@spinajs/authz-fs 0.0.0-stage → 3.0.0

package/README.md

@@ -1,3 +1,31 @@
-# Temporary Holding Version
+# `@spinajs/authz-fs`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Checks every file action of `@spinajs/fs` providers with `@spinajs/authz` (`AuthzFsMiddleware`) and keeps per-file
+rights in the ORM table `fs_acl`.
+
+## Documentation
+
+- [Package overview](../../docs/authz-fs/README.md)
+- [Access modes and configuration](../../docs/authz-fs/01-access-modes-and-configuration.md)
+- [Checks on file actions](../../docs/authz-fs/02-checks-on-file-actions.md)
+- [File ACL](../../docs/authz-fs/03-file-acl.md)
+- [Relation grants](../../docs/authz-fs/04-relation-grants.md)
+- [Managing ACL rows](../../docs/authz-fs/05-managing-acl-rows.md)
+- [Uploads and routes](../../docs/authz-fs/06-uploads-and-routes.md)
+- [ACL store](../../docs/authz-fs/07-acl-store.md)
+
+## Tests
+
+`npm run test` runs the behaviour fixture B28 once per provider kind, in suites titled `local` (fsNative), `temp`
+(fsTemp over fsNative) and `s3` (fsS3). The `s3` suites need localstack at `AUTHZ_FS_S3_ENDPOINT` (default
+`http://localhost:4566`):
+
+```sh
+docker run --rm -d -p 4566:4566 -e SERVICES=s3 localstack/localstack
+```
+
+Without it they are skipped with a message. Set `AUTHZ_FS_S3=required` (release gate item 4: run
+`AUTHZ_FS_S3=required npm test` in `packages/authz-fs` against localstack, a manual release step) to make an
+unreachable localstack fail them instead. Cases that cannot hold on S3 for a provider reason are listed, with the
+reason, as pending tests (`test/support/on-s3.ts`). The ORM store suite runs on SQLite, and on Postgres and MySQL with
+`AUTHZ_FS_DB=postgres,mysql` and the orm packages' test containers.

package/lib/cjs/access-config/acl-config.d.ts

@@ -0,0 +1,23 @@
+import type { IContainer } from '@spinajs/di';
+export declare const FS_ACL_CONNECTION_KEY = "authz.fsAcl.connection";
+export declare const FS_ACL_DEFAULT_CONNECTION = "default";
+/** The relation of the row owner stamping writes. */
+export declare const FS_ACL_OWNER = "owner";
+export declare const FS_ACL_DEFAULT_RELATIONS: readonly string[];
+/** fs_acl.relation holds this many characters. */
+export declare const FS_ACL_RELATION_MAX_LENGTH = 64;
+/** `authz.fsAcl` (fs middleware design §2). */
+export interface FsAclConfig {
+    /** ORM connection of OrmFileAclStore and of its migration. */
+    readonly connection: string;
+    /** The relations an ACL row may name; FsResourceAdapter serves a RelationResolver for each on fs, dir and file. */
+    readonly relations: readonly string[];
+}
+/**
+ * `authz.fsAcl` of the Configuration in `container`, defaults filled; without a Configuration the defaults (the
+ * migration reads the connection before any is resolved). `owner` is always among the relations, first: owner
+ * stamping writes it whatever the config lists.
+ * @throws AuthzConfigError for a malformed value no schema checked
+ */
+export declare function fsAclConfig(container?: IContainer): FsAclConfig;
+//# sourceMappingURL=acl-config.d.ts.map

package/lib/cjs/access-config/acl-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-config.d.ts","sourceRoot":"","sources":["../../../src/access-config/acl-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAC9D,eAAO,MAAM,yBAAyB,YAAY,CAAC;AACnD,qDAAqD;AACrD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAsD,CAAC;AAC7G,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mHAAmH;IACnH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,GAAE,UAA6B,GAAG,WAAW,CAUjF"}

