@rpcbase/db 0.75.0 → 0.76.0

package/dist/acl/index.js

@@ -1,13 +1,109 @@
-import { b, d, f, e, g, c, h, a, r } from "../can--Y-1LK22.js";
-export {
-  b as buildAbility,
-  d as buildAbilityFromSession,
-  f as can,
-  e as getAccessibleByQuery,
-  g as getRegisteredPolicies,
-  c as getTenantRolesFromSessionUser,
-  h as hasRegisteredPolicy,
-  a as registerPoliciesFromModules,
-  r as registerPolicy
-};
-//# sourceMappingURL=index.js.map
+import { AbilityBuilder, createMongoAbility, subject } from "@casl/ability";
+import { accessibleBy } from "@casl/mongoose";
+//#region src/acl/registry.ts
+var POLICIES_GLOBAL_KEY = Symbol.for("@rpcbase/db/acl/policiesBySubject");
+var getGlobalPoliciesMap = () => {
+	const store = globalThis;
+	const existing = store[POLICIES_GLOBAL_KEY];
+	if (existing instanceof Map) return existing;
+	const created = /* @__PURE__ */ new Map();
+	store[POLICIES_GLOBAL_KEY] = created;
+	return created;
+};
+var policiesBySubject = getGlobalPoliciesMap();
+var isPolicy = (value) => {
+	if (!value || typeof value !== "object") return false;
+	const maybe = value;
+	return typeof maybe.subject === "string" && typeof maybe.define === "function";
+};
+var registerPolicy = (policy) => {
+	const set = policiesBySubject.get(policy.subject) ?? /* @__PURE__ */ new Set();
+	set.add(policy.define);
+	policiesBySubject.set(policy.subject, set);
+};
+var registerPoliciesFromModules = (modules) => {
+	for (const [exportName, value] of Object.entries(modules)) {
+		if (!isPolicy(value)) continue;
+		if (!exportName.endsWith("Policy")) throw new Error(`Invalid policy export name "${exportName}". Policies must be exported as "<ModelName>Policy".`);
+		const expectedSubject = exportName.slice(0, -6);
+		if (value.subject !== expectedSubject) throw new Error(`Invalid policy "${exportName}": expected subject "${expectedSubject}", got "${value.subject}".`);
+		registerPolicy(value);
+	}
+};
+var getRegisteredPolicies = () => {
+	const out = [];
+	for (const set of policiesBySubject.values()) for (const fn of set) out.push(fn);
+	return out;
+};
+var hasRegisteredPolicy = (subject) => {
+	return policiesBySubject.has(subject);
+};
+//#endregion
+//#region src/acl/buildAbility.ts
+var buildAbility = (ctx) => {
+	const builder = new AbilityBuilder(createMongoAbility);
+	const { can } = builder;
+	if (ctx.roles.includes("owner") || ctx.roles.includes("admin")) can("manage", "all");
+	for (const define of getRegisteredPolicies()) define(builder, ctx);
+	return builder.build();
+};
+//#endregion
+//#region src/acl/session.ts
+var normalizeRole = (raw) => {
+	if (typeof raw !== "string") return null;
+	const normalized = raw.trim();
+	return normalized ? normalized : null;
+};
+var normalizeRoles = (raw) => {
+	if (Array.isArray(raw)) return raw.map(normalizeRole).filter((r) => Boolean(r));
+	const role = normalizeRole(raw);
+	return role ? [role] : [];
+};
