@spinajs/authz-fs 0.0.0-stage → 3.0.0

package/lib/cjs/refs/refs.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FS_RESOURCE_TYPES = void 0;
+exports.fsRef = fsRef;
+exports.parseFsRef = parseFsRef;
+exports.fsRow = fsRow;
+exports.fsRowOf = fsRowOf;
+exports.fsAncestors = fsAncestors;
+const authz_1 = require("@spinajs/authz");
+const util_1 = require("@spinajs/util");
+const fs_1 = require("@spinajs/fs");
+const checks_js_1 = require("../checks.js");
+exports.FS_RESOURCE_TYPES = Object.freeze(['fs', 'dir', 'file']);
+// The first ':' of a file or dir id ends the fs name, so a name must not hold one.
+const isFsName = (name) => typeof name === 'string' && name.length > 0 && !name.includes(':');
+/** `{ type: 'fs', id: fsName }` for the root, else `{ type: kind, id: '<fsName>:<normalised path>' }`. */
+function fsRef(fsName, path, kind) {
+    (0, checks_js_1.checkFsName)(fsName);
+    (0, util_1._check_arg)((0, util_1._one_of)(['file', 'dir']))(kind, 'kind');
+    const normalised = (0, fs_1.normalizeFsPath)(path);
+    return normalised === '' ? { type: 'fs', id: fsName } : { type: kind, id: `${fsName}:${normalised}` };
+}
+/** undefined for a ref that is not an fs ref, or whose id is not in the form fsRef builds. */
+function parseFsRef(ref) {
+    if (!ref || typeof ref.id !== 'string') {
+        return undefined;
+    }
+    if (ref.type === 'fs') {
+        return isFsName(ref.id) ? { fs: ref.id, path: '', type: 'fs' } : undefined;
+    }
+    if (ref.type !== 'file' && ref.type !== 'dir') {
+        return undefined;
+    }
+    const at = ref.id.indexOf(':');
+    const fs = ref.id.slice(0, at);
+    const path = ref.id.slice(at + 1);
+    if (at <= 0 || path === '' || !isCanonical(path)) {
+        return undefined;
+    }
+    return { fs, path, type: ref.type };
+}
+/** The row of a ref fsRef builds; null for a ref parseFsRef refuses. */
+function fsRow(ref) {
+    const parsed = parseFsRef(ref);
+    return parsed ? fsRowOf(parsed.fs, parsed.path, parsed.type) : null;
+}
+/** The row of an already normalised path, with no second normalisation; '' gives the fs row. */
+function fsRowOf(fsName, normalised, type) {
+    return normalised === '' ? Object.freeze({ id: fsName, type: 'fs', fs: fsName, path: '' }) : Object.freeze({ id: `${fsName}:${normalised}`, type, fs: fsName, path: normalised });
+}
+/**
+ * `[self, parent dirs nearest first, fs, GLOBAL]`, null for a ref parseFsRef refuses. This does not know which
+ * filesystems exist: an fs name no provider has still gets a chain.
+ */
+function fsAncestors(ref) {
+    const parsed = parseFsRef(ref);
+    if (!parsed) {
+        return null;
+    }
+    const chain = [];
+    if (parsed.type !== 'fs') {
+        chain.push({ type: parsed.type, id: `${parsed.fs}:${parsed.path}` });
+        const segments = parsed.path.split('/');
+        for (let n = segments.length - 1; n > 0; n--) {
+            chain.push({ type: 'dir', id: `${parsed.fs}:${segments.slice(0, n).join('/')}` });
+        }
+    }
+    chain.push({ type: 'fs', id: parsed.fs }, authz_1.GLOBAL);
+    return chain;
+}
+function isCanonical(path) {
+    try {
+        return (0, fs_1.normalizeFsPath)(path) === path;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=refs.js.map

