@spinajs/authz-fs 0.0.0-stage → 3.0.1

package/lib/mjs/acl/orm-store.js

@@ -0,0 +1,196 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { randomUUID } from 'node:crypto';
+import { AuthzConfigError } from '@spinajs/authz';
+import { DI, Injectable } from '@spinajs/di';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { Orm, instantFromDb } from '@spinajs/orm';
+import { chunk } from '@spinajs/util';
+import { FS_ACL_CONNECTION_KEY, FS_ACL_OWNER, fsAclConfig } from '../access-config/acl-config.js';
+import { FS_ACL_LIMITS, FS_ACL_TABLE, aclExpiry, aclFs, aclOwnerKey, aclPath, aclPathHash, aclRelation, aclSubjectKey, checkMove, fits, isWildcardKey, movedPath, subjectOfKey } from './shared.js';
+import { FileAclStore } from './store.js';
+const IN_CHUNK = 500;
+/**
+ * FileAclStore over `fs_acl` (migration AuthzFsAcl_2026_10_17_00_00_00). Reads are narrowed in SQL by `path_hash`
+ * (the indexed key) and decided by an exact comparison of `path` in code, and rows change by id, so a table created
+ * with a case-insensitive collation never merges two paths.
+ */
+let OrmFileAclStore = class OrmFileAclStore extends FileAclStore {
+    constructor(opts = {}) {
+        super();
+        this.opts = opts;
+    }
+    async holds(fs, paths, subjectKeys, relation, at) {
+        const f = aclFs(fs);
+        const r = aclRelation(relation);
+        const wanted = [...new Set(paths.map(aclPath))];
+        const keys = [...new Set(subjectKeys)];
+        if (wanted.length === 0 || keys.length === 0)
+            return false;
+        const hashes = wanted.map(aclPathHash);
+        const driver = await this.driver();
+        for (const part of chunk(keys, IN_CHUNK)) {
+            const rows = ((await driver.select().from(FS_ACL_TABLE).where({ fs: f, relation: r }).whereIn('path_hash', hashes).whereIn('subject_key', part)) ?? []);
+            if (rows.some((row) => row.fs === f && row.relation === r && wanted.includes(row.path) && part.includes(row.subject_key) && live(row, at)))
+                return true;
+        }
+        return false;
+    }
+    async list(fs, path) {
+        const f = aclFs(fs);
+        const p = aclPath(path);
+        return (await exactRows(await this.driver(), f, p)).map(rowOf);
+    }
+    async grant(row) {
+        const key = { fs: aclFs(row.fs), path: aclPath(row.path), subject_key: aclSubjectKey(row.subject), relation: aclRelation(row.relation) };
+        const values = { expires_at: aclExpiry(row.expiresAt), granted_by: row.grantedBy === undefined ? null : fits(row.grantedBy, 'granted_by') };
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => {
+            const found = (await exactRows(tx, key.fs, key.path)).find((r) => r.subject_key === key.subject_key && r.relation === key.relation);
+            if (found)
+                await tx.update().in(FS_ACL_TABLE).update(values).where({ id: found.id });
+            else
+                await tx.insert().into(FS_ACL_TABLE).values({ id: randomUUID(), ...key, path_hash: aclPathHash(key.path), ...values, created_at: new Date() });
+        });
+    }
+    async revoke(fs, path, subjectKey, relation) {
+        const f = aclFs(fs);
+        const p = aclPath(path);
+        const r = aclRelation(relation);
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => deleteIds(tx, (await exactRows(tx, f, p)).filter((row) => row.subject_key === subjectKey && row.relation === r).map((row) => row.id)));
+    }
+    async ownerOf(fs, path) {
+        const rows = (await exactRows(await this.driver(), aclFs(fs), aclPath(path))).filter((r) => r.relation === FS_ACL_OWNER && !isWildcardKey(r.subject_key));
+        for (const row of oldestFirst(rows)) {
+            const subject = subjectOfKey(row.subject_key, `${FS_ACL_TABLE} row ${row.id}`);
+            if (!('set' in subject))
+                return { type: subject.type, id: subject.id };
+        }
+        return null;
+    }
+    async setOwnerIfAbsent(fs, path, owner) {
+        const key = { fs: aclFs(fs), path: aclPath(path), subject_key: aclOwnerKey(owner), relation: FS_ACL_OWNER };
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => {
+            if ((await exactRows(tx, key.fs, key.path)).some((r) => r.relation === FS_ACL_OWNER))
+                return;
+            await tx.insert().into(FS_ACL_TABLE).values({ id: randomUUID(), ...key, path_hash: aclPathHash(key.path), expires_at: null, granted_by: null, created_at: new Date() });
+        });
+    }
+    async deleteTree(fs, path) {
+        const f = aclFs(fs);
+        const p = aclPath(path);
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => deleteIds(tx, (await tree(tx, f, p)).map((r) => r.id)));
+    }
+    async deletePath(fs, path) {
+        const f = aclFs(fs);
+        const p = aclPath(path);
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => deleteIds(tx, (await exactRows(tx, f, p)).map((r) => r.id)));
+    }
+    async moveTree(fromFs, from, toFs, to) {
+        const src = { fs: aclFs(fromFs), path: aclPath(from) };
+        const dst = { fs: aclFs(toFs), path: aclPath(to) };
+        if (src.fs === dst.fs && src.path === dst.path)
+            return;
+        checkMove(src.fs, src.path, dst.fs, dst.path);
