@seifer-webapp-factory/kits 0.1.0

package/README.md

@@ -0,0 +1,10 @@
+# @seifer-webapp-factory/kits
+
+Seifer foundation kits — domein-loze, herbruikbare **backend** (Node/NestJS) en **frontend** (Vue 3 / Nuxt 3) kits, één versielijn.
+
+```ts
+import { loadConfig } from "@seifer-webapp-factory/kits/backend/config";
+import { config } from "@seifer-webapp-factory/kits/frontend/config";
+```
+
+Subpaths: `@seifer-webapp-factory/kits/backend/*` en `@seifer-webapp-factory/kits/frontend/*` (zie `exports`).

package/dist/backend/access-control/adapters/in-memory-relations.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Dep-vrije referentie-{@link RelationResolver} (US-0503): levert relatie-edges uit een in-memory
+ * lijst. Productie-adapters (bv. bovenop persistence-kit) levert het consumerende project.
+ */
+import type { RelationEdge, RelationResolver } from '../core/ports.js';
+export declare function inMemoryRelationResolver(edges: RelationEdge[]): RelationResolver;
+//# sourceMappingURL=in-memory-relations.d.ts.map

package/dist/backend/access-control/adapters/in-memory-relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-relations.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/adapters/in-memory-relations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,gBAAgB,CAIhF"}

package/dist/backend/access-control/adapters/in-memory-relations.js

@@ -0,0 +1,6 @@
+export function inMemoryRelationResolver(edges) {
+    return {
+        relationsFrom: async (node) => edges.filter((edge) => edge.from === node),
+    };
+}
+//# sourceMappingURL=in-memory-relations.js.map

package/dist/backend/access-control/adapters/in-memory-relations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-relations.js","sourceRoot":"","sources":["../../../../backend/src/access-control/adapters/in-memory-relations.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;KAC1E,CAAC;AACJ,CAAC"}

package/dist/backend/access-control/core/enforcement.d.ts

@@ -0,0 +1,13 @@
+import type { Rbac } from './rbac.js';
+import type { Decision, Subject } from './ports.js';
+export interface AuthorizePermissionsParams {
+    subject?: Subject | null;
+    /** Vereiste permissies (AND). Leeg = geen declaratie → default-beleid. */
+    required: string[];
+    rbac: Rbac;
+    /** Beleid wanneer een handler geen permissies declareert. Default `deny`. */
+    defaultDecision?: 'allow' | 'deny';
+}
+/** Beslist toegang op basis van vereiste permissies en de effectieve permissies van het subject. */
+export declare function authorizePermissions(params: AuthorizePermissionsParams): Decision;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/backend/access-control/core/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/enforcement.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACpC;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG,QAAQ,CA8BjF"}

package/dist/backend/access-control/core/enforcement.js

@@ -0,0 +1,38 @@
+/**
+ * US-0502 — Enforcement (framework-agnostische kern van guard/decorator).
+ *
+ * Evalueert of een subject de vereiste permissies heeft, met **default-deny**: geen subject → deny;
+ * geen permissie-declaratie → het geconfigureerde default-beleid. De reden lekt geen rol-/permissie-
+ * informatie naar de eindgebruiker.
+ */
+import { UnknownRoleError } from './errors.js';
+/** Beslist toegang op basis van vereiste permissies en de effectieve permissies van het subject. */
+export function authorizePermissions(params) {
+    const { subject, required, rbac } = params;
+    // Geen geldig subject → deny zonder de permissie-resolutie te draaien (US-0502 AC3).
+    if (!subject) {
+        return { allowed: false, reason: 'geen geauthenticeerd subject' };
+    }
+    if (required.length === 0) {
+        const fallback = params.defaultDecision ?? 'deny';
+        return fallback === 'allow'
+            ? { allowed: true, reason: 'default-allow' }
+            : { allowed: false, reason: 'default-deny (geen permissie-declaratie)' };
+    }
+    let effective;
+    try {
+        effective = rbac.resolve(subject.roles);
+    }
+    catch (error) {
+        // Onbekende rol → fail-closed (deny), niet crashen.
+        if (error instanceof UnknownRoleError) {
+            return { allowed: false, reason: 'onbekende rol (fail-closed)' };
+        }
+        throw error;
+    }
+    const satisfied = required.every((permission) => effective.has(permission));
+    return satisfied
+        ? { allowed: true, reason: 'permissies voldaan' }
+        : { allowed: false, reason: 'ontbrekende permissie' };
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/backend/access-control/core/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAa/C,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAkC;IACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAE3C,qFAAqF;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC;QAClD,OAAO,QAAQ,KAAK,OAAO;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,SAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oDAAoD;QACpD,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,OAAO,SAAS;QACd,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE;QACjD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AAC1D,CAAC"}