package/lib/cjs/refs/refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.js","sourceRoot":"","sources":["../../../src/refs/refs.ts"],"names":[],"mappings":";;;;;;;;AAAA,0CAAwC;AAExC,wCAAoD;AAEpD,oCAA8C;AAG9C,4CAA2C;AAK9B,QAAA,iBAAiB,GAAyB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC,CAAC;AASrG,mFAAmF;AACnF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAEvH,0GAA0G;AAC1G,eAAsB,MAAc,EAAE,IAAY,EAAE,IAAgB;IAClE,IAAA,uBAAW,EAAC,MAAM,CAAC,CAAC;IACpB,IAAA,iBAAU,EAAC,IAAA,cAAO,EAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAA,oBAAe,EAAC,IAAI,CAAC,CAAC;IACzC,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,8FAA8F;AAC9F,oBAA2B,GAAgB;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAYD,wEAAwE;AACxE,eAAsB,GAAgB;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gGAAgG;AAChG,iBAAwB,MAAc,EAAE,UAAkB,EAAE,IAAe;IACzE,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACpL,CAAC;AAED;;;GAGG;AACH,qBAA4B,GAAgB;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,cAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAA,oBAAe,EAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/lib/mjs/access-config/acl-config.d.ts

@@ -0,0 +1,23 @@
+import type { IContainer } from '@spinajs/di';
+export declare const FS_ACL_CONNECTION_KEY = "authz.fsAcl.connection";
+export declare const FS_ACL_DEFAULT_CONNECTION = "default";
+/** The relation of the row owner stamping writes. */
+export declare const FS_ACL_OWNER = "owner";
+export declare const FS_ACL_DEFAULT_RELATIONS: readonly string[];
+/** fs_acl.relation holds this many characters. */
+export declare const FS_ACL_RELATION_MAX_LENGTH = 64;
+/** `authz.fsAcl` (fs middleware design §2). */
+export interface FsAclConfig {
+    /** ORM connection of OrmFileAclStore and of its migration. */
+    readonly connection: string;
+    /** The relations an ACL row may name; FsResourceAdapter serves a RelationResolver for each on fs, dir and file. */
+    readonly relations: readonly string[];
+}
+/**
+ * `authz.fsAcl` of the Configuration in `container`, defaults filled; without a Configuration the defaults (the
+ * migration reads the connection before any is resolved). `owner` is always among the relations, first: owner
+ * stamping writes it whatever the config lists.
+ * @throws AuthzConfigError for a malformed value no schema checked
+ */
+export declare function fsAclConfig(container?: IContainer): FsAclConfig;
+//# sourceMappingURL=acl-config.d.ts.map

package/lib/mjs/access-config/acl-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-config.d.ts","sourceRoot":"","sources":["../../../src/access-config/acl-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAC9D,eAAO,MAAM,yBAAyB,YAAY,CAAC;AACnD,qDAAqD;AACrD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAsD,CAAC;AAC7G,kDAAkD;AAClD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mHAAmH;IACnH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,GAAE,UAA6B,GAAG,WAAW,CAUjF"}

