@sasjs/api 0.6.0 → 0.7.0

package/build/cjs/corpus/runner.js

@@ -5,6 +5,7 @@ const dispatch_js_1 = require("../host/dispatch.js");
 const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
 const service_js_2 = require("../identity/service.js");
+const records_js_1 = require("../identity/records.js");
 const memory_store_js_2 = require("../identity/memory-store.js");
 const fixture_js_1 = require("../identity/fixture.js");
 const types_js_1 = require("../types.js");
@@ -14,12 +15,20 @@ const types_js_1 = require("../types.js");
  * The identity store is built for every case, drive or not, so a case that starts
  * mid-flow can declare the tokens and codes it begins with.
  */
-const servicesFor = (testCase) => ({
-    drive: (0, service_js_1.createDriveService)(testCase.unwritable
-        ? new RefusingDriveStore(testCase.seed || {})
-        : new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
-    identity: (0, service_js_2.createIdentityService)(new memory_store_js_2.MemoryIdentityStore(testCase.identity || fixture_js_1.DEFAULT_IDENTITY))
-});
+const servicesFor = (testCase) => {
+    // one identity store, shared by both services: a token the sign-in flow issues
+    // has to be the token a record route reads, and a user a record route creates
+    // has to be one the flow can sign in. Two stores built from the same fixture
+    // would let a case assert across two independent states and still pass.
+    const identity = new memory_store_js_2.MemoryIdentityStore(testCase.identity || fixture_js_1.DEFAULT_IDENTITY);
+    return {
+        drive: (0, service_js_1.createDriveService)(testCase.unwritable
+            ? new RefusingDriveStore(testCase.seed || {})
+            : new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
+        identity: (0, service_js_2.createIdentityService)(identity),
+        records: (0, records_js_1.createRecordService)(identity)
+    };
+};
 exports.servicesFor = servicesFor;
 /**
  * A drive that reads but refuses every write.

package/build/cjs/drive/deploy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deployTree = exports.isDeployTree = exports.checkDeployTree = exports.measureDeployTree = exports.decodeBase64 = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = void 0;
+exports.deployTree = exports.isDeployTree = exports.checkDeployTree = exports.measureDeployTree = exports.decodeBase64 = exports.MAX_DEPTH = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = void 0;
 const types_js_1 = require("../types.js");
 const paths_js_1 = require("./paths.js");
 exports.DEPLOY_LIMITS = {
@@ -36,6 +36,16 @@ exports.DEPLOY_SUCCESS = {
     status: 'success',
     message: 'Files deployed successfully to @sasjs/server.'
 };
+/**
+ * How deep a tree may nest.
+ *
+ * A deployment is an app: `services/`, `web/`, a folder per service. A few dozen
+ * levels is generous, and the number matters because the walk recurses once per
+ * level - without a ceiling, a tree nested deeply enough exhausts the stack and
+ * throws a `RangeError`, which is neither the `400` nor the `413` this route
+ * documents, on input the cap exists to bound.
+ */
+exports.MAX_DEPTH = 32;
 const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
 /** A base64 body without its padding, which is what the arithmetic needs. */
 const base64Body = (value) => value.replace(/[^A-Za-z0-9+/]/g, '');
@@ -82,14 +92,28 @@ const utf8Length = (value) => {
 const memberName = (member) => member.type === 'service' ? `${member.name}.sas` : member.name;
 /** The bytes a member writes. */
 const memberBytes = (member) => member.type === 'file' ? base64Length(member.code) : utf8Length(member.code);
+const MEGABYTE = 1024 * 1024;
 /**
- * Sizes as the messages state them: one decimal in binary megabytes, and bytes
- * below a megabyte - a limit small enough to be measured in bytes should not
- * read as "0 MB", which is what a stricter host would otherwise report.
+ * A MEASURED size, rounded UP to one decimal in binary megabytes.
+ *
+ * Up, not to nearest: a tree one byte over a 100 MB cap must not read as "100 MB
+ * (maximum 100 MB)", which is a refusal that states no overage at all. Rounding
+ * up is the direction that never understates what is being refused.
