@sapl/nestjs 1.0.0

package/dist/pdp.service.js

@@ -0,0 +1,296 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PdpService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PdpService = void 0;
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const sapl_constants_1 = require("./sapl.constants");
+const DEEP_EQUAL_MAX_DEPTH = 20;
+function deepEqual(a, b, depth = 0) {
+    if (depth > DEEP_EQUAL_MAX_DEPTH)
+        return false;
+    if (a === b)
+        return true;
+    if (a == null || b == null)
+        return a === b;
+    if (typeof a !== typeof b)
+        return false;
+    if (typeof a !== 'object')
+        return false;
+    if (Array.isArray(a)) {
+        return Array.isArray(b) && a.length === b.length && a.every((v, i) => deepEqual(v, b[i], depth + 1));
+    }
+    if (Array.isArray(b))
+        return false;
+    const keysA = Object.keys(a);
+    const keysB = Object.keys(b);
+    if (keysA.length !== keysB.length)
+        return false;
+    return keysA.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepEqual(a[k], b[k], depth + 1));
+}
+const DEFAULT_TIMEOUT_MS = 5000;
+const MAX_BUFFER_SIZE = 1_048_576; // 1 MB
+const MAX_LOG_BODY_LENGTH = 500;
+const DEFAULT_RETRY_BASE_DELAY_MS = 1000;
+const DEFAULT_RETRY_MAX_DELAY_MS = 30000;
+const RETRY_ESCALATION_THRESHOLD = 5;
+const VALID_DECISIONS = new Set(['PERMIT', 'DENY', 'INDETERMINATE', 'NOT_APPLICABLE']);
+function validateDecision(raw, logger) {
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        logger.warn('PDP response is not an object, returning INDETERMINATE');
+        return { decision: 'INDETERMINATE' };
+    }
+    const obj = raw;
+    if (typeof obj.decision !== 'string' || !VALID_DECISIONS.has(obj.decision)) {
+        logger.warn(`PDP response has invalid decision field: ${JSON.stringify(obj.decision)}, returning INDETERMINATE`);
+        return { decision: 'INDETERMINATE' };
+    }
+    const result = { decision: obj.decision };
+    if (Array.isArray(obj.obligations))
+        result.obligations = obj.obligations;
+    if (Array.isArray(obj.advice))
+        result.advice = obj.advice;
+    if (obj.resource !== undefined)
+        result.resource = obj.resource;
+    return result;
+}
+let PdpService = PdpService_1 = class PdpService {
+    constructor(options) {
+        this.options = options;
+        this.logger = new common_1.Logger(PdpService_1.name);
+        const parsedUrl = new URL(this.options.baseUrl);
+        if (parsedUrl.protocol === 'http:') {
+            if (!this.options.allowInsecureConnections) {
+                throw new Error(`PDP base URL uses HTTP (${this.options.baseUrl}). ` +
+                    'SAPL PDP communication carries authorization decisions and potentially sensitive information. ' +
+                    'Use HTTPS or set allowInsecureConnections: true to accept the risk.');
+            }
+            this.logger.warn('PDP connection uses unencrypted HTTP. Authorization decisions and potentially sensitive ' +
+                'information are transmitted in plaintext. Do not use HTTP in production.');
+        }
+        this.decideOnceUrl = new URL('/api/pdp/decide-once', this.options.baseUrl).toString();
+        this.decideUrl = new URL('/api/pdp/decide', this.options.baseUrl).toString();
+        this.timeoutMs = options.timeout ?? DEFAULT_TIMEOUT_MS;
+        this.retryBaseDelay = options.streamingRetryBaseDelay ?? DEFAULT_RETRY_BASE_DELAY_MS;
+        this.retryMaxDelay = options.streamingRetryMaxDelay ?? DEFAULT_RETRY_MAX_DELAY_MS;
+        this.maxRetries = options.streamingMaxRetries ?? Infinity;
+        this.logger.log(`PDP configured at ${this.options.baseUrl}`);
+    }
+    async decideOnce(subscription) {
+        const { secrets, ...safeForLog } = subscription;
+        const body = JSON.stringify(subscription);
+        this.logger.debug(`Requesting decision: ${JSON.stringify(safeForLog)}`);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            if (this.options.token) {
+                headers['Authorization'] = `Bearer ${this.options.token}`;
+            }
+            const response = await fetch(this.decideOnceUrl, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                let responseBody = '';
+                try {
+                    responseBody = await response.text();
+                }
+                catch {
+                    /* ignore unreadable body */
