@sasjs/api 0.6.1 → 0.7.0

package/build/esm/corpus/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAQnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QASjD,CAAA;AAkBF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AASnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAkBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}

package/build/esm/corpus/runner.js

@@ -2,6 +2,7 @@ import { dispatch } from '../host/dispatch.js';
 import { createDriveService } from '../drive/service.js';
 import { MemoryDriveStore } from '../drive/memory-store.js';
 import { createIdentityService } from '../identity/service.js';
+import { createRecordService } from '../identity/records.js';
 import { MemoryIdentityStore } from '../identity/memory-store.js';
 import { DEFAULT_IDENTITY } from '../identity/fixture.js';
 import { isApiError } from '../types.js';
@@ -11,12 +12,20 @@ import { isApiError } from '../types.js';
  * The identity store is built for every case, drive or not, so a case that starts
  * mid-flow can declare the tokens and codes it begins with.
  */
-export const servicesFor = (testCase) => ({
-    drive: createDriveService(testCase.unwritable
-        ? new RefusingDriveStore(testCase.seed || {})
-        : new MemoryDriveStore(testCase.seed || {})),
-    identity: createIdentityService(new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY))
-});
+export const servicesFor = (testCase) => {
+    // one identity store, shared by both services: a token the sign-in flow issues
+    // has to be the token a record route reads, and a user a record route creates
+    // has to be one the flow can sign in. Two stores built from the same fixture
+    // would let a case assert across two independent states and still pass.
+    const identity = new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY);
+    return {
+        drive: createDriveService(testCase.unwritable
+            ? new RefusingDriveStore(testCase.seed || {})
+            : new MemoryDriveStore(testCase.seed || {})),
+        identity: createIdentityService(identity),
+        records: createRecordService(identity)
+    };
+};
 /**
  * A drive that reads but refuses every write.
  *

package/build/esm/host/dispatch.d.ts

@@ -1,9 +1,16 @@
 import type { DriveService } from '../drive/service.js';
 import type { IdentityService } from '../identity/service.js';
+import type { RecordService } from '../identity/records.js';
 import type { Subject } from '../identity/types.js';
 export interface ApiRequest {
     query?: Record<string, string | undefined>;
     body?: Record<string, unknown>;
+    /**
+     * The values the route's path parameters carried, by name - `{ uid: 'abc' }`
+     * for `/user/{uid}`. A host extracts them from its own router; the corpus
+     * states them.
+     */
+    params?: Record<string, string>;
     /** The multipart payload: the API names it `file` on every route that takes one. */
     file?: {
         name: string;
@@ -33,6 +40,8 @@ export interface Services {
      * implement - the difference is the message, and it names the capability.
      */
     identity?: IdentityService;
+    /** Users, groups, permission rules and clients. Absent, the record routes answer 501. */
+    records?: RecordService;
 }
 export declare const dispatch: (services: Services, routeId: string, request?: ApiRequest) => Promise<ApiResponse>;
 /** Whether a route is one `dispatch` can answer today. */

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAInD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAsIrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAkBlC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA+VrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAwClC,CAAA"}

