@spinajs/authz-http-admin 0.0.0-stage → 3.0.0

package/lib/cjs/controllers/AuthzAdminController.js

@@ -0,0 +1,549 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzAdminController = void 0;
+const authz_1 = require("@spinajs/authz");
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const http_1 = require("@spinajs/http");
+const authz_http_1 = require("@spinajs/authz-http");
+const util_1 = require("@spinajs/util");
+require("../schemas/provider.js");
+const decode_js_1 = require("../routes/decode.js");
+const query_js_1 = require("../routes/query.js");
+const status_js_1 = require("../routes/status.js");
+const PATCH_KEYS = ['tags', 'addTags', 'removeTags', 'expiresAt'];
+const PATCH_KINDS = { tags: 'assignment.setTags', addTags: 'assignment.addTags', removeTags: 'assignment.removeTags' };
+function respond(status, body) {
+    switch (status) {
+        case 200:
+            return new http_1.Ok(body);
+        case 403:
+            return new http_1.ForbiddenResponse(body);
+        case 404:
+            return new http_1.NotFound(body);
+        case 409:
+            return new http_1.Conflict(body);
+        default:
+            return new http_1.BadRequestResponse(body);
+    }
+}
+function refused(e) {
+    return respond((0, status_js_1.adminErrorStatus)(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
+}
+function badRequest(message, field) {
+    throw new authz_1.AuthzAdminFailure('invalid_request', message, field);
+}
+function objectBody(body, what) {
+    if (!(0, util_1.isPlainObject)(body))
+        badRequest(`the body must be ${what}`);
+    return body;
+}
+/** The body of PUT /authz/rules/:id or /authz/policies/:id with the path id; an id in the body must equal it. */
+function withPathId(body, id, what) {
+    const o = objectBody(body, what);
+    if (o.id !== undefined && o.id !== id)
+        badRequest(`the body id ${JSON.stringify(o.id)} is not the path id ${JSON.stringify(id)}`, 'id');
+    return { ...o, id };
+}
+const LINK_PATCH_KEYS = ['expiresAt', 'attributes', 'role', 'tags'];
+/** PATCH /authz/links/:id as one link.update; like the assignment patch, a key it does not serve is refused, not ignored. */
+function linkUpdate(body, id) {
+    const patch = withPathId(body, id, 'an object { expiresAt?, attributes?, role?, tags? }');
+    const unknown = Object.keys(patch).find((k) => k !== 'id' && !LINK_PATCH_KEYS.includes(k));
+    if (unknown !== undefined)
+        badRequest(`a link patch takes ${LINK_PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
+    if (!LINK_PATCH_KEYS.some((k) => k in patch))
+        badRequest(`a link patch needs one of ${LINK_PATCH_KEYS.join(', ')}`);
+    return (0, decode_js_1.decodeCommand)({ ...patch, kind: 'link.update' });
+}
+/** For answers that may hold a link token: no proxy or browser cache may keep one. Set first, so it goes out with any answer the route gives. */
+function noStore(req) {
+    req.res?.setHeader('Cache-Control', 'no-store');
+    req.res?.setHeader('Pragma', 'no-cache');
+}
+const query = (req) => (req.query ?? {});
+const param = (req, name) => req.params[name];
+const actorOf = (req) => req.storage.Principal;
+const scopeOf = (req) => ({ type: param(req, 'type'), id: param(req, 'id') });
+/**
+ * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
+ *
+ * The routes check authentication only: the actor is always the request principal, and every
+ * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
+ * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
+ * `{ results }`, one entry per command.
+ *
+ * @tags Authz admin
+ */
+let AuthzAdminController = class AuthzAdminController extends http_1.BaseController {
+    /** Runs a route on the domain's AuthzAdmin; an AuthzAdminFailure becomes its status with `{ error }`, anything else propagates. */
+    async guarded(fn) {
+        const admin = (await this.Domains.service(this.AdminDomain)).admin();
+        try {
+            return await fn(admin);
+        }
+        catch (e) {
+            if (e instanceof authz_1.AuthzAdminFailure)
+                return refused(e);
+            throw e;
+        }
+    }
+    /** One batch built from the route, with the options of the query string. */
+    single(req, build) {
+        return this.guarded(async (admin) => {
+            const opts = (0, query_js_1.readWriteOptions)(query(req));
+            return results(await admin.execute(actorOf(req), build(), opts));
+        });
+    }
+    list(req, build) {
+        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())));
+    }
+    /**
+     * Run a batch of commands
+     * Runs the commands in order in one transaction on the configured domain; the first failure rolls the batch back and its status is the answer.
