@spinajs/authz-http-admin 0.0.0-stage → 3.0.0

package/lib/cjs/routes/decode.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISO_DATE_TIME = void 0;
+exports.decodeCommand = decodeCommand;
+exports.decodeCommands = decodeCommands;
+const util_1 = require("@spinajs/util");
+/** Date, time (seconds and fraction optional) and `Z` or an offset: the only strings read as a Date. */
+exports.ISO_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,9})?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
+// Date rolls 2027-02-30 over to 2 March instead of refusing it.
+function realFields(m) {
+    const [y, mo, d, h, mi, s, oh, om] = m.slice(1).map((x) => Number(x ?? 0));
+    const day = new Date(Date.UTC(y, mo - 1, d));
+    return day.getUTCFullYear() === y && day.getUTCMonth() === mo - 1 && day.getUTCDate() === d && h < 24 && mi < 60 && s < 60 && oh < 24 && om < 60;
+}
+/** Command kinds whose top-level `expiresAt`, or `expiresAt` inside one nested object, is a Date. */
+const DATE_PATHS = {
+    'assignment.grant': null,
+    'assignment.setExpiry': null,
+    'set.addMember': null,
+    'link.create': null,
+    'link.update': null,
+    'rule.put': 'rule',
+    'policy.put': 'policy',
+};
+function toDate(v) {
+    const m = typeof v === 'string' ? exports.ISO_DATE_TIME.exec(v) : null;
+    if (!m || !realFields(m))
+        return v;
+    const at = new Date(v);
+    return Number.isNaN(at.getTime()) ? v : at;
+}
+function withDate(o) {
+    return 'expiresAt' in o ? { ...o, expiresAt: toDate(o.expiresAt) } : o;
+}
+/**
+ * A command as JSON carries its expiry dates as strings; this copy holds Dates at the known expiry
+ * paths. Anything else, including a string that is not an ISO date-time, stays as it came, so
+ * AuthzAdmin refuses it as it would refuse it in-process.
+ */
+function decodeCommand(command) {
+    if (!(0, util_1.isPlainObject)(command) || typeof command.kind !== 'string' || !Object.hasOwn(DATE_PATHS, command.kind))
+        return command;
+    const nested = DATE_PATHS[command.kind];
+    if (nested === null)
+        return withDate(command);
+    const inner = command[nested];
+    return (0, util_1.isPlainObject)(inner) ? { ...command, [nested]: withDate(inner) } : command;
+}
+/** decodeCommand for each entry of a list; anything else goes through for AuthzAdmin to refuse. */
+function decodeCommands(commands) {
+    return Array.isArray(commands) ? commands.map(decodeCommand) : commands;
+}
+//# sourceMappingURL=decode.js.map

package/lib/cjs/routes/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../../src/routes/decode.ts"],"names":[],"mappings":";;;;;AAAA,wCAA8C;AAE9C,wGAAwG;AAC3F,QAAA,aAAa,GAAG,+FAA+F,CAAC;AAE7H,gEAAgE;AAChE,SAAS,UAAU,CAAC,CAAkB;IACpC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,GAA4C;IAC1D,kBAAkB,EAAE,IAAI;IACxB,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,QAAQ;CACvB,CAAC;AAEF,SAAS,MAAM,CAAC,CAAU;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAA,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAW,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B;IAC1C,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,uBAA8B,OAAgB;IAC5C,IAAI,CAAC,IAAA,oBAAa,EAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5H,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,wBAA+B,QAAiB;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1E,CAAC"}

package/lib/cjs/routes/index.d.ts

@@ -0,0 +1,4 @@
+export * from './decode.js';
+export * from './query.js';
+export * from './status.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/cjs/routes/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./decode.js"), exports);
+__exportStar(require("./query.js"), exports);
+__exportStar(require("./status.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,6CAA2B;AAC3B,8CAA4B"}