package/build/esm/host/dispatch.js

@@ -1,6 +1,8 @@
 import { routeById } from '../routes/index.js';
 import { ApiError } from '../types.js';
 import { DEPLOY_SUCCESS } from '../drive/deploy.js';
+/** The defaults sasjs/server's Client schema applies to an omitted lifetime. */
+const SECONDS_IN_A_DAY = 86400;
 /**
  * The parameters the table marks required, checked before the handler runs.
  *
@@ -39,10 +41,36 @@ export const dispatch = async (services, routeId, request = {}) => {
     const route = routeById(routeId);
     if (!route)
         throw new ApiError(404, `No such operation: ${routeId}`);
+    const { drive, identity, records } = services;
+    // The server authenticates before its payload schema runs, so an anonymous
+    // request with an incomplete body is a 401 there rather than a 400. The order
+    // is only observable on the route groups that gate on a caller: the sign-in
+    // flow has no caller by definition, and the drive has no identity at all.
+    const identityScoped = ['User', 'Group', 'Permission', 'Client'].includes(route.tag) ||
+        routeId === 'PATCH /SASjsApi/auth/updatePassword';
+    if (identityScoped && records) {
+        const subject = request.subject ??
+            (identity ? await identity.authenticate(request.token) : undefined);
+        if (!subject) {
+            // A host may serve records without a sign-in flow - it resolves the caller
+            // itself and passes `subject`. Without one it cannot authenticate at all,
+            // and a 401 would send every request round the login loop for ever, so it
+            // is told which capability it is missing instead.
+            if (!identity)
+                throw new ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+            throw new ApiError(401, 'Unauthorized');
+        }
+    }
     validate(route, request);
-    const { drive, identity } = services;
     const query = request.query || {};
     const body = request.body || {};
+    const params = request.params || {};
+    /** The record service, or the 501 a host without one answers. */
+    const required = () => {
+        if (!records)
+            throw new ApiError(501, `This host has no record service, so it cannot answer ${routeId}.`);
+        return records;
+    };
     /** The caller, from the request's own subject or the token it carried. */
     const caller = async () => {
         if (request.subject)
@@ -135,6 +163,144 @@ export const dispatch = async (services, routeId, request = {}) => {
         }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
+        // ------------------------------------------------------------- records
+        //
+        // The administration routes: users, groups, permission rules, clients and the
+        // caller's own password. Each handler resolves the caller and passes it on;
+        // the admin gate and the wording live in the service.
+        case 'GET /SASjsApi/user':
+            return { status: 200, body: await required().listUsers(await caller()) };
+        case 'GET /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    username: String(params.username ?? '')
+                })
+            };
+        case 'POST /SASjsApi/user':
+            return {
+                status: 200,
+                body: await required().createUser(await caller(), {
+                    username: String(body.username ?? ''),
+                    displayName: String(body.displayName ?? ''),
+                    password: String(body.password ?? ''),
+                    isAdmin: body.isAdmin,
+                    isActive: body.isActive,
+                    autoExec: body.autoExec
+                })
+            };
+        case 'PATCH /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { uid: String(params.uid ?? '') }, body)
+            };
+        case 'PATCH /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { username: String(params.username ?? '') }, body)
+            };
+        case 'DELETE /SASjsApi/user/{uid}':
+            await required().deleteUser(await caller(), { uid: String(params.uid ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'DELETE /SASjsApi/user/by/username/{username}':
+            await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'GET /SASjsApi/group':
+            return { status: 200, body: await required().listGroups(await caller()) };
+        case 'GET /SASjsApi/group/{uid}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/group/by/groupname/{name}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    name: String(params.name ?? '')
