@spinajs/authz-fs 0.0.0-stage → 3.0.1

package/lib/cjs/adapter/index.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FsResourceAdapter = void 0;
+const authz_1 = require("@spinajs/authz");
+const di_1 = require("@spinajs/di");
+const fs_1 = require("@spinajs/fs");
+const index_js_1 = require("../access-config/index.js");
+const relation_js_1 = require("../acl/relation.js");
+const index_js_2 = require("../permissions/index.js");
+const index_js_3 = require("../refs/index.js");
+const isKind = (v) => v === 'file' || v === 'dir';
+/** Refs, ancestors, rows and permissions of the filesystems; registered in the root container. */
+let FsResourceAdapter = class FsResourceAdapter extends authz_1.ResourceAdapter {
+    /** Where the published fs providers and the Configuration are looked up. */
+    constructor(container = di_1.DI.RootContainer) {
+        super();
+        this.container = container;
+        this.kind = 'fs';
+        this.types = index_js_3.FS_RESOURCE_TYPES;
+    }
+    accepts(target) {
+        if (target === null || typeof target !== 'object')
+            return false;
+        const proto = Object.getPrototypeOf(target);
+        if (proto !== Object.prototype && proto !== null)
+            return false;
+        const t = target;
+        return typeof t.fs === 'string' && typeof t.path === 'string' && (t.kind === undefined || isKind(t.kind));
+    }
+    refOf(target) {
+        const type = target.type;
+        return (0, index_js_3.fsRef)(target.fs, (0, index_js_3.normalizeFsPath)(target.path, this.basePathOf(target.fs)), target.kind ?? (type === 'dir' ? 'dir' : 'file'));
+    }
+    /** Does not know which filesystems exist, so an fs name with no provider still gets a chain (it grants nothing). */
+    async ancestors(ref) {
+        return (0, index_js_3.fsAncestors)(ref);
+    }
+    /** The row AuthzFsMiddleware passes as the subject of every check, built without IO. */
+    async load(ref) {
+        return (0, index_js_3.fsRow)(ref);
+    }
+    attribute(subject, field) {
+        return subject !== null && typeof subject === 'object' && Object.hasOwn(subject, field) ? subject[field] : undefined;
+    }
+    /**
+     * One FsAclRelation per fs type and `authz.fsAcl` relation: boot rule 8 needs a resolver for every relation a grant
+     * names, on every type of the permission, known at boot.
+     */
+    relations() {
+        const { relations } = (0, index_js_1.fsAclConfig)(this.container);
+        return Object.freeze(index_js_3.FS_RESOURCE_TYPES.flatMap((type) => relations.map((relation) => new relation_js_1.FsAclRelation(type, relation, this.container))));
+    }
+    permissions() {
+        return index_js_2.FS_PERMISSIONS;
+    }
+    // Read from the published provider, so refOf does no IO.
+    basePathOf(fsName) {
+        const basePath = (0, fs_1.publishedFs)(fsName, this.container)?.BasePath;
+        return typeof basePath === 'string' && basePath !== '' ? basePath : undefined;
+    }
+};
+exports.FsResourceAdapter = FsResourceAdapter;
+exports.FsResourceAdapter = FsResourceAdapter = __decorate([
+    (0, di_1.Injectable)(authz_1.ResourceAdapter),
+    __metadata("design:paramtypes", [Object])
+], FsResourceAdapter);
+//# sourceMappingURL=index.js.map