+ *
+ * Bytes below a megabyte are printed as bytes, because a limit small enough to
+ * be measured in bytes should not read as "0 MB" - which is what a host passing
+ * a tighter set would otherwise report.
  */
-const describeSize = (bytes) => bytes < 1024 * 1024
+const describeSize = (bytes) => bytes < MEGABYTE
     ? `${bytes} bytes`
-    : `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
+    : `${Math.ceil((bytes / MEGABYTE) * 10) / 10} MB`;
+/**
+ * A LIMIT, printed as it is stated: `DEPLOY_LIMITS` holds exact megabytes, so
+ * rounding cannot make it disagree with itself.
+ */
+const describeLimit = (bytes) => bytes < MEGABYTE
+    ? `${bytes} bytes`
+    : `${Math.round((bytes / MEGABYTE) * 10) / 10} MB`;
 /** A walk's starting point. */
 const emptyWalk = () => ({
     entries: 0,
@@ -113,8 +137,12 @@ const isSafeSegment = (name) => name !== '' &&
  * a caller that only wants the numbers gets the size of the whole tree, and the
  * validator decides whether the name matters. Returning early would report a
  * truncated tree as if it were the real one.
+ *
+ * The one thing that stops the walk is depth: past `MAX_DEPTH` it does not
+ * descend, because descending is the work that would exhaust the stack. The
+ * level it reached is recorded so the refusal can state it.
  */
-const walk = (members, parentPath, acc) => {
+const walk = (members, parentPath, acc, depth = 1) => {
     for (const member of members) {
         const name = memberName(member);
         const memberPath = parentPath ? `${parentPath}/${name}` : name;
@@ -126,7 +154,12 @@ const walk = (members, parentPath, acc) => {
             };
         acc.entries++;
         if (member.type === 'folder') {
-            walk(member.members, memberPath, acc);
+            if (depth + 1 > exports.MAX_DEPTH) {
+                if (!acc.tooDeep)
+                    acc.tooDeep = depth + 1;
+                continue;
+            }
+            walk(member.members, memberPath, acc, depth + 1);
             continue;
         }
         const bytes = memberBytes(member);
@@ -166,6 +199,12 @@ const checkDeployTree = (members, limits = exports.DEPLOY_LIMITS) => {
     walk(members, '', measured);
     if (measured.nameRefusal)
         return measured.nameRefusal;
+    if (measured.tooDeep)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `The file tree is nested too deeply: ${measured.tooDeep} levels (maximum ${exports.MAX_DEPTH}).`
+        };
     if (measured.entries > limits.entries)
         return {
             code: 413,
@@ -176,13 +215,13 @@ const checkDeployTree = (members, limits = exports.DEPLOY_LIMITS) => {
         return {
             code: 413,
             status: 'failure',
-            message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeSize(limits.totalBytes)}).`
+            message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeLimit(limits.totalBytes)}).`
         };
     if (measured.largest.bytes > limits.fileBytes)
         return {
             code: 413,
             status: 'failure',
-            message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeSize(limits.fileBytes)} per file).`
+            message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeLimit(limits.fileBytes)} per file).`
         };
     return null;
 };

package/build/cjs/host/dispatch.js

@@ -4,6 +4,8 @@ exports.HANDLED_ROUTES = exports.dispatch = void 0;
 const index_js_1 = require("../routes/index.js");
 const types_js_1 = require("../types.js");
 const deploy_js_1 = require("../drive/deploy.js");
+/** The defaults sasjs/server's Client schema applies to an omitted lifetime. */
+const SECONDS_IN_A_DAY = 86400;
 /**
  * The parameters the table marks required, checked before the handler runs.