+                }
+                this.logger.error(`PDP returned HTTP ${response.status} (${response.statusText}) ` +
+                    `for ${this.decideOnceUrl}` +
+                    (responseBody
+                        ? ` -- body: ${responseBody.length > MAX_LOG_BODY_LENGTH ? responseBody.substring(0, MAX_LOG_BODY_LENGTH) + '...' : responseBody}`
+                        : ''));
+                return { decision: 'INDETERMINATE' };
+            }
+            const decision = await response.json();
+            this.logger.debug(`Decision: ${JSON.stringify(decision)}`);
+            return validateDecision(decision, this.logger);
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === 'AbortError') {
+                this.logger.error(`PDP request to ${this.decideOnceUrl} timed out after ${this.timeoutMs}ms`);
+            }
+            else {
+                const msg = error instanceof Error ? error.message : String(error);
+                this.logger.error(`PDP request to ${this.decideOnceUrl} failed: ${msg}`);
+            }
+            return { decision: 'INDETERMINATE' };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    decide(subscription) {
+        const { secrets, ...safeForLog } = subscription;
+        const body = JSON.stringify(subscription);
+        this.logger.debug(`Streaming subscription: ${JSON.stringify(safeForLog)}`);
+        const singleAttempt$ = new rxjs_1.Observable((subscriber) => {
+            const controller = new AbortController();
+            let reader = null;
+            const connectTimeout = setTimeout(() => controller.abort(), this.timeoutMs);
+            const headers = {
+                'Content-Type': 'application/json',
+                'Accept': 'application/x-ndjson',
+            };
+            if (this.options.token) {
+                headers['Authorization'] = `Bearer ${this.options.token}`;
+            }
+            fetch(this.decideUrl, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal,
+            }).then(async (response) => {
+                clearTimeout(connectTimeout);
+                if (!response.ok) {
+                    let responseBody = '';
+                    try {
+                        responseBody = await response.text();
+                    }
+                    catch {
+                        /* ignore unreadable body */
+                    }
+                    this.logger.error(`PDP returned HTTP ${response.status} (${response.statusText}) ` +
+                        `for ${this.decideUrl}` +
+                        (responseBody
+                            ? ` -- body: ${responseBody.length > MAX_LOG_BODY_LENGTH ? responseBody.substring(0, MAX_LOG_BODY_LENGTH) + '...' : responseBody}`
+                            : ''));
+                    subscriber.next({ decision: 'INDETERMINATE' });
+                    subscriber.error(new Error(`PDP returned HTTP ${response.status}`));
+                    return;
+                }
+                if (!response.body) {
+                    this.logger.error('PDP streaming response has no body');
+                    subscriber.next({ decision: 'INDETERMINATE' });
+                    subscriber.error(new Error('PDP streaming response has no body'));
+                    return;
+                }
+                reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                let buffer = '';
+                try {
+                    while (true) {
+                        const { done, value } = await reader.read();
+                        if (done)
+                            break;
+                        buffer += decoder.decode(value, { stream: true });
+                        if (buffer.length > MAX_BUFFER_SIZE) {
+                            this.logger.error(`PDP streaming buffer exceeded ${MAX_BUFFER_SIZE} bytes. ` +
+                                'Aborting connection to prevent memory exhaustion.');
+                            subscriber.next({ decision: 'INDETERMINATE' });
+                            subscriber.error(new Error('PDP streaming buffer overflow'));
+                            return;
+                        }
+                        const lines = buffer.split('\n');
+                        buffer = lines.pop() ?? '';
+                        for (const line of lines) {
+                            const trimmed = line.trim();