package/lib/cjs/adapter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapter/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAiD;AAEjD,oCAA6C;AAE7C,oCAA0C;AAE1C,wDAAwD;AACxD,oDAAmD;AACnD,sDAAyD;AACzD,+CAAiG;AAUjG,MAAM,MAAM,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAE5E,kGAAkG;AAE3F,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,uBAAiC;IAItE,4EAA4E;IAC5E,YAA+B,SAAS,GAAe,OAAE,CAAC,aAAa;QACrE,KAAK,EAAE,CAAC;QADqB,cAAS,GAAT,SAAS,CAA+B;QAJ9D,SAAI,GAAG,IAAI,CAAC;QACZ,UAAK,GAA4B,4BAAiB,CAAC;IAK5D,CAAC;IAED,OAAO,CAAC,MAAe;QACrB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,KAAK,GAAY,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,MAAwB;QAC5B,MAAM,IAAI,GAAa,MAA6B,CAAC,IAAI,CAAC;QAC1D,OAAO,IAAA,gBAAK,EAAC,MAAM,CAAC,EAAE,EAAE,IAAA,0BAAe,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtI,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,SAAS,CAAC,GAAgB;QAC9B,OAAO,IAAA,sBAAW,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI,CAAC,GAAgB;QACzB,OAAO,IAAA,gBAAK,EAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,CAAC,OAAgB,EAAE,KAAa;QACvC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,OAAmC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpJ,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sBAAW,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,MAAM,CAAC,4BAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,2BAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,CAAC;IAED,WAAW;QACT,OAAO,yBAAc,CAAC;IACxB,CAAC;IAED,yDAAyD;IAC/C,UAAU,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;QAC/D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;CACF,CAAA;;4BAtDY,iBAAiB;IAD7B,IAAA,eAAU,EAAC,uBAAe,CAAC;;GACf,iBAAiB,CAsD7B"}

package/lib/cjs/checks.d.ts

@@ -0,0 +1,5 @@
+/** A non-empty filesystem name without ':' (the first ':' of a ref id ends the name). */
+export declare function checkFsName(fsName: unknown): string;
+/** `value` as JSON for an error message; a value JSON cannot hold gives its String or its tag. */
+export declare function show(value: unknown): string;
+//# sourceMappingURL=checks.d.ts.map

package/lib/cjs/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":"AAIA,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED,kGAAkG;AAClG,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM3C"}

package/lib/cjs/checks.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkFsName = checkFsName;
+exports.show = show;
+const util_1 = require("@spinajs/util");
+// Internal: the barrel does not export this module.
+/** A non-empty filesystem name without ':' (the first ':' of a ref id ends the name). */
+function checkFsName(fsName) {
+    return (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)(), (0, util_1._reg_match)(/^[^:]*$/)))(fsName, 'fsName');
+}
+/** `value` as JSON for an error message; a value JSON cannot hold gives its String or its tag. */
+function show(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return Object.prototype.toString.call(value);
+    }
+}
+//# sourceMappingURL=checks.js.map

package/lib/cjs/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":";;;;AAAA,wCAA+E;AAE/E,oDAAoD;AAEpD,yFAAyF;AACzF,qBAA4B,MAAe;IACzC,OAAO,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,iBAAU,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,kGAAkG;AAClG,cAAqB,KAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/lib/cjs/http/from-fs-path.d.ts

@@ -0,0 +1,15 @@
+import type { ResourceRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+/**
+ * A resource extractor for `@Access` (authz-http's `ResourceExtractor`): the `file` ref of the url parameter
+ * `param` on `fsName`, the `fs` ref for the root. The path is normalised as the fs core does (D3), with the base
+ * path of the published provider, so the ref is the one AuthzFsMiddleware checks for the same path. Only url
+ * parameters are read, as authz-http's `fromParam` does. An Express 5 wildcard (`*path`) gives an array of
+ * segments: they are joined with '/', each segment refused on its own when the normaliser refuses it (`..` included).
+ *
+ * @param container - where the published provider is looked up; default the root container
+ * @throws InvalidArgument (400) when the parameter is missing, not a string or a non-empty string array, or the
+ * path is refused
+ */
+export declare function fromFsPath(fsName: string, param: string, container?: IContainer): (req: unknown) => ResourceRef | Promise<ResourceRef>;
+//# sourceMappingURL=from-fs-path.d.ts.map

package/lib/cjs/http/from-fs-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-fs-path.d.ts","sourceRoot":"","sources":["../../../src/http/from-fs-path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAS9C;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAStI"}