package/lib/cjs/access-config/acl-config.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FS_ACL_RELATION_MAX_LENGTH = exports.FS_ACL_DEFAULT_RELATIONS = exports.FS_ACL_OWNER = exports.FS_ACL_DEFAULT_CONNECTION = exports.FS_ACL_CONNECTION_KEY = void 0;
+exports.fsAclConfig = fsAclConfig;
+const authz_1 = require("@spinajs/authz");
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const util_1 = require("@spinajs/util");
+const checks_js_1 = require("../checks.js");
+// Not under authz.fs: that section is keyed by filesystem name.
+exports.FS_ACL_CONNECTION_KEY = 'authz.fsAcl.connection';
+exports.FS_ACL_DEFAULT_CONNECTION = 'default';
+/** The relation of the row owner stamping writes. */
+exports.FS_ACL_OWNER = 'owner';
+exports.FS_ACL_DEFAULT_RELATIONS = Object.freeze([exports.FS_ACL_OWNER, 'editor', 'viewer']);
+/** fs_acl.relation holds this many characters. */
+exports.FS_ACL_RELATION_MAX_LENGTH = 64;
+/**
+ * `authz.fsAcl` of the Configuration in `container`, defaults filled; without a Configuration the defaults (the
+ * migration reads the connection before any is resolved). `owner` is always among the relations, first: owner
+ * stamping writes it whatever the config lists.
+ * @throws AuthzConfigError for a malformed value no schema checked
+ */
+function fsAclConfig(container = di_1.DI.RootContainer) {
+    const configuration = container.get(configuration_1.Configuration);
+    const read = (key) => (configuration && typeof configuration.get === 'function' ? configuration.get(['authz', 'fsAcl', key]) : undefined);
+    const connection = read('connection') ?? exports.FS_ACL_DEFAULT_CONNECTION;
+    if (typeof connection !== 'string' || connection === '')
+        throw new authz_1.AuthzConfigError(`${exports.FS_ACL_CONNECTION_KEY} must be a non-empty string, got ${(0, checks_js_1.show)(connection)}`);
+    const relations = read('relations') ?? exports.FS_ACL_DEFAULT_RELATIONS;
+    if (!(0, util_1.isStringArray)(relations, { nonEmpty: true }) || !relations.every((r) => r.length <= exports.FS_ACL_RELATION_MAX_LENGTH)) {
+        throw new authz_1.AuthzConfigError(`authz.fsAcl.relations must be a list of relation names of 1-${exports.FS_ACL_RELATION_MAX_LENGTH} characters, got ${(0, checks_js_1.show)(relations)}`);
+    }
+    return Object.freeze({ connection, relations: Object.freeze([...new Set([exports.FS_ACL_OWNER, ...relations])]) });
+}
+//# sourceMappingURL=acl-config.js.map

package/lib/cjs/access-config/acl-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-config.js","sourceRoot":"","sources":["../../../src/access-config/acl-config.ts"],"names":[],"mappings":";;;;AAAA,0CAAkD;AAClD,0DAAuD;AACvD,oCAAiC;AAEjC,wCAA8C;AAE9C,4CAAoC;AAEpC,gEAAgE;AACnD,QAAA,qBAAqB,GAAG,wBAAwB,CAAC;AACjD,QAAA,yBAAyB,GAAG,SAAS,CAAC;AACnD,qDAAqD;AACxC,QAAA,YAAY,GAAG,OAAO,CAAC;AACvB,QAAA,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAA,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7G,kDAAkD;AACrC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAU7C;;;;;GAKG;AACH,qBAA4B,SAAS,GAAe,OAAE,CAAC,aAAa;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,6BAAa,CAA8B,CAAC;IAChF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpK,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,QAAA,yBAAyB,CAAC;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,QAAA,qBAAqB,oCAAoC,IAAA,gBAAI,EAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpK,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,QAAA,wBAAwB,CAAC;IAChE,IAAI,CAAC,IAAA,oBAAa,EAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,QAAA,0BAA0B,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,wBAAgB,CAAC,+DAA+D,QAAA,0BAA0B,oBAAoB,IAAA,gBAAI,EAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7J,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAA,YAAY,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7G,CAAC"}

