@siriux/access-control 1.0.0

package/dist/AccessControlManager.d.ts

@@ -0,0 +1,24 @@
+import { Permission, AccessResult, AccessContext, AccessControlConfig } from './types';
+import { UserRole } from '@siriux/core';
+export declare class AccessControlManager {
+    private policyEngine;
+    private guardRegistry;
+    private rolePermissions;
+    constructor(config: AccessControlConfig);
+    can(permission: Permission, context: AccessContext, guards?: string[]): Promise<AccessResult>;
+    canAny(permissions: Permission[], context: AccessContext, guards?: string[]): Promise<AccessResult>;
+    canAll(permissions: Permission[], context: AccessContext, guards?: string[]): Promise<AccessResult>;
+    getUserPermissions(role: UserRole): Permission[];
+    ownsResource(userId: string, resourceId: string): Promise<boolean>;
+    addPolicy(policy: any): void;
+    removePolicy(policyId: string): void;
+    addGuard(guard: any): void;
+    removeGuard(guardName: string): void;
+    createMiddleware(options: {
+        permission: Permission;
+        guards?: string[];
+        getResourceContext?: (req: any) => Partial<AccessContext>;
+    }): (req: any, res: any, next: any) => Promise<any>;
+    static createDefault(): AccessControlManager;
+}
+//# sourceMappingURL=AccessControlManager.d.ts.map

package/dist/AccessControlManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessControlManager.d.ts","sourceRoot":"","sources":["../src/AccessControlManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EAEV,YAAY,EACZ,aAAa,EAEb,mBAAmB,EAEpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxC,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAA0C;gBAErD,MAAM,EAAE,mBAAmB;IAcjC,GAAG,CACP,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,YAAY,CAAC;IAwBlB,MAAM,CACV,WAAW,EAAE,UAAU,EAAE,EACzB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,YAAY,CAAC;IAelB,MAAM,CACV,WAAW,EAAE,UAAU,EAAE,EACzB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,YAAY,CAAC;IAYxB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,EAAE;IAK1C,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxE,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI;IAK5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI;IAK1B,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKpC,gBAAgB,CAAC,OAAO,EAAE;QACxB,UAAU,EAAE,UAAU,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;KAC3D,IACe,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG;IAgD7C,MAAM,CAAC,aAAa,IAAI,oBAAoB;CA2B7C"}

