@rimelight/auth 0.0.2 → 0.0.3

package/dist/adapters/auth0.d.mts

@@ -0,0 +1,115 @@
+import { AuthAdapter, UserSessionContext } from "../types.mjs";
+import { decodeJwt } from "jose";
+//#region src/adapters/auth0.d.ts
+interface Auth0AdapterOptions {
+  domain: string;
+  audience?: string | undefined;
+  clientId?: string | undefined;
+  clientSecret?: string | undefined;
+  rolesClaim?: string | undefined;
+  userTypeClaim?: string | undefined;
+  permissionsClaim?: string | undefined;
+  sessionCookieName?: string | undefined;
+  sessionSecret?: string | undefined;
+  loginUrl?: string | undefined;
+  defaultRole?: string | undefined;
+}
+interface Auth0AuthorizeUrlOptions {
+  domain: string;
+  clientId: string;
+  redirectUri: string;
+  audience?: string | undefined;
+  scope?: string | undefined;
+  state?: string | undefined;
+  codeChallenge?: string | undefined;
+  codeChallengeMethod?: "S256" | "plain" | undefined;
+  prompt?: string | undefined;
+  screenHint?: string | undefined;
+}
+interface Auth0TokenResponse {
+  access_token: string;
+  id_token?: string | undefined;
+  token_type: string;
+  expires_in: number;
+  refresh_token?: string | undefined;
+  scope?: string | undefined;
+}
+interface Auth0CodeExchangeOptions {
+  domain: string;
+  clientId: string;
+  clientSecret?: string | undefined;
+  code: string;
+  redirectUri: string;
+  codeVerifier?: string | undefined;
+}
+interface Auth0PasswordLoginOptions {
+  domain: string;
+  clientId: string;
+  clientSecret?: string | undefined;
+  username: string;
+  password: string;
+  audience?: string | undefined;
+  scope?: string | undefined;
+  realm?: string | undefined;
+}
+interface Auth0RefreshTokenOptions {
+  domain: string;
+  clientId: string;
+  clientSecret?: string | undefined;
+  refreshToken: string;
+  scope?: string | undefined;
+}
+/**
+ * Verifies an Auth0 RS256 JWT Access Token or ID Token against Auth0 JWKS endpoint
+ */
+declare function verifyAuth0Jwt(token: string, options: {
+  domain: string;
+  audience?: string | undefined;
+  issuer?: string | undefined;
+}): Promise<Record<string, any> | null>;
+/**
+ * Creates a signed compact session token (HS256) for local session cookie storage
+ */
+declare function createSessionToken(session: UserSessionContext, secret: string, expiresIn?: string | number): Promise<string>;
+/**
+ * Verifies a signed session token from a session cookie
+ */
+declare function verifySessionToken(token: string, secret: string): Promise<UserSessionContext | null>;
+/**
+ * Generates an Auth0 OAuth2 / OIDC authorization URL
+ */
+declare function createAuth0AuthorizeUrl(options: Auth0AuthorizeUrlOptions): string;
+/**
+ * Exchanges an authorization code for Auth0 tokens
+ */
+declare function exchangeAuth0Code(options: Auth0CodeExchangeOptions): Promise<Auth0TokenResponse>;
+/**
+ * Authenticates directly with Auth0 using Resource Owner Password Credentials (ROPC). Used by
+ * headless clients (e.g., Unreal Engine 5) to authenticate without browser redirects.
+ */
+declare function loginWithAuth0Password(options: Auth0PasswordLoginOptions): Promise<Auth0TokenResponse>;
+/**
+ * Exchanges a refresh token for a new Auth0 access token. Ensures uninterrupted play sessions in
+ * native game clients.
+ */
+declare function refreshAuth0Token(options: Auth0RefreshTokenOptions): Promise<Auth0TokenResponse>;
+/**
+ * Generates an Auth0 logout URL
+ */
+declare function createAuth0LogoutUrl(options: {
+  domain: string;
+  clientId: string;
+  returnTo: string;
+}): string;
+/**
+ * Auth0 / OIDC Auth Adapter
+ */
+declare function auth0Auth(options: Auth0AdapterOptions): AuthAdapter;
+declare function mapAuth0PayloadToSession(payload: Record<string, any>, options: {
+  rolesClaim: string;
+  userTypeClaim: string;
+  permissionsClaim: string;
+  defaultRole: string;
+}): UserSessionContext;
+//#endregion
+export { Auth0AdapterOptions, Auth0AuthorizeUrlOptions, Auth0CodeExchangeOptions, Auth0PasswordLoginOptions, Auth0RefreshTokenOptions, Auth0TokenResponse, auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken };

package/dist/adapters/auth0.mjs

@@ -0,0 +1,256 @@
+import { SignJWT, createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+//#region src/adapters/auth0.ts
+const jwksCache = /* @__PURE__ */ new Map();
+function getOrCreateJwks(domain) {
+	const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+	if (!jwksCache.has(cleanDomain)) {
+		const jwksUrl = new URL(`https://${cleanDomain}/.well-known/jwks.json`);
+		jwksCache.set(cleanDomain, createRemoteJWKSet(jwksUrl));
+	}
+	return jwksCache.get(cleanDomain);
+}
+/**
+* Verifies an Auth0 RS256 JWT Access Token or ID Token against Auth0 JWKS endpoint
+*/
+async function verifyAuth0Jwt(token, options) {
+	try {
+		const cleanDomain = options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+		const jwks = getOrCreateJwks(cleanDomain);
+		const verifyOpts = { issuer: options.issuer || `https://${cleanDomain}/` };
+		if (options.audience) verifyOpts.audience = options.audience;
+		const { payload } = await jwtVerify(token, jwks, verifyOpts);
+		return payload;
+	} catch {
+		return null;
+	}
+}
+/**
+* Creates a signed compact session token (HS256) for local session cookie storage
+*/
+async function createSessionToken(session, secret, expiresIn = "7d") {
+	const encSecret = new TextEncoder().encode(secret);
+	return new SignJWT({ ...session }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(encSecret);
+}
+/**
+* Verifies a signed session token from a session cookie
+*/
+async function verifySessionToken(token, secret) {
+	try {
+		const encSecret = new TextEncoder().encode(secret);
+		const { payload } = await jwtVerify(token, encSecret, { algorithms: ["HS256"] });
+		return payload;
+	} catch {
+		return null;
+	}
+}
+/**
+* Generates an Auth0 OAuth2 / OIDC authorization URL
+*/
+function createAuth0AuthorizeUrl(options) {
+	const cleanDomain = options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+	const url = new URL(`https://${cleanDomain}/authorize`);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", options.clientId);
+	url.searchParams.set("redirect_uri", options.redirectUri);
+	url.searchParams.set("scope", options.scope || "openid profile email");
+	if (options.audience) url.searchParams.set("audience", options.audience);
+	if (options.state) url.searchParams.set("state", options.state);
+	if (options.codeChallenge) {
+		url.searchParams.set("code_challenge", options.codeChallenge);
+		url.searchParams.set("code_challenge_method", options.codeChallengeMethod || "S256");
+	}
+	if (options.prompt) url.searchParams.set("prompt", options.prompt);
+	if (options.screenHint) url.searchParams.set("screen_hint", options.screenHint);
+	return url.toString();
+}
+/**
+* Exchanges an authorization code for Auth0 tokens
+*/
+async function exchangeAuth0Code(options) {
+	const tokenUrl = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "")}/oauth/token`;
+	const body = {
+		grant_type: "authorization_code",
+		client_id: options.clientId,
+		code: options.code,
+		redirect_uri: options.redirectUri
+	};
+	if (options.clientSecret) body.client_secret = options.clientSecret;
+	if (options.codeVerifier) body.code_verifier = options.codeVerifier;
+	const response = await fetch(tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const errText = await response.text();
+		throw new Error(`Auth0 token exchange failed (${response.status}): ${errText}`);
+	}
+	return await response.json();
+}
+/**
+* Authenticates directly with Auth0 using Resource Owner Password Credentials (ROPC). Used by
+* headless clients (e.g., Unreal Engine 5) to authenticate without browser redirects.
+*/
+async function loginWithAuth0Password(options) {
+	const tokenUrl = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "")}/oauth/token`;
+	const body = {
+		grant_type: options.realm ? "http://auth0.com/oauth/grant-type/password-realm" : "password",
+		client_id: options.clientId,
+		username: options.username,
+		password: options.password,
+		scope: options.scope || "openid profile email offline_access"
+	};
+	if (options.realm) body.realm = options.realm;
+	if (options.clientSecret) body.client_secret = options.clientSecret;
+	if (options.audience) body.audience = options.audience;
+	const response = await fetch(tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const errText = await response.text();
+		throw new Error(`Auth0 password login failed (${response.status}): ${errText}`);
+	}
+	return await response.json();
+}
+/**
+* Exchanges a refresh token for a new Auth0 access token. Ensures uninterrupted play sessions in