package/lib/cjs/access-config/index.d.ts

@@ -0,0 +1,34 @@
+import type { IContainer } from '@spinajs/di';
+export * from './schema.js';
+export * from './acl-config.js';
+export type FsAccessMode = 'off' | 'audit' | 'enforce';
+/** `authz.fs.<name>.signedUrl` (D9). */
+export interface FsSignedUrlConfig {
+    /** Cap on every signed URL's lifetime. */
+    readonly maxTtlSeconds?: number;
+    /** Lifetime when the caller asks for no `until`; default 900 (the S3 signer's own default). */
+    readonly defaultTtlSeconds?: number;
+}
+/** `authz.fs.<name>` (fs middleware design §2). */
+export interface FsAccessConfig {
+    readonly mode: FsAccessMode;
+    /** Authz domain the checks run in; default 'root'. Another domain must exist: authz-fs never creates one. */
+    readonly domain: string;
+    /** Record the first writer of a path an action creates as its `owner` ACL row. */
+    readonly stampOwner?: boolean;
+    readonly list?: 'dir' | 'each';
+    readonly signedUrl?: FsSignedUrlConfig;
+}
+/**
+ * `authz.fs.<fsName>` of the Configuration resolved in `container`, read on every call. A filesystem without an
+ * entry is off.
+ */
+export declare function fsAccessConfig(fsName: string, container?: IContainer): FsAccessConfig;
+/**
+ * One `authz.fs.<fsName>` entry; undefined is a missing entry (off). AUTHZ_FS_CONFIGURATION_SCHEMA checks the entry
+ * at boot; it may also come from a Configuration no schema checked, so every value is checked here too.
+ * @throws AuthzConfigError for a malformed value or an unknown key: a removed key such as `policies` must not be
+ *   dropped silently, since a dropped deny policy would open files
+ */
+export declare function parseFsAccessConfig(fsName: string, entry: unknown): FsAccessConfig;
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/access-config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/access-config/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAOD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE,UAA6B,GAAG,cAAc,CAGvG;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAalF"}

package/lib/cjs/access-config/index.js

@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fsAccessConfig = fsAccessConfig;
+exports.parseFsAccessConfig = parseFsAccessConfig;
+const authz_1 = require("@spinajs/authz");
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const util_1 = require("@spinajs/util");
+const checks_js_1 = require("../checks.js");
+__exportStar(require("./schema.js"), exports);
+__exportStar(require("./acl-config.js"), exports);
+const MODES = ['off', 'audit', 'enforce'];
+const KEYS = new Set(['mode', 'domain', 'stampOwner', 'list', 'signedUrl']);
+const OFF = Object.freeze({ mode: 'off', domain: 'root' });
+/**
+ * `authz.fs.<fsName>` of the Configuration resolved in `container`, read on every call. A filesystem without an
+ * entry is off.
+ */
+function fsAccessConfig(fsName, container = di_1.DI.RootContainer) {
+    const all = fsSection(container);
+    return all ? parseFsAccessConfig(fsName, Object.hasOwn(all, fsName) ? all[fsName] : undefined) : OFF;
+}
+function fsSection(container) {
+    const configuration = container.get(configuration_1.Configuration);
+    if (!configuration || typeof configuration.get !== 'function') {
+        throw new authz_1.AuthzConfigError('authz.fs: Configuration is not resolved; await DI.resolve(Configuration) first');
+    }
+    const all = configuration.get(['authz', 'fs']);
+    if (all === undefined || all === null)
+        return undefined;
+    // Fail-closed floor for a section no schema checked (Configuration.set, test configurations): it would read as every filesystem off.
+    if (!(0, util_1.isPlainObject)(all))
+        throw new authz_1.AuthzConfigError(`authz.fs must be an object keyed by filesystem name, got ${(0, checks_js_1.show)(all)}`);
+    return all;
+}
+/**
+ * One `authz.fs.<fsName>` entry; undefined is a missing entry (off). AUTHZ_FS_CONFIGURATION_SCHEMA checks the entry
+ * at boot; it may also come from a Configuration no schema checked, so every value is checked here too.
+ * @throws AuthzConfigError for a malformed value or an unknown key: a removed key such as `policies` must not be
+ *   dropped silently, since a dropped deny policy would open files
+ */
+function parseFsAccessConfig(fsName, entry) {
+    if (entry === undefined)
+        return OFF;
+    const at = `authz.fs.${fsName}`;
+    const mode = (0, util_1.isPlainObject)(entry) ? entry.mode : undefined;
+    if (!MODES.includes(mode))
+        throw new authz_1.AuthzConfigError(`${at}.mode must be one of ${MODES.join(', ')}, got ${(0, checks_js_1.show)((0, util_1.isPlainObject)(entry) ? mode : entry)}`);
+    const e = entry;
+    for (const key of Object.keys(e))
+        if (!KEYS.has(key))
+            throw new authz_1.AuthzConfigError(`${at}.${key} is not an authz.fs option (${[...KEYS].join(', ')})`);
+    if (e.domain !== undefined && (typeof e.domain !== 'string' || e.domain === ''))
+        throw new authz_1.AuthzConfigError(`${at}.domain must be a non-empty string, got ${(0, checks_js_1.show)(e.domain)}`);
+    if (e.stampOwner !== undefined && typeof e.stampOwner !== 'boolean')
+        throw new authz_1.AuthzConfigError(`${at}.stampOwner must be a boolean, got ${(0, checks_js_1.show)(e.stampOwner)}`);
+    if (e.list !== undefined && e.list !== 'dir' && e.list !== 'each')
+        throw new authz_1.AuthzConfigError(`${at}.list must be 'dir' or 'each', got ${(0, checks_js_1.show)(e.list)}`);
+    const out = { ...e, domain: e.domain ?? 'root' };
+    if (e.signedUrl !== undefined)
+        out.signedUrl = signedUrlOf(e.signedUrl, `${at}.signedUrl`);
+    return Object.freeze(out);
+}
+function signedUrlOf(value, at) {
+    if (!(0, util_1.isPlainObject)(value))
+        throw new authz_1.AuthzConfigError(`${at} must be an object, got ${(0, checks_js_1.show)(value)}`);
+    for (const [key, ttl] of Object.entries(value)) {
+        if (key !== 'maxTtlSeconds' && key !== 'defaultTtlSeconds')
+            throw new authz_1.AuthzConfigError(`${at}.${key} is not a signedUrl option`);
+        if (typeof ttl !== 'number' || !Number.isFinite(ttl) || ttl <= 0)
+            throw new authz_1.AuthzConfigError(`${at}.${key} must be a positive finite number, got ${(0, checks_js_1.show)(ttl)}`);
+    }
+    return Object.freeze({ ...value });
+}
+//# sourceMappingURL=index.js.map