package/dist/AccessControlManager.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessControlManager = void 0;
+const types_1 = require("./types");
+const core_1 = require("@siriux/core");
+const PolicyEngine_1 = require("./policies/PolicyEngine");
+const guards_1 = require("./guards");
+class AccessControlManager {
+    constructor(config) {
+        this.rolePermissions = new Map();
+        this.policyEngine = new PolicyEngine_1.DefaultPolicyEngine(config.policies);
+        this.guardRegistry = new guards_1.GuardRegistry();
+        // Register custom guards
+        config.guards.forEach(guard => this.guardRegistry.register(guard));
+        // Set up role permissions
+        config.defaultRoles.forEach(roleDef => {
+            this.rolePermissions.set(roleDef.role, roleDef.permissions);
+        });
+    }
+    // Check if a user has permission for a specific action
+    async can(permission, context, guards) {
+        const request = {
+            permission,
+            context
+        };
+        // First check permission
+        const permissionResult = await this.policyEngine.evaluate(request);
+        if (!permissionResult.granted) {
+            return permissionResult;
+        }
+        // Then check guards if specified
+        if (guards && guards.length > 0) {
+            const guardResult = await this.guardRegistry.evaluateGuards(guards, request);
+            if (!guardResult.granted) {
+                return guardResult;
+            }
+        }
+        return { granted: true };
+    }
+    // Check multiple permissions at once
+    async canAny(permissions, context, guards) {
+        for (const permission of permissions) {
+            const result = await this.can(permission, context, guards);
+            if (result.granted) {
+                return result;
+            }
+        }
+        return {
+            granted: false,
+            reason: `None of the required permissions are granted: ${permissions.join(', ')}`
+        };
+    }
+    // Check if user has all specified permissions
+    async canAll(permissions, context, guards) {
+        for (const permission of permissions) {
+            const result = await this.can(permission, context, guards);
+            if (!result.granted) {
+                return result;
+            }
+        }
+        return { granted: true };
+    }
+    // Get user permissions
+    getUserPermissions(role) {
+        return this.rolePermissions.get(role) || [];
+    }
+    // Check if user owns a resource
+    async ownsResource(userId, resourceId) {
+        const context = {
+            userId,
+            userRole: core_1.UserRole.USER, // Role doesn't matter for ownership check
+            resourceId
+        };
+        const result = await this.can(types_1.Permission.READ_OWN_PROFILE, context, ['ownership']);
+        return result.granted;
+    }
+    // Add custom policy
+    addPolicy(policy) {
+        this.policyEngine.addPolicy(policy);
+    }
+    // Remove policy
+    removePolicy(policyId) {
+        this.policyEngine.removePolicy(policyId);
+    }
+    // Add custom guard
+    addGuard(guard) {
+        this.guardRegistry.register(guard);
+    }
+    // Remove guard
+    removeGuard(guardName) {
+        this.guardRegistry.unregister(guardName);
+    }
+    // Create middleware for Express
+    createMiddleware(options) {
+        return async (req, res, next) => {
+            try {
+                // Get user from request (assuming auth middleware already ran)
+                if (!req.user) {
+                    return res.status(401).json({
+                        success: false,
+                        error: 'Authentication required'
+                    });
+                }
+                // Build access context
+                const baseContext = {
+                    userId: req.user.userId || req.user.id,
+                    userRole: req.user.role,
+                    ip: req.ip || req.connection.remoteAddress
+                };
+                // Add custom context if provided
+                const customContext = options.getResourceContext
+                    ? options.getResourceContext(req)
+                    : {};
+                const context = { ...baseContext, ...customContext };
+                // Check permission
+                const result = await this.can(options.permission, context, options.guards);
+                if (!result.granted) {
+                    return res.status(403).json({
+                        success: false,
+                        error: result.reason || 'Access denied'
+                    });
+                }
+                // Attach access result to request
+                req.access = result;
+                next();
+            }
+            catch (error) {
+                console.error('Access control error:', error);
+                res.status(500).json({
+                    success: false,
+                    error: 'Internal server error'
+                });
+            }
+        };
+    }
+    // Factory method to create default configuration
+    static createDefault() {
+        const config = {
+            defaultRoles: [
+                {
+                    role: core_1.UserRole.USER,
+                    permissions: [
+                        types_1.Permission.READ_OWN_PROFILE,
+                        types_1.Permission.UPDATE_OWN_PROFILE,
+                        types_1.Permission.DELETE_OWN_ACCOUNT,
+                        types_1.Permission.READ_ALL_CONTENT,
+                        types_1.Permission.CREATE_CONTENT,
+                        types_1.Permission.UPDATE_OWN_CONTENT,
+                        types_1.Permission.DELETE_OWN_CONTENT
+                    ]
+                },
+                {
+                    role: core_1.UserRole.ADMIN,
+                    permissions: Object.values(types_1.Permission)
+                }
+            ],
+            policies: [],
+            guards: [],
+            strictMode: true
+        };
+        return new AccessControlManager(config);
+    }
+}
+exports.AccessControlManager = AccessControlManager;
+//# sourceMappingURL=AccessControlManager.js.map

package/dist/AccessControlManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessControlManager.js","sourceRoot":"","sources":["../src/AccessControlManager.ts"],"names":[],"mappings":";;;AAAA,mCAQiB;AACjB,uCAAwC;AACxC,0DAA8D;AAC9D,qCAAiE;AAEjE,MAAa,oBAAoB;IAK/B,YAAY,MAA2B;QAF/B,oBAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;QAG/D,IAAI,CAAC,YAAY,GAAG,IAAI,kCAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG,IAAI,sBAAoB,EAAE,CAAC;QAEhD,yBAAyB;QACzB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAEnE,0BAA0B;QAC1B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,GAAG,CACP,UAAsB,EACtB,OAAsB,EACtB,MAAiB;QAEjB,MAAM,OAAO,GAAkB;YAC7B,UAAU;YACV,OAAO;SACR,CAAC;QAEF,yBAAyB;QACzB,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,iCAAiC;QACjC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,MAAM,CACV,WAAyB,EACzB,OAAsB,EACtB,MAAiB;QAEjB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iDAAiD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACV,WAAyB,EACzB,OAAsB,EACtB,MAAiB;QAEjB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,kBAAkB,CAAC,IAAc;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,UAAkB;QACnD,MAAM,OAAO,GAAkB;YAC7B,MAAM;YACN,QAAQ,EAAE,eAAQ,CAAC,IAAI,EAAE,0CAA0C;YACnE,UAAU;SACX,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,SAAS,CAAC,MAAW;QACnB,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;IAChB,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,mBAAmB;IACnB,QAAQ,CAAC,KAAU;QACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,eAAe;IACf,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC;IAChC,gBAAgB,CAAC,OAIhB;QACC,OAAO,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,IAAS,EAAE,EAAE;YAC7C,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,yBAAyB;qBACjC,CAAC,CAAC;gBACL,CAAC;gBAED,uBAAuB;gBACvB,MAAM,WAAW,GAAkB;oBACjC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE;oBACtC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;oBACvB,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa;iBAC3C,CAAC;gBAEF,iCAAiC;gBACjC,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB;oBAC9C,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;oBACjC,CAAC,CAAC,EAAE,CAAC;gBAEP,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,GAAG,aAAa,EAAE,CAAC;gBAEpE,mBAAmB;gBACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAE3E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC1B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe;qBACxC,CAAC,CAAC;gBACL,CAAC;gBAED,kCAAkC;gBAClC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;gBACpB,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAwB;YAClC,YAAY,EAAE;gBACZ;oBACE,IAAI,EAAE,eAAQ,CAAC,IAAI;oBACnB,WAAW,EAAE;wBACX,kBAAU,CAAC,gBAAgB;wBAC3B,kBAAU,CAAC,kBAAkB;wBAC7B,kBAAU,CAAC,kBAAkB;wBAC7B,kBAAU,CAAC,gBAAgB;wBAC3B,kBAAU,CAAC,cAAc;wBACzB,kBAAU,CAAC,kBAAkB;wBAC7B,kBAAU,CAAC,kBAAkB;qBAC9B;iBACF;gBACD;oBACE,IAAI,EAAE,eAAQ,CAAC,KAAK;oBACpB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAU,CAAC;iBACvC;aACF;YACD,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI;SACjB,CAAC;QAEF,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF;AAvMD,oDAuMC"}