  *
@@ -42,10 +44,36 @@ const dispatch = async (services, routeId, request = {}) => {
     const route = (0, index_js_1.routeById)(routeId);
     if (!route)
         throw new types_js_1.ApiError(404, `No such operation: ${routeId}`);
+    const { drive, identity, records } = services;
+    // The server authenticates before its payload schema runs, so an anonymous
+    // request with an incomplete body is a 401 there rather than a 400. The order
+    // is only observable on the route groups that gate on a caller: the sign-in
+    // flow has no caller by definition, and the drive has no identity at all.
+    const identityScoped = ['User', 'Group', 'Permission', 'Client'].includes(route.tag) ||
+        routeId === 'PATCH /SASjsApi/auth/updatePassword';
+    if (identityScoped && records) {
+        const subject = request.subject ??
+            (identity ? await identity.authenticate(request.token) : undefined);
+        if (!subject) {
+            // A host may serve records without a sign-in flow - it resolves the caller
+            // itself and passes `subject`. Without one it cannot authenticate at all,
+            // and a 401 would send every request round the login loop for ever, so it
+            // is told which capability it is missing instead.
+            if (!identity)
+                throw new types_js_1.ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+            throw new types_js_1.ApiError(401, 'Unauthorized');
+        }
+    }
     validate(route, request);
-    const { drive, identity } = services;
     const query = request.query || {};
     const body = request.body || {};
+    const params = request.params || {};
+    /** The record service, or the 501 a host without one answers. */
+    const required = () => {
+        if (!records)
+            throw new types_js_1.ApiError(501, `This host has no record service, so it cannot answer ${routeId}.`);
+        return records;
+    };
     /** The caller, from the request's own subject or the token it carried. */
     const caller = async () => {
         if (request.subject)
@@ -138,6 +166,144 @@ const dispatch = async (services, routeId, request = {}) => {
         }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
+        // ------------------------------------------------------------- records
+        //
+        // The administration routes: users, groups, permission rules, clients and the
+        // caller's own password. Each handler resolves the caller and passes it on;
+        // the admin gate and the wording live in the service.
+        case 'GET /SASjsApi/user':
+            return { status: 200, body: await required().listUsers(await caller()) };
+        case 'GET /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    username: String(params.username ?? '')
+                })
+            };
+        case 'POST /SASjsApi/user':
+            return {
+                status: 200,
+                body: await required().createUser(await caller(), {
+                    username: String(body.username ?? ''),
+                    displayName: String(body.displayName ?? ''),
+                    password: String(body.password ?? ''),
+                    isAdmin: body.isAdmin,
+                    isActive: body.isActive,
+                    autoExec: body.autoExec
+                })
+            };
+        case 'PATCH /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { uid: String(params.uid ?? '') }, body)
+            };
+        case 'PATCH /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { username: String(params.username ?? '') }, body)
+            };
+        case 'DELETE /SASjsApi/user/{uid}':
+            await required().deleteUser(await caller(), { uid: String(params.uid ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'DELETE /SASjsApi/user/by/username/{username}':
+            await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'GET /SASjsApi/group':
+            return { status: 200, body: await required().listGroups(await caller()) };
+        case 'GET /SASjsApi/group/{uid}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/group/by/groupname/{name}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    name: String(params.name ?? '')
+                })
+            };
+        case 'POST /SASjsApi/group':
+            return {
+                status: 200,
+                body: await required().createGroup(await caller(), {
+                    name: String(body.name ?? ''),
+                    description: String(body.description ?? ''),
+                    isActive: body.isActive
+                })
+            };
+        case 'POST /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().addUserToGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().removeUserFromGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{uid}':
+            // the document states 200 for this one - the server answers with the
+            // driver's delete result rather than nothing
+            await required().deleteGroup(await caller(), String(params.uid ?? ''));
+            return { status: 200 };
+        case 'GET /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().listPermissions(await caller())
+            };
+        case 'POST /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().createPermission(await caller(), {
+                    path: String(body.path ?? ''),
+                    type: String(body.type ?? ''),
+                    setting: String(body.setting ?? ''),
+                    principalType: String(body.principalType ?? ''),
+                    principalId: String(body.principalId ?? '')
+                })
+            };
+        case 'PATCH /SASjsApi/permission/{uid}':
+            return {
+                status: 200,
+                body: await required().updatePermission(await caller(), String(params.uid ?? ''), { setting: String(body.setting ?? '') })
+            };
+        case 'DELETE /SASjsApi/permission/{uid}':
+            await required().deletePermission(await caller(), String(params.uid ?? ''));
+            return { status: 204 };
+        case 'GET /SASjsApi/client':
+            return { status: 200, body: await required().listClients(await caller()) };
+        case 'POST /SASjsApi/client':
+            return {
+                status: 200,
+                // An omitted lifetime is the schema's default, not NaN: the server's
+                // Client model declares 86400 and 2592000, and a NaN lifetime would make
+                // every token the client buys expire on arrival.