package/lib/cjs/routes/query.d.ts

@@ -0,0 +1,16 @@
+import type { AssignmentSubject, AuthzAdminOptions, AuthzAdminQuery, ResourceRef } from '@spinajs/authz';
+/** A parsed query string (express: string, string[] or a nested object per key). */
+export type QueryInput = Readonly<Record<string, unknown>>;
+/** `<type>` or `<type>:<id>`, split at the first `:` (ids may hold more); `$global` is GLOBAL. */
+export declare function parseResourceRef(value: string, field: string): ResourceRef;
+/** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
+export declare function parseAssignmentSubject(value: string, field?: string): AssignmentSubject;
+/** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset`. */
+export declare function readAssignmentsQuery(q: QueryInput): AuthzAdminQuery;
+/** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset`. */
+export declare function readHoldersQuery(q: QueryInput): AuthzAdminQuery;
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset`. */
+export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: QueryInput): AuthzAdminQuery;
+/** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
+export declare function readWriteOptions(q: QueryInput): AuthzAdminOptions;
+//# sourceMappingURL=query.d.ts.map

package/lib/cjs/routes/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEzG,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAe3D,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AA6BD,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAYnE;AAED,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAa/D;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,eAAe,CAElG;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,iBAAiB,CASjE"}

package/lib/cjs/routes/query.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseResourceRef = parseResourceRef;
+exports.parseAssignmentSubject = parseAssignmentSubject;
+exports.readAssignmentsQuery = readAssignmentsQuery;
+exports.readHoldersQuery = readHoldersQuery;
+exports.readPageQuery = readPageQuery;
+exports.readWriteOptions = readWriteOptions;
+const authz_1 = require("@spinajs/authz");
+function invalid(field, message) {
+    throw new authz_1.AuthzAdminFailure('invalid_query', message, field);
+}
+function text(q, field) {
+    const v = q[field];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== 'string')
+        invalid(field, `${field} must be given once, as text`);
+    return v;
+}
+/** `<type>` or `<type>:<id>`, split at the first `:` (ids may hold more); `$global` is GLOBAL. */
+function parseResourceRef(value, field) {
+    if (value === authz_1.GLOBAL.type)
+        return authz_1.GLOBAL;
+    const at = value.indexOf(':');
+    const type = at < 0 ? value : value.slice(0, at);
+    if (type === '')
+        invalid(field, `${field} must be <type> or <type>:<id>, got ${JSON.stringify(value)}`);
+    if (at < 0)
+        return { type };
+    const id = value.slice(at + 1);
+    if (id === '')
+        invalid(field, `${field} must be <type> or <type>:<id>, got ${JSON.stringify(value)}`);
+    return { type, id };
+}
+/** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
+function parseAssignmentSubject(value, field = 'subject') {
+    const bad = () => invalid(field, `${field} must be <type>:<id> or set:<role>@<type>:<id>, got ${JSON.stringify(value)}`);
+    if (value.startsWith('set:')) {
+        const rest = value.slice('set:'.length);
+        const at = rest.indexOf('@');
+        if (at <= 0)
+            return bad();
+        const scope = rest.slice(at + 1);
+        if (scope === '' || scope.endsWith(':'))
+            return bad();
+        return { set: { role: rest.slice(0, at), scope: parseResourceRef(scope, field) } };
+    }
+    const at = value.indexOf(':');
+    if (at <= 0 || at === value.length - 1)
+        return bad();
+    return { type: value.slice(0, at), id: value.slice(at + 1) };
+}
+function flag(q, field) {
+    const v = text(q, field);
+    if (v === undefined)
+        return undefined;
+    if (v !== 'true' && v !== 'false')
+        invalid(field, `${field} must be true or false`);
+    return v === 'true';
+}
+function count(q, field) {
+    const v = text(q, field);
+    if (v === undefined)
+        return undefined;
+    if (!/^\d+$/.test(v))
+        invalid(field, `${field} must be a non-negative integer`);
+    return Number(v);
+}
+/** `limit` and `offset` as AuthzAdmin's page, only the ones given; AuthzAdmin defaults the rest. */
+function page(q) {
+    const limit = count(q, 'limit');
+    const offset = count(q, 'offset');
+    if (limit === undefined && offset === undefined)
+        return {};
+    return { page: { ...(limit === undefined ? {} : { limit }), ...(offset === undefined ? {} : { offset }) } };
+}
+function scope(q) {
+    const v = text(q, 'scope');
+    return v === undefined ? {} : { scope: parseResourceRef(v, 'scope') };
+}
+/** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset`. */
+function readAssignmentsQuery(q) {
+    const subject = text(q, 'subject');
+    const role = text(q, 'role');
+    const includeExpired = flag(q, 'includeExpired');
+    return {
+        kind: 'assignments',
+        ...scope(q),
+        ...(subject === undefined ? {} : { subject: parseAssignmentSubject(subject) }),
+        ...(role === undefined ? {} : { role }),
+        ...(includeExpired === undefined ? {} : { includeExpired }),
+        ...page(q),
+    };
+}
+/** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset`. */
+function readHoldersQuery(q) {
+    const scope = text(q, 'scope');
+    const permission = text(q, 'permission');
+    if (scope === undefined)
+        invalid('scope', 'scope is required');
+    if (permission === undefined || permission === '')
+        invalid('permission', 'permission is required');
+    const expandSets = flag(q, 'expandSets');
+    return {
+        kind: 'holders',
+        scope: parseResourceRef(scope, 'scope'),
+        permission,
+        ...(expandSets === undefined ? {} : { expandSets }),
+        ...page(q),
+    };
+}
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset`. */
+function readPageQuery(kind, q) {
+    return { kind, ...scope(q), ...page(q) };
+}
+/** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
+function readWriteOptions(q) {
+    const reason = text(q, 'reason');
+    const idempotencyKey = text(q, 'idempotencyKey');
+    const dryRun = flag(q, 'dryRun');
+    return {
+        ...(reason === undefined ? {} : { reason }),
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        ...(dryRun === undefined ? {} : { dryRun }),
+    };
+}
+//# sourceMappingURL=query.js.map