package/dist/guards/index.d.ts

@@ -0,0 +1,17 @@
+import { Guard, AccessRequest, AccessResult } from '../types';
+export declare const OwnershipGuard: Guard;
+export declare const TimeGuard: Guard;
+export declare const IPGuard: Guard;
+export declare const RoleGuard: Guard;
+export declare const ResourceStateGuard: Guard;
+export declare function createCustomGuard(name: string, checkFunction: (request: AccessRequest) => AccessResult | Promise<AccessResult>): Guard;
+export declare class GuardRegistry {
+    private guards;
+    constructor();
+    register(guard: Guard): void;
+    unregister(guardName: string): void;
+    get(guardName: string): Guard | undefined;
+    getAll(): Guard[];
+    evaluateGuards(guardNames: string[], request: AccessRequest): Promise<AccessResult>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAC;AAG7E,eAAO,MAAM,cAAc,EAAE,KAsB5B,CAAC;AAGF,eAAO,MAAM,SAAS,EAAE,KAcvB,CAAC;AAGF,eAAO,MAAM,OAAO,EAAE,KAqBrB,CAAC;AAGF,eAAO,MAAM,SAAS,EAAE,KA0BvB,CAAC;AAGF,eAAO,MAAM,kBAAkB,EAAE,KA2BhC,CAAC;AAGF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAC9E,KAAK,CAKP;AAGD,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAiC;;IAW/C,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAI5B,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAIzC,MAAM,IAAI,KAAK,EAAE;IAIX,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CAkB1F"}