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => {
+            const rows = await tree(tx, src.fs, src.path);
+            const landing = rows.map((row) => ({ row, path: movedPath(src.path, dst.path, row.path) }));
+            // A row too long for the path column goes: what it named falls under the moved parents' rows.
+            const moves = landing.filter((m) => m.path.length <= FS_ACL_LIMITS.path);
+            // Only a move onto an ancestor can land one moved row on another; no provider moves a directory there.
+            const sources = new Set(rows.map((r) => r.path));
+            if (src.fs === dst.fs && moves.some((m) => sources.has(m.path)))
+                throw new InvalidArgument(`cannot move ${src.fs}:${src.path} onto ${dst.path}, which holds it`, 'to');
+            const taken = new Set(moves.map((m) => rowKey(m.path, m.row)));
+            const replaced = (await tree(tx, dst.fs, dst.path)).filter((r) => taken.has(rowKey(r.path, r))).map((r) => r.id);
+            const dropped = landing.filter((m) => !moves.includes(m)).map((m) => m.row.id);
+            await deleteIds(tx, [...replaced, ...dropped]);
+            for (const m of moves)
+                await tx.update().in(FS_ACL_TABLE).update({ fs: dst.fs, path: m.path, path_hash: aclPathHash(m.path) }).where({ id: m.row.id });
+        });
+    }
+    async movePath(fromFs, from, toFs, to) {
+        const src = { fs: aclFs(fromFs), path: aclPath(from) };
+        const dst = { fs: aclFs(toFs), path: aclPath(to) };
+        if (src.fs === dst.fs && src.path === dst.path)
+            return;
+        const driver = await this.driver();
+        await driver.transaction(async (tx) => {
+            // The destination's equal rows go first, else the UPDATE would break the unique key.
+            const moving = new Set((await exactRows(tx, src.fs, src.path)).map((r) => rowKey(dst.path, r)));
+            await deleteIds(tx, (await exactRows(tx, dst.fs, dst.path)).filter((r) => moving.has(rowKey(r.path, r))).map((r) => r.id));
+            await tx.update().in(FS_ACL_TABLE).update({ fs: dst.fs, path: dst.path, path_hash: aclPathHash(dst.path) }).where({ fs: src.fs, path_hash: aclPathHash(src.path), path: src.path });
+        });
+    }
+    async driver() {
+        const container = this.opts.container ?? DI.RootContainer;
+        const name = this.opts.connection ?? fsAclConfig(container).connection;
+        const orm = (await container.resolve(Orm));
+        const driver = orm.Connections.get(name);
+        if (!driver)
+            throw new AuthzConfigError(`OrmFileAclStore: ${FS_ACL_CONNECTION_KEY} names connection ${JSON.stringify(name)}, which the ORM does not have (connections: ${[...orm.Connections.keys()].join(', ') || 'none'})`);
+        return driver;
+    }
+};
+OrmFileAclStore = __decorate([
+    Injectable(FileAclStore),
+    __metadata("design:paramtypes", [Object])
+], OrmFileAclStore);
+export { OrmFileAclStore };
+const rowKey = (path, r) => `${path}\0${r.subject_key}\0${r.relation}`;
+// Rows are read without a model, so no column converter runs: SQLite hands back ISO text, the others a Date.
+function toDate(value, column) {
+    if (value === null || value === undefined)
+        return null;
+    const instant = instantFromDb(value);
+    if (!instant)
+        throw new AuthzConfigError(`${FS_ACL_TABLE}.${column} holds an unreadable datetime ${JSON.stringify(value)}`);
+    return instant.toJSDate();
+}
+function live(row, at) {
+    const until = toDate(row.expires_at, 'expires_at');
+    return until === null || until.getTime() > at.getTime();
+}
+const oldestFirst = (rows) => [...rows].sort((a, b) => (toDate(a.created_at, 'created_at')?.getTime() ?? 0) - (toDate(b.created_at, 'created_at')?.getTime() ?? 0));
+function rowOf(row) {
+    const expiresAt = toDate(row.expires_at, 'expires_at');
+    return Object.freeze({
+        fs: row.fs,
+        path: row.path,
+        subject: subjectOfKey(row.subject_key, `${FS_ACL_TABLE} row ${row.id}`),
+        relation: row.relation,
+        ...(expiresAt ? { expiresAt } : {}),
+        ...(row.granted_by ? { grantedBy: row.granted_by } : {}),
+    });
+}
+async function exactRows(driver, fs, path) {
+    const rows = ((await driver.select().from(FS_ACL_TABLE).where({ fs, path_hash: aclPathHash(path), path })) ?? []);
+    return rows.filter((r) => r.fs === fs && r.path === path);
+}
+/**
+ * The rows at `path` and under it ('' = every row of the filesystem). `whereStartsWith` only narrows the read (it may
+ * ignore case under the column's collation); the exact test in code decides.
+ */
+async function tree(driver, fs, path) {
+    if (path === '')
+        return ((await driver.select().from(FS_ACL_TABLE).where({ fs })) ?? []).filter((r) => r.fs === fs);
+    const below = ((await driver.select().from(FS_ACL_TABLE).where({ fs }).whereStartsWith('path', `${path}/`)) ?? []);
+    return [...(await exactRows(driver, fs, path)), ...below.filter((r) => r.fs === fs && r.path.startsWith(`${path}/`))];
+}
+async function deleteIds(driver, ids) {
+    for (const part of chunk(ids, IN_CHUNK))
+        await driver.del().from(FS_ACL_TABLE).whereIn('id', part);
+}
+//# sourceMappingURL=orm-store.js.map