package/lib/cjs/routes/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":";;;;;;;;AAAA,0CAA2D;AAQ3D,SAAS,OAAO,CAAC,KAAa,EAAE,OAAe;IAC7C,MAAM,IAAI,yBAAiB,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,CAAa,EAAE,KAAa;IACxC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAClG,0BAAiC,KAAa,EAAE,KAAa;IAC3D,IAAI,KAAK,KAAK,cAAM,CAAC,IAAI;QAAE,OAAO,cAAM,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,gCAAuC,KAAa,EAAE,KAAK,GAAG,SAAS;IACrE,MAAM,GAAG,GAAG,GAAU,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChI,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,CAAa,EAAE,KAAa;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,CAAa,EAAE,KAAa;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,SAAS,IAAI,CAAC,CAAa;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,KAAK,CAAC,CAAa;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,8BAAqC,CAAa;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,GAAG,KAAK,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC,CAAC;KACQ,CAAC;AACvB,CAAC;AAED,qGAAqG;AACrG,0BAAiC,CAAa;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;QACvC,UAAU;QACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,IAAI,CAAC,CAAC,CAAC;KACQ,CAAC;AACvB,CAAC;AAED,sFAAsF;AACtF,uBAA8B,IAAoC,EAAE,CAAa;IAC/E,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAqB,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,0BAAiC,CAAa;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/lib/cjs/routes/status.d.ts

@@ -0,0 +1,6 @@
+import type { AuthzCommandResult } from '@spinajs/authz';
+/** The HTTP status of an AuthzAdminError code: refusals 403, not_found 404, conflict 409, the rest (validation) 400. */
+export declare function adminErrorStatus(code: string): number;
+/** 200 when every command succeeded, else the status of the failed one (a batch reports its first failure). */
+export declare function resultsStatus(results: readonly AuthzCommandResult[]): number;
+//# sourceMappingURL=status.d.ts.map

package/lib/cjs/routes/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/routes/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIzD,wHAAwH;AACxH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAG5E"}

package/lib/cjs/routes/status.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminErrorStatus = adminErrorStatus;
+exports.resultsStatus = resultsStatus;
+const REFUSED = new Set(['forbidden', 'escalation', 'last_holder', 'self_lockout', 'protected_role']);
+/** The HTTP status of an AuthzAdminError code: refusals 403, not_found 404, conflict 409, the rest (validation) 400. */
+function adminErrorStatus(code) {
+    if (REFUSED.has(code))
+        return 403;
+    if (code === 'not_found')
+        return 404;
+    if (code === 'conflict')
+        return 409;
+    return 400;
+}
+/** 200 when every command succeeded, else the status of the failed one (a batch reports its first failure). */
+function resultsStatus(results) {
+    const failed = results.find((r) => !r.ok);
+    return failed && !failed.ok ? adminErrorStatus(failed.error.code) : 200;
+}
+//# sourceMappingURL=status.js.map