package/dist/guards/index.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardRegistry = exports.ResourceStateGuard = exports.RoleGuard = exports.IPGuard = exports.TimeGuard = exports.OwnershipGuard = void 0;
+exports.createCustomGuard = createCustomGuard;
+// Ownership guard - checks if user owns the resource
+exports.OwnershipGuard = {
+    name: 'ownership',
+    check: (request) => {
+        const { userId } = request.context;
+        const { resourceId } = request.context;
+        if (!resourceId) {
+            return {
+                granted: false,
+                reason: 'No resource ID provided for ownership check'
+            };
+        }
+        // In a real implementation, this would check the database
+        // For now, we'll assume the resource ID contains the owner ID
+        const isOwner = resourceId.includes(`owner:${userId}`);
+        return {
+            granted: isOwner,
+            reason: isOwner ? 'User owns the resource' : 'User does not own the resource'
+        };
+    }
+};
+// Time-based guard - checks if access is within allowed time windows
+exports.TimeGuard = {
+    name: 'time',
+    check: (request) => {
+        const now = new Date();
+        const hour = now.getHours();
+        // Allow access during business hours (9 AM - 6 PM)
+        const isBusinessHours = hour >= 9 && hour <= 18;
+        return {
+            granted: isBusinessHours,
+            reason: isBusinessHours ? 'Access within business hours' : 'Access outside business hours'
+        };
+    }
+};
+// IP-based guard - checks if access is from allowed IP addresses
+exports.IPGuard = {
+    name: 'ip',
+    check: (request) => {
+        const clientIP = request.context?.ip;
+        if (!clientIP) {
+            return {
+                granted: false,
+                reason: 'No IP address provided'
+            };
+        }
+        // In a real implementation, this would check against a whitelist
+        const allowedIPs = ['127.0.0.1', '::1']; // localhost
+        const isAllowed = allowedIPs.includes(clientIP);
+        return {
+            granted: isAllowed,
+            reason: isAllowed ? 'IP address allowed' : 'IP address not allowed'
+        };
+    }
+};
+// Role-based guard - checks if user has required role
+exports.RoleGuard = {
+    name: 'role',
+    check: (request) => {
+        const { userRole } = request.context;
+        const requiredRole = request.context?.requiredRole;
+        if (!requiredRole) {
+            return { granted: true };
+        }
+        const roleHierarchy = {
+            'admin': 3,
+            'manager': 2,
+            'user': 1
+        };
+        const userLevel = roleHierarchy[userRole] || 0;
+        const requiredLevel = roleHierarchy[requiredRole] || 0;
+        const hasRequiredRole = userLevel >= requiredLevel;
+        return {
+            granted: hasRequiredRole,
+            reason: hasRequiredRole ? 'Role requirement satisfied' : 'Insufficient role level'
+        };
+    }
+};
+// Resource state guard - checks if resource is in a state that allows access
+exports.ResourceStateGuard = {
+    name: 'resource-state',
+    check: (request) => {
+        const resourceState = request.context?.resourceState;
+        if (!resourceState) {
+            return { granted: true };
+        }
+        // Define states that allow different actions
+        const allowedStates = {
+            'read': ['active', 'archived', 'draft'],
+            'update': ['active', 'draft'],
+            'delete': ['active', 'draft'],
+            'create': []
+        };
+        const action = request.context?.action || 'read';
+        const allowedStatesForAction = allowedStates[action] || [];
+        const isAllowed = allowedStatesForAction.includes(resourceState);
+        return {
+            granted: isAllowed,
+            reason: isAllowed ? 'Resource state allows action' : 'Resource state does not allow action'
+        };
+    }
+};
+// Custom guard factory for creating dynamic guards
+function createCustomGuard(name, checkFunction) {
+    return {
+        name,
+        check: checkFunction
+    };
+}
+// Guard registry for managing multiple guards
+class GuardRegistry {
+    constructor() {
+        this.guards = new Map();
+        // Register default guards
+        this.register(exports.OwnershipGuard);
+        this.register(exports.TimeGuard);
+        this.register(exports.IPGuard);
+        this.register(exports.RoleGuard);
+        this.register(exports.ResourceStateGuard);
+    }
+    register(guard) {
+        this.guards.set(guard.name, guard);
+    }
+    unregister(guardName) {
+        this.guards.delete(guardName);
+    }
+    get(guardName) {
+        return this.guards.get(guardName);
+    }
+    getAll() {
+        return Array.from(this.guards.values());
+    }
+    async evaluateGuards(guardNames, request) {
+        for (const guardName of guardNames) {
+            const guard = this.get(guardName);
+            if (!guard) {
+                return {
+                    granted: false,
+                    reason: `Guard not found: ${guardName}`
+                };
+            }
+            const result = await guard.check(request);
+            if (!result.granted) {
+                return result;
+            }
+        }
+        return { granted: true };
+    }
+}
+exports.GuardRegistry = GuardRegistry;