package/dist/backend/access-control/core/errors.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Foutentaxonomie voor access-control. Fouten lekken geen rol-/permissie-/policy-details naar
+ * eindgebruikers (geen informatie-lek); default is altijd deny (fail-closed).
+ */
+export declare class AccessControlError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** Onbekende rol bij toewijzing/resolutie (US-0501 AC3). */
+export declare class UnknownRoleError extends AccessControlError {
+    readonly role: string;
+    constructor(role: string);
+}
+/** Cyclische rol-hiërarchie gedetecteerd bij het laden van het model (US-0501 AC2). */
+export declare class RoleCycleError extends AccessControlError {
+    constructor(cycle: string[]);
+}
+/** Structureel ongeldige autorisatie-aanvraag (US-0504 AC3). */
+export declare class InvalidAuthorizationRequestError extends AccessControlError {
+    constructor(reason: string);
+}
+/** Fout bij het oplossen van relaties via de relatie-port (US-0503 AC3). Niet-lekkend. */
+export declare class RelationResolutionError extends AccessControlError {
+    constructor();
+}
+/** Toegang geweigerd (bruikbaar door adapters om op 403 te mappen). */
+export declare class AccessDeniedError extends AccessControlError {
+    constructor(reason?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/backend/access-control/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM1C;AAED,4DAA4D;AAC5D,qBAAa,gBAAiB,SAAQ,kBAAkB;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAIzB;AAED,uFAAuF;AACvF,qBAAa,cAAe,SAAQ,kBAAkB;gBACxC,KAAK,EAAE,MAAM,EAAE;CAG5B;AAED,gEAAgE;AAChE,qBAAa,gCAAiC,SAAQ,kBAAkB;gBAC1D,MAAM,EAAE,MAAM;CAG3B;AAED,0FAA0F;AAC1F,qBAAa,uBAAwB,SAAQ,kBAAkB;;CAI9D;AAED,uEAAuE;AACvE,qBAAa,iBAAkB,SAAQ,kBAAkB;gBAC3C,MAAM,SAAsB;CAGzC"}