+                body: await required().createClient(await caller(), {
+                    clientId: String(body.clientId ?? ''),
+                    clientSecret: String(body.clientSecret ?? ''),
+                    accessTokenExpiration: body.accessTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY
+                        : Number(body.accessTokenExpiration),
+                    refreshTokenExpiration: body.refreshTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY * 30
+                        : Number(body.refreshTokenExpiration)
+                })
+            };
+        case 'PATCH /SASjsApi/auth/updatePassword':
+            await required().updatePassword(await caller(), {
+                currentPassword: String(body.currentPassword ?? ''),
+                newPassword: String(body.newPassword ?? '')
+            });
+            return { status: 204 };
         default: {
             // The reason the table carries travels with the refusal: a host developer
             // reading a 501 wants to know what the operation waits on, not only that
@@ -166,5 +332,27 @@ exports.HANDLED_ROUTES = [
     'POST /SASLogon/login',
     'POST /SASLogon/authorize',
     'GET /SASLogon/logout',
-    'GET /SASjsApi/session'
+    'GET /SASjsApi/session',
+    'GET /SASjsApi/user',
+    'GET /SASjsApi/user/{uid}',
+    'GET /SASjsApi/user/by/username/{username}',
+    'POST /SASjsApi/user',
+    'PATCH /SASjsApi/user/{uid}',
+    'PATCH /SASjsApi/user/by/username/{username}',
+    'DELETE /SASjsApi/user/{uid}',
+    'DELETE /SASjsApi/user/by/username/{username}',
+    'GET /SASjsApi/group',
+    'GET /SASjsApi/group/{uid}',
+    'GET /SASjsApi/group/by/groupname/{name}',
+    'POST /SASjsApi/group',
+    'POST /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{uid}',
+    'GET /SASjsApi/permission',
+    'POST /SASjsApi/permission',
+    'PATCH /SASjsApi/permission/{uid}',
+    'DELETE /SASjsApi/permission/{uid}',
+    'GET /SASjsApi/client',
+    'POST /SASjsApi/client',
+    'PATCH /SASjsApi/auth/updatePassword'
 ];

package/build/cjs/identity/memory-store.js

@@ -42,9 +42,12 @@ const live = (issued, now) => issued && (issued.expiresAt === undefined || issue
  */
 class MemoryIdentityStore {
     constructor(fixture = fixture_js_1.DEFAULT_IDENTITY) {
-        this.users = [];
+        this.userList = [];
         this.passwords = new Map();
-        this.clients = new Map();
+        this.groupList = new Map();
+        this.permissionList = new Map();
+        this.clientRecords = new Map();
+        this.clientMap = new Map();
         this.pairs = new Map();
         this.access = new Map();
         this.refresh = new Map();
@@ -53,24 +56,60 @@ class MemoryIdentityStore {
         if (fixture.format !== fixture_js_1.IDENTITY_FORMAT)
             throw new types_js_1.ApiError(500, `The identity fixture states format ${String(fixture.format)}; this store reads ${fixture_js_1.IDENTITY_FORMAT}.`);
         for (const user of fixture.users) {
-            this.users.push({
+            this.userList.push({
                 uid: user.uid,
                 username: user.username,
                 displayName: user.displayName,
                 isAdmin: user.isAdmin,
                 isActive: user.isActive,
-                needsToUpdatePassword: user.needsToUpdatePassword
+                needsToUpdatePassword: user.needsToUpdatePassword,
+                authProvider: user.authProvider,
+                autoExec: user.autoExec
             });
             this.passwords.set(user.uid, user.password);
         }
-        for (const client of fixture.clients)
-            this.clients.set(client.clientId, {
+        for (const client of fixture.clients) {
+            this.clientMap.set(client.clientId, {
                 clientId: client.clientId,
                 accessTokenExpiration: client.accessTokenExpiration,
                 refreshTokenExpiration: client.refreshTokenExpiration
             });
+            this.clientRecords.set(client.clientId, {
+                clientId: client.clientId,
+                clientSecret: client.clientSecret,
+                accessTokenExpiration: client.accessTokenExpiration,