package/lib/mjs/acl/orm-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.js","sourceRoot":"","sources":["../../../src/acl/orm-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpM,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB1C,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB;;;;GAIG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,YAAY;IAC/C,YAA6B,IAAI,GAA2B,EAAE;QAC5D,KAAK,EAAE,CAAC;oBADmB,IAAI;IAEjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAwB,EAAE,WAA8B,EAAE,QAAgB,EAAE,EAAQ;QAC1G,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC;YACjK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1J,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,IAAY;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAa;QACvB,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzI,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpI,IAAI,KAAK;gBAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;;gBAChF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACtJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,UAAkB,EAAE,QAAgB;QACzE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CACpC,SAAS,CACP,EAAE,EACF,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CACvH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,IAAY;QACpC,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1J,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,YAAY,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,IAAY,EAAE,KAAmB;QAClE,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACpC,IAAI,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;gBAAE,OAAO;YAC7F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1K,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAY;QACvC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAY;QACvC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAU;QACnE,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO;QACvD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,8FAA8F;YAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;YACzE,uGAAuG;YACvG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,MAAM,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACzJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAU;QACnE,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACpC,qFAAqF;YACrF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChG,MAAM,SAAS,CACb,EAAE,EACF,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtG,CAAC;YACF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;QACvE,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAQ,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,qBAAqB,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+CAA+C,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC9N,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAhIY,eAAe;IAD3B,UAAU,CAAC,YAAY,CAAC;;GACZ,eAAe,CAgI3B;;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,CAAM,EAAU,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE5F,6GAA6G;AAC7G,SAAS,MAAM,CAAC,KAAc,EAAE,MAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,YAAY,IAAI,MAAM,iCAAiC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,GAAQ,EAAE,EAAQ;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAoB,EAAS,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAE3L,SAAS,KAAK,CAAC,GAAQ;IACrB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,YAAY,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAiB,EAAE,EAAU,EAAE,IAAY;IAClE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC;IAC3H,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,IAAI,CAAC,MAAiB,EAAE,EAAU,EAAE,IAAY;IAC7D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAQ,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC;IAC5H,OAAO,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAiB,EAAE,GAAsB;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrG,CAAC"}

package/lib/mjs/acl/relation.d.ts

@@ -0,0 +1,29 @@
+import { RelationResolver } from '@spinajs/authz';
+import type { Principal, ResourceRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsRefType } from '../refs/index.js';
+/**
+ * `relation` on fs refs of `type`, read from the file ACL (fs middleware design §2.2): holds when a live row of the
+ * relation at the path, a parent directory or the filesystem root names one of the principal's subject keys. The
+ * subject the engine passes is ignored: a caller-built row could claim anything.
+ *
+ * Known limit: `holds` never sees a check's `fresh` flag, so subjectKeysOf reads assignments through the RBAC
+ * model's cache and a set membership may lag by its TTL.
+ */
+export declare class FsAclRelation extends RelationResolver {
+    readonly type: FsRefType;
+    readonly relation: string;
+    /** Where the Configuration, AuthzDomains and the FileAclStore are resolved. */
+    protected readonly container: IContainer;
+    constructor(type: FsRefType, relation: string, 
+    /** Where the Configuration, AuthzDomains and the FileAclStore are resolved. */
+    container?: IContainer);
+    holds(principal: Principal, ref: ResourceRef): Promise<boolean>;
+    /**
+     * From the RbacService registered in the domain or a parent (sets, companions, wildcards, the ceiling applied),
+     * used only when it is the service of a model the domain's AuthzService runs: a child domain without one must not match
+     * set rows through its parent's service. Otherwise the principal and its type wildcard.
+     */
+    protected subjectKeys(principal: Principal, domain: string, at: Date): Promise<readonly string[]>;
+}
+//# sourceMappingURL=relation.d.ts.map