+                            if (trimmed.startsWith(':') || trimmed === '')
+                                continue;
+                            const data = trimmed.startsWith('data:')
+                                ? trimmed.slice(5).trim()
+                                : trimmed;
+                            if (data === '')
+                                continue;
+                            try {
+                                const decision = JSON.parse(data);
+                                this.logger.debug(`Streaming decision: ${JSON.stringify(decision)}`);
+                                subscriber.next(validateDecision(decision, this.logger));
+                            }
+                            catch (parseError) {
+                                this.logger.warn(`Failed to parse streaming data: ${data}`);
+                            }
+                        }
+                    }
+                    const trailing = buffer.trim();
+                    if (trailing !== '') {
+                        const data = trailing.startsWith('data:')
+                            ? trailing.slice(5).trim()
+                            : trailing;
+                        if (data !== '') {
+                            try {
+                                const decision = JSON.parse(data);
+                                subscriber.next(validateDecision(decision, this.logger));
+                            }
+                            catch {
+                                /* ignore trailing partial data */
+                            }
+                        }
+                    }
+                    // PDP closed the stream -- fail closed and let retry reconnect
+                    subscriber.next({ decision: 'INDETERMINATE' });
+                    subscriber.error(new Error('PDP decision stream ended unexpectedly'));
+                }
+                catch (error) {
+                    if (controller.signal.aborted)
+                        return;
+                    const msg = error instanceof Error ? error.message : String(error);
+                    this.logger.error(`PDP streaming read failed: ${msg}`);
+                    subscriber.next({ decision: 'INDETERMINATE' });
+                    subscriber.error(error);
+                }
+            }).catch((error) => {
+                clearTimeout(connectTimeout);
+                if (controller.signal.aborted)
+                    return;
+                if (error instanceof Error && error.name === 'AbortError') {
+                    this.logger.error(`PDP streaming connection to ${this.decideUrl} timed out after ${this.timeoutMs}ms`);
+                }
+                else {
+                    const msg = error instanceof Error ? error.message : String(error);
+                    this.logger.error(`PDP streaming request to ${this.decideUrl} failed: ${msg}`);
+                }
+                subscriber.next({ decision: 'INDETERMINATE' });
+                subscriber.error(error);
+            });
+            return () => {
+                clearTimeout(connectTimeout);
+                reader?.cancel().catch(() => { });
+                controller.abort();
+            };
+        });
+        return singleAttempt$.pipe((0, rxjs_1.retry)({
+            count: this.maxRetries,
+            delay: (_error, retryCount) => {
+                const baseDelay = Math.min(this.retryBaseDelay * Math.pow(2, retryCount - 1), this.retryMaxDelay);
+                const delay = Math.round(baseDelay * (0.5 + Math.random() * 0.5));
+                const message = `PDP streaming connection lost, reconnecting in ${delay}ms` +
+                    ` (attempt ${retryCount}${this.maxRetries === Infinity ? '' : `/${this.maxRetries}`})`;
+                if (retryCount >= RETRY_ESCALATION_THRESHOLD) {
+                    this.logger.error(message);
+                }
+                else {
+                    this.logger.warn(message);
+                }
+                return (0, rxjs_1.timer)(delay);
+            },
+        }), (0, rxjs_1.distinctUntilChanged)(deepEqual));
+    }
+};
+exports.PdpService = PdpService;
+exports.PdpService = PdpService = PdpService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(sapl_constants_1.SAPL_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], PdpService);
+//# sourceMappingURL=pdp.service.js.map