package/lib/cjs/http/from-fs-path.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromFsPath = fromFsPath;
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+const fs_1 = require("@spinajs/fs");
+const util_1 = require("@spinajs/util");
+const checks_js_1 = require("../checks.js");
+const decide_js_1 = require("../middleware/decide.js");
+const index_js_1 = require("../refs/index.js");
+/**
+ * A resource extractor for `@Access` (authz-http's `ResourceExtractor`): the `file` ref of the url parameter
+ * `param` on `fsName`, the `fs` ref for the root. The path is normalised as the fs core does (D3), with the base
+ * path of the published provider, so the ref is the one AuthzFsMiddleware checks for the same path. Only url
+ * parameters are read, as authz-http's `fromParam` does. An Express 5 wildcard (`*path`) gives an array of
+ * segments: they are joined with '/', each segment refused on its own when the normaliser refuses it (`..` included).
+ *
+ * @param container - where the published provider is looked up; default the root container
+ * @throws InvalidArgument (400) when the parameter is missing, not a string or a non-empty string array, or the
+ * path is refused
+ */
+function fromFsPath(fsName, param, container) {
+    (0, checks_js_1.checkFsName)(fsName);
+    (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)()))(param, 'param');
+    return (req) => {
+        const params = req !== null && typeof req === 'object' ? req.params : undefined;
+        const value = params !== null && typeof params === 'object' && Object.hasOwn(params, param) ? params[param] : undefined;
+        return (0, decide_js_1.refOf)(fsName, (0, index_js_1.normalizeFsPath)(pathOf(value, param, fsName), (0, fs_1.publishedFs)(fsName, container ?? di_1.DI.RootContainer)?.BasePath), 'file');
+    };
+}
+function pathOf(value, param, fsName) {
+    if (typeof value === 'string')
+        return value;
+    if ((0, util_1.isStringArray)(value) && value.length > 0) {
+        // A segment such as '..' is refused even where the joined path would stay inside the filesystem.
+        for (const segment of value)
+            if (segment === '' || segment.includes('/') || (0, index_js_1.normalizeFsPath)(segment) !== segment)
+                throw new exceptions_1.InvalidArgument(`url parameter ${param} has the segment ${JSON.stringify(segment)}`, param);
+        return value.join('/');
+    }
+    throw new exceptions_1.InvalidArgument(`url parameter ${param} is required to identify a file of ${fsName}`, param);
+}
+//# sourceMappingURL=from-fs-path.js.map

package/lib/cjs/http/from-fs-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-fs-path.js","sourceRoot":"","sources":["../../../src/http/from-fs-path.ts"],"names":[],"mappings":";;;AACA,oCAAiC;AAEjC,oDAAsD;AACtD,oCAA0C;AAC1C,wCAAkF;AAElF,4CAA2C;AAC3C,uDAAgD;AAChD,+CAAmD;AAEnD;;;;;;;;;;GAUG;AACH,oBAA2B,MAAc,EAAE,KAAa,EAAE,SAAsB;IAC9E,IAAA,uBAAW,EAAC,MAAM,CAAC,CAAC;IACpB,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAErD,OAAO,CAAC,GAAY,EAAe,EAAE;QACnC,MAAM,MAAM,GAAY,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,MAAM,KAAK,GAAY,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9J,OAAO,IAAA,iBAAK,EAAC,MAAM,EAAE,IAAA,0BAAe,EAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,IAAA,gBAAW,EAAC,MAAM,EAAE,SAAS,IAAI,OAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5I,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,EAAE,MAAc;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,IAAA,oBAAa,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,iGAAiG;QACjG,KAAK,MAAM,OAAO,IAAI,KAAiB;YAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAA,0BAAe,EAAC,OAAO,CAAC,KAAK,OAAO;gBAAE,MAAM,IAAI,4BAAe,CAAC,iBAAiB,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpO,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,4BAAe,CAAC,iBAAiB,KAAK,sCAAsC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;AACzG,CAAC"}

package/lib/cjs/http/index.d.ts

@@ -0,0 +1,3 @@
+export * from './upload.js';
+export * from './from-fs-path.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}

package/lib/cjs/http/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./upload.js"), exports);
+__exportStar(require("./from-fs-path.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,oDAAkC"}