package/lib/mjs/access-config/acl-config.js

@@ -0,0 +1,32 @@
+import { AuthzConfigError } from '@spinajs/authz';
+import { Configuration } from '@spinajs/configuration';
+import { DI } from '@spinajs/di';
+import { isStringArray } from '@spinajs/util';
+import { show } from '../checks.js';
+// Not under authz.fs: that section is keyed by filesystem name.
+export const FS_ACL_CONNECTION_KEY = 'authz.fsAcl.connection';
+export const FS_ACL_DEFAULT_CONNECTION = 'default';
+/** The relation of the row owner stamping writes. */
+export const FS_ACL_OWNER = 'owner';
+export const FS_ACL_DEFAULT_RELATIONS = Object.freeze([FS_ACL_OWNER, 'editor', 'viewer']);
+/** fs_acl.relation holds this many characters. */
+export const FS_ACL_RELATION_MAX_LENGTH = 64;
+/**
+ * `authz.fsAcl` of the Configuration in `container`, defaults filled; without a Configuration the defaults (the
+ * migration reads the connection before any is resolved). `owner` is always among the relations, first: owner
+ * stamping writes it whatever the config lists.
+ * @throws AuthzConfigError for a malformed value no schema checked
+ */
+export function fsAclConfig(container = DI.RootContainer) {
+    const configuration = container.get(Configuration);
+    const read = (key) => (configuration && typeof configuration.get === 'function' ? configuration.get(['authz', 'fsAcl', key]) : undefined);
+    const connection = read('connection') ?? FS_ACL_DEFAULT_CONNECTION;
+    if (typeof connection !== 'string' || connection === '')
+        throw new AuthzConfigError(`${FS_ACL_CONNECTION_KEY} must be a non-empty string, got ${show(connection)}`);
+    const relations = read('relations') ?? FS_ACL_DEFAULT_RELATIONS;
+    if (!isStringArray(relations, { nonEmpty: true }) || !relations.every((r) => r.length <= FS_ACL_RELATION_MAX_LENGTH)) {
+        throw new AuthzConfigError(`authz.fsAcl.relations must be a list of relation names of 1-${FS_ACL_RELATION_MAX_LENGTH} characters, got ${show(relations)}`);
+    }
+    return Object.freeze({ connection, relations: Object.freeze([...new Set([FS_ACL_OWNER, ...relations])]) });
+}
+//# sourceMappingURL=acl-config.js.map

package/lib/mjs/access-config/acl-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-config.js","sourceRoot":"","sources":["../../../src/access-config/acl-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AACnD,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AACpC,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7G,kDAAkD;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAU7C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,SAAS,GAAe,EAAE,CAAC,aAAa;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAA8B,CAAC;IAChF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpK,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,yBAAyB,CAAC;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,qBAAqB,oCAAoC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpK,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC;IAChE,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,0BAA0B,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,0BAA0B,oBAAoB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7J,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7G,CAAC"}

package/lib/mjs/access-config/index.d.ts

@@ -0,0 +1,34 @@
+import type { IContainer } from '@spinajs/di';
+export * from './schema.js';
+export * from './acl-config.js';
+export type FsAccessMode = 'off' | 'audit' | 'enforce';
+/** `authz.fs.<name>.signedUrl` (D9). */
+export interface FsSignedUrlConfig {
+    /** Cap on every signed URL's lifetime. */
+    readonly maxTtlSeconds?: number;
+    /** Lifetime when the caller asks for no `until`; default 900 (the S3 signer's own default). */
+    readonly defaultTtlSeconds?: number;
+}
+/** `authz.fs.<name>` (fs middleware design §2). */
+export interface FsAccessConfig {
+    readonly mode: FsAccessMode;
+    /** Authz domain the checks run in; default 'root'. Another domain must exist: authz-fs never creates one. */
+    readonly domain: string;
+    /** Record the first writer of a path an action creates as its `owner` ACL row. */
+    readonly stampOwner?: boolean;
+    readonly list?: 'dir' | 'each';
+    readonly signedUrl?: FsSignedUrlConfig;
+}
+/**
+ * `authz.fs.<fsName>` of the Configuration resolved in `container`, read on every call. A filesystem without an
+ * entry is off.
+ */
+export declare function fsAccessConfig(fsName: string, container?: IContainer): FsAccessConfig;
+/**
+ * One `authz.fs.<fsName>` entry; undefined is a missing entry (off). AUTHZ_FS_CONFIGURATION_SCHEMA checks the entry
+ * at boot; it may also come from a Configuration no schema checked, so every value is checked here too.
+ * @throws AuthzConfigError for a malformed value or an unknown key: a removed key such as `policies` must not be
+ *   dropped silently, since a dropped deny policy would open files
+ */
+export declare function parseFsAccessConfig(fsName: string, entry: unknown): FsAccessConfig;
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/access-config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/access-config/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAEhC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAOD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE,UAA6B,GAAG,cAAc,CAGvG;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAalF"}