+//# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":";;;AAgIA,8CAQC;AAtID,qDAAqD;AACxC,QAAA,cAAc,GAAU;IACnC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,CAAC,OAAsB,EAAgB,EAAE;QAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAEvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,8DAA8D;QAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,gCAAgC;SAC9E,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,qEAAqE;AACxD,QAAA,SAAS,GAAU;IAC9B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,OAAsB,EAAgB,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAE5B,mDAAmD;QACnD,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAEhD,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,+BAA+B;SAC3F,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,iEAAiE;AACpD,QAAA,OAAO,GAAU;IAC5B,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,CAAC,OAAsB,EAAgB,EAAE;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAErC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhD,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB;SACpE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,sDAAsD;AACzC,QAAA,SAAS,GAAU;IAC9B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,CAAC,OAAsB,EAAgB,EAAE;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;QAEnD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;SACV,CAAC;QAEF,MAAM,SAAS,GAAG,aAAa,CAAC,QAAsC,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,aAAa,CAAC,YAA0C,CAAC,IAAI,CAAC,CAAC;QAErF,MAAM,eAAe,GAAG,SAAS,IAAI,aAAa,CAAC;QAEnD,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,yBAAyB;SACnF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,6EAA6E;AAChE,QAAA,kBAAkB,GAAU;IACvC,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,CAAC,OAAsB,EAAgB,EAAE;QAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAErD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,6CAA6C;QAC7C,MAAM,aAAa,GAA6B;YAC9C,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC;YACvC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC7B,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC;QACjD,MAAM,sBAAsB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAE3D,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sCAAsC;SAC5F,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,mDAAmD;AACnD,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,aAA+E;IAE/E,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,aAAa;KACrB,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAa,aAAa;IAGxB;QAFQ,WAAM,GAAuB,IAAI,GAAG,EAAE,CAAC;QAG7C,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,sBAAc,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,iBAAS,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,eAAO,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,iBAAS,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,0BAAkB,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,KAAY;QACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAoB,EAAE,OAAsB;QAC/D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oBAAoB,SAAS,EAAE;iBACxC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AA9CD,sCA8CC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export { AccessControlManager } from './AccessControlManager';
+export { DefaultPolicyEngine } from './policies/PolicyEngine';
+export { OwnershipGuard, TimeGuard, IPGuard, RoleGuard, ResourceStateGuard, createCustomGuard, GuardRegistry } from './guards';
+export declare const SIRIUX_ACCESS_CONTROL_VERSION = "1.0.0";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG9D,OAAO,EACL,cAAc,EACd,SAAS,EACT,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACd,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,6BAA6B,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIRIUX_ACCESS_CONTROL_VERSION = exports.GuardRegistry = exports.createCustomGuard = exports.ResourceStateGuard = exports.RoleGuard = exports.IPGuard = exports.TimeGuard = exports.OwnershipGuard = exports.DefaultPolicyEngine = exports.AccessControlManager = void 0;
+// Core exports
+__exportStar(require("./types"), exports);
+// Main classes
+var AccessControlManager_1 = require("./AccessControlManager");
+Object.defineProperty(exports, "AccessControlManager", { enumerable: true, get: function () { return AccessControlManager_1.AccessControlManager; } });
+var PolicyEngine_1 = require("./policies/PolicyEngine");
+Object.defineProperty(exports, "DefaultPolicyEngine", { enumerable: true, get: function () { return PolicyEngine_1.DefaultPolicyEngine; } });
+// Guards
+var guards_1 = require("./guards");
+Object.defineProperty(exports, "OwnershipGuard", { enumerable: true, get: function () { return guards_1.OwnershipGuard; } });
+Object.defineProperty(exports, "TimeGuard", { enumerable: true, get: function () { return guards_1.TimeGuard; } });
+Object.defineProperty(exports, "IPGuard", { enumerable: true, get: function () { return guards_1.IPGuard; } });
+Object.defineProperty(exports, "RoleGuard", { enumerable: true, get: function () { return guards_1.RoleGuard; } });
+Object.defineProperty(exports, "ResourceStateGuard", { enumerable: true, get: function () { return guards_1.ResourceStateGuard; } });
+Object.defineProperty(exports, "createCustomGuard", { enumerable: true, get: function () { return guards_1.createCustomGuard; } });
+Object.defineProperty(exports, "GuardRegistry", { enumerable: true, get: function () { return guards_1.GuardRegistry; } });
+// Version information
+exports.SIRIUX_ACCESS_CONTROL_VERSION = '1.0.0';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,eAAe;AACf,0CAAwB;AAExB,eAAe;AACf,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,wDAA8D;AAArD,mHAAA,mBAAmB,OAAA;AAE5B,SAAS;AACT,mCAQkB;AAPhB,wGAAA,cAAc,OAAA;AACd,mGAAA,SAAS,OAAA;AACT,iGAAA,OAAO,OAAA;AACP,mGAAA,SAAS,OAAA;AACT,4GAAA,kBAAkB,OAAA;AAClB,2GAAA,iBAAiB,OAAA;AACjB,uGAAA,aAAa,OAAA;AAGf,sBAAsB;AACT,QAAA,6BAA6B,GAAG,OAAO,CAAC"}