package/lib/cjs/access-config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access-config/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,0CAAkD;AAClD,0DAAuD;AACvD,oCAAiC;AAEjC,wCAA8C;AAE9C,4CAAoC;AAEpC,8CAA4B;AAC5B,kDAAgC;AAuBhC,MAAM,KAAK,GAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,MAAM,GAAG,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,wBAA+B,MAAc,EAAE,SAAS,GAAe,OAAE,CAAC,aAAa;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,SAAqB;IACtC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,6BAAa,CAA8B,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,wBAAgB,CAAC,gFAAgF,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,qIAAqI;IACrI,IAAI,CAAC,IAAA,oBAAa,EAAC,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAgB,CAAC,4DAA4D,IAAA,gBAAI,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,6BAAoC,MAAc,EAAE,KAAc;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,EAAE,GAAG,YAAY,MAAM,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAA,gBAAI,EAAC,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzJ,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,+BAA+B,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrJ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,2CAA2C,IAAA,gBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9K,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,sCAAsC,IAAA,gBAAI,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjK,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,sCAAsC,IAAA,gBAAI,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzJ,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IAC1E,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAA8B,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,EAAU;IAC7C,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,CAAC;QAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,2BAA2B,IAAA,gBAAI,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrG,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,mBAAmB;YAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,4BAA4B,CAAC,CAAC;QACjI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,0CAA0C,IAAA,gBAAI,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAsB,CAAC;AAC1D,CAAC"}

package/lib/cjs/access-config/schema.d.ts

@@ -0,0 +1,31 @@
+import { Bootstrapper } from '@spinajs/di';
+/** `authz.fs.<filesystem>`: one entry per filesystem name; a filesystem without one is off. */
+export declare const AUTHZ_FS_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    additionalProperties: {
+        type: string;
+        properties: Record<string, unknown>;
+        propertyNames: {
+            enum: string[];
+        };
+        required?: string[] | undefined;
+    };
+};
+export declare const AUTHZ_FS_ACL_CONFIGURATION_SCHEMA: {
+    type: string;
+    properties: Record<string, unknown>;
+    propertyNames: {
+        enum: string[];
+    };
+    required?: string[] | undefined;
+    $id: string;
+    $configurationModule: string;
+    description: string;
+};
+export declare class AuthzFsConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=schema.d.ts.map