+     * Body: { commands, reason?, idempotencyKey?, dryRun? } (schema AuthzAdminBatch); `commands` lists the command kinds of AuthzCommand, with dates as ISO 8601 strings. The options go in the body, not the query string.
+     * The result of a link.create carries the link token, shown once: every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token), and a retried or dry-run batch answers without the token.
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async commands(req) {
+        noStore(req);
+        return this.guarded(async (admin) => {
+            const body = objectBody(req.body, 'an object { commands, reason?, idempotencyKey?, dryRun? }');
+            const opts = {};
+            for (const key of ['reason', 'idempotencyKey', 'dryRun'])
+                if (key in body)
+                    opts[key] = body[key];
+            return results(await admin.execute(actorOf(req), (0, decode_js_1.decodeCommands)(body.commands), opts));
+        });
+    }
+    /**
+     * List assignments
+     * Lists assignments, filtered by the query.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listAssignments(req) {
+        return this.list(req, () => (0, query_js_1.readAssignmentsQuery)(query(req)));
+    }
+    /**
+     * List holders
+     * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
+     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of holders
+     * @response 400 {AuthzAdminError} invalid_query: a malformed or missing query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
+     */
+    async listHolders(req) {
+        return this.list(req, () => (0, query_js_1.readHoldersQuery)(query(req)));
+    }
+    /**
+     * Grant a role
+     * Grants a role to a subject at a scope (assignment.grant).
+     * Body: the fields of assignment.grant without `kind` (schema AuthzAssignmentGrant).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async grant(req) {
+        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ ...objectBody(req.body, 'the fields of assignment.grant'), kind: 'assignment.grant' })]);
+    }
+    /**
+     * Change an assignment
+     * Changes the tags or the expiry of an assignment.
+     * Body: { tags?, addTags?, removeTags?, expiresAt? } with at least one key (schema AuthzAssignmentPatch); the keys run as one batch.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchAssignment(req) {
+        return this.single(req, () => {
+            const body = objectBody(req.body, 'an object { tags?, addTags?, removeTags?, expiresAt? }');
+            const unknown = Object.keys(body).find((k) => !PATCH_KEYS.includes(k));
+            if (unknown !== undefined)
+                badRequest(`an assignment patch takes ${PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
+            const id = param(req, 'id');
+            const commands = [];
+            for (const key of ['tags', 'addTags', 'removeTags'])
+                if (key in body)
+                    commands.push({ kind: PATCH_KINDS[key], id, tags: body[key] });
+            if ('expiresAt' in body)
+                commands.push((0, decode_js_1.decodeCommand)({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
+            if (commands.length === 0)
+                badRequest(`an assignment patch needs one of ${PATCH_KEYS.join(', ')}`);
+            return commands;
+        });
+    }
+    /**
+     * Revoke an assignment
+     * Revokes the assignment with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async revoke(req) {
+        return this.single(req, () => [{ kind: 'assignment.revoke', id: param(req, 'id') }]);
+    }
+    /**
+     * List share links
+     * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listLinks(req) {
+        return this.list(req, () => (0, query_js_1.readPageQuery)('links', query(req)));
+    }
+    /**
+     * Create a share link
+     * Creates a share link that grants a role at a scope (link.create). The result carries the link id and its token: the token is shown once, here, and every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token). A dry run or a retried request (same idempotency key) answers without the token.
+     * Body: the fields of link.create without `kind` (schema AuthzLinkCreate).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} The link was created; results[0] holds its id and token
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async createLink(req) {
+        noStore(req);
+        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ ...objectBody(req.body, 'the fields of link.create'), kind: 'link.create' })]);
+    }
+    /**
+     * Change a share link
+     * Changes the expiry, attributes, role or tags of the link with the path id (link.update). The answer never carries the token.
+     * Body: { expiresAt?, attributes?, role?, tags? } with at least one key (schema AuthzLinkPatch); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchLink(req) {
+        return this.single(req, () => [linkUpdate(req.body, param(req, 'id'))]);
+    }
+    /**
+     * Revoke a share link
+     * Revokes the link with the path id and the role it grants (link.revoke); its token opens nothing from then on.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async revokeLink(req) {
+        return this.single(req, () => [{ kind: 'link.revoke', id: param(req, 'id') }]);
+    }
+    /**
+     * List rules
+     * Lists the RBAC rules held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listRules(req) {
+        return this.list(req, () => (0, query_js_1.readPageQuery)('rules', query(req)));
+    }
+    /**
+     * Put a rule
+     * Inserts or replaces the RBAC rule with the path id.