package/lib/mjs/acl/relation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation.d.ts","sourceRoot":"","sources":["../../../src/acl/relation.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,gBAAgB;IAE/C,QAAQ,CAAC,IAAI,EAAE,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU;IAJ1C,YACW,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM;IACzB,+EAA+E;IAC5D,SAAS,GAAE,UAA6B,EAG5D;IAEK,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpE;IAED;;;;OAIG;IACH,UAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAQtG;CACF"}

package/lib/mjs/acl/relation.js

@@ -0,0 +1,56 @@
+import { AuthzDomains, AuthzService, RelationResolver } from '@spinajs/authz';
+import { RbacService, principalSubjectKey, subjectKeyOf } from '@spinajs/authz-rbac';
+import { Configuration } from '@spinajs/configuration';
+import { DI } from '@spinajs/di';
+import { fsAccessConfig } from '../access-config/index.js';
+import { domainNow } from '../middleware/decide.js';
+import { FS_NO_OWNER_TYPES } from '../middleware/owner.js';
+import { parseFsRef } from '../refs/index.js';
+import { FS_ACL_LIMITS, aclPathChain, fileAclStore } from './shared.js';
+/**
+ * `relation` on fs refs of `type`, read from the file ACL (fs middleware design §2.2): holds when a live row of the
+ * relation at the path, a parent directory or the filesystem root names one of the principal's subject keys. The
+ * subject the engine passes is ignored: a caller-built row could claim anything.
+ *
+ * Known limit: `holds` never sees a check's `fresh` flag, so subjectKeysOf reads assignments through the RBAC
+ * model's cache and a set membership may lag by its TTL.
+ */
+export class FsAclRelation extends RelationResolver {
+    constructor(type, relation, 
+    /** Where the Configuration, AuthzDomains and the FileAclStore are resolved. */
+    container = DI.RootContainer) {
+        super();
+        this.type = type;
+        this.relation = relation;
+        this.container = container;
+    }
+    async holds(principal, ref) {
+        if (ref?.type !== this.type || FS_NO_OWNER_TYPES.has(principal.type))
+            return false;
+        const parsed = parseFsRef(ref);
+        if (!parsed || parsed.fs.length > FS_ACL_LIMITS.fs)
+            return false;
+        // No row can exist for a path past the column width, and the store refuses one.
+        const chain = aclPathChain(parsed.path).filter((p) => p.length <= FS_ACL_LIMITS.path);
+        const domain = this.container.get(Configuration) ? fsAccessConfig(parsed.fs, this.container).domain : 'root';
+        const at = await domainNow(this.container, domain);
+        const keys = await this.subjectKeys(principal, domain, at);
+        return (await fileAclStore(this.container)).holds(parsed.fs, chain, keys, this.relation, at);
+    }
+    /**
+     * From the RbacService registered in the domain or a parent (sets, companions, wildcards, the ceiling applied),
+     * used only when it is the service of a model the domain's AuthzService runs: a child domain without one must not match
+     * set rows through its parent's service. Otherwise the principal and its type wildcard.
+     */
+    async subjectKeys(principal, domain, at) {
+        const own = [principalSubjectKey(principal), subjectKeyOf({ type: principal.type, id: '*' })];
+        const domains = domain === 'root' ? undefined : (await this.container.resolve(AuthzDomains));
+        const scope = domains ? domains.container(domain) : this.container;
+        if (!scope.hasRegistered(RbacService))
+            return own;
+        const rbac = (await scope.resolve(RbacService));
+        const authz = domains ? await domains.service(domain) : (await scope.resolve(AuthzService));
+        return authz.models().includes(rbac.model) ? rbac.subjectKeysOf(principal, at) : own;
+    }
+}
+//# sourceMappingURL=relation.js.map