+var normalizeRolesByTenantId = (raw) => {
+	if (!raw || typeof raw !== "object") return null;
+	if (raw instanceof Map) return Object.fromEntries(Array.from(raw.entries()).map(([key, value]) => [String(key), normalizeRoles(value)]));
+	const obj = raw;
+	const out = {};
+	for (const [key, value] of Object.entries(obj)) {
+		const tenantId = String(key).trim();
+		if (!tenantId) continue;
+		out[tenantId] = normalizeRoles(value);
+	}
+	return out;
+};
+var getTenantRolesFromSessionUser = (user, tenantId) => {
+	if (!user || typeof user !== "object") return [];
+	const rolesByTenantId = normalizeRolesByTenantId(user.tenantRoles);
+	if (!rolesByTenantId) return [];
+	return rolesByTenantId[tenantId]?.filter(Boolean) ?? [];
+};
+var buildAbilityFromSession = ({ tenantId, session, claims }) => {
+	const user = session?.user;
+	const userId = typeof user?.id === "string" ? user.id.trim() : "";
+	const rolesByTenantId = normalizeRolesByTenantId(user?.tenantRoles);
+	const hasExplicitTenantEntry = Boolean(rolesByTenantId && Object.prototype.hasOwnProperty.call(rolesByTenantId, tenantId));
+	const signedInTenantsRaw = user?.signedInTenants;
+	const signedInTenants = Array.isArray(signedInTenantsRaw) ? signedInTenantsRaw.map(String) : [];
+	const roles = hasExplicitTenantEntry ? rolesByTenantId[tenantId] ?? [] : userId && signedInTenants.includes(tenantId) ? ["owner"] : getTenantRolesFromSessionUser(user, tenantId);
+	return buildAbility({
+		tenantId,
+		userId: userId || null,
+		roles,
+		claims
+	});
+};
+//#endregion
+//#region src/acl/accessible.ts
+var getAccessibleByQuery = (ability, action, subject) => {
+	return accessibleBy(ability, action).ofType(subject);
+};
+//#endregion
+//#region src/acl/can.ts
+var can = (ability, action, subjectType, object) => {
+	if (object && typeof object === "object") return ability.can(action, subject(subjectType, object));
+	return ability.can(action, subjectType);
+};
+//#endregion
+export { buildAbility, buildAbilityFromSession, can, getAccessibleByQuery, getRegisteredPolicies, getTenantRolesFromSessionUser, hasRegisteredPolicy, registerPoliciesFromModules, registerPolicy };
+
+//# sourceMappingURL=index.js.map

package/dist/acl/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}
+{"version":3,"file":"index.js","names":["AbilityBuilder","AclContext","AclSubjectType","AppAbility","AclPolicy","subject","Exclude","define","builder","ctx","POLICIES_GLOBAL_KEY","Symbol","for","getGlobalPoliciesMap","Map","Set","store","globalThis","Record","existing","created","policiesBySubject","isPolicy","value","maybe","Partial","registerPolicy","policy","set","get","add","registerPoliciesFromModules","modules","exportName","Object","entries","endsWith","Error","expectedSubject","slice","length","getRegisteredPolicies","Array","out","values","fn","push","hasRegisteredPolicy","has","AbilityBuilder","createMongoAbility","getRegisteredPolicies","