package/dist/backend/access-control/core/errors.js

@@ -0,0 +1,46 @@
+/**
+ * Foutentaxonomie voor access-control. Fouten lekken geen rol-/permissie-/policy-details naar
+ * eindgebruikers (geen informatie-lek); default is altijd deny (fail-closed).
+ */
+export class AccessControlError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Onbekende rol bij toewijzing/resolutie (US-0501 AC3). */
+export class UnknownRoleError extends AccessControlError {
+    role;
+    constructor(role) {
+        super(`Onbekende rol: "${role}"`, 'UNKNOWN_ROLE');
+        this.role = role;
+    }
+}
+/** Cyclische rol-hiërarchie gedetecteerd bij het laden van het model (US-0501 AC2). */
+export class RoleCycleError extends AccessControlError {
+    constructor(cycle) {
+        super(`Cyclische rol-verwijzing: ${cycle.join(' -> ')}`, 'ROLE_CYCLE');
+    }
+}
+/** Structureel ongeldige autorisatie-aanvraag (US-0504 AC3). */
+export class InvalidAuthorizationRequestError extends AccessControlError {
+    constructor(reason) {
+        super(`Ongeldige autorisatie-aanvraag: ${reason}`, 'INVALID_REQUEST');
+    }
+}
+/** Fout bij het oplossen van relaties via de relatie-port (US-0503 AC3). Niet-lekkend. */
+export class RelationResolutionError extends AccessControlError {
+    constructor() {
+        super('Relatie-evaluatie mislukt', 'RELATION_RESOLUTION');
+    }
+}
+/** Toegang geweigerd (bruikbaar door adapters om op 403 te mappen). */
+export class AccessDeniedError extends AccessControlError {
+    constructor(reason = 'Toegang geweigerd') {
+        super(reason, 'ACCESS_DENIED');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/backend/access-control/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,gBAAiB,SAAQ,kBAAkB;IAC7C,IAAI,CAAS;IACtB,YAAY,IAAY;QACtB,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,cAAe,SAAQ,kBAAkB;IACpD,YAAY,KAAe;QACzB,KAAK,CAAC,6BAA6B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IACzE,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,gCAAiC,SAAQ,kBAAkB;IACtE,YAAY,MAAc;QACxB,KAAK,CAAC,mCAAmC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;IAC7D;QACE,KAAK,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,iBAAkB,SAAQ,kBAAkB;IACvD,YAAY,MAAM,GAAG,mBAAmB;QACtC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/backend/access-control/core/pdp.d.ts

@@ -0,0 +1,14 @@
+import type { RebacChecker } from './rebac.js';
+import type { Rbac } from './rbac.js';
+import type { Decision, DecisionRequest, Policy } from './ports.js';
+export interface PdpDependencies {
+    rbac: Rbac;
+    rebac?: RebacChecker;
+    policies: Policy[];
+}
+export declare class PolicyDecisionPoint {
+    #private;
+    constructor(deps: PdpDependencies);
+    decide(request: DecisionRequest): Promise<Decision>;
+}
+//# sourceMappingURL=pdp.d.ts.map

package/dist/backend/access-control/core/pdp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdp.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/pdp.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,qBAAa,mBAAmB;;gBAKlB,IAAI,EAAE,eAAe;IAM3B,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;CA+D1D"}

package/dist/backend/access-control/core/pdp.js

@@ -0,0 +1,79 @@
+/**
+ * US-0504 — Policy-definitie + centraal decision-point (PDP).
+ *
+ * Evalueert een aanvraag (subject, action, resource, context) tegen geïnjecteerde policies en geeft
+ * een expliciete beslissing terug: `allow`/`deny` mét reden. Combineert RBAC- (permissies) en ReBAC-
+ * signalen (relaties/ownership) per policy. Default is deny bij afwezigheid van een toestaande policy;
+ * een structureel ongeldige aanvraag faalt fail-fast.
+ */
+import { InvalidAuthorizationRequestError } from './errors.js';
+export class PolicyDecisionPoint {
+    #rbac;
+    #rebac;
+    #policies;
+    constructor(deps) {
+        this.#rbac = deps.rbac;
+        this.#rebac = deps.rebac;
+        this.#policies = deps.policies;
+    }
+    async decide(request) {
+        this.#validate(request);
+        const candidates = this.#policies.filter((p) => p.action === request.action && (!p.resourceType || p.resourceType === request.resource?.type));
+        if (candidates.length === 0) {
+            return { allowed: false, reason: 'geen toestaande policy (default-deny)' };
+        }
+        let lastFailure = 'geen toestaande policy (default-deny)';
+        for (const policy of candidates) {
+            const failure = await this.#evaluate(policy, request);
+            if (failure === null) {
+                return { allowed: true, reason: `toegestaan door policy "${policy.id}"`, policyId: policy.id };
+            }
+            lastFailure = failure;
+        }
+        return { allowed: false, reason: lastFailure };
+    }
+    #validate(request) {
+        const subject = request?.subject;
+        if (!subject || typeof subject.id !== 'string' || !Array.isArray(subject.roles)) {
+            throw new InvalidAuthorizationRequestError('ontbrekend of ongeldig subject');
+        }
+        if (typeof request.action !== 'string' || request.action.length === 0) {
+            throw new InvalidAuthorizationRequestError('ontbrekende action');
+        }
+    }
+    /** Retourneert `null` als de policy toestaat, anders een faal-reden. */
+    async #evaluate(policy, request) {
+        if (policy.requirePermissions?.length) {
+            let effective;
+            try {
+                effective = this.#rbac.resolve(request.subject.roles);
+            }
+            catch {
+                return 'onbekende rol (RBAC)';
+            }
+            if (!policy.requirePermissions.every((p) => effective.has(p))) {
+                return 'ontbrekende permissie (RBAC)';
+            }
+        }
+        const relations = policy.requireOwnership
+            ? ['owner', ...(policy.requireRelations ?? [])]
+            : policy.requireRelations;
+        if (relations && relations.length > 0) {
+            if (!this.#rebac)
+                return 'ReBAC-conditie kan niet worden geëvalueerd (geen relatie-checker)';
+            if (!request.resource)
+                return 'ReBAC-conditie vereist een resource';
+            let result;
+            try {
+                result = await this.#rebac.check(request.subject.id, request.resource.id, { relations });
+            }
+            catch {
+                return 'relatie-evaluatie mislukt';
+            }
+            if (!result.allowed)
+                return 'ownership-conditie (ReBAC) niet voldaan';
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=pdp.js.map