package/dist/pdp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdp.service.js","sourceRoot":"","sources":["../lib/pdp.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,+BAAsE;AACtE,qDAAuD;AAIvD,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,SAAS,SAAS,CAAC,CAAM,EAAE,CAAM,EAAE,KAAK,GAAG,CAAC;IAC1C,IAAI,KAAK,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,OAAO;AAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF,SAAS,gBAAgB,CAAC,GAAY,EAAE,MAAc;IACpD,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CACT,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CACpG,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAA0B,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAoB,EAAE,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAGM,IAAM,UAAU,kBAAhB,MAAM,UAAU;IASrB,YAEE,OAA2C;QAA1B,YAAO,GAAP,OAAO,CAAmB;QAV5B,WAAM,GAAG,IAAI,eAAM,CAAC,YAAU,CAAC,IAAI,CAAC,CAAC;QAYpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK;oBACpD,gGAAgG;oBAChG,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0FAA0F;gBAC1F,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtF,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,uBAAuB,IAAI,2BAA2B,CAAC;QACrF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,sBAAsB,IAAI,0BAA0B,CAAC;QAClF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,mBAAmB,IAAI,QAAQ,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,YAAuC;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,CAAC,aAAa,EAClB;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,YAAY,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qBAAqB,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,IAAI;oBAC9D,OAAO,IAAI,CAAC,aAAa,EAAE;oBAC3B,CAAC,YAAY;wBACX,CAAC,CAAC,aAAa,YAAY,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;wBAClI,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACvC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3D,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kBAAkB,IAAI,CAAC,aAAa,oBAAoB,IAAI,CAAC,SAAS,IAAI,CAC3E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kBAAkB,IAAI,CAAC,aAAa,YAAY,GAAG,EAAE,CACtD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,YAAuC;QAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3E,MAAM,cAAc,GAAG,IAAI,iBAAU,CAAwB,CAAC,UAAU,EAAE,EAAE;YAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,IAAI,MAAM,GAAmD,IAAI,CAAC;YAClE,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAE5E,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,QAAQ,EAAE,sBAAsB;aACjC,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5D,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACzB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAE7B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,YAAY,GAAG,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACvC,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qBAAqB,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,IAAI;wBAC9D,OAAO,IAAI,CAAC,SAAS,EAAE;wBACvB,CAAC,YAAY;4BACX,CAAC,CAAC,aAAa,YAAY,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;4BAClI,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;oBACF,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;oBACxD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAEhB,IAAI,CAAC;oBACH,OAAO,IAAI,EAAE,CAAC;wBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC5C,IAAI,IAAI;4BAAE,MAAM;wBAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;wBAElD,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;4BACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iCAAiC,eAAe,UAAU;gCAC1D,mDAAmD,CACpD,CAAC;4BACF,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;4BAC/C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;4BAC7D,OAAO;wBACT,CAAC;wBAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;wBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;4BACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;4BAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,EAAE;gCAAE,SAAS;4BACxD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;gCACtC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gCACzB,CAAC,CAAC,OAAO,CAAC;4BACZ,IAAI,IAAI,KAAK,EAAE;gCAAE,SAAS;4BAC1B,IAAI,CAAC;gCACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gCAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gCACrE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3D,CAAC;4BAAC,OAAO,UAAU,EAAE,CAAC;gCACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;4BAC9D,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC/B,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;4BACvC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;4BAC1B,CAAC,CAAC,QAAQ,CAAC;wBACb,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;4BAChB,IAAI,CAAC;gCACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gCAClC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3D,CAAC;4BAAC,MAAM,CAAC;gCACP,kCAAkC;4BACpC,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,+DAA+D;oBAC/D,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAE,OAAO;oBACtC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;oBACvD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/C,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACtC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+BAA+B,IAAI,CAAC,SAAS,oBAAoB,IAAI,CAAC,SAAS,IAAI,CACpF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4BAA4B,IAAI,CAAC,SAAS,YAAY,GAAG,EAAE,CAC5D,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;gBAC/C,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YAEH,OAAO,GAAG,EAAE;gBACV,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACjC,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,cAAc,CAAC,IAAI,CACxB,IAAA,YAAK,EAAC;YACJ,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,EACjD,IAAI,CAAC,aAAa,CACnB,CAAC;gBACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAClE,MAAM,OAAO,GACX,kDAAkD,KAAK,IAAI;oBAC3D,aAAa,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC;gBACzF,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;gBACD,OAAO,IAAA,YAAK,EAAC,KAAK,CAAC,CAAC;YACtB,CAAC;SACF,CAAC,EACF,IAAA,2BAAoB,EAAC,SAAS,CAAC,CAChC,CAAC;IACJ,CAAC;CACF,CAAA;AA1QY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,oCAAmB,CAAC,CAAA;;GAVnB,UAAU,CA0QtB"}