AclContext","AppAbility","buildAbility","ctx","builder","can","roles","includes","define","build","buildAbility","AppAbility","TenantRolesByTenantId","SessionUserLike","id","signedInTenants","tenantRoles","SessionLike","user","normalizeRole","raw","normalized","trim","normalizeRoles","Array","isArray","map","filter","r","Boolean","role","normalizeRolesByTenantId","Map","Object","fromEntries","from","entries","key","value","String","obj","Record","out","tenantId","getTenantRolesFromSessionUser","rolesByTenantId","buildAbilityFromSession","session","claims","userId","hasExplicitTenantEntry","prototype","hasOwnProperty","call","signedInTenantsRaw","roles","includes","accessibleBy","AclAction","AclSubjectType","AppAbility","getAccessibleByQuery","ability","action","subject","Exclude","Record","ofType","subject","AclAction","AclSubject","AclSubjectMap","AclSubjectType","AppAbility","can","Exclude","ability","action","subjectType","TSubject","object","Partial"],"sources":["../../src/acl/registry.ts","../../src/acl/buildAbility.ts","../../src/acl/session.ts","../../src/acl/accessible.ts","../../src/acl/can.ts"],"sourcesContent":["import type { AbilityBuilder } from \"@casl/ability\"\n\nimport type { AclContext, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport type AclPolicy = {\n  subject: Exclude<AclSubjectType, \"all\">\n  define: (builder: AbilityBuilder<AppAbility>, ctx: AclContext) => void\n}\n\nconst POLICIES_GLOBAL_KEY = Symbol.for(\"@rpcbase/db/acl/policiesBySubject\")\n\nconst getGlobalPoliciesMap = (): Map<string, Set<AclPolicy[\"define\"]>> => {\n  const store = globalThis as unknown as Record<symbol, unknown>\n  const existing = store[POLICIES_GLOBAL_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Set<AclPolicy[\"define\"]>>\n  }\n  const created = new Map<string, Set<AclPolicy[\"define\"]>>()\n  store[POLICIES_GLOBAL_KEY] = created\n  return created\n}\n\nconst policiesBySubject = getGlobalPoliciesMap()\n\nconst isPolicy = (value: unknown): value is AclPolicy => {\n  if (!value || typeof value !== \"object\") return false\n  const maybe = value as Partial<AclPolicy>\n  return typeof maybe.subject === \"string\" && typeof maybe.define === \"function\"\n}\n\nexport const registerPolicy = (policy: AclPolicy): void => {\n  const set = policiesBySubject.get(policy.subject) ?? new Set<AclPolicy[\"define\"]>()\n  set.add(policy.define)\n  policiesBySubject.set(policy.subject, set)\n}\n\nexport const registerPoliciesFromModules = (modules: Record<string, unknown>): void => {\n  for (const [exportName, value] of Object.entries(modules)) {\n    if (!isPolicy(value)) continue\n\n    if (!exportName.endsWith(\"Policy\")) {\n      throw new Error(\n        `Invalid policy export name \"${exportName}\". Policies must be exported as \"<ModelName>Policy\".`,\n      )\n    }\n\n    const expectedSubject = exportName.slice(0, -(\"Policy\".length))\n    if (value.subject !