package/dist/backend/access-control/core/pdp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdp.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/pdp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAW/D,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAO;IACZ,MAAM,CAA2B;IACjC,SAAS,CAAW;IAE7B,YAAY,IAAqB;QAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAExB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CACrG,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,WAAW,GAAG,uCAAuC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YACjG,CAAC;YACD,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,OAAwB;QAChC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,gCAAgC,CAAC,gCAAgC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,gCAAgC,CAAC,oBAAoB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,OAAwB;QACtD,IAAI,MAAM,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;YACtC,IAAI,SAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,OAAO,8BAA8B,CAAC;YACxC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB;YACvC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAE5B,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,mEAAmE,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,qCAAqC,CAAC;YACpE,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,2BAA2B,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,yCAAyC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/backend/access-control/core/ports.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Poorten & types voor de access-control-kit. Rollen, permissies, relaties en policies worden door
+ * het consumerende project geïnjecteerd; de kit bevat geen concrete rol-/permissie-namen of regels.
+ */
+/** Geauthenticeerd subject (identiteit-context, komt bv. van auth-kit). */
+export interface Subject {
+    id: string;
+    roles: string[];
+}
+export interface Resource {
+    id: string;
+    type?: string;
+}
+/** Uitkomst van een autorisatie-beslissing: expliciet allow/deny mét reden. */
+export interface Decision {
+    allowed: boolean;
+    /** Verklaarbare reden (voor audit); niet bedoeld om ruw aan eindgebruikers te tonen. */
+    reason: string;
+    /** Id van de toepasselijke policy bij een allow via het PDP. */
+    policyId?: string;
+}
+export interface RoleDefinition {
+    name: string;
+    permissions?: string[];
+    /** Andere rollen die deze rol omvat (rol-hiërarchie). */
+    includes?: string[];
+}
+export interface RbacDefinition {
+    roles: RoleDefinition[];
+}
+export interface RelationEdge {
+    from: string;
+    relation: string;
+    to: string;
+}
+/** Levert de directe relatie-edges vanaf een node (subject/team/resource). Data zit niet in de kit. */
+export interface RelationResolver {
+    relationsFrom(node: string): Promise<RelationEdge[]>;
+}
+export interface RebacResult {
+    allowed: boolean;
+    /** De terminale relatie waarmee de resource is bereikt (bv. `owner`). */
+    relation?: string;
+    /** Het opgeloste pad subject → … → resource. */
+    path?: string[];
+}
+export interface Policy {
+    id: string;
+    /** Action waarop deze policy van toepassing is, bv. `article:write`. */
+    action: string;
+    /** Optioneel: alleen van toepassing op dit resource-type. */
+    resourceType?: string;
+    /** RBAC-conditie: subject moet alle genoemde permissies hebben. */
+    requirePermissions?: string[];
+    /** ReBAC-conditie: subject moet in een (van deze) relatie(s) tot de resource staan. */
+    requireRelations?: string[];
+    /** ReBAC-conditie: subject moet eigenaar van de resource zijn (alias voor `requireRelations: ['owner']`). */
+    requireOwnership?: boolean;
+    /** Alleen allow-policies; deny is het default (afwezigheid van een toestaande policy). */
+    effect?: 'allow';
+}
+export interface DecisionRequest {
+    subject: Subject;
+    action: string;
+    resource?: Resource;
+    context?: Record<string, unknown>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/backend/access-control/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAID,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,6GAA6G;IAC7G,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC"}