package/lib/cjs/access-config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/access-config/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAqBvD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B;IACxC,GAAG;IACH,oBAAoB;IACpB,WAAW;IACX,IAAI;IACJ,oBAAoB;;;;YApBuG,IAAI;;;;CAqBhI,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;QAvB+E,IAAI;;;;;;CAgChI,CAAC;AAKF,qBACa,yBAA0B,SAAQ,YAAY;IAClD,SAAS,IAAI,IAAI,CAGvB;CACF"}

package/lib/cjs/access-config/schema.js

@@ -0,0 +1,55 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzFsConfigBootstrapper = exports.AUTHZ_FS_ACL_CONFIGURATION_SCHEMA = exports.AUTHZ_FS_CONFIGURATION_SCHEMA = void 0;
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const acl_config_js_1 = require("./acl-config.js");
+const name = { type: 'string', minLength: 1 };
+// propertyNames refuses an unknown key; additionalProperties: false would let removeAdditional drop a typo silently.
+const closed = (properties, required) => ({ type: 'object', properties, propertyNames: { enum: Object.keys(properties) }, ...(required ? { required } : {}) });
+const entry = closed({
+    mode: { type: 'string', enum: ['off', 'audit', 'enforce'] },
+    domain: name,
+    stampOwner: { type: 'boolean' },
+    signedUrl: closed({ maxTtlSeconds: { type: 'number', exclusiveMinimum: 0 }, defaultTtlSeconds: { type: 'number', exclusiveMinimum: 0 } }),
+    list: { type: 'string', enum: ['dir', 'each'] },
+}, 
+// A present entry says its mode: an entry with other keys but no mode must not be silently off.
+['mode']);
+/** `authz.fs.<filesystem>`: one entry per filesystem name; a filesystem without one is off. */
+exports.AUTHZ_FS_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-fs.configuration.schema.json',
+    $configurationModule: 'authz.fs',
+    description: 'Filesystem access configuration (authz.fs.<filesystem>)',
+    type: 'object',
+    additionalProperties: entry,
+};
+exports.AUTHZ_FS_ACL_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-fs-acl.configuration.schema.json',
+    // Not under authz.fs: that section is keyed by filesystem name.
+    $configurationModule: 'authz.fsAcl',
+    description: 'File ACL configuration (authz.fsAcl.*)',
+    ...closed({
+        connection: { ...name, default: acl_config_js_1.FS_ACL_DEFAULT_CONNECTION },
+        relations: { type: 'array', uniqueItems: true, items: { type: 'string', minLength: 1, maxLength: acl_config_js_1.FS_ACL_RELATION_MAX_LENGTH }, default: [...acl_config_js_1.FS_ACL_DEFAULT_RELATIONS] },
+    }),
+};
+(0, configuration_1.registerConfigurationSchemaAtImport)(exports.AUTHZ_FS_CONFIGURATION_SCHEMA);
+(0, configuration_1.registerConfigurationSchemaAtImport)(exports.AUTHZ_FS_ACL_CONFIGURATION_SCHEMA);
+let AuthzFsConfigBootstrapper = class AuthzFsConfigBootstrapper extends di_1.Bootstrapper {
+    bootstrap() {
+        (0, configuration_1.registerConfigurationSchema)(exports.AUTHZ_FS_CONFIGURATION_SCHEMA);
+        (0, configuration_1.registerConfigurationSchema)(exports.AUTHZ_FS_ACL_CONFIGURATION_SCHEMA);
+    }
+};
+exports.AuthzFsConfigBootstrapper = AuthzFsConfigBootstrapper;
+exports.AuthzFsConfigBootstrapper = AuthzFsConfigBootstrapper = __decorate([
+    (0, di_1.Injectable)(di_1.Bootstrapper)
+], AuthzFsConfigBootstrapper);
+//# sourceMappingURL=schema.js.map