package/dist/sapl.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const SAPL_MODULE_OPTIONS = "SAPL_MODULE_OPTIONS";
+//# sourceMappingURL=sapl.constants.d.ts.map

package/dist/sapl.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.constants.d.ts","sourceRoot":"","sources":["../lib/sapl.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC"}

package/dist/sapl.constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAPL_MODULE_OPTIONS = void 0;
+exports.SAPL_MODULE_OPTIONS = 'SAPL_MODULE_OPTIONS';
+//# sourceMappingURL=sapl.constants.js.map

package/dist/sapl.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.constants.js","sourceRoot":"","sources":["../lib/sapl.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG,qBAAqB,CAAC"}

package/dist/sapl.interfaces.d.ts

@@ -0,0 +1,25 @@
+import { ModuleMetadata } from '@nestjs/common';
+import { ClsModuleOptions } from 'nestjs-cls';
+export interface SaplModuleOptions {
+    /** Base URL of the SAPL PDP server (e.g., 'https://localhost:8443') */
+    baseUrl: string;
+    /** Bearer token for PDP REST API authentication (optional for noauth mode) */
+    token?: string;
+    /** Timeout in milliseconds for PDP HTTP requests (default: 5000) */
+    timeout?: number;
+    /** Maximum reconnection attempts for streaming subscriptions (default: unlimited) */
+    streamingMaxRetries?: number;
+    /** Initial delay in ms before first streaming reconnection (default: 1000) */
+    streamingRetryBaseDelay?: number;
+    /** Maximum backoff delay in ms for streaming reconnection (default: 30000) */
+    streamingRetryMaxDelay?: number;
+    /** Set to true to allow unencrypted HTTP connections to the PDP. NOT RECOMMENDED for production. */
+    allowInsecureConnections?: boolean;
+    /** Options merged into ClsModule.forRoot(). Default: { global: true, middleware: { mount: true } } */
+    cls?: Partial<ClsModuleOptions>;
+}
+export interface SaplModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    useFactory: (...args: any[]) => Promise<SaplModuleOptions> | SaplModuleOptions;
+    inject?: any[];
+}
+//# sourceMappingURL=sapl.interfaces.d.ts.map

package/dist/sapl.interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.interfaces.d.ts","sourceRoot":"","sources":["../lib/sapl.interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oGAAoG;IACpG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,sGAAsG;IACtG,GAAG,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,sBACf,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IACvC,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB"}

package/dist/sapl.interfaces.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sapl.interfaces.js.map

package/dist/sapl.interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.interfaces.js","sourceRoot":"","sources":["../lib/sapl.interfaces.ts"],"names":[],"mappings":""}

package/dist/sapl.module.d.ts

@@ -0,0 +1,7 @@
+import { DynamicModule } from '@nestjs/common';
+import { SaplModuleOptions, SaplModuleAsyncOptions } from './sapl.interfaces';
+export declare class SaplModule {
+    static forRoot(options: SaplModuleOptions): DynamicModule;
+    static forRootAsync(asyncOptions: SaplModuleAsyncOptions): DynamicModule;
+}
+//# sourceMappingURL=sapl.module.d.ts.map