== expectedSubject) {\n      throw new Error(\n        `Invalid policy \"${exportName}\": expected subject \"${expectedSubject}\", got \"${value.subject}\".`,\n      )\n    }\n\n    registerPolicy(value)\n  }\n}\n\nexport const getRegisteredPolicies = (): Array<AclPolicy[\"define\"]> => {\n  const out: Array<AclPolicy[\"define\"]> = []\n  for (const set of policiesBySubject.values()) {\n    for (const fn of set) out.push(fn)\n  }\n  return out\n}\n\nexport const hasRegisteredPolicy = (subject: string): boolean => {\n  return policiesBySubject.has(subject)\n}\n","import { AbilityBuilder, createMongoAbility } from \"@casl/ability\"\n\nimport { getRegisteredPolicies } from \"./registry\"\nimport type { AclContext, AppAbility } from \"./types\"\n\n\nexport const buildAbility = (ctx: AclContext): AppAbility => {\n  const builder = new AbilityBuilder<AppAbility>(createMongoAbility)\n\n  const { can } = builder\n\n  if (ctx.roles.includes(\"owner\") || ctx.roles.includes(\"admin\")) {\n    can(\"manage\", \"all\")\n  }\n\n  for (const define of getRegisteredPolicies()) {\n    define(builder, ctx)\n  }\n\n  return builder.build()\n}\n\n","import { buildAbility } from \"./buildAbility\"\nimport type { AppAbility, TenantRolesByTenantId } from \"./types\"\n\n\ntype SessionUserLike = {\n  id?: unknown\n  signedInTenants?: unknown\n  tenantRoles?: unknown\n}\n\ntype SessionLike = {\n  user?: SessionUserLike\n}\n\nconst normalizeRole = (raw: unknown): string | null => {\n  if (typeof raw !== \"string\") return null\n  const normalized = raw.trim()\n  return normalized ? normalized : null\n}\n\nconst normalizeRoles = (raw: unknown): string[] => {\n  if (Array.isArray(raw)) {\n    return raw.map(normalizeRole).filter((r): r is string => Boolean(r))\n  }\n  const role = normalizeRole(raw)\n  return role ? [role] : []\n}\n\nconst normalizeRolesByTenantId = (raw: unknown): TenantRolesByTenantId | null => {\n  if (!raw || typeof raw !== \"object\") return null\n  if (raw instanceof Map) {\n    return Object.fromEntries(Array.from(raw.entries()).map(([key, value]) => [String(key), normalizeRoles(value)]))\n  }\n  const obj = raw as Record<string, unknown>\n  const out: TenantRolesByTenantId = {}\n  for (const [key, value] of Object.entries(obj)) {\n    const tenantId = String(key).trim()\n    if (!tenantId) continue\n    out[tenantId] = normalizeRoles(value)\n  }\n  return out\n}\n\nexport const getTenantRolesFromSessionUser = (user: unknown, tenantId: string): string[] => {\n  if (!user || typeof user !