+* native game clients.
+*/
+async function refreshAuth0Token(options) {
+	const tokenUrl = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "")}/oauth/token`;
+	const body = {
+		grant_type: "refresh_token",
+		client_id: options.clientId,
+		refresh_token: options.refreshToken
+	};
+	if (options.clientSecret) body.client_secret = options.clientSecret;
+	if (options.scope) body.scope = options.scope;
+	const response = await fetch(tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	if (!response.ok) {
+		const errText = await response.text();
+		throw new Error(`Auth0 token refresh failed (${response.status}): ${errText}`);
+	}
+	return await response.json();
+}
+/**
+* Generates an Auth0 logout URL
+*/
+function createAuth0LogoutUrl(options) {
+	const cleanDomain = options.domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+	const url = new URL(`https://${cleanDomain}/v2/logout`);
+	url.searchParams.set("client_id", options.clientId);
+	url.searchParams.set("returnTo", options.returnTo);
+	return url.toString();
+}
+function parseCookie(cookieHeader, name) {
+	if (!cookieHeader) return null;
+	const cookies = cookieHeader.split(";");
+	for (const cookie of cookies) {
+		const [k, v] = cookie.trim().split("=");
+		if (k === name && v) return decodeURIComponent(v);
+	}
+	return null;
+}
+/**
+* Auth0 / OIDC Auth Adapter
+*/
+function auth0Auth(options) {
+	const { domain, audience, rolesClaim = "https://rimelight.com/roles", userTypeClaim = "https://rimelight.com/user_type", permissionsClaim = "permissions", sessionCookieName = "rimelight_session", sessionSecret, loginUrl = "/api/auth/login", defaultRole = "user" } = options;
+	return {
+		name: "auth0",
+		options,
+		async getSession(req) {
+			if (!req) return null;
+			const getHeader = (name) => {
+				try {
+					if (req.headers && typeof req.headers.get === "function") return req.headers.get(name);
+					const h = req?.headers;
+					if (h && typeof h === "object") return h[name] || h[name.toLowerCase()] || null;
+				} catch {}
+				return null;
+			};
+			const authHeader = getHeader("authorization");
+			if (authHeader?.startsWith("Bearer ")) {
+				const payload = await verifyAuth0Jwt(authHeader.slice(7).trim(), {
+					domain,
+					audience
+				});
+				if (payload) return mapAuth0PayloadToSession(payload, {
+					rolesClaim,
+					userTypeClaim,
+					permissionsClaim,
+					defaultRole
+				});
+			}
+			const sessionCookie = parseCookie(getHeader("cookie"), sessionCookieName);
+			if (sessionCookie) {
+				if (sessionSecret) {
+					const verified = await verifySessionToken(sessionCookie, sessionSecret);
+					if (verified) return verified;
+				} else {
+					const payload = await verifyAuth0Jwt(sessionCookie, {
+						domain,
+						audience
+					});
+					if (payload) return mapAuth0PayloadToSession(payload, {
+						rolesClaim,
+						userTypeClaim,
+						permissionsClaim,
+						defaultRole
+					});
+				}
+			}
+			return null;
+		},
+		handleUnauthorized(req) {
+			if (loginUrl) {
+				try {
+					if (req && req.url) {
+						const origin = new URL(req.url).origin;
+						const fullUrl = new URL(loginUrl, origin).toString();
+						return Response.redirect(fullUrl, 302);
+					}
+				} catch {}
+				try {
+					return Response.redirect(loginUrl, 302);
+				} catch {
+					return new Response(null, {
+						status: 302,
+						headers: { Location: loginUrl }
+					});
+				}
+			}
+			return new Response("Unauthorized Auth0 Identity", { status: 401 });
+		}
+	};
+}
+function mapAuth0PayloadToSession(payload, options) {
+	const roles = Array.isArray(payload[options.rolesClaim]) ? payload[options.rolesClaim] : Array.isArray(payload.roles) ? payload.roles : [options.defaultRole];
+	const permissions = Array.isArray(payload[options.permissionsClaim]) ? payload[options.permissionsClaim] : Array.isArray(payload.permissions) ? payload.permissions : [];
+	const isStaff = roles.some((r) => [
+		"owner",
+		"admin",
+		"editor",
+		"employee",
+		"superadmin"
+	].includes(r.toLowerCase()));
+	const userType = payload[options.userTypeClaim] || payload.user_type || (isStaff ? "employee" : "user");
+	return {
+		userId: payload.sub || "anonymous",
+		email: payload.email,
+		name: payload.name || payload.nickname || payload.email?.split("@")[0] || "User",
+		avatar: payload.picture,
+		roles,
+		permissions,
+		userType,
+		metadata: payload
+	};
+}
+//#endregion
+export { auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken };

package/dist/adapters/cf-access.d.mts

@@ -0,0 +1,13 @@
+import { AuthAdapter } from "../types.mjs";
+//#region src/adapters/cf-access.d.ts
+interface CfAccessAdapterOptions {
+  aud?: string | undefined;
+  teamDomain?: string | undefined;
+  defaultRole?: string | undefined;
+  adminEmails?: string[] | undefined;
+  verifyJwt?: boolean | undefined;
+  loginUrl?: string | undefined;
+}
+declare function cfAccessAuth(options?: CfAccessAdapterOptions): AuthAdapter;
+//#endregion
+export { CfAccessAdapterOptions, cfAccessAuth };

package/dist/adapters/cf-access.mjs

@@ -0,0 +1,66 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/adapters/cf-access.ts
+function cfAccessAuth(options = {}) {
+	const { aud, teamDomain, defaultRole = "admin", adminEmails = [], verifyJwt = false, loginUrl } = options;
+	let jwks = null;
+	if (teamDomain && verifyJwt) {
+		const certsUrl = new URL(`https://${teamDomain.replace(/^https?:\/\//, "")}/cdn-cgi/access/certs`);
+		jwks = createRemoteJWKSet(certsUrl);
+	}
+	return {
+		name: "cf-access",
+		options,
+		async getSession(req) {
+			const emailHeader = req.headers.get("cf-access-authenticated-user-email");
+			const jwtAssertion = req.headers.get("cf-access-jwt-assertion");
+			if (!emailHeader && !jwtAssertion) return null;
+			let email = emailHeader?.toLowerCase().trim();
+			let name;
+			let customClaims = {};
+			if (jwtAssertion && jwks) try {
+				const verifyOpts = {};
+				if (aud) verifyOpts.audience = aud;
+				if (teamDomain) verifyOpts.issuer = `https://${teamDomain.replace(/^https?:\/\//, "")}`;
+				const { payload } = await jwtVerify(jwtAssertion, jwks, verifyOpts);
+				if (payload.email && typeof payload.email === "string") email = payload.email.toLowerCase().trim();
+				if (payload.name && typeof payload.name === "string") name = payload.name;
+				customClaims = payload;
+			} catch {
+				return null;
+			}
+			const userEmail = email || "cf-access-user";
+			const isAdmin = adminEmails && adminEmails.length > 0 ? adminEmails.map((e) => e.toLowerCase()).includes(userEmail) : true;
+			return {
+				userId: userEmail,
+				email: userEmail,
+				name: name || userEmail.split("@")[0],
+				roles: isAdmin ? [defaultRole] : ["viewer"],
+				permissions: isAdmin ? ["*"] : [],
+				userType: "employee",
+				metadata: customClaims
+			};
+		},
+		handleUnauthorized(req) {
+			if (loginUrl) {
+				try {
+					if (req && req.url) {
+						const origin = new URL(req.url).origin;
+						const fullUrl = new URL(loginUrl, origin).toString();
+						return Response.redirect(fullUrl, 302);
+					}
+				} catch {}
+				try {
+					return Response.redirect(loginUrl, 302);
+				} catch {
+					return new Response(null, {
+						status: 302,
+						headers: { Location: loginUrl }
+					});
+				}
+			}
+			return new Response("Unauthorized Cloudflare Access Identity", { status: 401 });
+		}
+	};
+}
+//#endregion
+export { cfAccessAuth };

package/dist/adapters/mock.d.mts

@@ -0,0 +1,9 @@
+import { AuthAdapter, UserSessionContext } from "../types.mjs";
+//#region src/adapters/mock.d.ts
+interface MockAuthOptions {
+  session?: Partial<UserSessionContext> | null;
+  unauthorizedResponse?: Response;
+}
+declare function mockAuth(options?: MockAuthOptions | Partial<UserSessionContext>): AuthAdapter;
+//#endregion
+export { MockAuthOptions, mockAuth };