+                refreshTokenExpiration: client.refreshTokenExpiration
+            });
+        }
+        for (const group of fixture.groups) {
+            const uid = group.uid;
+            this.groupList.set(uid, {
+                uid,
+                name: group.name,
+                description: group.description,
+                isActive: group.isActive,
+                authProvider: group.authProvider,
+                users: group.users
+                    .map((username) => this.userList.find((user) => user.username === username)?.uid)
+                    .filter((member) => member !== undefined)
+            });
+        }
+        for (const permission of fixture.permissions) {
+            this.permissionList.set(permission.uid, {
+                uid: permission.uid,
+                path: permission.path,
+                type: permission.type,
+                setting: permission.setting,
+                user: permission.user
+                    ? this.userList.find((user) => user.uid === permission.user)?.uid
+                    : undefined,
+                group: permission.group
+                    ? this.groupList.get(permission.group)?.uid
+                    : undefined
+            });
+        }
         for (const token of fixture.tokens || []) {
-            const user = this.users.find((candidate) => candidate.username === token.username);
+            const user = this.userList.find((candidate) => candidate.username === token.username);
             if (!user)
                 continue;
             const subject = { userId: user.uid, clientId: token.clientId };
@@ -87,7 +126,7 @@ class MemoryIdentityStore {
                 });
         }
         for (const code of fixture.codes || []) {
-            const user = this.users.find((candidate) => candidate.username === code.username);
+            const user = this.userList.find((candidate) => candidate.username === code.username);
             if (!user)
                 continue;
             this.codes.set(code.code, {
@@ -96,17 +135,19 @@ class MemoryIdentityStore {
         }
     }
     async userByName(username) {
-        return this.users.find((user) => user.username === username);
+        const user = this.userList.find((candidate) => candidate.username === username);
+        return user ? this.recordOf(user) : undefined;
     }
     async userById(uid) {
-        return this.users.find((user) => user.uid === uid);
+        const user = this.userList.find((candidate) => candidate.uid === uid);
+        return user ? this.recordOf(user) : undefined;
     }
     /** A fixture holds the password in clear, so the check is an equality. */
     async passwordMatches(user, password) {
         return this.passwords.get(user.uid) === password;
     }
     async client(clientId) {
-        return this.clients.get(clientId);
+        return this.clientMap.get(clientId);
     }
     async issue(subject, client) {
         // The lifetimes are the client's, recorded against the instant of issue: a
@@ -191,5 +232,149 @@ class MemoryIdentityStore {
         this.claimed.add(code);
         return true;
     }
+    // ---------------------------------------------------------------- records
+    async users() {
+        return this.userList.map((user) => this.recordOf(user));
+    }
+    /** A user as the administration routes report one: groups derived, not stored. */
+    recordOf(user) {
+        return {
+            ...user,
+            groups: [...this.groupList.values()]
+                .filter((group) => group.users.includes(user.uid))
+                .map((group) => group.uid)
+        };
+    }
+    async createUser(input) {
+        const user = {
+            uid: `user-${randomHex(6)}`,
+            username: input.username,
+            displayName: input.displayName,
+            isAdmin: input.isAdmin,
+            isActive: input.isActive,
+            needsToUpdatePassword: false,
+            autoExec: input.autoExec,
+            authProvider: input.authProvider
+        };
+        this.userList.push(user);
+        return this.recordOf(user);
+    }
+    async updateUser(uid, change) {