== \"object\") return []\n  const rolesByTenantId = normalizeRolesByTenantId((user as SessionUserLike).tenantRoles)\n  if (!rolesByTenantId) return []\n  return rolesByTenantId[tenantId]?.filter(Boolean) ?? []\n}\n\nexport const buildAbilityFromSession = ({\n  tenantId,\n  session,\n  claims,\n}: {\n  tenantId: string\n  session: SessionLike | null | undefined\n  claims?: Record<string, unknown>\n}): AppAbility => {\n  const user = session?.user\n  const userId = typeof user?.id === \"string\" ? user.id.trim() : \"\"\n  const rolesByTenantId = normalizeRolesByTenantId(user?.tenantRoles)\n  const hasExplicitTenantEntry = Boolean(\n    rolesByTenantId && Object.prototype.hasOwnProperty.call(rolesByTenantId, tenantId),\n  )\n\n  const signedInTenantsRaw = user?.signedInTenants\n  const signedInTenants = Array.isArray(signedInTenantsRaw) ? signedInTenantsRaw.map(String) : []\n\n  const roles = hasExplicitTenantEntry\n    ? rolesByTenantId![tenantId] ?? []\n    : userId && signedInTenants.includes(tenantId)\n      ? [\"owner\"]\n      : getTenantRolesFromSessionUser(user, tenantId)\n\n  return buildAbility({\n    tenantId,\n    userId: userId || null,\n    roles,\n    claims,\n  })\n}\n","import { accessibleBy } from \"@casl/mongoose\"\n\nimport type { AclAction, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const getAccessibleByQuery = (\n  ability: AppAbility,\n  action: AclAction,\n  subject: Exclude<AclSubjectType, \"all\">,\n): Record<string, unknown> => {\n  return accessibleBy(ability, action).ofType(subject)\n}\n","import { subject } from \"@casl/ability\"\n\nimport type { AclAction, AclSubject, AclSubjectMap, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const can = <TSubject extends Exclude<AclSubjectType, \"all\">>(\n  ability: AppAbility,\n  action: AclAction,\n  subjectType: TSubject,\n  object?: Partial<AclSubjectMap[TSubject]> | null,\n): boolean => {\n  if (object && typeof object === \"object\") {\n    return ability.can(action, subject(subjectType, object) as unknown as AclSubject)\n  }\n  return ability.can(action, subjectType)\n}\n"],"mappings":";;;AAUA,IAAMU,sBAAsBC,OAAOC,IAAI,oCAAoC;AAE3E,IAAMC,6BAAoE;CACxE,MAAMG,QAAQC;CACd,MAAME,WAAWH,MAAMN;AACvB,KAAIS,oBAAoBL,IACtB,QAAOK;CAET,MAAMC,0BAAU,IAAIN,KAAuC;AAC3DE,OAAMN,uBAAuBU;AAC7B,QAAOA;;AAGT,IAAMC,oBAAoBR,sBAAsB;AAEhD,IAAMS,YAAYC,UAAuC;AACvD,KAAI,CAACA,SAAS,OAAOA,UAAU,SAAU,QAAO;CAChD,MAAMC,QAAQD;AACd,QAAO,OAAOC,MAAMnB,YAAY,YAAY,OAAOmB,MAAMjB,WAAW;;AAGtE,IAAamB,kBAAkBC,WAA4B;CACzD,MAAMC,MAAMP,kBAAkBQ,IAAIF,OAAOtB,QAAQ,oBAAI,IAAIU,KAA0B;AACnFa,KAAIE,IAAIH,OAAOpB,OAAO;AACtBc,mBAAkBO,IAAID,OAAOtB,SAASuB,IAAI;;AAG5C,IAAaG,+BAA+BC,YAA2C;AACrF,MAAK,MAAM,CAACC,YAAYV,UAAUW,OAAOC,QAAQH,QAAQ,EAAE;AACzD,MAAI,CAACV,SAASC,MAAM,CAAE;AAEtB,MAAI,CAACU,WAAWG,SAAS,SAAS,CAChC,OAAM,IAAIC,MACR,+BAA+BJ,WAAU,sDAC1C;EAGH,MAAMK,kBAAkBL,WAAWM,MAAM,GAAG,GAAmB;AAC/D,MAAIhB,MAAMlB,YAAYiC,gBACpB,OAAM,IAAID,MACR,mBAAmBJ,WAAU,uBAAwBK,gBAAe,UAAWf,MAAMlB,QAAO,IAC7F;AAGHqB,iBAAeH,MAAM;;;AAIzB,IAAakB,8BAA0D;CACrE,MAAME,MAAkC,EAAE;AAC1C,MAAK,MAAMf,OAAOP,kBAAkBuB,QAAQ,CAC1C,MAAK,MAAMC,MAAMjB,IAAKe,KAAIG,KAAKD,GAAG;AAEpC,QAAOF;;AAGT,IAAaI,uBAAuB1C,YAA6B;AAC/D,QAAOgB,kBAAkB2B,IAAI3C,QAAQ;;;;AC7DvC,IAAaiD,gBAAgBC,QAAgC;CAC3D,MAAMC,UAAU,IAAIP,eAA2BC,mBAAmB;CAElE,MAAM,EAAEO,QAAQD;AAEhB,KAAID,IAAIG,MAAMC,SAAS,QAAQ,IAAIJ,IAAIG,MAAMC,SAAS,QAAQ,CAC5DF,KAAI,UAAU,MAAM;AAGtB,MAAK,MAAMG,UAAUT,uBAAuB,CAC1CS,QAAOJ,SAASD,IAAI;AAGtB,QAAOC,QAAQK,OAAO;;;;ACLxB,IAAMU,iBAAiBC,QAAgC;AACrD,KAAI,OAAOA,QAAQ,SAAU,QAAO;CACpC,MAAMC,aAAaD,IAAIE,MAAM;AAC7B,QAAOD,aAAaA,aAAa;;AAGnC,IAAME,kBAAkBH,QAA2B;AACjD,KAAII,MAAMC,QAAQL,IAAI,CACpB,QAAOA,IAAIM,IAAIP,cAAc,CAACQ,QAAQC,MAAmBC,QAAQD,EAAE,CAAC;CAEtE,MAAME,OAAOX,cAAcC,IAAI;AAC/B,QAAOU,OAAO,CAACA,KAAK,GAAG,EAAE;;AAG3B,IAAMC,4BAA4BX,QAA+C;AAC/E,KAAI,CAACA,OAAO,OAAOA,QAAQ,SAAU,QAAO;AAC5C,KAAIA,eAAeY,IACjB,QAAOC,OAAOC,YAAYV,MAAMW,KAAKf,IAAIgB,SAAS,CAAC,CAACV,KAAK,CAACW,KAAKC,WAAW,CAACC,OAAOF,IAAI,EAAEd,eAAee,MAAM,CAAC,CAAC,CAAC;CAElH,MAAME,MAAMpB;CACZ,MAAMsB,MAA6B,EAAE;AACrC,MAAK,MAAM,CAACL,KAAKC,UAAUL,OAAOG,QAAQI,IAAI,EAAE;EAC9C,MAAMG,WAAWJ,OAAOF,IAAI,CAACf,MAAM;AACnC,MAAI,CAACqB,SAAU;AACfD,MAAIC,YAAYpB,eAAee,MAAM;;AAEvC,QAAOI;;AAGT,IAAaE,iCAAiC1B,MAAeyB,aAA+B;AAC1F,KAAI,CAACzB,QAAQ,OAAOA,SAAS,SAAU,QAAO,EAAE;CAChD,MAAM2B,kBAAkBd,yBAA0Bb,KAAyBF,YAAY;AACvF,KAAI,CAAC6B,gBAAiB,QAAO,EAAE;AAC/B,QAAOA,gBAAgBF,WAAWhB,OAAOE,QAAQ,IAAI,EAAE;;AAGzD,IAAaiB,2BAA2B,EACtCH,UACAI,SACAC,aAKgB;CAChB,MAAM9B,OAAO6B,SAAS7B;CACtB,MAAM+B,SAAS,OAAO/B,MAAMJ,OAAO,WAAWI,KAAKJ,GAAGQ,MAAM,GAAG;CAC/D,MAAMuB,kBAAkBd,yBAAyBb,MAAMF,YAAY;CACnE,MAAMkC,yBAAyBrB,QAC7BgB,mBAAmBZ,OAAOkB,UAAUC,eAAeC,KAAKR,iBAAiBF,SAC3E,CAAC;CAED,MAAMW,qBAAqBpC,MAAMH;CACjC,MAAMA,kBAAkBS,MAAMC,QAAQ6B,mBAAmB,GAAGA,mBAAmB5B,IAAIa,OAAO,GAAG,EAAE;CAE/F,MAAMgB,QAAQL,yBACVL,gBAAiBF,aAAa,EAAE,GAChCM,UAAUlC,gBAAgByC,SAASb,SAAS,GAC1C,CAAC,QAAQ,GACTC,8BAA8B1B,MAAMyB,SAAS;AAEnD,QAAOjC,aAAa;EAClBiC;EACAM,QAAQA,UAAU;EAClBM;EACAP;EACD,CAAC;;;;AC3EJ,IAAaa,wBACXC,SACAC,QACAC,YAC4B;AAC5B,QAAOP,aAAaK,SAASC,OAAO,CAACI,OAAOH,QAAQ;;;;ACLtD,IAAaU,OACXE,SACAC,QACAC,aACAE,WACY;AACZ,KAAIA,UAAU,OAAOA,WAAW,SAC9B,QAAOJ,QAAQF,IAAIG,QAAQT,QAAQU,aAAaE,OAAO,CAA0B;AAEnF,QAAOJ,QAAQF,IAAIG,QAAQC,YAAY"}

package/dist/index.browser.js

@@ -1,16 +1,2 @@
-import { a, E, L, c, e, m, r, w, z, b, f, d } from "./index-g1_0RZ-U.js";
-export {
-  a as E164_PHONE_OR_EMPTY_REGEX,
-  E as E164_PHONE_REGEX,
-  L as LANGUAGE_CODE_REGEX,
-  c as buildLocaleFallbackChain,
-  e as extendZod,
-  m as makeZE164Phone,
-  r as resolveLocalizedString,
-  w as withLocalizedStringFallback,
-  z,
-  b as zE164Phone,
-  f as zI18nString,
-  d as zLocalizedString
-};
-//# sourceMappingURL=index.browser.js.map
+import { a as makeZE164Phone, c as buildLocaleFallbackChain, d as zI18nString, f as zLocalizedString, i as E164_PHONE_REGEX, l as resolveLocalizedString, n as extendZod, o as zE164Phone, r as E164_PHONE_OR_EMPTY_REGEX, s as LANGUAGE_CODE_REGEX, t as z, u as withLocalizedStringFallback } from "./zod-Co_dG17m.js";
+export { E164_PHONE_OR_EMPTY_REGEX, E164_PHONE_REGEX, LANGUAGE_CODE_REGEX, buildLocaleFallbackChain, extendZod, makeZE164Phone, resolveLocalizedString, withLocalizedStringFallback, z, zE164Phone, zI18nString, zLocalizedString };