package/lib/cjs/http/upload.d.ts

@@ -0,0 +1,29 @@
+import type { Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FileUploadMiddleware } from '@spinajs/http';
+import type { IUploadOptions, IUploadedFile } from '@spinajs/http';
+import type { FsDecideService, FsLog } from '../middleware/decide.js';
+/** The filesystem `FromFile` uploads to when the route names none. */
+export declare const DEFAULT_UPLOAD_FS = "__file_upload_default_provider__";
+export interface AuthzUploadMiddlewareOptions {
+    /** Where the Configuration, the published providers and AuthzDomains are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED (what AuthzService.current() returns). */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+}
+/**
+ * Checks `fs:write` on the file an upload will be written to (`file.Provider`, else `options.fs`, else the default
+ * upload filesystem, at `file.BaseName`) before the uploader copies it, with that filesystem's mode and domain:
+ * enforce refuses with AccessDenied (403) so the formidable temp file is never copied, audit warns, off does
+ * nothing. AuthzFsMiddleware checks the copy again, but the uploader turns its denial into an IOFail (500); this
+ * gives the 403. Apps add it after middlewares that rename the file.
+ */
+export declare class AuthzUploadMiddleware extends FileUploadMiddleware {
+    protected readonly options: AuthzUploadMiddlewareOptions;
+    constructor(options?: AuthzUploadMiddlewareOptions);
+    beforeUpload(file: IUploadedFile, options?: IUploadOptions): Promise<IUploadedFile>;
+}
+//# sourceMappingURL=upload.d.ts.map

package/lib/cjs/http/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/http/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAGtE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBACa,qBAAsB,SAAQ,oBAAoB;IACjD,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,4BAA4B;IAApE,YAA+B,OAAO,GAAE,4BAAiC,EAExE;IAEY,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB/F;CACF"}

package/lib/cjs/http/upload.js

@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzUploadMiddleware = exports.DEFAULT_UPLOAD_FS = void 0;
+const authz_1 = require("@spinajs/authz");
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+const fs_1 = require("@spinajs/fs");
+const http_1 = require("@spinajs/http");
+const index_js_1 = require("../access-config/index.js");
+const decide_js_1 = require("../middleware/decide.js");
+const index_js_2 = require("../refs/index.js");
+/** The filesystem `FromFile` uploads to when the route names none. */
+exports.DEFAULT_UPLOAD_FS = '__file_upload_default_provider__';
+/**
+ * Checks `fs:write` on the file an upload will be written to (`file.Provider`, else `options.fs`, else the default
+ * upload filesystem, at `file.BaseName`) before the uploader copies it, with that filesystem's mode and domain:
+ * enforce refuses with AccessDenied (403) so the formidable temp file is never copied, audit warns, off does
+ * nothing. AuthzFsMiddleware checks the copy again, but the uploader turns its denial into an IOFail (500); this
+ * gives the 403. Apps add it after middlewares that rename the file.
+ */
+let AuthzUploadMiddleware = class AuthzUploadMiddleware extends http_1.FileUploadMiddleware {
+    constructor(options = {}) {
+        super();
+        this.options = options;
+    }
+    async beforeUpload(file, options) {
+        // ImmediateFileUploader copies to file.Provider, which an earlier middleware may have replaced; FromFile also
+        // falls back on an empty options.fs.
+        const named = file.Provider?.Name;
+        const fsName = typeof named === 'string' && named !== '' ? named : options?.fs || exports.DEFAULT_UPLOAD_FS;
+        const container = this.options.container ?? di_1.DI.RootContainer;
+        const config = (0, index_js_1.fsAccessConfig)(fsName, container);
+        if (config.mode === 'off')
+            return file;
+        const provider = (0, fs_1.publishedFs)(fsName, container) ?? (file.Provider?.Name === fsName ? file.Provider : undefined);
+        const path = (0, index_js_2.normalizeFsPath)(file.BaseName, provider?.BasePath);
+        if (path === '')
+            throw new exceptions_1.InvalidArgument(`upload ${JSON.stringify(file.Name)} has no file name to write to`, 'BaseName');
+        const service = await (this.options.service ?? ((domain) => (0, decide_js_1.domainService)(container, domain)))(config.domain);
+        await (0, decide_js_1.decideFs)({
+            fsName,
+            mode: config.mode,
+            service,
+            log: this.options.log ?? (0, authz_1.engineLog)('authz-fs'),
+            principal: (this.options.principal ?? authz_1.currentPrincipal)(),
+            permission: 'fs:write',
+            ref: (0, decide_js_1.refOf)(fsName, path, 'file'),
+            subject: (0, index_js_2.fsRowOf)(fsName, path, 'file'),
+        });
+        return file;
+    }
+};
+exports.AuthzUploadMiddleware = AuthzUploadMiddleware;
+exports.AuthzUploadMiddleware = AuthzUploadMiddleware = __decorate([
+    (0, di_1.Injectable)(http_1.FileUploadMiddleware),
+    __metadata("design:paramtypes", [Object])
+], AuthzUploadMiddleware);
+//# sourceMappingURL=upload.js.map