package/lib/cjs/access-config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/access-config/schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0DAA0G;AAC1G,oCAAuD;AAEvD,mDAAkH;AAElH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAE9C,qHAAqH;AACrH,MAAM,MAAM,GAAG,CAAC,UAAmC,EAAE,QAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAEnM,MAAM,KAAK,GAAG,MAAM,CAClB;IACE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;IAC3D,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;IACzI,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;CAChD;AACD,gGAAgG;AAChG,CAAC,MAAM,CAAC,CACT,CAAC;AAEF,+FAA+F;AAClF,QAAA,6BAA6B,GAAG;IAC3C,GAAG,EAAE,4CAA4C;IACjD,oBAAoB,EAAE,UAAU;IAChC,WAAW,EAAE,yDAAyD;IACtE,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AAEW,QAAA,iCAAiC,GAAG;IAC/C,GAAG,EAAE,gDAAgD;IACrD,gEAAgE;IAChE,oBAAoB,EAAE,aAAa;IACnC,WAAW,EAAE,wCAAwC;IACrD,GAAG,MAAM,CAAC;QACR,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,yCAAyB,EAAE;QAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,0CAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,wCAAwB,CAAC,EAAE;KACxK,CAAC;CACH,CAAC;AAEF,IAAA,mDAAmC,EAAC,QAAA,6BAA6B,CAAC,CAAC;AACnE,IAAA,mDAAmC,EAAC,QAAA,iCAAiC,CAAC,CAAC;AAGhE,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,iBAAY;IAClD,SAAS;QACd,IAAA,2CAA2B,EAAC,QAAA,6BAA6B,CAAC,CAAC;QAC3D,IAAA,2CAA2B,EAAC,QAAA,iCAAiC,CAAC,CAAC;IACjE,CAAC;CACF,CAAA;;oCALY,yBAAyB;IADrC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,yBAAyB,CAKrC"}

package/lib/cjs/acl/facade.d.ts

@@ -0,0 +1,39 @@
+import type { AssignmentSubject, Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsDecideService, FsLog } from '../middleware/decide.js';
+import type { FileAclStore, FsAclRow } from './store.js';
+export interface FsAclOptions {
+    /** Where the Configuration, the published providers, AuthzService, AuthzDomains and the FileAclStore are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED. */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+    readonly store?: () => Promise<FileAclStore>;
+}
+/**
+ * Changes the file ACL as the current principal. Every call asserts a definite
+ * `fs:manage` on both the file and the dir ref of the path (the fs ref for the root), whatever the filesystem's
+ * `authz.fs` mode; only SYSTEM is exempt. The checks run in the domain of `authz.fs.<fs>.domain`, 'root' without an
+ * entry. fs:manage lets the holder grant any configured relation, owner included. System code that needs unchecked
+ * writes uses the FileAclStore directly. A row granted on a path that does not exist yet is cleared as stale when
+ * that path is later created through the middleware.
+ */
+export declare class FsAcl {
+    protected readonly options: FsAclOptions;
+    private logger?;
+    constructor(options?: FsAclOptions);
+    grant(fs: string, path: string, subject: AssignmentSubject, relation: string, opts?: {
+        readonly expiresAt?: Date;
+    }): Promise<void>;
+    revoke(fs: string, path: string, subject: AssignmentSubject, relation: string): Promise<void>;
+    list(fs: string, path: string): Promise<readonly FsAclRow[]>;
+    protected get container(): IContainer;
+    private get log();
+    private principal;
+    private store;
+    private known;
+    private authorize;
+}
+//# sourceMappingURL=facade.d.ts.map

package/lib/cjs/acl/facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../../src/acl/facade.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAItE,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,qBAAa,KAAK;IAGJ,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY;IAFpD,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,YAA+B,OAAO,GAAE,YAAiB,EAAI;IAEvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3I;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlG;IAEK,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAGjE;IAED,SAAS,KAAK,SAAS,IAAI,UAAU,CAEpC;IAED,OAAO,KAAK,GAAG,GAEd;IAED,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,KAAK;YAKC,SAAS;CAaxB"}