package/dist/sapl.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.module.d.ts","sourceRoot":"","sources":["../lib/sapl.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAKvD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAuB9E,qBACa,UAAU;IACrB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa;IA0BzD,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,sBAAsB,GAAG,aAAa;CAwBzE"}

package/dist/sapl.module.js

@@ -0,0 +1,91 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SaplModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SaplModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const sapl_constants_1 = require("./sapl.constants");
+const pdp_service_1 = require("./pdp.service");
+const PreEnforceAspect_1 = require("./PreEnforceAspect");
+const PostEnforceAspect_1 = require("./PostEnforceAspect");
+const EnforceTillDeniedAspect_1 = require("./EnforceTillDeniedAspect");
+const EnforceDropWhileDeniedAspect_1 = require("./EnforceDropWhileDeniedAspect");
+const EnforceRecoverableIfDeniedAspect_1 = require("./EnforceRecoverableIfDeniedAspect");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+const ContentFilteringProvider_1 = require("./constraints/providers/ContentFilteringProvider");
+const ContentFilterPredicateProvider_1 = require("./constraints/providers/ContentFilterPredicateProvider");
+const SHARED_PROVIDERS = [
+    pdp_service_1.PdpService,
+    ConstraintEnforcementService_1.ConstraintEnforcementService,
+    ContentFilteringProvider_1.ContentFilteringProvider,
+    ContentFilterPredicateProvider_1.ContentFilterPredicateProvider,
+    PreEnforceAspect_1.PreEnforceAspect,
+    PostEnforceAspect_1.PostEnforceAspect,
+    EnforceTillDeniedAspect_1.EnforceTillDeniedAspect,
+    EnforceDropWhileDeniedAspect_1.EnforceDropWhileDeniedAspect,
+    EnforceRecoverableIfDeniedAspect_1.EnforceRecoverableIfDeniedAspect,
+];
+let SaplModule = SaplModule_1 = class SaplModule {
+    static forRoot(options) {
+        return {
+            module: SaplModule_1,
+            imports: [
+                core_1.DiscoveryModule,
+                nestjs_aop_1.AopModule,
+                nestjs_cls_1.ClsModule.forRoot({
+                    global: true,
+                    middleware: { mount: true },
+                    ...options.cls,
+                }),
+            ],
+            providers: [
+                { provide: sapl_constants_1.SAPL_MODULE_OPTIONS, useValue: options },
+                ...SHARED_PROVIDERS,
+            ],
+            exports: [pdp_service_1.PdpService, ConstraintEnforcementService_1.ConstraintEnforcementService],
+            global: true,
+        };
+    }
+    // Custom CLS options (like forRoot's `cls` field) are not supported here
+    // because module imports are resolved before the async factory runs. The
+    // factory result (SaplModuleOptions) is not available at import time, so
+    // ClsModule always gets the defaults. Users who need custom CLS setup can
+    // inject ClsService in a guard or interceptor instead.
+    static forRootAsync(asyncOptions) {
+        return {
+            module: SaplModule_1,
+            imports: [
+                core_1.DiscoveryModule,
+                nestjs_aop_1.AopModule,
+                nestjs_cls_1.ClsModule.forRoot({
+                    global: true,
+                    middleware: { mount: true },
+                }),
+                ...(asyncOptions.imports ?? []),
+            ],
+            providers: [
+                {
+                    provide: sapl_constants_1.SAPL_MODULE_OPTIONS,
+                    useFactory: asyncOptions.useFactory,
+                    inject: asyncOptions.inject ?? [],
+                },
+                ...SHARED_PROVIDERS,
+            ],
+            exports: [pdp_service_1.PdpService, ConstraintEnforcementService_1.ConstraintEnforcementService],
+            global: true,
+        };
+    }
+};
+exports.SaplModule = SaplModule;
+exports.SaplModule = SaplModule = SaplModule_1 = __decorate([
+    (0, common_1.Module)({})
+], SaplModule);
+//# sourceMappingURL=sapl.module.js.map