package/lib/cjs/http/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/http/upload.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAA6D;AAE7D,oCAA6C;AAE7C,oDAAsD;AACtD,oCAA0C;AAC1C,wCAAqD;AAGrD,wDAA2D;AAC3D,uDAAyE;AAEzE,+CAA4D;AAE5D,sEAAsE;AACzD,QAAA,iBAAiB,GAAG,kCAAkC,CAAC;AAYpE;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,2BAAoB;IAC7D,YAA+B,OAAO,GAAiC,EAAE;QACvE,KAAK,EAAE,CAAC;uBADqB,OAAO;IAEtC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,IAAmB,EAAE,OAAwB;QACrE,8GAA8G;QAC9G,qCAAqC;QACrC,MAAM,KAAK,GAAY,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,QAAA,iBAAiB,CAAC;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAE,CAAC,aAAa,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,yBAAc,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAEvC,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,IAAA,0BAAe,EAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,4BAAe,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;QAE3H,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,IAAA,yBAAa,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtH,MAAM,IAAA,oBAAQ,EAAC;YACb,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAA,iBAAS,EAAC,UAAU,CAAC;YAC9C,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,wBAAgB,CAAC,EAAE;YACzD,UAAU,EAAE,UAAU;YACtB,GAAG,EAAE,IAAA,iBAAK,EAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;YAChC,OAAO,EAAE,IAAA,kBAAO,EAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;;gCA/BY,qBAAqB;IADjC,IAAA,eAAU,EAAC,2BAAoB,CAAC;;GACpB,qBAAqB,CA+BjC"}

package/lib/cjs/index.d.ts

@@ -0,0 +1,9 @@
+export * from './refs/index.js';
+export * from './permissions/index.js';
+export * from './access-config/index.js';
+export * from './acl/index.js';
+export * from './adapter/index.js';
+export * from './middleware/index.js';
+export * from './migrations/index.js';
+export * from './http/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/lib/cjs/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./refs/index.js"), exports);
+__exportStar(require("./permissions/index.js"), exports);
+__exportStar(require("./access-config/index.js"), exports);
+__exportStar(require("./acl/index.js"), exports);
+__exportStar(require("./adapter/index.js"), exports);
+__exportStar(require("./middleware/index.js"), exports);
+__exportStar(require("./migrations/index.js"), exports);
+__exportStar(require("./http/index.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,yDAAuC;AACvC,2DAAyC;AACzC,iDAA+B;AAC/B,qDAAmC;AACnC,wDAAsC;AACtC,wDAAsC;AACtC,kDAAgC"}

package/lib/cjs/middleware/decide.d.ts

@@ -0,0 +1,32 @@
+import type { AuthzLog, CheckInput, Decision, Permission, Principal, ResourceRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsAccessMode } from '../access-config/index.js';
+import type { FsPathKind, FsRow } from '../refs/index.js';
+/** The part of AuthzService the fs checks call. */
+export interface FsDecideService {
+    check(req: CheckInput): Promise<Decision>;
+    assert(principal: Principal, permission: Permission, resource?: ResourceRef | object, subject?: unknown): Promise<Decision>;
+}
+/** `error` is for a file ACL update that failed after the IO; default `warn`. */
+export type FsLog = Pick<AuthzLog, 'warn'> & Partial<Pick<AuthzLog, 'error'>>;
+/** One check of one path: enforce asserts, audit checks and warns. */
+export interface FsCheck {
+    readonly fsName: string;
+    readonly mode: Exclude<FsAccessMode, 'off'>;
+    readonly service: FsDecideService;
+    readonly log: FsLog;
+    readonly principal: Principal;
+    readonly permission: Permission;
+    readonly ref: ResourceRef;
+    readonly subject: FsRow;
+}
+export declare function decideFs({ fsName, mode, service, log, principal, permission, ref, subject }: FsCheck): Promise<Decision>;
+export declare function warnDenied(fsName: string, log: FsLog, principal: Principal, permission: Permission, ref: ResourceRef, decision: Decision): void;
+/** 'root' is the root AuthzService; any other domain must exist already (`authz.domains`): it is never created here. */
+export declare function domainService(container: IContainer, domain: string): Promise<FsDecideService>;
+/** `now` when it is a valid Date, else the system time. */
+export declare const validNow: (now: unknown) => Date;
+/** The AuthzClock the domain's service booted with, else the system time. */
+export declare function domainNow(container: IContainer, domain: string): Promise<Date>;
+export declare const refOf: (fsName: string, normalised: string, kind: FsPathKind) => ResourceRef;
+//# sourceMappingURL=decide.d.ts.map