package/lib/mjs/access-config/index.js

@@ -0,0 +1,71 @@
+import { AuthzConfigError } from '@spinajs/authz';
+import { Configuration } from '@spinajs/configuration';
+import { DI } from '@spinajs/di';
+import { isPlainObject } from '@spinajs/util';
+import { show } from '../checks.js';
+export * from './schema.js';
+export * from './acl-config.js';
+const MODES = ['off', 'audit', 'enforce'];
+const KEYS = new Set(['mode', 'domain', 'stampOwner', 'list', 'signedUrl']);
+const OFF = Object.freeze({ mode: 'off', domain: 'root' });
+/**
+ * `authz.fs.<fsName>` of the Configuration resolved in `container`, read on every call. A filesystem without an
+ * entry is off.
+ */
+export function fsAccessConfig(fsName, container = DI.RootContainer) {
+    const all = fsSection(container);
+    return all ? parseFsAccessConfig(fsName, Object.hasOwn(all, fsName) ? all[fsName] : undefined) : OFF;
+}
+function fsSection(container) {
+    const configuration = container.get(Configuration);
+    if (!configuration || typeof configuration.get !== 'function') {
+        throw new AuthzConfigError('authz.fs: Configuration is not resolved; await DI.resolve(Configuration) first');
+    }
+    const all = configuration.get(['authz', 'fs']);
+    if (all === undefined || all === null)
+        return undefined;
+    // Fail-closed floor for a section no schema checked (Configuration.set, test configurations): it would read as every filesystem off.
+    if (!isPlainObject(all))
+        throw new AuthzConfigError(`authz.fs must be an object keyed by filesystem name, got ${show(all)}`);
+    return all;
+}
+/**
+ * One `authz.fs.<fsName>` entry; undefined is a missing entry (off). AUTHZ_FS_CONFIGURATION_SCHEMA checks the entry
+ * at boot; it may also come from a Configuration no schema checked, so every value is checked here too.
+ * @throws AuthzConfigError for a malformed value or an unknown key: a removed key such as `policies` must not be
+ *   dropped silently, since a dropped deny policy would open files
+ */
+export function parseFsAccessConfig(fsName, entry) {
+    if (entry === undefined)
+        return OFF;
+    const at = `authz.fs.${fsName}`;
+    const mode = isPlainObject(entry) ? entry.mode : undefined;
+    if (!MODES.includes(mode))
+        throw new AuthzConfigError(`${at}.mode must be one of ${MODES.join(', ')}, got ${show(isPlainObject(entry) ? mode : entry)}`);
+    const e = entry;
+    for (const key of Object.keys(e))
+        if (!KEYS.has(key))
+            throw new AuthzConfigError(`${at}.${key} is not an authz.fs option (${[...KEYS].join(', ')})`);
+    if (e.domain !== undefined && (typeof e.domain !== 'string' || e.domain === ''))
+        throw new AuthzConfigError(`${at}.domain must be a non-empty string, got ${show(e.domain)}`);
+    if (e.stampOwner !== undefined && typeof e.stampOwner !== 'boolean')
+        throw new AuthzConfigError(`${at}.stampOwner must be a boolean, got ${show(e.stampOwner)}`);
+    if (e.list !== undefined && e.list !== 'dir' && e.list !== 'each')
+        throw new AuthzConfigError(`${at}.list must be 'dir' or 'each', got ${show(e.list)}`);
+    const out = { ...e, domain: e.domain ?? 'root' };
+    if (e.signedUrl !== undefined)
+        out.signedUrl = signedUrlOf(e.signedUrl, `${at}.signedUrl`);
+    return Object.freeze(out);
+}
+function signedUrlOf(value, at) {
+    if (!isPlainObject(value))
+        throw new AuthzConfigError(`${at} must be an object, got ${show(value)}`);
+    for (const [key, ttl] of Object.entries(value)) {
+        if (key !== 'maxTtlSeconds' && key !== 'defaultTtlSeconds')
+            throw new AuthzConfigError(`${at}.${key} is not a signedUrl option`);
+        if (typeof ttl !== 'number' || !Number.isFinite(ttl) || ttl <= 0)
+            throw new AuthzConfigError(`${at}.${key} must be a positive finite number, got ${show(ttl)}`);
+    }
+    return Object.freeze({ ...value });
+}
+//# sourceMappingURL=index.js.map