package/lib/mjs/acl/relation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation.js","sourceRoot":"","sources":["../../../src/acl/relation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,gBAAgB;IACjD,YACW,IAAe,EACf,QAAgB;IACzB,+EAA+E;IAC5D,SAAS,GAAe,EAAE,CAAC,aAAa;QAE3D,KAAK,EAAE,CAAC;oBALC,IAAI;wBACJ,QAAQ;yBAEE,SAAS;IAG9B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAoB,EAAE,GAAgB;QAChD,IAAI,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,aAAa,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACjE,gFAAgF;QAChF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7G,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,WAAW,CAAC,SAAoB,EAAE,MAAc,EAAE,EAAQ;QACxE,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAkB,CAAC;QAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC;YAAE,OAAO,GAAG,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAgB,CAAC;QAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAkB,CAAC;QAC9G,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,CAAC;CACF"}

package/lib/mjs/acl/shared.d.ts

@@ -0,0 +1,36 @@
+import type { AssignmentSubject, PrincipalRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FileAclStore } from './store.js';
+export declare const FS_ACL_TABLE = "fs_acl";
+export declare const FS_ACL_LIMITS: Readonly<{
+    fs: 64;
+    path: 512;
+    subject_key: 200;
+    relation: 64;
+    granted_by: 100;
+}>;
+type Column = keyof typeof FS_ACL_LIMITS;
+export declare function fits(value: string, column: Column): string;
+export declare const aclFs: (fs: unknown) => string;
+export declare const aclPath: (path: string) => string;
+/** `fs_acl.path_hash`: keeps the unique key short enough for every driver (path alone is 2048 bytes in MySQL utf8mb4). */
+export declare const aclPathHash: (normalised: string) => string;
+export declare const aclRelation: (relation: unknown) => string;
+export declare const aclSubjectKey: (subject: AssignmentSubject) => string;
+/** An owner is one principal: its own key, never the type wildcard (a principal whose id is '*' stays itself). */
+export declare function aclOwnerKey(owner: PrincipalRef): string;
+export declare function aclExpiry(expiresAt: unknown): Date | null;
+/** `type:*`: every principal of the type. */
+export declare const isWildcardKey: (key: string) => boolean;
+/** The subject a stored key names: a set (`type:id#role`), a principal, or a type wildcard. */
+export declare function subjectOfKey(key: string, at: string): AssignmentSubject;
+/** `path`, its parent directories nearest first, then '' (D7: a row on a directory or the root covers what is under it). */
+export declare function aclPathChain(path: string): string[];
+export declare const isUnder: (path: string, root: string) => boolean;
+/** Where `path` (at or under `from`) lands when `from` moves to `to`. */
+export declare function movedPath(from: string, to: string, path: string): string;
+export declare function checkMove(fromFs: string, from: string, toFs: string, to: string): void;
+/** The FileAclStore of `container`: the last one registered (OrmFileAclStore unless an app or a test adds one). */
+export declare function fileAclStore(container: IContainer): Promise<FileAclStore>;
+export {};
+//# sourceMappingURL=shared.d.ts.map

package/lib/mjs/acl/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/acl/shared.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI1C,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,eAAO,MAAM,aAAa;;;;;;EAA2G,CAAC;AAEtI,KAAK,MAAM,GAAG,MAAM,OAAO,aAAa,CAAC;AAEzC,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,eAAO,MAAM,KAAK,OAAQ,OAAO,KAAG,MAAqC,CAAC;AAE1E,eAAO,MAAM,OAAO,SAAU,MAAM,KAAG,MAA6C,CAAC;AAErF,0HAA0H;AAC1H,eAAO,MAAM,WAAW,eAAgB,MAAM,KAAG,MAA4B,CAAC;AAE9E,eAAO,MAAM,WAAW,aAAc,OAAO,KAAG,MAAgG,CAAC;AAEjJ,eAAO,MAAM,aAAa,YAAa,iBAAiB,KAAG,MAAoD,CAAC;AAEhH,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAKvD;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAIzD;AAED,6CAA6C;AAC7C,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,OAA6B,CAAC;AAE1E,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAED,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOnD;AAED,eAAO,MAAM,OAAO,SAAU,MAAM,QAAQ,MAAM,KAAG,OAAsE,CAAC;AAE5H,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEtF;AAED,mHAAmH;AACnH,wBAAsB,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAE/E"}