+        const user = this.userList.find((candidate) => candidate.uid === uid);
+        if (!user)
+            return undefined;
+        if (change.username !== undefined)
+            user.username = change.username;
+        if (change.displayName !== undefined)
+            user.displayName = change.displayName;
+        if (change.isAdmin !== undefined)
+            user.isAdmin = change.isAdmin;
+        if (change.isActive !== undefined)
+            user.isActive = change.isActive;
+        if (change.needsToUpdatePassword !== undefined)
+            user.needsToUpdatePassword = change.needsToUpdatePassword;
+        if (change.autoExec !== undefined)
+            user.autoExec = change.autoExec;
+        return this.recordOf(user);
+    }
+    async deleteUser(uid) {
+        const index = this.userList.findIndex((user) => user.uid === uid);
+        if (index === -1)
+            return;
+        this.userList.splice(index, 1);
+        this.passwords.delete(uid);
+        for (const group of this.groupList.values())
+            group.users = group.users.filter((member) => member !== uid);
+        for (const [key, permission] of this.permissionList)
+            if (permission.user === uid)
+                this.permissionList.delete(key);
+        for (const key of this.pairs.keys())
+            if (key.startsWith(`${uid}|`))
+                this.pairs.delete(key);
+    }
+    async setPassword(uid, password) {
+        this.passwords.set(uid, password);
+    }
+    async groups() {
+        return [...this.groupList.values()];
+    }
+    async groupById(uid) {
+        return this.groupList.get(uid);
+    }
+    async groupByName(name) {
+        return [...this.groupList.values()].find((group) => group.name === name);
+    }
+    async createGroup(input) {
+        const group = {
+            uid: `group-${randomHex(6)}`,
+            name: input.name,
+            description: input.description,
+            isActive: input.isActive,
+            users: []
+        };
+        this.groupList.set(group.uid, group);
+        return group;
+    }
+    async deleteGroup(uid) {
+        this.groupList.delete(uid);
+        for (const [key, permission] of this.permissionList)
+            if (permission.group === uid)
+                this.permissionList.delete(key);
+    }
+    async addToGroup(groupUid, userUid) {
+        const group = this.groupList.get(groupUid);
+        if (!group)
+            return undefined;
+        if (!group.users.includes(userUid))
+            group.users.push(userUid);
+        return group;
+    }
+    async removeFromGroup(groupUid, userUid) {
+        const group = this.groupList.get(groupUid);
+        if (!group)
+            return undefined;
+        group.users = group.users.filter((member) => member !== userUid);
+        return group;
+    }
+    async permissions() {
+        return [...this.permissionList.values()];
+    }
+    async permissionById(uid) {
+        return this.permissionList.get(uid);
+    }
+    async createPermission(input) {
+        const permission = {
+            uid: `rule-${randomHex(6)}`,
+            path: input.path,
+            type: input.type,
+            setting: input.setting,
+            user: input.user,
+            group: input.group
+        };
+        this.permissionList.set(permission.uid, permission);
+        return permission;
+    }
+    async setPermissionSetting(uid, setting) {
+        const permission = this.permissionList.get(uid);
+        if (!permission)
+            return undefined;
+        permission.setting = setting;
+        return permission;
+    }
+    async deletePermission(uid) {
+        this.permissionList.delete(uid);
+    }
+    async clients() {
+        return [...this.clientRecords.values()];
+    }
+    async createClient(input) {
+        this.clientRecords.set(input.clientId, input);
+        this.clientMap.set(input.clientId, {
+            clientId: input.clientId,
+            accessTokenExpiration: input.accessTokenExpiration,
+            refreshTokenExpiration: input.refreshTokenExpiration
+        });
+        return input;
+    }
 }
 exports.MemoryIdentityStore = MemoryIdentityStore;