package/lib/mjs/access-config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access-config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAuBhC,MAAM,KAAK,GAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,MAAM,GAAG,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAS,GAAe,EAAE,CAAC,aAAa;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,SAAqB;IACtC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAA8B,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,gFAAgF,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,qIAAqI;IACrI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,4DAA4D,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7H,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAc;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,EAAE,GAAG,YAAY,MAAM,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzJ,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,+BAA+B,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrJ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,2CAA2C,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9K,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,sCAAsC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjK,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,sCAAsC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzJ,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IAC1E,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAA8B,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,EAAU;IAC7C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrG,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,mBAAmB;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,4BAA4B,CAAC,CAAC;QACjI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,0CAA0C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAsB,CAAC;AAC1D,CAAC"}

package/lib/mjs/access-config/schema.d.ts

@@ -0,0 +1,31 @@
+import { Bootstrapper } from '@spinajs/di';
+/** `authz.fs.<filesystem>`: one entry per filesystem name; a filesystem without one is off. */
+export declare const AUTHZ_FS_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    additionalProperties: {
+        type: string;
+        properties: Record<string, unknown>;
+        propertyNames: {
+            enum: string[];
+        };
+        required?: string[] | undefined;
+    };
+};
+export declare const AUTHZ_FS_ACL_CONFIGURATION_SCHEMA: {
+    type: string;
+    properties: Record<string, unknown>;
+    propertyNames: {
+        enum: string[];
+    };
+    required?: string[] | undefined;
+    $id: string;
+    $configurationModule: string;
+    description: string;
+};
+export declare class AuthzFsConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=schema.d.ts.map

package/lib/mjs/access-config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/access-config/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAqBvD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B;IACxC,GAAG;IACH,oBAAoB;IACpB,WAAW;IACX,IAAI;IACJ,oBAAoB;;;;YApBuG,IAAI;;;;CAqBhI,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;QAvB+E,IAAI;;;;;;CAgChI,CAAC;AAKF,qBACa,yBAA0B,SAAQ,YAAY;IAClD,SAAS,IAAI,IAAI,CAGvB;CACF"}

package/lib/mjs/access-config/schema.js

@@ -0,0 +1,52 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { registerConfigurationSchema, registerConfigurationSchemaAtImport } from '@spinajs/configuration';
+import { Bootstrapper, Injectable } from '@spinajs/di';
+import { FS_ACL_DEFAULT_CONNECTION, FS_ACL_DEFAULT_RELATIONS, FS_ACL_RELATION_MAX_LENGTH } from './acl-config.js';
+const name = { type: 'string', minLength: 1 };
+// propertyNames refuses an unknown key; additionalProperties: false would let removeAdditional drop a typo silently.
+const closed = (properties, required) => ({ type: 'object', properties, propertyNames: { enum: Object.keys(properties) }, ...(required ? { required } : {}) });
+const entry = closed({
+    mode: { type: 'string', enum: ['off', 'audit', 'enforce'] },
+    domain: name,
+    stampOwner: { type: 'boolean' },
+    signedUrl: closed({ maxTtlSeconds: { type: 'number', exclusiveMinimum: 0 }, defaultTtlSeconds: { type: 'number', exclusiveMinimum: 0 } }),
+    list: { type: 'string', enum: ['dir', 'each'] },
+}, 
+// A present entry says its mode: an entry with other keys but no mode must not be silently off.
+['mode']);
+/** `authz.fs.<filesystem>`: one entry per filesystem name; a filesystem without one is off. */
+export const AUTHZ_FS_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-fs.configuration.schema.json',
+    $configurationModule: 'authz.fs',
+    description: 'Filesystem access configuration (authz.fs.<filesystem>)',
+    type: 'object',
+    additionalProperties: entry,
+};
+export const AUTHZ_FS_ACL_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-fs-acl.configuration.schema.json',
+    // Not under authz.fs: that section is keyed by filesystem name.
+    $configurationModule: 'authz.fsAcl',
+    description: 'File ACL configuration (authz.fsAcl.*)',
+    ...closed({
+        connection: { ...name, default: FS_ACL_DEFAULT_CONNECTION },
+        relations: { type: 'array', uniqueItems: true, items: { type: 'string', minLength: 1, maxLength: FS_ACL_RELATION_MAX_LENGTH }, default: [...FS_ACL_DEFAULT_RELATIONS] },
+    }),
+};
+registerConfigurationSchemaAtImport(AUTHZ_FS_CONFIGURATION_SCHEMA);
+registerConfigurationSchemaAtImport(AUTHZ_FS_ACL_CONFIGURATION_SCHEMA);
+let AuthzFsConfigBootstrapper = class AuthzFsConfigBootstrapper extends Bootstrapper {
+    bootstrap() {
+        registerConfigurationSchema(AUTHZ_FS_CONFIGURATION_SCHEMA);
+        registerConfigurationSchema(AUTHZ_FS_ACL_CONFIGURATION_SCHEMA);
+    }
+};
+AuthzFsConfigBootstrapper = __decorate([
+    Injectable(Bootstrapper)
+], AuthzFsConfigBootstrapper);
+export { AuthzFsConfigBootstrapper };
+//# sourceMappingURL=schema.js.map