+                })
+            };
+        case 'POST /SASjsApi/group':
+            return {
+                status: 200,
+                body: await required().createGroup(await caller(), {
+                    name: String(body.name ?? ''),
+                    description: String(body.description ?? ''),
+                    isActive: body.isActive
+                })
+            };
+        case 'POST /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().addUserToGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().removeUserFromGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{uid}':
+            // the document states 200 for this one - the server answers with the
+            // driver's delete result rather than nothing
+            await required().deleteGroup(await caller(), String(params.uid ?? ''));
+            return { status: 200 };
+        case 'GET /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().listPermissions(await caller())
+            };
+        case 'POST /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().createPermission(await caller(), {
+                    path: String(body.path ?? ''),
+                    type: String(body.type ?? ''),
+                    setting: String(body.setting ?? ''),
+                    principalType: String(body.principalType ?? ''),
+                    principalId: String(body.principalId ?? '')
+                })
+            };
+        case 'PATCH /SASjsApi/permission/{uid}':
+            return {
+                status: 200,
+                body: await required().updatePermission(await caller(), String(params.uid ?? ''), { setting: String(body.setting ?? '') })
+            };
+        case 'DELETE /SASjsApi/permission/{uid}':
+            await required().deletePermission(await caller(), String(params.uid ?? ''));
+            return { status: 204 };
+        case 'GET /SASjsApi/client':
+            return { status: 200, body: await required().listClients(await caller()) };
+        case 'POST /SASjsApi/client':
+            return {
+                status: 200,
+                // An omitted lifetime is the schema's default, not NaN: the server's
+                // Client model declares 86400 and 2592000, and a NaN lifetime would make
+                // every token the client buys expire on arrival.
+                body: await required().createClient(await caller(), {
+                    clientId: String(body.clientId ?? ''),
+                    clientSecret: String(body.clientSecret ?? ''),
+                    accessTokenExpiration: body.accessTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY
+                        : Number(body.accessTokenExpiration),
+                    refreshTokenExpiration: body.refreshTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY * 30
+                        : Number(body.refreshTokenExpiration)
+                })
+            };
+        case 'PATCH /SASjsApi/auth/updatePassword':
+            await required().updatePassword(await caller(), {
+                currentPassword: String(body.currentPassword ?? ''),
+                newPassword: String(body.newPassword ?? '')
+            });
+            return { status: 204 };
         default: {
             // The reason the table carries travels with the refusal: a host developer
             // reading a 501 wants to know what the operation waits on, not only that
@@ -162,5 +328,27 @@ export const HANDLED_ROUTES = [
     'POST /SASLogon/login',
     'POST /SASLogon/authorize',
     'GET /SASLogon/logout',
-    'GET /SASjsApi/session'
+    'GET /SASjsApi/session',
+    'GET /SASjsApi/user',
+    'GET /SASjsApi/user/{uid}',
+    'GET /SASjsApi/user/by/username/{username}',
+    'POST /SASjsApi/user',
+    'PATCH /SASjsApi/user/{uid}',
+    'PATCH /SASjsApi/user/by/username/{username}',
+    'DELETE /SASjsApi/user/{uid}',
+    'DELETE /SASjsApi/user/by/username/{username}',
+    'GET /SASjsApi/group',
+    'GET /SASjsApi/group/{uid}',
+    'GET /SASjsApi/group/by/groupname/{name}',
+    'POST /SASjsApi/group',
+    'POST /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{uid}',
+    'GET /SASjsApi/permission',
+    'POST /SASjsApi/permission',
+    'PATCH /SASjsApi/permission/{uid}',
+    'DELETE /SASjsApi/permission/{uid}',
+    'GET /SASjsApi/client',
+    'POST /SASjsApi/client',
+    'PATCH /SASjsApi/auth/updatePassword'
 ];