package/dist/policies/PolicyEngine.d.ts

@@ -0,0 +1,14 @@
+import { Policy, PolicyEngine, AccessRequest, AccessResult } from '../types';
+export declare class DefaultPolicyEngine implements PolicyEngine {
+    private policies;
+    constructor(policies?: Policy[]);
+    evaluate(request: AccessRequest): AccessResult;
+    addPolicy(policy: Policy): void;
+    removePolicy(policyId: string): void;
+    getPolicies(): Policy[];
+    private getUserPermissions;
+    private evaluatePolicy;
+    private evaluateCondition;
+    private getFieldValue;
+}
+//# sourceMappingURL=PolicyEngine.d.ts.map

package/dist/policies/PolicyEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyEngine.d.ts","sourceRoot":"","sources":["../../src/policies/PolicyEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAmB,MAAM,UAAU,CAAC;AAE9F,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,QAAQ,CAAkC;gBAEtC,QAAQ,GAAE,MAAM,EAAO;IAInC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY;IA0B9C,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIpC,WAAW,IAAI,MAAM,EAAE;IAIvB,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,iBAAiB;IAyBzB,OAAO,CAAC,aAAa;CAGtB"}

package/dist/policies/PolicyEngine.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultPolicyEngine = void 0;
+class DefaultPolicyEngine {
+    constructor(policies = []) {
+        this.policies = new Map();
+        policies.forEach(policy => this.addPolicy(policy));
+    }
+    evaluate(request) {
+        const userPermissions = this.getUserPermissions(request.context.userRole);
+        // Check if user has the required permission
+        if (!userPermissions.includes(request.permission)) {
+            return {
+                granted: false,
+                reason: `User does not have permission: ${request.permission}`
+            };
+        }
+        // Evaluate policies
+        for (const policy of this.policies.values()) {
+            if (!policy.permissions.includes(request.permission)) {
+                continue;
+            }
+            const result = this.evaluatePolicy(policy, request);
+            if (!result.granted) {
+                return result;
+            }
+        }
+        return { granted: true };
+    }
+    addPolicy(policy) {
+        this.policies.set(policy.id, policy);
+    }
+    removePolicy(policyId) {
+        this.policies.delete(policyId);
+    }
+    getPolicies() {
+        return Array.from(this.policies.values());
+    }
+    getUserPermissions(role) {
+        // This would typically come from a role manager
+        // For now, return basic role permissions
+        switch (role) {
+            case 'admin':
+                return Object.values(require('../types').Permission);
+            case 'user':
+                return [
+                    require('../types').Permission.READ_OWN_PROFILE,
+                    require('../types').Permission.UPDATE_OWN_PROFILE,
+                    require('../types').Permission.DELETE_OWN_ACCOUNT,
+                    require('../types').Permission.READ_ALL_CONTENT,
+                    require('../types').Permission.CREATE_CONTENT,
+                    require('../types').Permission.UPDATE_OWN_CONTENT,
+                    require('../types').Permission.DELETE_OWN_CONTENT
+                ];
+            default:
+                return [];
+        }
+    }
+    evaluatePolicy(policy, request) {
+        if (!policy.conditions || policy.conditions.length === 0) {
+            return { granted: true, policy: policy.id };
+        }
+        for (const condition of policy.conditions) {
+            if (!this.evaluateCondition(condition, request.context)) {
+                return {
+                    granted: false,
+                    reason: `Policy condition failed: ${policy.name}`,
+                    policy: policy.id
+                };
+            }
+        }
+        return { granted: true, policy: policy.id };
+    }
+    evaluateCondition(condition, context) {
+        const fieldValue = this.getFieldValue(context, condition.field);
+        switch (condition.operator) {
+            case 'eq':
+                return fieldValue === condition.value;
+            case 'ne':
+                return fieldValue !== condition.value;
+            case 'in':
+                return Array.isArray(condition.value) && condition.value.includes(fieldValue);
+            case 'nin':
+                return Array.isArray(condition.value) && !condition.value.includes(fieldValue);
+            case 'gt':
+                return fieldValue > condition.value;
+            case 'gte':
+                return fieldValue >= condition.value;
+            case 'lt':
+                return fieldValue < condition.value;
+            case 'lte':
+                return fieldValue <= condition.value;
+            default:
+                return false;
+        }
+    }
+    getFieldValue(context, field) {
+        return field.split('.').reduce((obj, key) => obj?.[key], context);
+    }
+}
+exports.DefaultPolicyEngine = DefaultPolicyEngine;
+//# sourceMappingURL=PolicyEngine.js.map

package/dist/policies/PolicyEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PolicyEngine.js","sourceRoot":"","sources":["../../src/policies/PolicyEngine.ts"],"names":[],"mappings":";;;AAEA,MAAa,mBAAmB;IAG9B,YAAY,WAAqB,EAAE;QAF3B,aAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;QAGhD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,OAAsB;QAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE1E,4CAA4C;QAC5C,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kCAAkC,OAAO,CAAC,UAAU,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,IAAY;QACrC,gDAAgD;QAChD,yCAAyC;QACzC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC;YACvD,KAAK,MAAM;gBACT,OAAO;oBACL,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,gBAAgB;oBAC/C,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,kBAAkB;oBACjD,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,kBAAkB;oBACjD,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,gBAAgB;oBAC/C,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,cAAc;oBAC7C,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,kBAAkB;oBACjD,OAAO,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,kBAAkB;iBAClD,CAAC;YACJ;gBACE,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,OAAsB;QAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4BAA4B,MAAM,CAAC,IAAI,EAAE;oBACjD,MAAM,EAAE,MAAM,CAAC,EAAE;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAEO,iBAAiB,CAAC,SAA0B,EAAE,OAAY;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAEhE,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3B,KAAK,IAAI;gBACP,OAAO,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC;YACxC,KAAK,IAAI;gBACP,OAAO,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC;YACxC,KAAK,IAAI;gBACP,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChF,KAAK,KAAK;gBACR,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjF,KAAK,IAAI;gBACP,OAAO,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;YACtC,KAAK,KAAK;gBACR,OAAO,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC;YACvC,KAAK,IAAI;gBACP,OAAO,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;YACtC,KAAK,KAAK;gBACR,OAAO,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC;YACvC;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,OAAY,EAAE,KAAa;QAC/C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;CACF;AAhHD,kDAgHC"}