package/lib/mjs/access-config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/access-config/schema.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,2BAA2B,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAElH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAE9C,qHAAqH;AACrH,MAAM,MAAM,GAAG,CAAC,UAAmC,EAAE,QAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAEnM,MAAM,KAAK,GAAG,MAAM,CAClB;IACE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;IAC3D,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;IACzI,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;CAChD;AACD,gGAAgG;AAChG,CAAC,MAAM,CAAC,CACT,CAAC;AAEF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,GAAG,EAAE,4CAA4C;IACjD,oBAAoB,EAAE,UAAU;IAChC,WAAW,EAAE,yDAAyD;IACtE,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,GAAG,EAAE,gDAAgD;IACrD,gEAAgE;IAChE,oBAAoB,EAAE,aAAa;IACnC,WAAW,EAAE,wCAAwC;IACrD,GAAG,MAAM,CAAC;QACR,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE;QAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,wBAAwB,CAAC,EAAE;KACxK,CAAC;CACH,CAAC;AAEF,mCAAmC,CAAC,6BAA6B,CAAC,CAAC;AACnE,mCAAmC,CAAC,iCAAiC,CAAC,CAAC;AAGhE,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,YAAY;IAClD,SAAS;QACd,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;QAC3D,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;IACjE,CAAC;CACF,CAAA;AALY,yBAAyB;IADrC,UAAU,CAAC,YAAY,CAAC;GACZ,yBAAyB,CAKrC"}

package/lib/mjs/acl/facade.d.ts

@@ -0,0 +1,39 @@
+import type { AssignmentSubject, Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsDecideService, FsLog } from '../middleware/decide.js';
+import type { FileAclStore, FsAclRow } from './store.js';
+export interface FsAclOptions {
+    /** Where the Configuration, the published providers, AuthzService, AuthzDomains and the FileAclStore are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED. */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+    readonly store?: () => Promise<FileAclStore>;
+}
+/**
+ * Changes the file ACL as the current principal. Every call asserts a definite
+ * `fs:manage` on both the file and the dir ref of the path (the fs ref for the root), whatever the filesystem's
+ * `authz.fs` mode; only SYSTEM is exempt. The checks run in the domain of `authz.fs.<fs>.domain`, 'root' without an
+ * entry. fs:manage lets the holder grant any configured relation, owner included. System code that needs unchecked
+ * writes uses the FileAclStore directly. A row granted on a path that does not exist yet is cleared as stale when
+ * that path is later created through the middleware.
+ */
+export declare class FsAcl {
+    protected readonly options: FsAclOptions;
+    private logger?;
+    constructor(options?: FsAclOptions);
+    grant(fs: string, path: string, subject: AssignmentSubject, relation: string, opts?: {
+        readonly expiresAt?: Date;
+    }): Promise<void>;
+    revoke(fs: string, path: string, subject: AssignmentSubject, relation: string): Promise<void>;
+    list(fs: string, path: string): Promise<readonly FsAclRow[]>;
+    protected get container(): IContainer;
+    private get log();
+    private principal;
+    private store;
+    private known;
+    private authorize;
+}
+//# sourceMappingURL=facade.d.ts.map