package/build/esm/identity/fixture.d.ts

@@ -19,6 +19,10 @@ export interface IdentityFixtureUser {
     isAdmin: boolean;
     isActive: boolean;
     needsToUpdatePassword: boolean;
+    /** Set when the account is managed by an external auth provider. */
+    authProvider?: string;
+    /** The account's own auto-exec code, where the fixture declares one. */
+    autoExec?: string;
 }
 export interface IdentityFixtureGroup {
     uid: string;
@@ -27,6 +31,8 @@ export interface IdentityFixtureGroup {
     isActive: boolean;
     /** Usernames of the members. */
     users: string[];
+    /** Set when the group is managed by an external auth provider. */
+    authProvider?: string;
 }
 export interface IdentityFixturePermission {
     uid: string;

package/build/esm/identity/fixture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/identity/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,eAAe,IAAI,CAAA;AAEhC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAID,eAAO,MAAM,gBAAgB,EAAE,eA6E9B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,eA2B5C,CAAA"}
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/identity/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,eAAe,IAAI,CAAA;AAEhC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAID,eAAO,MAAM,gBAAgB,EAAE,eA6E9B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,eA2B5C,CAAA"}

package/build/esm/identity/memory-store.d.ts

@@ -8,7 +8,7 @@
  * resolving. A host with real credentials - a server - supplies its own store
  * with JWTs, bcrypt and a database behind it.
  */
-import type { IdentityClient, IdentityStore, IdentityUser, Subject, TokenPair } from './types.js';
+import type { IdentityClient, IdentityClientRecord, IdentityGroupRecord, IdentityPermissionRecord, IdentityStore, IdentityUser, IdentityUserRecord, NewGroup, NewPermission, NewUser, Subject, TokenPair, UserChange } from './types.js';
 import { type IdentityFixture } from './fixture.js';
 /**
  * Whether a token minted for one subject names the same user and client.
@@ -17,17 +17,20 @@ import { type IdentityFixture } from './fixture.js';
  * the read paths compare rather than trust the reference.
  */
 export declare class MemoryIdentityStore implements IdentityStore {
-    private readonly users;
+    private readonly userList;
     private readonly passwords;
-    private readonly clients;
+    private readonly groupList;
+    private readonly permissionList;
+    private readonly clientRecords;
+    private readonly clientMap;
     private readonly pairs;
     private readonly access;
     private readonly refresh;
     private readonly codes;
     private readonly claimed;
     constructor(fixture?: IdentityFixture);
-    userByName(username: string): Promise<IdentityUser | undefined>;
-    userById(uid: string): Promise<IdentityUser | undefined>;
+    userByName(username: string): Promise<IdentityUserRecord | undefined>;
+    userById(uid: string): Promise<IdentityUserRecord | undefined>;
     /** A fixture holds the password in clear, so the check is an equality. */
     passwordMatches(user: IdentityUser, password: string): Promise<boolean>;
     client(clientId: string): Promise<IdentityClient | undefined>;
@@ -57,5 +60,26 @@ export declare class MemoryIdentityStore implements IdentityStore {
     issueCode(subject: Subject): Promise<string>;
     readCode(code: string): Promise<Subject | undefined>;
     claimCode(code: string): Promise<boolean>;
+    users(): Promise<IdentityUserRecord[]>;
+    /** A user as the administration routes report one: groups derived, not stored. */
+    private recordOf;
+    createUser(input: NewUser): Promise<IdentityUserRecord>;
+    updateUser(uid: string, change: UserChange): Promise<IdentityUserRecord | undefined>;
+    deleteUser(uid: string): Promise<void>;
+    setPassword(uid: string, password: string): Promise<void>;
+    groups(): Promise<IdentityGroupRecord[]>;
+    groupById(uid: string): Promise<IdentityGroupRecord | undefined>;
+    groupByName(name: string): Promise<IdentityGroupRecord | undefined>;
+    createGroup(input: NewGroup): Promise<IdentityGroupRecord>;
+    deleteGroup(uid: string): Promise<void>;
+    addToGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    removeFromGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    permissions(): Promise<IdentityPermissionRecord[]>;
+    permissionById(uid: string): Promise<IdentityPermissionRecord | undefined>;
+    createPermission(input: NewPermission): Promise<IdentityPermissionRecord>;
+    setPermissionSetting(uid: string, setting: string): Promise<IdentityPermissionRecord | undefined>;
+    deletePermission(uid: string): Promise<void>;
+    clients(): Promise<IdentityClientRecord[]>;
+    createClient(input: IdentityClientRecord): Promise<IdentityClientRecord>;
 }
 //# sourceMappingURL=memory-store.d.ts.map

package/build/esm/identity/memory-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../../../src/identity/memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AAyDrB;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAEhC,OAAO,GAAE,eAAkC;IAsDjD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAI/D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAI9D,0EAA0E;IACpE,eAAe,CACnB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI7D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzE;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI9D,OAAO,CAAC,OAAO;IAef;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAWzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAS5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIpD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKhD"}
+{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../../../src/identity/memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAA;AACnB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AA+DrB;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAEhC,OAAO,GAAE,eAAkC;IA+FjD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAOrE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAKpE,0EAA0E;IACpE,eAAe,CACnB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI7D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzE;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI9D,OAAO,CAAC,OAAO;IAef;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAWzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAS5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIpD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzC,KAAK,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI5C,kFAAkF;IAClF,OAAO,CAAC,QAAQ;IASV,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAevD,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAepC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAatC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIxC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAIhE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAInE,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAY1D,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvC,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAOrC,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAOrC,WAAW,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAIlD,cAAc,CAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAI1C,gBAAgB,CACpB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,wBAAwB,CAAC;IAa9B,oBAAoB,CACxB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAO1C,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI1C,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC;CASjC"}

