI,QAAQ,IAAI,QAAQ,CAAC,aAAa,EAAE;gBACtC,MAAM,MAAM,GAAG,IAAI,qBAAM,CAAC,QAAQ,EAAE,gBAAM,CAAC,CAAC;gBAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,KAAK,IAAI,UAAU,IAAI,QAAQ,CAAC,aAAa,EAAE;oBAC7C,IAAI,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;oBAClD,IAAI,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC/C,IAAI,QAAQ,CAAC,MAAM,EAAE;wBACnB,KAAK,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE;4BACrC,MAAM,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;yBAC1C;qBACF;iBACF;aACF;YACD,OAAO,aAAK,CAAC;SACd;KACF;IACD,OAAO,aAAK,CAAC;AACf,CAAC,CAAA,CAAC;AAjCW,QAAA,SAAS,aAiCpB"}

package/lib/acs/interfaces.d.ts

@@ -7,6 +7,32 @@ export declare enum AuthZAction {
     DROP = "DROP",
     ALL = "*"
 }
+export declare enum Operation {
+    isAllowed = "isAllowed",
+    whatIsAllowed = "whatIsAllowed"
+}
+export interface Resource {
+    resource: string;
+    id?: string | string[];
+    property?: string[];
+}
+export interface CtxResource {
+    id: string;
+    meta: {
+        created?: number;
+        modified?: number;
+        modified_by?: string;
+        owner: Attribute[];
+    };
+    [key: string]: any;
+}
+export interface ACSClientContext {
+    subject?: Subject;
+    resources?: CtxResource[];
+}
+export interface Database {
+    database: 'arangoDB' | 'postgres';
+}
 export interface AuthZSubject {
     id: string;
     role_associations: RoleAssociation[];
@@ -17,13 +43,18 @@ export interface HierarchicalScope {
     role?: string;
     children?: HierarchicalScope[];
 }
+export interface ResolvedSubject {
+    id: string;
+    scope: string;
+    token: string;
+    role_associations?: RoleAssociation[];
+    hierarchical_scopes?: HierarchicalScope[];
+}
 export interface Subject {
     id?: string;
     scope?: string;
     unauthenticated?: boolean;
     token?: string;
-    role_associations?: RoleAssociation[];
-    hierarchical_scopes?: HierarchicalScope[];
 }
 export declare enum Decision {
     PERMIT = "PERMIT",
@@ -38,15 +69,9 @@ export interface DecisionResponse {
         message: string;
     };
 }
-export interface Resource {
-    type: string;
-    fields?: string[];
-    instance?: any;
-    namespace?: string;
-}
 export interface Target<TSubject, TResource, TAction> {
     subject: TSubject;
-    resources: TResource[];
+    resource: TResource;
     action: TAction;
 }
 export interface Request<TTarget, TContext> {
@@ -63,16 +88,16 @@ export interface AuthZ<TSubject, TContext = any, TResource = Resource, TAction =
     /**
      * Check is the subject is allowed to do an action on a specific resource
      */
-    isAllowed(request: Request<Target<TSubject, TResource, TAction>, TContext>, useCache: boolean): Promise<DecisionResponse>;
+    isAllowed(request: Request<Target<TSubject, TResource, TAction>, TContext>, ctx: ACSClientContext, useCache: boolean): Promise<DecisionResponse>;
 }
 export interface Credentials {
     type: string;
     [key: string]: any;
 }
-export declare type AuthZTarget = Target<Subject, Resource, AuthZAction>;
-export declare type NoAuthTarget = Target<UnauthenticatedData, Resource, AuthZAction>;
-export declare type AuthZWhatIsAllowedTarget = Target<Subject, Resource, AuthZAction[]>;
-export declare type NoAuthWhatIsAllowedTarget = Target<UnauthenticatedData, Resource, AuthZAction[]>;
+export declare type AuthZTarget = Target<Subject, Resource[], AuthZAction>;