package/lib/mjs/acl/facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../../src/acl/facade.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK9C,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAItE,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,mDAAmD;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,qBAAa,KAAK;IAGJ,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY;IAFpD,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,YAA+B,OAAO,GAAE,YAAiB,EAAI;IAEvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3I;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlG;IAEK,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAGjE;IAED,SAAS,KAAK,SAAS,IAAI,UAAU,CAEpC;IAED,OAAO,KAAK,GAAG,GAEd;IAED,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,KAAK;YAKC,SAAS;CAaxB"}

package/lib/mjs/acl/facade.js

@@ -0,0 +1,69 @@
+import { AuthzConfigError, SYSTEM, currentPrincipal, engineLog, principalKey } from '@spinajs/authz';
+import { DI } from '@spinajs/di';
+import { publishedFs } from '@spinajs/fs';
+import { fsAccessConfig, fsAclConfig } from '../access-config/index.js';
+import { decideFs, domainService, refOf } from '../middleware/decide.js';
+import { fsRowOf, normalizeFsPath } from '../refs/index.js';
+import { aclSubjectKey, fileAclStore } from './shared.js';
+/**
+ * Changes the file ACL as the current principal. Every call asserts a definite
+ * `fs:manage` on both the file and the dir ref of the path (the fs ref for the root), whatever the filesystem's
+ * `authz.fs` mode; only SYSTEM is exempt. The checks run in the domain of `authz.fs.<fs>.domain`, 'root' without an
+ * entry. fs:manage lets the holder grant any configured relation, owner included. System code that needs unchecked
+ * writes uses the FileAclStore directly. A row granted on a path that does not exist yet is cleared as stale when
+ * that path is later created through the middleware.
+ */
+export class FsAcl {
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async grant(fs, path, subject, relation, opts = {}) {
+        this.known(relation);
+        const principal = this.principal();
+        const at = await this.authorize(fs, path, principal);
+        await (await this.store()).grant({ fs, path: at, subject, relation, grantedBy: principalKey(principal), ...(opts.expiresAt ? { expiresAt: opts.expiresAt } : {}) });
+    }
+    async revoke(fs, path, subject, relation) {
+        this.known(relation);
+        const key = aclSubjectKey(subject);
+        const at = await this.authorize(fs, path, this.principal());
+        await (await this.store()).revoke(fs, at, key, relation);
+    }
+    async list(fs, path) {
+        const at = await this.authorize(fs, path, this.principal());
+        return (await this.store()).list(fs, at);
+    }
+    get container() {
+        return this.options.container ?? DI.RootContainer;
+    }
+    get log() {
+        return (this.logger ??= this.options.log ?? engineLog('authz-fs'));
+    }
+    principal() {
+        return (this.options.principal ?? currentPrincipal)();
+    }
+    store() {
+        return this.options.store ? this.options.store() : fileAclStore(this.container);
+    }
+    known(relation) {
+        const { relations } = fsAclConfig(this.container);
+        if (!relations.includes(relation))
+            throw new AuthzConfigError(`FsAcl: relation ${JSON.stringify(relation)} is not in authz.fsAcl.relations (${relations.join(', ')})`);
+    }
+    async authorize(fs, path, principal) {
+        const provider = publishedFs(fs, this.container);
+        if (!provider)
+            throw new AuthzConfigError(`FsAcl: filesystem ${JSON.stringify(fs)} has no published provider`);
+        const normalised = normalizeFsPath(path, provider.BasePath);
+        if (principal === SYSTEM)
+            return normalised;
+        const { domain } = fsAccessConfig(fs, this.container);
+        const service = await (this.options.service ? this.options.service(domain) : domainService(this.container, domain));
+        const kinds = normalised === '' ? ['file'] : ['file', 'dir'];
+        for (const kind of kinds) {
+            await decideFs({ fsName: fs, mode: 'enforce', service, log: this.log, principal, permission: 'fs:manage', ref: refOf(fs, normalised, kind), subject: fsRowOf(fs, normalised, kind) });
+        }
+        return normalised;
+    }
+}
+//# sourceMappingURL=facade.js.map