package/dist/backend/access-control/core/ports.js

@@ -0,0 +1,6 @@
+/**
+ * Poorten & types voor de access-control-kit. Rollen, permissies, relaties en policies worden door
+ * het consumerende project geïnjecteerd; de kit bevat geen concrete rol-/permissie-namen of regels.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/backend/access-control/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/ports.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/backend/access-control/core/rbac.d.ts

@@ -0,0 +1,10 @@
+import type { RbacDefinition } from './ports.js';
+export interface Rbac {
+    /** Effectieve permissies voor een set rollen (incl. geërfde permissies via `includes`). */
+    resolve(roleNames: string[]): Set<string>;
+    hasPermission(roleNames: string[], permission: string): boolean;
+    readonly roleNames: string[];
+}
+/** Bouwt een RBAC-model uit een geïnjecteerde definitie; valideert referenties + cycli fail-fast. */
+export declare function createRbac(definition: RbacDefinition): Rbac;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/backend/access-control/core/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/rbac.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,IAAI;IACnB,2FAA2F;IAC3F,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,CA8B3D"}

package/dist/backend/access-control/core/rbac.js

@@ -0,0 +1,78 @@
+/**
+ * US-0501 — Rollen/permissie-model met resolutie van effectieve permissies en rol-hiërarchie.
+ *
+ * Het model wordt geïnjecteerd (config/policies-port); de kit kent geen concrete rol-/permissie-namen.
+ * Cyclische rol-verwijzingen worden bij het laden gedetecteerd en geweigerd. Resolutie van een
+ * onbekende rol faalt fail-fast; onbekende permissies leiden nooit tot impliciete toegang.
+ */
+import { RoleCycleError, UnknownRoleError } from './errors.js';
+/** Bouwt een RBAC-model uit een geïnjecteerde definitie; valideert referenties + cycli fail-fast. */
+export function createRbac(definition) {
+    const roles = new Map();
+    for (const role of definition.roles) {
+        roles.set(role.name, role);
+    }
+    // Alle `includes` moeten bestaande rollen zijn.
+    for (const role of definition.roles) {
+        for (const included of role.includes ?? []) {
+            if (!roles.has(included))
+                throw new UnknownRoleError(included);
+        }
+    }
+    detectCycles(roles);
+    const resolve = (roleNames) => {
+        const permissions = new Set();
+        const visited = new Set();
+        for (const name of roleNames) {
+            if (!roles.has(name))
+                throw new UnknownRoleError(name);
+            expand(name, roles, visited, permissions);
+        }
+        return permissions;
+    };
+    return {
+        resolve,
+        hasPermission: (roleNames, permission) => resolve(roleNames).has(permission),
+        roleNames: [...roles.keys()],
+    };
+}
+function expand(name, roles, visited, out) {
+    if (visited.has(name))
+        return;
+    visited.add(name);
+    const role = roles.get(name);
+    if (!role)
+        return;
+    for (const permission of role.permissions ?? [])
+        out.add(permission);
+    for (const included of role.includes ?? [])
+        expand(included, roles, visited, out);
+}
+function detectCycles(roles) {
+    const WHITE = 0;
+    const GRAY = 1;
+    const BLACK = 2;
+    const color = new Map();
+    for (const name of roles.keys())
+        color.set(name, WHITE);
+    const visit = (name, stack) => {
+        color.set(name, GRAY);
+        stack.push(name);
+        for (const included of roles.get(name)?.includes ?? []) {
+            const c = color.get(included);
+            if (c === GRAY) {
+                const start = stack.indexOf(included);
+                throw new RoleCycleError([...stack.slice(start), included]);
+            }
+            if (c === WHITE)
+                visit(included, stack);
+        }
+        color.set(name, BLACK);
+        stack.pop();
+    };
+    for (const name of roles.keys()) {
+        if (color.get(name) === WHITE)
+            visit(name, []);
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/backend/access-control/core/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAU/D,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,UAA0B;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,YAAY,CAAC,KAAK,CAAC,CAAC;IAEpB,MAAM,OAAO,GAAG,CAAC,SAAmB,EAAe,EAAE;QACnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,aAAa,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QAC5E,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,KAAkC,EAClC,OAAoB,EACpB,GAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,KAAkC;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAe,EAAQ,EAAE;QACpD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACvD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,IAAI,cAAc,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/backend/access-control/core/rebac.d.ts