+export declare type NoAuthTarget = Target<UnauthenticatedData, Resource[], AuthZAction>;
+export declare type AuthZWhatIsAllowedTarget = Target<Subject, Resource[], AuthZAction>;
+export declare type NoAuthWhatIsAllowedTarget = Target<UnauthenticatedData, Resource[], AuthZAction>;
 export interface AuthZContext {
     security: any;
 }
@@ -89,8 +114,8 @@ export interface AuthZResponse extends Response {
     decision: Decision;
     obligation: string;
 }
-export interface IAuthZ extends AuthZ<AuthZSubject | UnauthenticatedData, AuthZContext, Resource, AuthZAction> {
-    whatIsAllowed: (request: Request<AuthZWhatIsAllowedTarget | NoAuthWhatIsAllowedTarget, AuthZContext>, useCache: boolean) => Promise<PolicySetRQResponse>;
+export interface IAuthZ extends AuthZ<AuthZSubject | UnauthenticatedData, AuthZContext, Resource[], AuthZAction> {
+    whatIsAllowed: (request: Request<AuthZWhatIsAllowedTarget | NoAuthWhatIsAllowedTarget, AuthZContext>, ctx: ACSClientContext, useCache: boolean) => Promise<PolicySetRQResponse>;
 }
 export interface UserCredentials extends Credentials {
     identifier: string;
@@ -139,8 +164,37 @@ export interface PolicySetRQ extends AccessControlObjectInterface {
     combining_algorithm?: string;
     policies?: PolicyRQ[];
 }
+export declare enum FilterValueType {
+    STRING = 0,
+    NUMBER = 1,
+    BOOLEAN = 2,
+    DATE = 3,
+    ARRAY = 4
+}
+export interface Filter {
+    field: string;
+    operation: FilterOperation;
+    value: string;
+    type?: FilterValueType;
+    filters?: Filters[];
+}
+export interface Filters {
+    filter?: Filter[];
+    operator?: OperatorType;
+}
+export interface EnityFilterMap {
+    resource: string;
+    filters: Filters[];
+}
+export interface CustomQueryArgs {
+    resource: string;
+    custom_queries: string[];
+    custom_arguments: any;
+}
 export interface PolicySetRQResponse extends AccessControlObjectInterface {
     policy_sets?: PolicySetRQ[];
+    filters?: EnityFilterMap[];
+    custom_query_args?: CustomQueryArgs[];
     decision: Decision;
     operation_status: {
         code: number;

package/lib/acs/interfaces.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OperatorType = exports.FilterOperation = exports.Effect = exports.Decision = exports.AuthZAction = void 0;
+exports.OperatorType = exports.FilterOperation = exports.Effect = exports.FilterValueType = exports.Decision = exports.Operation = exports.AuthZAction = void 0;
 var AuthZAction;
 (function (AuthZAction) {
     AuthZAction["CREATE"] = "CREATE";
@@ -11,6 +11,12 @@ var AuthZAction;
     AuthZAction["DROP"] = "DROP";
     AuthZAction["ALL"] = "*";
 })(AuthZAction = exports.AuthZAction || (exports.AuthZAction = {}));
+var Operation;
+(function (Operation) {
+    Operation["isAllowed"] = "isAllowed";
+    Operation["whatIsAllowed"] = "whatIsAllowed";
+})(Operation = exports.Operation || (exports.Operation = {}));
+;
 var Decision;
 (function (Decision) {
     Decision["PERMIT"] = "PERMIT";
@@ -18,6 +24,15 @@ var Decision;
     Decision["INDETERMINATE"] = "INDETERMINATE";
 })(Decision = exports.Decision || (exports.Decision = {}));
 ;
+var FilterValueType;
+(function (FilterValueType) {
+    FilterValueType[FilterValueType["STRING"] = 0] = "STRING";
+    FilterValueType[FilterValueType["NUMBER"] = 1] = "NUMBER";
+    FilterValueType[FilterValueType["BOOLEAN"] = 2] = "BOOLEAN";
+    FilterValueType[FilterValueType["DATE"] = 3] = "DATE";