package/dist/types/index.d.ts

@@ -0,0 +1,114 @@
+import { UserRole } from '@siriux/core';
+export declare enum Permission {
+    READ_OWN_PROFILE = "read:own:profile",
+    UPDATE_OWN_PROFILE = "update:own:profile",
+    DELETE_OWN_ACCOUNT = "delete:own:account",
+    READ_ALL_USERS = "read:all:users",
+    UPDATE_ALL_USERS = "update:all:users",
+    DELETE_ALL_USERS = "delete:all:users",
+    MANAGE_ROLES = "manage:roles",
+    READ_ALL_CONTENT = "read:all:content",
+    CREATE_CONTENT = "create:content",
+    UPDATE_OWN_CONTENT = "update:own:content",
+    UPDATE_ALL_CONTENT = "update:all:content",
+    DELETE_OWN_CONTENT = "delete:own:content",
+    DELETE_ALL_CONTENT = "delete:all:content",
+    READ_SYSTEM_LOGS = "read:system:logs",
+    MANAGE_SYSTEM = "manage:system",
+    VIEW_ANALYTICS = "view:analytics"
+}
+export declare enum ResourceType {
+    USER = "user",
+    CONTENT = "content",
+    SYSTEM = "system",
+    ANALYTICS = "analytics"
+}
+export declare enum ActionType {
+    CREATE = "create",
+    READ = "read",
+    UPDATE = "update",
+    DELETE = "delete",
+    MANAGE = "manage"
+}
+export interface Policy {
+    id: string;
+    name: string;
+    description: string;
+    permissions: Permission[];
+    conditions?: PolicyCondition[];
+}
+export interface PolicyCondition {
+    field: string;
+    operator: 'eq' | 'ne' | 'in' | 'nin' | 'gt' | 'gte' | 'lt' | 'lte';
+    value: any;
+}
+export interface RoleDefinition {
+    role: UserRole;
+    permissions: Permission[];
+    policies?: string[];
+}
+export interface AccessContext {
+    userId: string;
+    userRole: UserRole;
+    resourceId?: string;
+    resourceType?: ResourceType;
+    action?: ActionType;
+    ip?: string;
+    requiredRole?: UserRole;
+    resourceState?: string;
+    context?: Record<string, any>;
+}
+export interface AccessRequest {
+    permission: Permission;
+    context: AccessContext;
+}
+export interface AccessResult {
+    granted: boolean;
+    reason?: string;
+    policy?: string;
+}
+export interface Resource {
+    id: string;
+    type: ResourceType;
+    ownerId?: string;
+    attributes: Record<string, any>;
+}
+export interface Guard {
+    name: string;
+    check: (request: AccessRequest) => AccessResult | Promise<AccessResult>;
+}
+export interface PolicyEngine {
+    evaluate: (request: AccessRequest) => AccessResult | Promise<AccessResult>;
+    addPolicy: (policy: Policy) => void;
+    removePolicy: (policyId: string) => void;
+    getPolicies: () => Policy[];
+}
+export interface RoleManager {
+    getRolePermissions: (role: UserRole) => Permission[];
+    assignRole: (userId: string, role: UserRole) => void;
+    removeRole: (userId: string, role: UserRole) => void;
+    getUserRoles: (userId: string) => UserRole[];
+}
+export interface AccessControlConfig {
+    defaultRoles: RoleDefinition[];
+    policies: Policy[];
+    guards: Guard[];
+    strictMode?: boolean;
+}
+export interface AccessControlMiddlewareOptions {
+    resourceType: ResourceType;
+    action: ActionType;
+    resourceIdParam?: string;
+    checkOwnership?: boolean;
+    customGuards?: string[];
+}
+export interface AccessControlRequest {
+    user?: {
+        id: string;
+        role: UserRole;
+        permissions: Permission[];
+    };
+    resource?: Resource;
+    access?: AccessResult;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,oBAAY,UAAU;IAEpB,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IAGzC,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAG7B,gBAAgB,qBAAqB;IACrC,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IAGzC,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;CAClC;AAGD,oBAAY,YAAY;IACtB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAGD,oBAAY,UAAU;IACpB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAGD,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACnE,KAAK,EAAE,GAAG,CAAC;CACZ;AAGD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,QAAQ,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAGD,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;CACxB;AAGD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACjC;AAGD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACzE;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3E,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,WAAW,EAAE,MAAM,MAAM,EAAE,CAAC;CAC7B;AAGD,MAAM,WAAW,WAAW;IAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;IACrD,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IACrD,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IACrD,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;CAC9C;AAGD,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAGD,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAGD,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,WAAW,EAAE,UAAU,EAAE,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB"}