package/dist/adapters/mock.mjs

@@ -0,0 +1,31 @@
+//#region src/adapters/mock.ts
+function mockAuth(options = {}) {
+	const opts = "session" in options || "unauthorizedResponse" in options ? options : { session: options };
+	const defaultSession = {
+		userId: "mock-user-id",
+		email: "dev@rimelight.com",
+		name: "Mock Dev User",
+		avatar: "https://cdn.rimelight.com/Images/default_avatar.png",
+		roles: ["admin", "editor"],
+		permissions: ["*"],
+		userType: "employee",
+		metadata: { isMock: true }
+	};
+	return {
+		name: "mock",
+		options: opts,
+		async getSession() {
+			if (opts.session === null) return null;
+			return {
+				...defaultSession,
+				...opts.session
+			};
+		},
+		handleUnauthorized() {
+			if (opts.unauthorizedResponse) return opts.unauthorizedResponse;
+			return new Response("Unauthorized Mock Session", { status: 401 });
+		}
+	};
+}
+//#endregion
+export { mockAuth };

package/dist/index.d.mts

@@ -0,0 +1,8 @@
+import { AuthAdapter, UserSessionContext, UserType } from "./types.mjs";
+import { Auth0AdapterOptions, Auth0AuthorizeUrlOptions, Auth0CodeExchangeOptions, Auth0PasswordLoginOptions, Auth0RefreshTokenOptions, Auth0TokenResponse, auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken } from "./adapters/auth0.mjs";
+import { CfAccessAdapterOptions, cfAccessAuth } from "./adapters/cf-access.mjs";
+import { MockAuthOptions, mockAuth } from "./adapters/mock.mjs";
+import { AccessControl, AccessRole, StatementMap, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc } from "./permissions/index.mjs";
+import { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername } from "./plugins/reserved-usernames/index.mjs";
+import { CONSTRUCTION_GUEST_COOKIE, GuestEnv, isConstructionGuest, signInConstructionGuest } from "./plugins/construction-guest/index.mjs";
+export { AccessControl, AccessRole, Auth0AdapterOptions, Auth0AuthorizeUrlOptions, Auth0CodeExchangeOptions, Auth0PasswordLoginOptions, Auth0RefreshTokenOptions, Auth0TokenResponse, AuthAdapter, CONSTRUCTION_GUEST_COOKIE, CfAccessAdapterOptions, GuestEnv, MockAuthOptions, RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, StatementMap, UserSessionContext, UserType, adminAc, auth0Auth, cfAccessAuth, createAccessControl, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createPermissions, createRestrictedUsernameSet, createSessionToken, decodeJwt, defaultStatements, evaluateAccess, exchangeAuth0Code, hasPermission, hasRole, isConstructionGuest, loginWithAuth0Password, mapAuth0PayloadToSession, memberAc, mockAuth, normalizeUsername, ownerAc, refreshAuth0Token, signInConstructionGuest, verifyAuth0Jwt, verifySessionToken };

package/dist/index.mjs

@@ -0,0 +1,8 @@
+import "./types.mjs";
+import { cfAccessAuth } from "./adapters/cf-access.mjs";
+import { auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken } from "./adapters/auth0.mjs";
+import { mockAuth } from "./adapters/mock.mjs";
+import { AccessControl, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc } from "./permissions/index.mjs";
+import { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername } from "./plugins/reserved-usernames/index.mjs";
+import { CONSTRUCTION_GUEST_COOKIE, isConstructionGuest, signInConstructionGuest } from "./plugins/construction-guest/index.mjs";
+export { AccessControl, CONSTRUCTION_GUEST_COOKIE, RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, adminAc, auth0Auth, cfAccessAuth, createAccessControl, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createPermissions, createRestrictedUsernameSet, createSessionToken, decodeJwt, defaultStatements, evaluateAccess, exchangeAuth0Code, hasPermission, hasRole, isConstructionGuest, loginWithAuth0Password, mapAuth0PayloadToSession, memberAc, mockAuth, normalizeUsername, ownerAc, refreshAuth0Token, signInConstructionGuest, verifyAuth0Jwt, verifySessionToken };