+    FilterValueType[FilterValueType["ARRAY"] = 4] = "ARRAY";
+})(FilterValueType = exports.FilterValueType || (exports.FilterValueType = {}));
+;
 var Effect;
 (function (Effect) {
     Effect["PERMIT"] = "PERMIT";

package/lib/acs/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/acs/interfaces.ts"],"names":[],"mappings":";;;AAAA,IAAY,WAQX;AARD,WAAY,WAAW;IACrB,gCAAiB,CAAA;IACjB,4BAAa,CAAA;IACb,gCAAiB,CAAA;IACjB,gCAAiB,CAAA;IACjB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,wBAAS,CAAA;AACX,CAAC,EARW,WAAW,GAAX,mBAAW,KAAX,mBAAW,QAQtB;AAuBD,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,2CAA+B,CAAA;AACjC,CAAC,EAJW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QAInB;AASA,CAAC;AA8JF,IAAY,MAIX;AAJD,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,uBAAa,CAAA;IACb,yCAA+B,CAAA;AACjC,CAAC,EAJW,MAAM,GAAN,cAAM,KAAN,cAAM,QAIjB;AAmBD,IAAY,eAUX;AAVD,WAAY,eAAe;IACzB,iDAAM,CAAA;IACN,iDAAM,CAAA;IACN,mDAAO,CAAA;IACP,iDAAM,CAAA;IACN,mDAAO,CAAA;IACP,2DAAW,CAAA;IACX,uDAAS,CAAA;IACT,iDAAM,CAAA;IACN,mDAAO,CAAA;AACT,CAAC,EAVW,eAAe,GAAf,uBAAe,KAAf,uBAAe,QAU1B;AAAA,CAAC;AAEF,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,6CAAO,CAAA;IACP,2CAAM,CAAA;AACR,CAAC,EAHW,YAAY,GAAZ,oBAAY,KAAZ,oBAAY,QAGvB;AAAA,CAAC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/acs/interfaces.ts"],"names":[],"mappings":";;;AAAA,IAAY,WAQX;AARD,WAAY,WAAW;IACrB,gCAAiB,CAAA;IACjB,4BAAa,CAAA;IACb,gCAAiB,CAAA;IACjB,gCAAiB,CAAA;IACjB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,wBAAS,CAAA;AACX,CAAC,EARW,WAAW,GAAX,mBAAW,KAAX,mBAAW,QAQtB;AAED,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,oCAAuB,CAAA;IACvB,4CAA+B,CAAA;AACjC,CAAC,EAHW,SAAS,GAAT,iBAAS,KAAT,iBAAS,QAGpB;AA0BA,CAAC;AA6BF,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,2CAA+B,CAAA;AACjC,CAAC,EAJW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QAInB;AASA,CAAC;AA6HF,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,yDAAU,CAAA;IACV,yDAAU,CAAA;IACV,2DAAW,CAAA;IACX,qDAAQ,CAAA;IACR,uDAAS,CAAA;AACX,CAAC,EANW,eAAe,GAAf,uBAAe,KAAf,uBAAe,QAM1B;AAAA,CAAC;AAqDF,IAAY,MAIX;AAJD,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,uBAAa,CAAA;IACb,yCAA+B,CAAA;AACjC,CAAC,EAJW,MAAM,GAAN,cAAM,KAAN,cAAM,QAIjB;AAmBD,IAAY,eAUX;AAVD,WAAY,eAAe;IACzB,iDAAM,CAAA;IACN,iDAAM,CAAA;IACN,mDAAO,CAAA;IACP,iDAAM,CAAA;IACN,mDAAO,CAAA;IACP,2DAAW,CAAA;IACX,uDAAS,CAAA;IACT,iDAAM,CAAA;IACN,mDAAO,CAAA;AACT,CAAC,EAVW,eAAe,GAAf,uBAAe,KAAf,uBAAe,QAU1B;AAAA,CAAC;AAEF,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,6CAAO,CAAA;IACP,2CAAM,CAAA;AACR,CAAC,EAHW,YAAY,GAAZ,oBAAY,KAAZ,oBAAY,QAGvB;AAAA,CAAC"}

package/lib/acs/resolver.d.ts

@@ -1,25 +1,26 @@
-import { Resource, ACSRequest, Subject, UnauthenticatedData, DecisionResponse, PolicySetRQResponse } from './interfaces';
+import { ACSRequest, Subject, ACSClientContext, Filters, DecisionResponse, PolicySetRQResponse, Operation, Resource } from './interfaces';
 import { AuthZAction } from './interfaces';
 import { ACSAuthZ } from './authz';
-export declare const isAllowedRequest: (subject: Subject | UnauthenticatedData, resources: Resource[], action: AuthZAction, authZ: ACSAuthZ, useCache: boolean) => Promise<DecisionResponse>;
+export declare const isAllowedRequest: (subject: Subject, resource: Resource[], action: AuthZAction, ctx: ACSClientContext, useCache: boolean) => Promise<DecisionResponse>;
 /**
  * It turns an API request as can be found in typical Web frameworks like express, koa etc.