package/build/esm/identity/memory-store.js

@@ -39,9 +39,12 @@ const live = (issued, now) => issued && (issued.expiresAt === undefined || issue
  */
 export class MemoryIdentityStore {
     constructor(fixture = DEFAULT_IDENTITY) {
-        this.users = [];
+        this.userList = [];
         this.passwords = new Map();
-        this.clients = new Map();
+        this.groupList = new Map();
+        this.permissionList = new Map();
+        this.clientRecords = new Map();
+        this.clientMap = new Map();
         this.pairs = new Map();
         this.access = new Map();
         this.refresh = new Map();
@@ -50,24 +53,60 @@ export class MemoryIdentityStore {
         if (fixture.format !== IDENTITY_FORMAT)
             throw new ApiError(500, `The identity fixture states format ${String(fixture.format)}; this store reads ${IDENTITY_FORMAT}.`);
         for (const user of fixture.users) {
-            this.users.push({
+            this.userList.push({
                 uid: user.uid,
                 username: user.username,
                 displayName: user.displayName,
                 isAdmin: user.isAdmin,
                 isActive: user.isActive,
-                needsToUpdatePassword: user.needsToUpdatePassword
+                needsToUpdatePassword: user.needsToUpdatePassword,
+                authProvider: user.authProvider,
+                autoExec: user.autoExec
             });
             this.passwords.set(user.uid, user.password);
         }
-        for (const client of fixture.clients)
-            this.clients.set(client.clientId, {
+        for (const client of fixture.clients) {
+            this.clientMap.set(client.clientId, {
                 clientId: client.clientId,
                 accessTokenExpiration: client.accessTokenExpiration,
                 refreshTokenExpiration: client.refreshTokenExpiration
             });
+            this.clientRecords.set(client.clientId, {
+                clientId: client.clientId,
+                clientSecret: client.clientSecret,
+                accessTokenExpiration: client.accessTokenExpiration,
+                refreshTokenExpiration: client.refreshTokenExpiration
+            });
+        }
+        for (const group of fixture.groups) {
+            const uid = group.uid;
+            this.groupList.set(uid, {
+                uid,
+                name: group.name,
+                description: group.description,
+                isActive: group.isActive,
+                authProvider: group.authProvider,
+                users: group.users
+                    .map((username) => this.userList.find((user) => user.username === username)?.uid)
+                    .filter((member) => member !== undefined)
+            });
+        }
+        for (const permission of fixture.permissions) {
+            this.permissionList.set(permission.uid, {
+                uid: permission.uid,
+                path: permission.path,
+                type: permission.type,
+                setting: permission.setting,
+                user: permission.user
+                    ? this.userList.find((user) => user.uid === permission.user)?.uid
+                    : undefined,
+                group: permission.group
+                    ? this.groupList.get(permission.group)?.uid
+                    : undefined
+            });
+        }
         for (const token of fixture.tokens || []) {
-            const user = this.users.find((candidate) => candidate.username === token.username);
+            const user = this.userList.find((candidate) => candidate.username === token.username);
             if (!user)
                 continue;
             const subject = { userId: user.uid, clientId: token.clientId };
@@ -84,7 +123,7 @@ export class MemoryIdentityStore {
                 });
         }
         for (const code of fixture.codes || []) {
-            const user = this.users.find((candidate) => candidate.username === code.username);
+            const user = this.userList.find((candidate) => candidate.username === code.username);
             if (!user)
                 continue;
             this.codes.set(code.code, {
@@ -93,17 +132,19 @@ export class MemoryIdentityStore {
         }
     }
     async userByName(username) {
-        return this.users.find((user) => user.username === username);
+        const user = this.userList.find((candidate) => candidate.username === username);
+        return user ? this.recordOf(user) : undefined;
     }
     async userById(uid) {
-        return this.users.find((user) => user.uid === uid);
+        const user = this.userList.find((candidate) => candidate.uid === uid);
+        return user ? this.recordOf(user) : undefined;
     }
     /** A fixture holds the password in clear, so the check is an equality. */
     async passwordMatches(user, password) {
         return this.passwords.get(user.uid) === password;
     }
     async client(clientId) {
-        return this.clients.get(clientId);
+        return this.clientMap.get(clientId);
     }
     async issue(subject, client) {
         // The lifetimes are the client's, recorded against the instant of issue: a
@@ -188,4 +229,148 @@ export class MemoryIdentityStore {