package/lib/cjs/middleware/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../../../src/middleware/decide.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAI1D,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7H;AAED,iFAAiF;AACjF,MAAM,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;CACzB;AAED,wBAAsB,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAS9H;AAMD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAG/I;AAED,wHAAwH;AACxH,wBAAsB,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAGnG;AAED,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,QAAS,OAAO,KAAG,IAAgF,CAAC;AAEzH,6EAA6E;AAC7E,wBAAsB,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,eAAO,MAAM,KAAK,WAAY,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAG,WAA+G,CAAC"}

package/lib/cjs/middleware/decide.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refOf = exports.validNow = void 0;
+exports.decideFs = decideFs;
+exports.warnDenied = warnDenied;
+exports.domainService = domainService;
+exports.domainNow = domainNow;
+const authz_1 = require("@spinajs/authz");
+async function decideFs({ fsName, mode, service, log, principal, permission, ref, subject }) {
+    if (mode === 'enforce') {
+        const decision = await service.assert(principal, permission, ref, subject);
+        if (!(0, authz_1.definite)(decision))
+            throw new authz_1.AccessDenied(conditional(decision));
+        return decision;
+    }
+    const decision = await service.check({ principal, permission, resource: ref, subject });
+    if (!(0, authz_1.definite)(decision))
+        warnDenied(fsName, log, principal, permission, ref, decision);
+    return decision;
+}
+function conditional(decision) {
+    return { ...decision, allowed: false, residual: authz_1.FALSE, reason: { code: 'needs_subject', priority: authz_1.DEFAULT_DENY_PRIORITY.needs_subject } };
+}
+function warnDenied(fsName, log, principal, permission, ref, decision) {
+    const why = decision.allowed ? 'conditional' : decision.reason?.code;
+    log.warn({ fsName, principal: (0, authz_1.principalKey)(principal), permission, resource: (0, authz_1.resourceKey)(ref), why }, 'authz.fs.${fsName}: ${principal} lacks ${permission} on ${resource}${?why} (${why})${/why}; allowed in audit mode');
+}
+/** 'root' is the root AuthzService; any other domain must exist already (`authz.domains`): it is never created here. */
+async function domainService(container, domain) {
+    if (domain === 'root')
+        return (await container.resolve(authz_1.AuthzService));
+    return (await container.resolve(authz_1.AuthzDomains)).service(domain);
+}
+/** `now` when it is a valid Date, else the system time. */
+const validNow = (now) => (now instanceof Date && !Number.isNaN(now.getTime()) ? now : new Date());
+exports.validNow = validNow;
+/** The AuthzClock the domain's service booted with, else the system time. */
+async function domainNow(container, domain) {
+    try {
+        const domains = await container.resolve(authz_1.AuthzDomains);
+        if (domains instanceof authz_1.DefaultAuthzDomains)
+            return (0, exports.validNow)(domains.clock(domain).now());
+    }
+    catch {
+        // no authz host, no such domain or its service has not booted: the system time
+    }
+    return new Date();
+}
+const refOf = (fsName, normalised, kind) => (normalised === '' ? { type: 'fs', id: fsName } : { type: kind, id: `${fsName}:${normalised}` });
+exports.refOf = refOf;
+//# sourceMappingURL=decide.js.map