@@ -0,0 +1,15 @@
+import type { RebacResult, RelationResolver } from './ports.js';
+export interface RebacOptions {
+    /** Maximale keten-diepte. Default 5. */
+    maxDepth?: number;
+}
+export interface CheckOptions {
+    /** Alleen deze terminale relaties tellen als toegang (bv. `['owner']`). Leeg = elke relatie. */
+    relations?: string[];
+}
+export declare class RebacChecker {
+    #private;
+    constructor(resolver: RelationResolver, options?: RebacOptions);
+    check(subject: string, resource: string, options?: CheckOptions): Promise<RebacResult>;
+}
+//# sourceMappingURL=rebac.d.ts.map

package/dist/backend/access-control/core/rebac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebac.d.ts","sourceRoot":"","sources":["../../../../backend/src/access-control/core/rebac.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAQD,qBAAa,YAAY;;gBAIX,QAAQ,EAAE,gBAAgB,EAAE,OAAO,GAAE,YAAiB;IAK5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;CAgCjG"}

package/dist/backend/access-control/core/rebac.js

@@ -0,0 +1,48 @@
+/**
+ * US-0503 — Ownership/relatie-checks (ReBAC).
+ *
+ * Evalueert of een subject via directe of indirecte relaties (bv. lid → team → bezit) tot een
+ * resource in relatie staat. De relatie-data komt via de geïnjecteerde {@link RelationResolver}-port.
+ * De keten-diepte is begrensd (geen oneindige/cyclische resolutie); afwezige relatie → default-deny;
+ * een falende port propageert als niet-lekkende fout, nooit als "toegestaan".
+ */
+import { RelationResolutionError } from './errors.js';
+export class RebacChecker {
+    #resolver;
+    #maxDepth;
+    constructor(resolver, options = {}) {
+        this.#resolver = resolver;
+        this.#maxDepth = options.maxDepth ?? 5;
+    }
+    async check(subject, resource, options = {}) {
+        const visited = new Set([subject]);
+        let frontier = [{ node: subject, depth: 0, path: [subject] }];
+        try {
+            while (frontier.length > 0) {
+                const next = [];
+                for (const current of frontier) {
+                    if (current.depth >= this.#maxDepth)
+                        continue; // begrensd
+                    const edges = await this.#resolver.relationsFrom(current.node);
+                    for (const edge of edges) {
+                        if (edge.to === resource &&
+                            (!options.relations || options.relations.includes(edge.relation))) {
+                            return { allowed: true, relation: edge.relation, path: [...current.path, resource] };
+                        }
+                        if (!visited.has(edge.to)) {
+                            visited.add(edge.to);
+                            next.push({ node: edge.to, depth: current.depth + 1, path: [...current.path, edge.to] });
+                        }
+                    }
+                }
+                frontier = next;
+            }
+        }
+        catch {
+            // Port-fout nooit als "toegestaan" laten doorgaan (US-0503 AC3).
+            throw new RelationResolutionError();
+        }
+        return { allowed: false };
+    }
+}
+//# sourceMappingURL=rebac.js.map