package/lib/mjs/acl/shared.js

@@ -0,0 +1,73 @@
+import { AuthzConfigError } from '@spinajs/authz';
+import { SUBJECT_KEY_MAX_LENGTH, parsePrincipalKey, parsePrincipalSubjectKey, parseSetKey, principalSubjectKey, subjectKeyOf } from '@spinajs/authz-rbac';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { normalizeFsPath } from '@spinajs/fs';
+import { _check_arg, _is_string, _non_empty } from '@spinajs/util';
+import { sha256 } from '@spinajs/util/crypto';
+import { checkFsName } from '../checks.js';
+import { FileAclStore } from './store.js';
+// Internal to the ACL stores, the relation and the middleware; the barrel exports the two constants only.
+export const FS_ACL_TABLE = 'fs_acl';
+export const FS_ACL_LIMITS = Object.freeze({ fs: 64, path: 512, subject_key: SUBJECT_KEY_MAX_LENGTH, relation: 64, granted_by: 100 });
+export function fits(value, column) {
+    if (value.length > FS_ACL_LIMITS[column])
+        throw new InvalidArgument(`${JSON.stringify(value.slice(0, 40))}… does not fit ${FS_ACL_TABLE}.${column} (${FS_ACL_LIMITS[column]} characters)`, column);
+    return value;
+}
+export const aclFs = (fs) => fits(checkFsName(fs), 'fs');
+export const aclPath = (path) => fits(normalizeFsPath(path), 'path');
+/** `fs_acl.path_hash`: keeps the unique key short enough for every driver (path alone is 2048 bytes in MySQL utf8mb4). */
+export const aclPathHash = (normalised) => sha256(normalised);
+export const aclRelation = (relation) => fits(_check_arg(_is_string(_non_empty()))(relation, 'relation'), 'relation');
+export const aclSubjectKey = (subject) => fits(subjectKeyOf(subject), 'subject_key');
+/** An owner is one principal: its own key, never the type wildcard (a principal whose id is '*' stays itself). */
+export function aclOwnerKey(owner) {
+    if (owner === null || typeof owner !== 'object' || typeof owner.type !== 'string' || owner.type === '' || typeof owner.id !== 'string' || owner.id === '') {
+        throw new InvalidArgument(`an owner is a principal { type, id } with non-empty strings, got ${JSON.stringify(owner)}`, 'owner');
+    }
+    return fits(principalSubjectKey({ type: owner.type, id: owner.id }), 'subject_key');
+}
+export function aclExpiry(expiresAt) {
+    if (expiresAt === undefined || expiresAt === null)
+        return null;
+    if (!(expiresAt instanceof Date) || Number.isNaN(expiresAt.getTime()))
+        throw new InvalidArgument(`expiresAt must be a valid Date, got ${String(expiresAt)}`, 'expiresAt');
+    return expiresAt;
+}
+/** `type:*`: every principal of the type. */
+export const isWildcardKey = (key) => key.endsWith(':*');
+/** The subject a stored key names: a set (`type:id#role`), a principal, or a type wildcard. */
+export function subjectOfKey(key, at) {
+    const subject = parseSetKey(key) ?? parsePrincipalSubjectKey(key) ?? (isWildcardKey(key) ? parsePrincipalKey(key) : undefined);
+    if (!subject)
+        throw new AuthzConfigError(`${at}: ${JSON.stringify(key)} is not a subject key`);
+    return subject;
+}
+/** `path`, its parent directories nearest first, then '' (D7: a row on a directory or the root covers what is under it). */
+export function aclPathChain(path) {
+    if (path === '')
+        return [''];
+    const segments = path.split('/');
+    const chain = [];
+    for (let n = segments.length; n > 0; n--)
+        chain.push(segments.slice(0, n).join('/'));
+    chain.push('');
+    return chain;
+}
+export const isUnder = (path, root) => root === '' || path === root || path.startsWith(`${root}/`);
+/** Where `path` (at or under `from`) lands when `from` moves to `to`. */
+export function movedPath(from, to, path) {
+    const rest = from === '' ? path : path.slice(from.length + 1);
+    if (to === '')
+        return rest;
+    return rest === '' ? to : `${to}/${rest}`;
+}
+export function checkMove(fromFs, from, toFs, to) {
+    if (fromFs === toFs && from !== to && (from === '' || to.startsWith(`${from}/`)))
+        throw new InvalidArgument(`cannot move ${fromFs}:${from} into itself (${to})`, 'to');
+}
+/** The FileAclStore of `container`: the last one registered (OrmFileAclStore unless an app or a test adds one). */
+export async function fileAclStore(container) {
+    return (await container.resolve(FileAclStore));
+}
+//# sourceMappingURL=shared.js.map

package/lib/mjs/acl/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/acl/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1J,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,0GAA0G;AAE1G,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAItI,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAChD,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,YAAY,IAAI,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACnM,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAW,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAErF,0HAA0H;AAC1H,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAW,EAAE,UAAU,CAAC,CAAC;AAEjJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAU,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;AAEhH,kHAAkH;AAClH,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1J,MAAM,IAAI,eAAe,CAAC,oEAAoE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAkB;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1K,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAE1E,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,EAAU;IAClD,MAAM,OAAO,GAAI,WAAW,CAAC,GAAG,CAAmC,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClK,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAE5H,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAU;IAC9E,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,MAAM,IAAI,IAAI,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACzK,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAqB;IACtD,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAiB,CAAC;AACjE,CAAC"}