package/dist/permissions/index.d.mts

@@ -0,0 +1,47 @@
+import { UserSessionContext } from "../types.mjs";
+//#region src/permissions/index.d.ts
+declare function hasRole(session: UserSessionContext | null | undefined, requiredRoles: string | string[]): boolean;
+declare function hasPermission(session: UserSessionContext | null | undefined, requiredPermission: string): boolean;
+declare function evaluateAccess(session: UserSessionContext | null | undefined, constraints: {
+  roles?: string[];
+  permission?: string;
+}): boolean;
+type StatementMap = Record<string, readonly string[]>;
+interface AccessRole<TStatements extends StatementMap> {
+  statements: Partial<{ [K in keyof TStatements]: TStatements[K][number][]; }>;
+  can(statement: string, action: string): boolean;
+}
+declare class AccessControl<TStatements extends StatementMap> {
+  readonly statements: TStatements;
+  constructor(statements: TStatements);
+  newRole(permissions: Partial<{ [K in keyof TStatements]: TStatements[K][number][]; }>): AccessRole<TStatements>;
+}
+declare function createAccessControl<const TStatements extends StatementMap>(statements: TStatements): AccessControl<TStatements>;
+declare const defaultStatements: {
+  user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
+};
+declare const ownerAc: {
+  statements: {
+    user: string[];
+  };
+};
+declare const adminAc: {
+  statements: {
+    user: string[];
+  };
+};
+declare const memberAc: {
+  statements: {
+    user: string[];
+  };
+};
+declare function createPermissions<const TStatements extends StatementMap>(statements: TStatements): {
+  ac: AccessControl<{
+    user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
+  } & TStatements>;
+  statements: {
+    user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
+  } & TStatements;
+};
+//#endregion
+export { AccessControl, AccessRole, StatementMap, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc };

package/dist/permissions/index.mjs

@@ -0,0 +1,83 @@
+//#region src/permissions/index.ts
+function hasRole(session, requiredRoles) {
+	if (!session || !session.roles || session.roles.length === 0) return false;
+	const normalized = (Array.isArray(requiredRoles) ? requiredRoles : [requiredRoles]).map((r) => r.toLowerCase());
+	if (normalized.includes("*")) return true;
+	return session.roles.some((r) => normalized.includes(r.toLowerCase()));
+}
+function hasPermission(session, requiredPermission) {
+	if (!session || !session.permissions || session.permissions.length === 0) return false;
+	if (session.permissions.includes("*") || session.permissions.includes("admin")) return true;
+	if (session.permissions.includes(requiredPermission)) return true;
+	const [resource] = requiredPermission.split(":");
+	if (resource && session.permissions.includes(`${resource}:*`)) return true;
+	return false;
+}
+function evaluateAccess(session, constraints) {
+	if (constraints.roles && constraints.roles.length > 0) {
+		if (!hasRole(session, constraints.roles)) return false;
+	}
+	if (constraints.permission) {
+		if (!hasPermission(session, constraints.permission)) return false;
+	}
+	return true;
+}
+var AccessControl = class {
+	statements;
+	constructor(statements) {
+		this.statements = statements;
+	}
+	newRole(permissions) {
+		const stmts = permissions;
+		return {
+			statements: stmts,
+			can(statement, action) {
+				const allowed = stmts[statement] ?? [];
+				return allowed.includes(action) || allowed.includes("*");
+			}
+		};
+	}
+};
+function createAccessControl(statements) {
+	return new AccessControl(statements);
+}
+const defaultStatements = { user: [
+	"create",
+	"list",
+	"set-role",
+	"ban",
+	"impersonate",
+	"delete",
+	"setRole"
+] };
+const ownerAc = { statements: { user: [
+	"create",
+	"list",
+	"set-role",
+	"ban",
+	"impersonate",
+	"delete",
+	"setRole"
+] } };
+const adminAc = { statements: { user: [
+	"create",
+	"list",
+	"set-role",
+	"ban",
+	"impersonate",
+	"delete",
+	"setRole"
+] } };
+const memberAc = { statements: { user: ["create", "list"] } };
+function createPermissions(statements) {
+	const mergedStatements = {
+		...defaultStatements,
+		...statements
+	};
+	return {
+		ac: createAccessControl(mergedStatements),
+		statements: mergedStatements
+	};
+}
+//#endregion
+export { AccessControl, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc };

package/dist/plugins/construction-guest/index.d.mts

@@ -0,0 +1,9 @@
+//#region src/plugins/construction-guest/index.d.ts
+declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
+type GuestEnv = {
+  CONSTRUCTION_PASSPHRASE?: string;
+};
+declare const isConstructionGuest: (c: any) => Promise<boolean>;
+declare const signInConstructionGuest: (c: any, passphrase: string, rememberMe?: boolean) => Promise<boolean>;
+//#endregion
+export { CONSTRUCTION_GUEST_COOKIE, GuestEnv, isConstructionGuest, signInConstructionGuest };