package/dist/sapl.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sapl.module.js","sourceRoot":"","sources":["../lib/sapl.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,uCAA+C;AAC/C,iDAA6C;AAC7C,2CAAuC;AACvC,qDAAuD;AAEvD,+CAA2C;AAC3C,yDAAsD;AACtD,2DAAwD;AACxD,uEAAoE;AACpE,iFAA8E;AAC9E,yFAAsF;AACtF,6FAA0F;AAC1F,+FAA4F;AAC5F,2GAAwG;AAExG,MAAM,gBAAgB,GAAG;IACvB,wBAAU;IACV,2DAA4B;IAC5B,mDAAwB;IACxB,+DAA8B;IAC9B,mCAAgB;IAChB,qCAAiB;IACjB,iDAAuB;IACvB,2DAA4B;IAC5B,mEAAgC;CACjC,CAAC;AAGK,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,MAAM,CAAC,OAAO,CAAC,OAA0B;QACvC,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE;gBACP,sBAAe;gBACf,sBAAS;gBACT,sBAAS,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC3B,GAAG,OAAO,CAAC,GAAG;iBACf,CAAC;aACH;YACD,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oCAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnD,GAAG,gBAAgB;aACpB;YACD,OAAO,EAAE,CAAC,wBAAU,EAAE,2DAA4B,CAAC;YACnD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,CAAC,YAAY,CAAC,YAAoC;QACtD,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE;gBACP,sBAAe;gBACf,sBAAS;gBACT,sBAAS,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBAC5B,CAAC;gBACF,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC;YACD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,oCAAmB;oBAC5B,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE;iBAClC;gBACD,GAAG,gBAAgB;aACpB;YACD,OAAO,EAAE,CAAC,wBAAU,EAAE,2DAA4B,CAAC;YACnD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;CACF,CAAA;AAnDY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAmDtB"}

package/dist/types.d.ts

@@ -0,0 +1,29 @@
+export type Decision = 'PERMIT' | 'DENY' | 'INDETERMINATE' | 'NOT_APPLICABLE';
+/**
+ * A PDP authorization decision with optional constraints.
+ *
+ * The `decision` field contains the access control verdict.
+ * `obligations` must be handled (unhandled obligations deny access).
+ * `advice` should be handled but failures are non-fatal.
+ * `resource` replaces the handler's return value when present.
+ */
+export interface AuthorizationDecision {
+    decision: Decision;
+    obligations?: unknown[];
+    advice?: unknown[];
+    resource?: unknown;
+}
+/**
+ * An authorization subscription sent to the PDP.
+ *
+ * All fields are optional at the type level because sensible defaults
+ * are derived at runtime from the HTTP request context.
+ */
+export interface AuthorizationSubscription {
+    subject?: unknown;
+    action?: unknown;
+    resource?: unknown;
+    environment?: unknown;
+    secrets?: unknown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../lib/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../lib/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@sapl/nestjs",
+  "version": "1.0.0",
+  "description": "SAPL authorization for NestJS - ABAC with constraint handling",
+  "author": "Dominic Heutelbeck",
+  "keywords": ["sapl", "nestjs", "abac", "authorization", "policy", "access-control", "streaming"],
+  "homepage": "https://github.com/heutelbeck/sapl-nestjs#readme",
+  "bugs": {
+    "url": "https://github.com/heutelbeck/sapl-nestjs/issues"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "jest",
+    "test:cov": "jest --coverage",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@toss/nestjs-aop": "^2.1.0",
+    "nestjs-cls": "^6.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.0.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/testing": "^11.0.0",
+    "@toss/nestjs-aop": "^2.1.7",
+    "@types/jest": "^29.0.0",
+    "@types/node": "^22.0.0",
+    "jest": "^29.0.0",
+    "nestjs-cls": "^6.2.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0",
+    "ts-jest": "^29.2.5",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/heutelbeck/sapl-nestjs"
+  },
+  "dependencies": {
+    "safe-regex2": "^5.0.0"
+  }
+}