package/lib/mjs/acl/store.d.ts

@@ -0,0 +1,43 @@
+import type { AssignmentSubject, PrincipalRef } from '@spinajs/authz';
+/** One row of the file ACL: `subject` holds `relation` on `path` of `fs` and on everything under it (D7). */
+export interface FsAclRow {
+    readonly fs: string;
+    /** Normalised; '' is the filesystem root. */
+    readonly path: string;
+    /** A principal, `{ type, id: '*' }` for every principal of a type, or a subject set (D8). */
+    readonly subject: AssignmentSubject;
+    readonly relation: string;
+    readonly expiresAt?: Date;
+    /** principalKey of whoever granted the row. */
+    readonly grantedBy?: string;
+}
+/**
+ * The file ACL (fs middleware design §3.1). Paths are normalised without a base path ('' = the root); subject keys
+ * are authz-rbac `subjectKeyOf` keys. AuthzFsMiddleware keeps it in step with the files; system code may call it
+ * directly, apps go through FsAcl.
+ */
+export declare abstract class FileAclStore {
+    /** Whether a live row of `relation` at one of `paths` names one of `subjectKeys` at `at`. */
+    abstract holds(fs: string, paths: readonly string[], subjectKeys: readonly string[], relation: string, at: Date): Promise<boolean>;
+    /** The rows at exactly `path`, expired ones included. */
+    abstract list(fs: string, path: string): Promise<readonly FsAclRow[]>;
+    /** Idempotent on (fs, path, subject, relation): a second grant replaces `expiresAt` and `grantedBy`. */
+    abstract grant(row: FsAclRow): Promise<void>;
+    abstract revoke(fs: string, path: string, subjectKey: string, relation: string): Promise<void>;
+    /** The principal of the oldest `owner` row at exactly `path` (set and wildcard rows skipped); null without one. */
+    abstract ownerOf(fs: string, path: string): Promise<PrincipalRef | null>;
+    /** Adds an `owner` row for `owner` unless `path` has an owner row already (first writer wins). */
+    abstract setOwnerIfAbsent(fs: string, path: string, owner: PrincipalRef): Promise<void>;
+    /** The rows at `path` and under it; '' takes every row of the filesystem. */
+    abstract deleteTree(fs: string, path: string): Promise<void>;
+    /** The rows at exactly `path`. */
+    abstract deletePath(fs: string, path: string): Promise<void>;
+    /**
+     * Moves the rows at `from` and under it to `to` on `toFs`; a moved row replaces an equal one there. A row whose new
+     * path would be longer than FS_ACL_LIMITS.path is deleted.
+     */
+    abstract moveTree(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+    /** Moves the rows at exactly `from` (none under it) to `to` on `toFs`; a moved row replaces an equal one there. */
+    abstract movePath(fromFs: string, from: string, toFs: string, to: string): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/mjs/acl/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/acl/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtE,6GAA6G;AAC7G,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,8BAAsB,YAAY;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnI,yDAAyD;IACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IACtE,wGAAwG;IACxG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,mHAAmH;IACnH,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACzE,kGAAkG;IAClG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,kCAAkC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,mHAAmH;IACnH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1F"}

package/lib/mjs/acl/store.js

@@ -0,0 +1,8 @@
+/**
+ * The file ACL (fs middleware design §3.1). Paths are normalised without a base path ('' = the root); subject keys
+ * are authz-rbac `subjectKeyOf` keys. AuthzFsMiddleware keeps it in step with the files; system code may call it
+ * directly, apps go through FsAcl.
+ */
+export class FileAclStore {
+}
+//# sourceMappingURL=store.js.map

package/lib/mjs/acl/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/acl/store.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,MAAM,OAAgB,YAAY;CAuBjC"}