package/dist/types/index.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionType = exports.ResourceType = exports.Permission = void 0;
+// Permission types
+var Permission;
+(function (Permission) {
+    // User permissions
+    Permission["READ_OWN_PROFILE"] = "read:own:profile";
+    Permission["UPDATE_OWN_PROFILE"] = "update:own:profile";
+    Permission["DELETE_OWN_ACCOUNT"] = "delete:own:account";
+    // Admin permissions
+    Permission["READ_ALL_USERS"] = "read:all:users";
+    Permission["UPDATE_ALL_USERS"] = "update:all:users";
+    Permission["DELETE_ALL_USERS"] = "delete:all:users";
+    Permission["MANAGE_ROLES"] = "manage:roles";
+    // Content permissions
+    Permission["READ_ALL_CONTENT"] = "read:all:content";
+    Permission["CREATE_CONTENT"] = "create:content";
+    Permission["UPDATE_OWN_CONTENT"] = "update:own:content";
+    Permission["UPDATE_ALL_CONTENT"] = "update:all:content";
+    Permission["DELETE_OWN_CONTENT"] = "delete:own:content";
+    Permission["DELETE_ALL_CONTENT"] = "delete:all:content";
+    // System permissions
+    Permission["READ_SYSTEM_LOGS"] = "read:system:logs";
+    Permission["MANAGE_SYSTEM"] = "manage:system";
+    Permission["VIEW_ANALYTICS"] = "view:analytics";
+})(Permission || (exports.Permission = Permission = {}));
+// Resource types
+var ResourceType;
+(function (ResourceType) {
+    ResourceType["USER"] = "user";
+    ResourceType["CONTENT"] = "content";
+    ResourceType["SYSTEM"] = "system";
+    ResourceType["ANALYTICS"] = "analytics";
+})(ResourceType || (exports.ResourceType = ResourceType = {}));
+// Action types
+var ActionType;
+(function (ActionType) {
+    ActionType["CREATE"] = "create";
+    ActionType["READ"] = "read";
+    ActionType["UPDATE"] = "update";
+    ActionType["DELETE"] = "delete";
+    ActionType["MANAGE"] = "manage";
+})(ActionType || (exports.ActionType = ActionType = {}));
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";;;AAEA,mBAAmB;AACnB,IAAY,UAwBX;AAxBD,WAAY,UAAU;IACpB,mBAAmB;IACnB,mDAAqC,CAAA;IACrC,uDAAyC,CAAA;IACzC,uDAAyC,CAAA;IAEzC,oBAAoB;IACpB,+CAAiC,CAAA;IACjC,mDAAqC,CAAA;IACrC,mDAAqC,CAAA;IACrC,2CAA6B,CAAA;IAE7B,sBAAsB;IACtB,mDAAqC,CAAA;IACrC,+CAAiC,CAAA;IACjC,uDAAyC,CAAA;IACzC,uDAAyC,CAAA;IACzC,uDAAyC,CAAA;IACzC,uDAAyC,CAAA;IAEzC,qBAAqB;IACrB,mDAAqC,CAAA;IACrC,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;AACnC,CAAC,EAxBW,UAAU,0BAAV,UAAU,QAwBrB;AAED,iBAAiB;AACjB,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,6BAAa,CAAA;IACb,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;AACzB,CAAC,EALW,YAAY,4BAAZ,YAAY,QAKvB;AAED,eAAe;AACf,IAAY,UAMX;AAND,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,2BAAa,CAAA;IACb,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;AACnB,CAAC,EANW,UAAU,0BAAV,UAAU,QAMrB"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@siriux/access-control",
+  "version": "1.0.0",
+  "description": "Siriux Access Control - Role-based access control, permissions, and policies",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "jest",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "keywords": [
+    "siriux",
+    "access-control",
+    "rbac",
+    "permissions",
+    "authorization",
+    "policies",
+    "guards",
+    "security"
+  ],
+  "author": "jawwad@alsirius.co.uk",
+  "license": "MIT",
+  "dependencies": {
+    "@siriux/core": "^2.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.5",
+    "typescript": "^5.3.3",
+    "jest": "^29.7.0",
+    "@types/jest": "^29.5.8"
+  },
+  "files": [
+    "dist/**/*"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}