package/lib/mjs/acl/facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../../src/acl/facade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAErG,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAc1D;;;;;;;GAOG;AACH,MAAM,OAAO,KAAK;IAGhB,YAA+B,OAAO,GAAiB,EAAE;uBAA1B,OAAO;IAAsB,CAAC;IAE7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,IAAY,EAAE,OAA0B,EAAE,QAAgB,EAAE,IAAI,GAAkC,EAAE;QAC1H,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,OAA0B,EAAE,QAAgB;QACjF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY;QACjC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,CAAC;IACpD,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,SAAS;QACf,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,QAAgB;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzK,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,IAAY,EAAE,SAAoB;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;QAC/G,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,MAAM;YAAE,OAAO,UAAU,CAAC;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpH,MAAM,KAAK,GAA0B,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/lib/mjs/acl/index.d.ts

@@ -0,0 +1,6 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './relation.js';
+export * from './facade.js';
+export { FS_ACL_LIMITS, FS_ACL_TABLE } from './shared.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/acl/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/acl/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/lib/mjs/acl/index.js

@@ -0,0 +1,6 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './relation.js';
+export * from './facade.js';
+export { FS_ACL_LIMITS, FS_ACL_TABLE } from './shared.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/acl/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/acl/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/lib/mjs/acl/orm-store.d.ts

@@ -0,0 +1,31 @@
+import type { PrincipalRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FileAclStore } from './store.js';
+import type { FsAclRow } from './store.js';
+export interface OrmFileAclStoreOptions {
+    /** The ORM connection; default `authz.fsAcl.connection`, else 'default'. */
+    readonly connection?: string;
+    /** Where Configuration and Orm are resolved; default the DI root. */
+    readonly container?: IContainer;
+}
+/**
+ * FileAclStore over `fs_acl` (migration AuthzFsAcl_2026_10_17_00_00_00). Reads are narrowed in SQL by `path_hash`
+ * (the indexed key) and decided by an exact comparison of `path` in code, and rows change by id, so a table created
+ * with a case-insensitive collation never merges two paths.
+ */
+export declare class OrmFileAclStore extends FileAclStore {
+    private readonly opts;
+    constructor(opts?: OrmFileAclStoreOptions);
+    holds(fs: string, paths: readonly string[], subjectKeys: readonly string[], relation: string, at: Date): Promise<boolean>;
+    list(fs: string, path: string): Promise<readonly FsAclRow[]>;
+    grant(row: FsAclRow): Promise<void>;
+    revoke(fs: string, path: string, subjectKey: string, relation: string): Promise<void>;
+    ownerOf(fs: string, path: string): Promise<PrincipalRef | null>;
+    setOwnerIfAbsent(fs: string, path: string, owner: PrincipalRef): Promise<void>;
+    deleteTree(fs: string, path: string): Promise<void>;
+    deletePath(fs: string, path: string): Promise<void>;
+    moveTree(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+    movePath(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+    private driver;
+}
+//# sourceMappingURL=orm-store.d.ts.map

package/lib/mjs/acl/orm-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.d.ts","sourceRoot":"","sources":["../../../src/acl/orm-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQ9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAc3C,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAID;;;;GAIG;AACH,qBACa,eAAgB,SAAQ,YAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,GAAE,sBAA2B,EAE7D;IAEK,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAa9H;IAEK,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAIjE;IAEK,KAAK,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CASxC;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1F;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAOpE;IAEK,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxD;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxD;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpF;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcpF;YAEa,MAAM;CAQrB"}