package/lib/cjs/acl/facade.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FsAcl = void 0;
+const authz_1 = require("@spinajs/authz");
+const di_1 = require("@spinajs/di");
+const fs_1 = require("@spinajs/fs");
+const index_js_1 = require("../access-config/index.js");
+const decide_js_1 = require("../middleware/decide.js");
+const index_js_2 = require("../refs/index.js");
+const shared_js_1 = require("./shared.js");
+/**
+ * Changes the file ACL as the current principal. Every call asserts a definite
+ * `fs:manage` on both the file and the dir ref of the path (the fs ref for the root), whatever the filesystem's
+ * `authz.fs` mode; only SYSTEM is exempt. The checks run in the domain of `authz.fs.<fs>.domain`, 'root' without an
+ * entry. fs:manage lets the holder grant any configured relation, owner included. System code that needs unchecked
+ * writes uses the FileAclStore directly. A row granted on a path that does not exist yet is cleared as stale when
+ * that path is later created through the middleware.
+ */
+class FsAcl {
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async grant(fs, path, subject, relation, opts = {}) {
+        this.known(relation);
+        const principal = this.principal();
+        const at = await this.authorize(fs, path, principal);
+        await (await this.store()).grant({ fs, path: at, subject, relation, grantedBy: (0, authz_1.principalKey)(principal), ...(opts.expiresAt ? { expiresAt: opts.expiresAt } : {}) });
+    }
+    async revoke(fs, path, subject, relation) {
+        this.known(relation);
+        const key = (0, shared_js_1.aclSubjectKey)(subject);
+        const at = await this.authorize(fs, path, this.principal());
+        await (await this.store()).revoke(fs, at, key, relation);
+    }
+    async list(fs, path) {
+        const at = await this.authorize(fs, path, this.principal());
+        return (await this.store()).list(fs, at);
+    }
+    get container() {
+        return this.options.container ?? di_1.DI.RootContainer;
+    }
+    get log() {
+        return (this.logger ??= this.options.log ?? (0, authz_1.engineLog)('authz-fs'));
+    }
+    principal() {
+        return (this.options.principal ?? authz_1.currentPrincipal)();
+    }
+    store() {
+        return this.options.store ? this.options.store() : (0, shared_js_1.fileAclStore)(this.container);
+    }
+    known(relation) {
+        const { relations } = (0, index_js_1.fsAclConfig)(this.container);
+        if (!relations.includes(relation))
+            throw new authz_1.AuthzConfigError(`FsAcl: relation ${JSON.stringify(relation)} is not in authz.fsAcl.relations (${relations.join(', ')})`);
+    }
+    async authorize(fs, path, principal) {
+        const provider = (0, fs_1.publishedFs)(fs, this.container);
+        if (!provider)
+            throw new authz_1.AuthzConfigError(`FsAcl: filesystem ${JSON.stringify(fs)} has no published provider`);
+        const normalised = (0, index_js_2.normalizeFsPath)(path, provider.BasePath);
+        if (principal === authz_1.SYSTEM)
+            return normalised;
+        const { domain } = (0, index_js_1.fsAccessConfig)(fs, this.container);
+        const service = await (this.options.service ? this.options.service(domain) : (0, decide_js_1.domainService)(this.container, domain));
+        const kinds = normalised === '' ? ['file'] : ['file', 'dir'];
+        for (const kind of kinds) {
+            await (0, decide_js_1.decideFs)({ fsName: fs, mode: 'enforce', service, log: this.log, principal, permission: 'fs:manage', ref: (0, decide_js_1.refOf)(fs, normalised, kind), subject: (0, index_js_2.fsRowOf)(fs, normalised, kind) });
+        }
+        return normalised;
+    }
+}
+exports.FsAcl = FsAcl;
+//# sourceMappingURL=facade.js.map