package/lib/mjs/adapter/index.d.ts

@@ -0,0 +1,33 @@
+import { ResourceAdapter } from '@spinajs/authz';
+import type { PermissionDef, RelationResolver, ResourceRef, ResourceType } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsPathKind, FsRow } from '../refs/index.js';
+export interface FsResourceTarget {
+    readonly fs: string;
+    readonly path: string;
+    /** Default: 'dir' for a row (load) of type 'dir', else 'file'. */
+    readonly kind?: FsPathKind;
+}
+/** Refs, ancestors, rows and permissions of the filesystems; registered in the root container. */
+export declare class FsResourceAdapter extends ResourceAdapter<FsResourceTarget> {
+    protected readonly container: IContainer;
+    readonly kind = "fs";
+    readonly types: readonly ResourceType[];
+    /** Where the published fs providers and the Configuration are looked up. */
+    constructor(container?: IContainer);
+    accepts(target: unknown): target is FsResourceTarget;
+    refOf(target: FsResourceTarget): ResourceRef;
+    /** Does not know which filesystems exist, so an fs name with no provider still gets a chain (it grants nothing). */
+    ancestors(ref: ResourceRef): Promise<readonly ResourceRef[] | null>;
+    /** The row AuthzFsMiddleware passes as the subject of every check, built without IO. */
+    load(ref: ResourceRef): Promise<FsRow | null>;
+    attribute(subject: unknown, field: string): unknown;
+    /**
+     * One FsAclRelation per fs type and `authz.fsAcl` relation: boot rule 8 needs a resolver for every relation a grant
+     * names, on every type of the permission, known at boot.
+     */
+    relations(): readonly RelationResolver[];
+    permissions(): readonly Omit<PermissionDef, 'source'>[];
+    protected basePathOf(fsName: string): string | undefined;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/adapter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapter/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAID,kGAAkG;AAClG,qBACa,iBAAkB,SAAQ,eAAe,CAAC,gBAAgB,CAAC;IAK1D,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU;IAJpD,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAqB;IAE5D,4EAA4E;IAC5E,YAA+B,SAAS,GAAE,UAA6B,EAEtE;IAED,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAMnD;IAED,KAAK,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAG3C;IAED,oHAAoH;IAC9G,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,GAAG,IAAI,CAAC,CAExE;IAED,wFAAwF;IAClF,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAElD;IAED,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;IAED;;;OAGG;IACH,SAAS,IAAI,SAAS,gBAAgB,EAAE,CAGvC;IAED,WAAW,IAAI,SAAS,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAEtD;IAGD,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGvD;CACF"}

package/lib/mjs/adapter/index.js

@@ -0,0 +1,73 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ResourceAdapter } from '@spinajs/authz';
+import { DI, Injectable } from '@spinajs/di';
+import { publishedFs } from '@spinajs/fs';
+import { fsAclConfig } from '../access-config/index.js';
+import { FsAclRelation } from '../acl/relation.js';
+import { FS_PERMISSIONS } from '../permissions/index.js';
+import { FS_RESOURCE_TYPES, fsAncestors, fsRef, fsRow, normalizeFsPath } from '../refs/index.js';
+const isKind = (v) => v === 'file' || v === 'dir';
+/** Refs, ancestors, rows and permissions of the filesystems; registered in the root container. */
+let FsResourceAdapter = class FsResourceAdapter extends ResourceAdapter {
+    /** Where the published fs providers and the Configuration are looked up. */
+    constructor(container = DI.RootContainer) {
+        super();
+        this.container = container;
+        this.kind = 'fs';
+        this.types = FS_RESOURCE_TYPES;
+    }
+    accepts(target) {
+        if (target === null || typeof target !== 'object')
+            return false;
+        const proto = Object.getPrototypeOf(target);
+        if (proto !== Object.prototype && proto !== null)
+            return false;
+        const t = target;
+        return typeof t.fs === 'string' && typeof t.path === 'string' && (t.kind === undefined || isKind(t.kind));
+    }
+    refOf(target) {
+        const type = target.type;
+        return fsRef(target.fs, normalizeFsPath(target.path, this.basePathOf(target.fs)), target.kind ?? (type === 'dir' ? 'dir' : 'file'));
+    }
+    /** Does not know which filesystems exist, so an fs name with no provider still gets a chain (it grants nothing). */
+    async ancestors(ref) {
+        return fsAncestors(ref);
+    }
+    /** The row AuthzFsMiddleware passes as the subject of every check, built without IO. */
+    async load(ref) {
+        return fsRow(ref);
+    }
+    attribute(subject, field) {
+        return subject !== null && typeof subject === 'object' && Object.hasOwn(subject, field) ? subject[field] : undefined;
+    }
+    /**
+     * One FsAclRelation per fs type and `authz.fsAcl` relation: boot rule 8 needs a resolver for every relation a grant
+     * names, on every type of the permission, known at boot.
+     */
+    relations() {
+        const { relations } = fsAclConfig(this.container);
+        return Object.freeze(FS_RESOURCE_TYPES.flatMap((type) => relations.map((relation) => new FsAclRelation(type, relation, this.container))));
+    }
+    permissions() {
+        return FS_PERMISSIONS;
+    }
+    // Read from the published provider, so refOf does no IO.
+    basePathOf(fsName) {
+        const basePath = publishedFs(fsName, this.container)?.BasePath;
+        return typeof basePath === 'string' && basePath !== '' ? basePath : undefined;
+    }
+};
+FsResourceAdapter = __decorate([
+    Injectable(ResourceAdapter),
+    __metadata("design:paramtypes", [Object])
+], FsResourceAdapter);
+export { FsResourceAdapter };
+//# sourceMappingURL=index.js.map