+     * Body: a rule (schema AuthzRuleBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async putRule(req) {
+        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ kind: 'rule.put', rule: withPathId(req.body, param(req, 'id'), 'a rule') })]);
+    }
+    /**
+     * Delete a rule
+     * Deletes the RBAC rule with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async deleteRule(req) {
+        return this.single(req, () => [{ kind: 'rule.delete', id: param(req, 'id') }]);
+    }
+    /**
+     * List policies
+     * Lists the ABAC policies held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listPolicies(req) {
+        return this.list(req, () => (0, query_js_1.readPageQuery)('policies', query(req)));
+    }
+    /**
+     * Put a policy
+     * Inserts or replaces the ABAC policy with the path id.
+     * Body: a policy (schema AuthzPolicyBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async putPolicy(req) {
+        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ kind: 'policy.put', policy: withPathId(req.body, param(req, 'id'), 'a policy') })]);
+    }
+    /**
+     * Delete a policy
+     * Deletes the ABAC policy with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async deletePolicy(req) {
+        return this.single(req, () => [{ kind: 'policy.delete', id: param(req, 'id') }]);
+    }
+    /**
+     * Read scope attributes
+     * Returns the attributes of the scope node `<type>:<id>`.
+     * @response 200 {AuthzAdminPage} items holds one entry, the attributes object of the scope; total is 1
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async attributes(req) {
+        return this.list(req, () => ({ kind: 'attributes', scope: scopeOf(req) }));
+    }
+    /**
+     * Merge scope attributes
+     * Deep-merges the body into the attributes of the scope node; null deletes a path.
+     * Body: an object (schema AuthzAttributesPatch).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchAttributes(req) {
+        return this.single(req, () => [{ kind: 'scope.setAttributes', scope: scopeOf(req), patch: req.body }]);
+    }
+    /**
+     * Replace scope attributes
+     * Replaces all attributes of the scope node with the body.
+     * Body: an object (schema AuthzAttributesBody).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async replaceAttributes(req) {
+        return this.single(req, () => [{ kind: 'scope.replaceAttributes', scope: scopeOf(req), attributes: req.body }]);
+    }
+};
+exports.AuthzAdminController = AuthzAdminController;
+__decorate([
+    (0, configuration_1.Config)('authz.http.admin.domain'),
+    __metadata("design:type", String)
+], AuthzAdminController.prototype, "AdminDomain", void 0);
+__decorate([
+    (0, di_1.Autoinject)(authz_1.AuthzDomains),
+    __metadata("design:type", authz_1.AuthzDomains)
+], AuthzAdminController.prototype, "Domains", void 0);
+__decorate([
+    (0, http_1.Post)('commands'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "commands", null);
+__decorate([
+    (0, http_1.Get)('assignments'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listAssignments", null);
+__decorate([
+    (0, http_1.Get)('holders'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listHolders", null);
+__decorate([
+    (0, http_1.Post)('assignments'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "grant", null);
+__decorate([
+    (0, http_1.Patch)('assignments/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchAssignment", null);
+__decorate([
+    (0, http_1.Del)('assignments/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "revoke", null);
+__decorate([
+    (0, http_1.Get)('links'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listLinks", null);
+__decorate([
+    (0, http_1.Post)('links'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "createLink", null);
+__decorate([
+    (0, http_1.Patch)('links/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchLink", null);
+__decorate([
+    (0, http_1.Del)('links/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "revokeLink", null);
+__decorate([
+    (0, http_1.Get)('rules'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listRules", null);
+__decorate([
+    (0, http_1.Put)('rules/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "putRule", null);
+__decorate([
+    (0, http_1.Del)('rules/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "deleteRule", null);
+__decorate([
+    (0, http_1.Get)('policies'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listPolicies", null);