package/lib/cjs/acl/facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../../src/acl/facade.ts"],"names":[],"mappings":";;;AAAA,0CAAqG;AAErG,oCAAiC;AAEjC,oCAA0C;AAE1C,wDAAwE;AACxE,uDAAyE;AAEzE,+CAA4D;AAE5D,2CAA0D;AAc1D;;;;;;;GAOG;AACH;IAGE,YAA+B,OAAO,GAAiB,EAAE;uBAA1B,OAAO;IAAsB,CAAC;IAE7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,IAAY,EAAE,OAA0B,EAAE,QAAgB,EAAE,IAAI,GAAkC,EAAE;QAC1H,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAA,oBAAY,EAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,OAA0B,EAAE,QAAgB;QACjF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY;QACjC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAE,CAAC,aAAa,CAAC;IACpD,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAA,iBAAS,EAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,SAAS;QACf,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,wBAAgB,CAAC,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAA,wBAAY,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sBAAW,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,wBAAgB,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzK,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,IAAY,EAAE,SAAoB;QACpE,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,wBAAgB,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;QAC/G,MAAM,UAAU,GAAG,IAAA,0BAAe,EAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,cAAM;YAAE,OAAO,UAAU,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,yBAAc,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpH,MAAM,KAAK,GAA0B,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAA,oBAAQ,EAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,IAAA,iBAAK,EAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAA,kBAAO,EAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/lib/cjs/acl/index.d.ts

@@ -0,0 +1,6 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './relation.js';
+export * from './facade.js';
+export { FS_ACL_LIMITS, FS_ACL_TABLE } from './shared.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/acl/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/acl/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/lib/cjs/acl/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FS_ACL_TABLE = exports.FS_ACL_LIMITS = void 0;
+__exportStar(require("./store.js"), exports);
+__exportStar(require("./orm-store.js"), exports);
+__exportStar(require("./relation.js"), exports);
+__exportStar(require("./facade.js"), exports);
+var shared_js_1 = require("./shared.js");
+Object.defineProperty(exports, "FS_ACL_LIMITS", { enumerable: true, get: function () { return shared_js_1.FS_ACL_LIMITS; } });
+Object.defineProperty(exports, "FS_ACL_TABLE", { enumerable: true, get: function () { return shared_js_1.FS_ACL_TABLE; } });
+//# sourceMappingURL=index.js.map

package/lib/cjs/acl/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/acl/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,iDAA+B;AAC/B,gDAA8B;AAC9B,8CAA4B;AAC5B,yCAA0D;AAAjD,0GAAA,aAAa,OAAA;AAAE,yGAAA,YAAY,OAAA"}

package/lib/cjs/acl/orm-store.d.ts

@@ -0,0 +1,31 @@
+import type { PrincipalRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FileAclStore } from './store.js';
+import type { FsAclRow } from './store.js';
+export interface OrmFileAclStoreOptions {
+    /** The ORM connection; default `authz.fsAcl.connection`, else 'default'. */
+    readonly connection?: string;
+    /** Where Configuration and Orm are resolved; default the DI root. */
+    readonly container?: IContainer;
+}
+/**
+ * FileAclStore over `fs_acl` (migration AuthzFsAcl_2026_10_17_00_00_00). Reads are narrowed in SQL by `path_hash`
+ * (the indexed key) and decided by an exact comparison of `path` in code, and rows change by id, so a table created
+ * with a case-insensitive collation never merges two paths.
+ */
+export declare class OrmFileAclStore extends FileAclStore {
+    private readonly opts;
+    constructor(opts?: OrmFileAclStoreOptions);
+    holds(fs: string, paths: readonly string[], subjectKeys: readonly string[], relation: string, at: Date): Promise<boolean>;
+    list(fs: string, path: string): Promise<readonly FsAclRow[]>;
+    grant(row: FsAclRow): Promise<void>;
+    revoke(fs: string, path: string, subjectKey: string, relation: string): Promise<void>;
+    ownerOf(fs: string, path: string): Promise<PrincipalRef | null>;
+    setOwnerIfAbsent(fs: string, path: string, owner: PrincipalRef): Promise<void>;
+    deleteTree(fs: string, path: string): Promise<void>;
+    deletePath(fs: string, path: string): Promise<void>;
+    moveTree(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+    movePath(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+    private driver;
+}
+//# sourceMappingURL=orm-store.d.ts.map

package/lib/cjs/acl/orm-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.d.ts","sourceRoot":"","sources":["../../../src/acl/orm-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQ9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAc3C,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAID;;;;GAIG;AACH,qBACa,eAAgB,SAAQ,YAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,GAAE,sBAA2B,EAE7D;IAEK,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAa9H;IAEK,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAIjE;IAEK,KAAK,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CASxC;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1F;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAOpE;IAEK,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxD;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxD;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpF;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcpF;YAEa,MAAM;CAQrB"}