package/lib/cjs/middleware/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../../src/middleware/decide.ts"],"names":[],"mappings":";;;;;;;AAAA,0CAAkK;AA8B3J,KAAK,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAW;IACzG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,oBAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,IAAA,gBAAQ,EAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB;IACrC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,6BAAqB,CAAC,aAAa,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,oBAA2B,MAAc,EAAE,GAAU,EAAE,SAAoB,EAAE,UAAsB,EAAE,GAAgB,EAAE,QAAkB;IACvI,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,oBAAY,EAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAA,mBAAW,EAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,mHAAmH,CAAC,CAAC;AAC7N,CAAC;AAED,wHAAwH;AACjH,KAAK,wBAAwB,SAAqB,EAAE,MAAc;IACvE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,oBAAY,CAAC,CAAiB,CAAC;IACtF,OAAQ,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,oBAAY,CAAC,CAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,2DAA2D;AACpD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAQ,EAAE,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAA5G,QAAA,QAAQ,GAAR,QAAQ,CAAoG;AAEzH,6EAA6E;AACtE,KAAK,oBAAoB,SAAqB,EAAE,MAAc;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,oBAAY,CAAC,CAAC;QACtD,IAAI,OAAO,YAAY,2BAAmB;YAAE,OAAO,IAAA,QAAA,QAAQ,EAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAEM,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAgB,EAAe,EAAE,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;AAAhL,QAAA,KAAK,GAAL,KAAK,CAA2K"}

package/lib/cjs/middleware/index.d.ts

@@ -0,0 +1,53 @@
+import type { Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FsMiddleware } from '@spinajs/fs';
+import type { FsActionContext, fs } from '@spinajs/fs';
+import type { FsAccessConfig } from '../access-config/index.js';
+import type { FileAclStore } from '../acl/store.js';
+import type { FsDecideService, FsLog } from './decide.js';
+export type { FsDecideService, FsLog } from './decide.js';
+export { FS_NO_OWNER_TYPES } from './owner.js';
+export { DEFAULT_SIGNED_URL_TTL_SECONDS } from './signed-url.js';
+export interface AuthzFsMiddlewareOptions {
+    /** Where the Configuration, AuthzService, AuthzDomains and the FileAclStore are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED (what AuthzService.current() returns). */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+    /** The time signed URL lifetimes count from; default the AuthzClock of the filesystem's domain. */
+    readonly now?: () => Date;
+    readonly store?: () => Promise<FileAclStore>;
+}
+/**
+ * Checks every target of every fs action with the `authz.fs.<name>` entry of the target's own filesystem (fs
+ * middleware design §2.1) and keeps the file ACL in step with what the action did.
+ */
+export declare class AuthzFsMiddleware extends FsMiddleware {
+    protected readonly options: AuthzFsMiddlewareOptions;
+    order: number;
+    private logger?;
+    constructor(options?: AuthzFsMiddlewareOptions);
+    isEnabled(target: fs): boolean;
+    before(ctx: FsActionContext): Promise<void>;
+    after(ctx: FsActionContext, result: unknown): Promise<unknown>;
+    protected get container(): IContainer;
+    protected configOf(target: fs): FsAccessConfig;
+    private get log();
+    private service;
+    private store;
+    private decide;
+    private narrowSignedUrl;
+    private probeDeleted;
+    private applyRows;
+    /**
+     * A destination that existed keeps its rows (first writer) and the source rows go; otherwise the source rows move
+     * there, onto another filesystem too (one table): a directory's whole tree, anything else only its own rows. No
+     * owner is stamped: the rows travel with the file. A key whose prefix holds keys leaves its rows to the prefix. A
+     * destination too long for a row gets none: the source rows go, its parents' rows cover it.
+     */
+    private moveRows;
+    private listEach;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAY,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAK1D,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEjE,MAAM,WAAW,wBAAwB;IACvC,+GAA+G;IAC/G,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACrB,mGAAmG;IACnG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AA8CD;;;GAGG;AACH,qBACa,iBAAkB,SAAQ,YAAY;IAIrC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,wBAAwB;IAHzD,KAAK,SAAO;IACnB,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,YAA+B,OAAO,GAAE,wBAA6B,EAEpE;IAED,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAE7B;IAEK,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhD;IAEK,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnE;IAED,SAAS,KAAK,SAAS,IAAI,UAAU,CAEpC;IAKD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,cAAc,CAM7C;IAED,OAAO,KAAK,GAAG,GAEd;IAED,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,KAAK;YAIC,MAAM;YAYN,eAAe;YAQf,YAAY;YAKZ,SAAS;IAmBvB;;;;;OAKG;YACW,QAAQ;YAaR,QAAQ;CA0BvB"}