+__decorate([
+    (0, http_1.Put)('policies/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "putPolicy", null);
+__decorate([
+    (0, http_1.Del)('policies/:id'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "deletePolicy", null);
+__decorate([
+    (0, http_1.Get)('scopes/:type/:id/attributes'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "attributes", null);
+__decorate([
+    (0, http_1.Patch)('scopes/:type/:id/attributes'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchAttributes", null);
+__decorate([
+    (0, http_1.Put)('scopes/:type/:id/attributes'),
+    __param(0, (0, http_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "replaceAttributes", null);
+exports.AuthzAdminController = AuthzAdminController = __decorate([
+    (0, http_1.Policy)(authz_http_1.IsAuthenticated),
+    (0, http_1.BasePath)('authz')
+], AuthzAdminController);
+function results(r) {
+    return respond((0, status_js_1.resultsStatus)(r), { results: r });
+}
+//# sourceMappingURL=AuthzAdminController.js.map

package/lib/cjs/controllers/AuthzAdminController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthzAdminController.js","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,0CAAiE;AACjE,0DAAgD;AAChD,oCAAyC;AAEzC,wCAAiK;AAEjK,oDAAsD;AACtD,wCAA8C;AAE9C,kCAAgC;AAChC,mDAAoE;AACpE,iDAA6G;AAE7G,mDAAsE;AAEtE,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAC3E,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,uBAAuB,EAAW,CAAC;AAEhI,SAAS,OAAO,CAAC,MAAc,EAAE,IAAa;IAC5C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,IAAI,wBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,GAAG;YACN,OAAO,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B;YACE,OAAO,IAAI,yBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAoB;IACnC,OAAO,OAAO,CAAC,IAAA,4BAAgB,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAAc;IACjD,MAAM,IAAI,yBAAiB,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,IAAY;IAC7C,IAAI,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC;QAAE,UAAU,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iHAAiH;AACjH,SAAS,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE;QAAE,UAAU,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxI,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE7E,6HAA6H;AAC7H,SAAS,UAAU,CAAC,IAAa,EAAE,EAAU;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,qDAAqD,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,OAAO,KAAK,SAAS;QAAE,UAAU,CAAC,sBAAsB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,UAAU,CAAC,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpH,OAAO,IAAA,yBAAa,EAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAiB,CAAC;AAC1E,CAAC;AAED,iJAAiJ;AACjJ,SAAS,OAAO,CAAC,GAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,GAAY,EAAc,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAe,CAAC;AAC5E,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC;AACjF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAU,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,GAAY,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAEpG;;;;;;;;;GASG;AAGI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAc;IAOtD,mIAAmI;IACzH,KAAK,CAAC,OAAO,CAAC,EAA4C;QAClE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,yBAAiB;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,4EAA4E;IAClE,MAAM,CAAC,GAAY,EAAE,KAA2B;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAES,IAAI,CAAC,GAAY,EAAE,KAA4B;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAQ,GAAY;QACvC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,2DAA2D,CAAC,CAAC;YAC/F,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU;gBAAE,IAAI,GAAG,IAAI,IAAI;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1G,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAA,0BAAc,EAAC,IAAI,CAAC,QAAQ,CAAmB,EAAE,IAAyB,CAAC,CAAC,CAAC;QAChI,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAoB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAQ,GAAY;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,2BAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,yBAAa,EAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,gCAAgC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAiB,CAAC,CAAC,CAAC;IAC1J,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,IAAI,OAAO,KAAK,SAAS;gBAAE,UAAU,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACrI,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAU;gBAAE,IAAI,GAAG,IAAI,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9I,IAAI,WAAW,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAA,yBAAa,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACvH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,UAAU,CAAC,oCAAoC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnG,OAAO,QAA0B,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,wBAAa,EAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,yBAAa,EAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAiB,CAAC,CAAC,CAAC;IAChJ,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,wBAAa,EAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,OAAO,CAAQ,GAAY;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,yBAAa,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAiB,CAAC,CAAC,CAAC;IAC/I,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,wBAAa,EAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,yBAAa,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAiB,CAAC,CAAC,CAAC;IACrJ,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,iBAAiB,CAAQ,GAAY;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClH,CAAC;CACF,CAAA;;AAxVW;IADT,IAAA,sBAAM,EAAC,yBAAyB,CAAC;;yDACJ;AAGpB;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACN,oBAAY;qDAAC;AAsCnB;IADZ,IAAA,WAAI,EAAC,UAAU,CAAC;IACM,WAAA,IAAA,UAAG,GAAE,CAAA;;;;oDAQ3B;AAYY;IADZ,IAAA,UAAG,EAAC,aAAa,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;2DAElC;AAYY;IADZ,IAAA,UAAG,EAAC,SAAS,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;uDAE9B;AAeY;IADZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACA,WAAA,IAAA,UAAG,GAAE,CAAA;;;;iDAExB;AAeY;IADZ,IAAA,YAAK,EAAC,iBAAiB,CAAC;IACK,WAAA,IAAA,UAAG,GAAE,CAAA;;;;2DAYlC;AAcY;IADZ,IAAA,UAAG,EAAC,iBAAiB,CAAC;IACF,WAAA,IAAA,UAAG,GAAE,CAAA;;;;kDAEzB;AAYY;IADZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;qDAE5B;AAeY;IADZ,IAAA,WAAI,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;sDAG7B;AAeY;IADZ,IAAA,YAAK,EAAC,WAAW,CAAC;IACK,WAAA,IAAA,UAAG,GAAE,CAAA;;;;qDAE5B;AAcY;IADZ,IAAA,UAAG,EAAC,WAAW,CAAC;IACQ,WAAA,IAAA,UAAG,GAAE,CAAA;;;;sDAE7B;AAYY;IADZ,IAAA,UAAG,EAAC,OAAO,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;qDAE5B;AAeY;IADZ,IAAA,UAAG,EAAC,WAAW,CAAC;IACK,WAAA,IAAA,UAAG,GAAE,CAAA;;;;mDAE1B;AAcY;IADZ,IAAA,UAAG,EAAC,WAAW,CAAC;IACQ,WAAA,IAAA,UAAG,GAAE,CAAA;;;;sDAE7B;AAYY;IADZ,IAAA,UAAG,EAAC,UAAU,CAAC;IACW,WAAA,IAAA,UAAG,GAAE,CAAA;;;;wDAE/B;AAeY;IADZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACI,WAAA,IAAA,UAAG,GAAE,CAAA;;;;qDAE5B;AAcY;IADZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACO,WAAA,IAAA,UAAG,GAAE,CAAA;;;;wDAE/B;AAWY;IADZ,IAAA,UAAG,EAAC,6BAA6B,CAAC;IACV,WAAA,IAAA,UAAG,GAAE,CAAA;;;;sDAE7B;AAeY;IADZ,IAAA,YAAK,EAAC,6BAA6B,CAAC;IACP,WAAA,IAAA,UAAG,GAAE,CAAA;;;;2DAElC;AAeY;IADZ,IAAA,UAAG,EAAC,6BAA6B,CAAC;IACH,WAAA,IAAA,UAAG,GAAE,CAAA;;;;6DAEpC;+BAzVU,oBAAoB;IAFhC,IAAA,aAAM,EAAC,4BAAe,CAAC;IACvB,IAAA,eAAQ,EAAC,OAAO,CAAC;GACL,oBAAoB,CA0VhC;AAED,SAAS,OAAO,CAAC,CAA6C;IAC5D,OAAO,OAAO,CAAC,IAAA,yBAAa,EAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/lib/cjs/index.d.ts

@@ -0,0 +1,4 @@
+export * from './controllers/AuthzAdminController.js';
+export * from './routes/index.js';
+export * from './schemas/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/lib/cjs/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./controllers/AuthzAdminController.js"), exports);
+__exportStar(require("./routes/index.js"), exports);
+__exportStar(require("./schemas/index.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wEAAsD;AACtD,oDAAkC;AAClC,qDAAmC"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/routes/decode.d.ts

@@ -0,0 +1,11 @@
+/** Date, time (seconds and fraction optional) and `Z` or an offset: the only strings read as a Date. */
+export declare const ISO_DATE_TIME: RegExp;
+/**
+ * A command as JSON carries its expiry dates as strings; this copy holds Dates at the known expiry
+ * paths. Anything else, including a string that is not an ISO date-time, stays as it came, so
+ * AuthzAdmin refuses it as it would refuse it in-process.
+ */
+export declare function decodeCommand(command: unknown): unknown;
+/** decodeCommand for each entry of a list; anything else goes through for AuthzAdmin to refuse. */
+export declare function decodeCommands(commands: unknown): unknown;
+//# sourceMappingURL=decode.d.ts.map

package/lib/cjs/routes/decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.d.ts","sourceRoot":"","sources":["../../../src/routes/decode.ts"],"names":[],"mappings":"AAEA,wGAAwG;AACxG,eAAO,MAAM,aAAa,QAAkG,CAAC;AA+B7H;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAMvD;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAEzD"}