         this.claimed.add(code);
         return true;
     }
+    // ---------------------------------------------------------------- records
+    async users() {
+        return this.userList.map((user) => this.recordOf(user));
+    }
+    /** A user as the administration routes report one: groups derived, not stored. */
+    recordOf(user) {
+        return {
+            ...user,
+            groups: [...this.groupList.values()]
+                .filter((group) => group.users.includes(user.uid))
+                .map((group) => group.uid)
+        };
+    }
+    async createUser(input) {
+        const user = {
+            uid: `user-${randomHex(6)}`,
+            username: input.username,
+            displayName: input.displayName,
+            isAdmin: input.isAdmin,
+            isActive: input.isActive,
+            needsToUpdatePassword: false,
+            autoExec: input.autoExec,
+            authProvider: input.authProvider
+        };
+        this.userList.push(user);
+        return this.recordOf(user);
+    }
+    async updateUser(uid, change) {
+        const user = this.userList.find((candidate) => candidate.uid === uid);
+        if (!user)
+            return undefined;
+        if (change.username !== undefined)
+            user.username = change.username;
+        if (change.displayName !== undefined)
+            user.displayName = change.displayName;
+        if (change.isAdmin !== undefined)
+            user.isAdmin = change.isAdmin;
+        if (change.isActive !== undefined)
+            user.isActive = change.isActive;
+        if (change.needsToUpdatePassword !== undefined)
+            user.needsToUpdatePassword = change.needsToUpdatePassword;
+        if (change.autoExec !== undefined)
+            user.autoExec = change.autoExec;
+        return this.recordOf(user);
+    }
+    async deleteUser(uid) {
+        const index = this.userList.findIndex((user) => user.uid === uid);
+        if (index === -1)
+            return;
+        this.userList.splice(index, 1);
+        this.passwords.delete(uid);
+        for (const group of this.groupList.values())
+            group.users = group.users.filter((member) => member !== uid);
+        for (const [key, permission] of this.permissionList)
+            if (permission.user === uid)
+                this.permissionList.delete(key);
+        for (const key of this.pairs.keys())
+            if (key.startsWith(`${uid}|`))
+                this.pairs.delete(key);
+    }
+    async setPassword(uid, password) {
+        this.passwords.set(uid, password);
+    }
+    async groups() {
+        return [...this.groupList.values()];
+    }
+    async groupById(uid) {
+        return this.groupList.get(uid);
+    }
+    async groupByName(name) {
+        return [...this.groupList.values()].find((group) => group.name === name);
+    }
+    async createGroup(input) {
+        const group = {
+            uid: `group-${randomHex(6)}`,
+            name: input.name,
+            description: input.description,
+            isActive: input.isActive,
+            users: []
+        };
+        this.groupList.set(group.uid, group);
+        return group;
+    }
+    async deleteGroup(uid) {
+        this.groupList.delete(uid);
+        for (const [key, permission] of this.permissionList)
+            if (permission.group === uid)
+                this.permissionList.delete(key);
+    }
+    async addToGroup(groupUid, userUid) {
+        const group = this.groupList.get(groupUid);
+        if (!group)
+            return undefined;
+        if (!group.users.includes(userUid))
+            group.users.push(userUid);
+        return group;
+    }
+    async removeFromGroup(groupUid, userUid) {
+        const group = this.groupList.get(groupUid);
+        if (!group)
+            return undefined;
+        group.users = group.users.filter((member) => member !== userUid);
+        return group;
+    }
+    async permissions() {
+        return [...this.permissionList.values()];
+    }
+    async permissionById(uid) {
+        return this.permissionList.get(uid);
+    }
+    async createPermission(input) {
+        const permission = {
+            uid: `rule-${randomHex(6)}`,
+            path: input.path,
+            type: input.type,
+            setting: input.setting,
+            user: input.user,
+            group: input.group
+        };
+        this.permissionList.set(permission.uid, permission);
+        return permission;
+    }
+    async setPermissionSetting(uid, setting) {
+        const permission = this.permissionList.get(uid);
+        if (!permission)
+            return undefined;
+        permission.setting = setting;
+        return permission;
+    }
+    async deletePermission(uid) {
+        this.permissionList.delete(uid);
+    }
+    async clients() {
+        return [...this.clientRecords.values()];
+    }
+    async createClient(input) {
+        this.clientRecords.set(input.clientId, input);
+        this.clientMap.set(input.clientId, {
+            clientId: input.clientId,
+            accessTokenExpiration: input.accessTokenExpiration,
+            refreshTokenExpiration: input.refreshTokenExpiration
+        });
+        return input;
+    }
 }