- * into a proper ACS request. For write operations it uses `isAllowed()` and for read operations
- * it uses `whatIsAllowed()`. For the latter it extends the filter provided in the `ReadRequst`
+ * into a proper ACS request. For `whatIsAllowed` operation it returns the filters
  * to enforce the applicapble poilicies. The response is `Decision`
  * or policy set reverse query `PolicySetRQ` depending on the requeste operation `isAllowed()` or
  * `whatIsAllowed()` respectively.
- * @param {Subject | ApiKey} subject Contains subject information or ApiKey
- * @param {any | any[] | ReadRequest} request request object of type any for resource or ReadRequest
+ * @param {Subject} subject Contains subject information or ApiKey
+ * @param {Resource[]} resource Contains resource name, resource instance and optional resource properties
  * @param {AuthZAction} action Action to be performed on resource
- * @param {ACSAuthZ} authZ ACS Authorization Object containing grpc client connection for `access-control-srv`
- * @param {string} entity entity name optional
- * @param {string} resourceNameSpace resource name space optional
+ * @param {ACSClientContext} ctx Context containing Subject and Context Resources for ACS
+ * @param {Operation} operation Operation to perform `isAllowed` or `whatIsAllowed`,
+ * if this param is missing defaults to `isAllowed` operation
+ * @param {Database} database database used either `arangoDB` or `postgres`,
+ * if this param is missing defaults to `arangoDB`
  * @param {boolean} useCache by default ACS caching is used, if set to false then ACS cache
  * is not used and ACS request is made to `access-control-srv`
  * @returns {DecisionResponse | PolicySetRQResponse}
  */
-export declare const accessRequest: (subject: Subject, request: any | any[] | ReadRequest, action: AuthZAction, authZ: ACSAuthZ, entity?: string, resourceNameSpace?: string, useCache?: boolean) => Promise<DecisionResponse | PolicySetRQResponse>;
+export declare const accessRequest: (subject: Subject, resource: Resource[], action: AuthZAction, ctx: ACSClientContext, operation?: Operation, database?: 'arangoDB' | 'postgres', useCache?: boolean) => Promise<DecisionResponse | PolicySetRQResponse>;
 /**
  * Exposes the isAllowed() api of `access-control-srv` and retruns the response
  * as `Decision`.
@@ -59,17 +60,13 @@ export interface LoginError {
     code: string;
     message: string;
 }
-export interface ReadRequest {
-    entity: string;
-    args: QueryArguments;
-    database?: string;
-    namespace?: string;
-}
 export interface QueryArguments {
-    filters?: any;
+    filters?: Filters[];
     limit?: any;
     sort?: any;
     offset?: any;
+    custom_queries: string[];
+    custom_arguments: any;
 }
 export interface UserQueryArguments extends QueryArguments {
     user_role: RoleRequest;