package/dist/backend/access-control/core/rebac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebac.js","sourceRoot":"","sources":["../../../../backend/src/access-control/core/rebac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAmBtD,MAAM,OAAO,YAAY;IACd,SAAS,CAAmB;IAC5B,SAAS,CAAS;IAE3B,YAAY,QAA0B,EAAE,UAAwB,EAAE;QAChE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,QAAgB,EAAE,UAAwB,EAAE;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,GAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE1E,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAe,EAAE,CAAC;gBAC5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS;wBAAE,SAAS,CAAC,WAAW;oBAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,IACE,IAAI,CAAC,EAAE,KAAK,QAAQ;4BACpB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EACjE,CAAC;4BACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACvF,CAAC;wBACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;4BAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BACrB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC3F,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACtC,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/dist/backend/access-control/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `access-control` kit — domein-loze autorisatie: RBAC (rollen/permissies + hiërarchie),
+ * enforcement met default-deny, ReBAC (ownership/relatie-checks) en een centraal policy-decision-point
+ * (allow/deny + reden). Pure core + adapters; rollen en policies worden geïnjecteerd.
+ *
+ * De NestJS-guard/decorator zit onder `@seifer-webapp-factory/kits/backend/access-control/nestjs`.
+ */
+export { createRbac, type Rbac } from './core/rbac.js';
+export { authorizePermissions, type AuthorizePermissionsParams } from './core/enforcement.js';
+export { RebacChecker, type RebacOptions, type CheckOptions } from './core/rebac.js';
+export { PolicyDecisionPoint, type PdpDependencies } from './core/pdp.js';
+export type { Subject, Resource, Decision, RoleDefinition, RbacDefinition, RelationEdge, RelationResolver, RebacResult, Policy, DecisionRequest, } from './core/ports.js';
+export { AccessControlError, UnknownRoleError, RoleCycleError, InvalidAuthorizationRequestError, RelationResolutionError, AccessDeniedError, } from './core/errors.js';
+export { inMemoryRelationResolver } from './adapters/in-memory-relations.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/access-control/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../backend/src/access-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,EAAE,oBAAoB,EAAE,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAG9F,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAG1E,YAAY,EACV,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/backend/access-control/index.js

@@ -0,0 +1,20 @@
+/**
+ * `access-control` kit — domein-loze autorisatie: RBAC (rollen/permissies + hiërarchie),
+ * enforcement met default-deny, ReBAC (ownership/relatie-checks) en een centraal policy-decision-point
+ * (allow/deny + reden). Pure core + adapters; rollen en policies worden geïnjecteerd.
+ *
+ * De NestJS-guard/decorator zit onder `@seifer-webapp-factory/kits/backend/access-control/nestjs`.
+ */
+// RBAC (US-0501)
+export { createRbac } from './core/rbac.js';
+// Enforcement (US-0502)
+export { authorizePermissions } from './core/enforcement.js';
+// ReBAC (US-0503)
+export { RebacChecker } from './core/rebac.js';
+// Policy decision-point (US-0504)
+export { PolicyDecisionPoint } from './core/pdp.js';
+// Fouten
+export { AccessControlError, UnknownRoleError, RoleCycleError, InvalidAuthorizationRequestError, RelationResolutionError, AccessDeniedError, } from './core/errors.js';
+// Adapters
+export { inMemoryRelationResolver } from './adapters/in-memory-relations.js';
+//# sourceMappingURL=index.js.map

package/dist/backend/access-control/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../backend/src/access-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,iBAAiB;AACjB,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AAEvD,wBAAwB;AACxB,OAAO,EAAE,oBAAoB,EAAmC,MAAM,uBAAuB,CAAC;AAE9F,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAwC,MAAM,iBAAiB,CAAC;AAErF,kCAAkC;AAClC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAgB1E,SAAS;AACT,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,WAAW;AACX,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC"}