package/lib/cjs/routes/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/routes/status.ts"],"names":[],"mappings":";;;;AAEA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEtG,wHAAwH;AACxH,0BAAiC,IAAY;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,uBAA8B,OAAsC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1E,CAAC"}

package/lib/cjs/schemas/bodies.d.ts

@@ -0,0 +1,16 @@
+import type { JsonSchema } from './primitives.js';
+export declare const AuthzAdminBatch: JsonSchema;
+export declare const AuthzAssignmentGrant: JsonSchema;
+export declare const AuthzAssignmentPatch: JsonSchema;
+export declare const AuthzLinkCreate: JsonSchema;
+export declare const AuthzLinkPatch: JsonSchema;
+export declare const AuthzRuleBody: JsonSchema;
+export declare const AuthzPolicyBody: JsonSchema;
+export declare const AuthzAttributesPatch: JsonSchema;
+export declare const AuthzAttributesBody: JsonSchema;
+export declare const AuthzAdminError: JsonSchema;
+export declare const AuthzCommandResult: JsonSchema;
+export declare const AuthzAdminResults: JsonSchema;
+export declare const AuthzAdminPage: JsonSchema;
+export declare const AuthzAdminAttributes: JsonSchema;
+//# sourceMappingURL=bodies.d.ts.map

package/lib/cjs/schemas/bodies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodies.d.ts","sourceRoot":"","sources":["../../../src/schemas/bodies.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAWlD,eAAO,MAAM,eAAe,EAAE,UAAiO,CAAC;AAEhQ,eAAO,MAAM,oBAAoB,EAAE,UAA2S,CAAC;AAE/U,eAAO,MAAM,oBAAoB,EAAE,UAIlC,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAA4T,CAAC;AAE3V,eAAO,MAAM,cAAc,EAAE,UAI5B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAA4H,CAAC;AACzJ,eAAO,MAAM,eAAe,EAAE,UAA2I,CAAC;AAC1K,eAAO,MAAM,oBAAoB,EAAE,UAAyH,CAAC;AAC7J,eAAO,MAAM,mBAAmB,EAAE,UAA+G,CAAC;AAIlJ,eAAO,MAAM,eAAe,EAAE,UAA+Z,CAAC;AAM9b,eAAO,MAAM,kBAAkB,EAAE,UAA4E,CAAC;AAE9G,eAAO,MAAM,iBAAiB,EAAE,UAAyR,CAAC;AAE1T,eAAO,MAAM,cAAc,EAAE,UAA0L,CAAC;AAExN,eAAO,MAAM,oBAAoB,EAAE,UAAuE,CAAC"}

package/lib/cjs/schemas/bodies.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzAdminAttributes = exports.AuthzAdminPage = exports.AuthzAdminResults = exports.AuthzCommandResult = exports.AuthzAdminError = exports.AuthzAttributesBody = exports.AuthzAttributesPatch = exports.AuthzPolicyBody = exports.AuthzRuleBody = exports.AuthzLinkPatch = exports.AuthzLinkCreate = exports.AuthzAssignmentPatch = exports.AuthzAssignmentGrant = exports.AuthzAdminBatch = void 0;
+const commands_js_1 = require("./commands.js");
+const primitives_js_1 = require("./primitives.js");
+const { id: _ruleId, ...ruleFields } = commands_js_1.ruleBody.properties;
+const { id: _policyId, ...policyFields } = commands_js_1.policyBody.properties;
+const writeOptions = {
+    reason: { ...primitives_js_1.text, description: 'goes to the audit trail' },
+    idempotencyKey: { ...primitives_js_1.text, description: 'a retried batch with the same key returns the first result' },
+    dryRun: { type: 'boolean', description: 'validate and guard, then roll back' },
+};
+exports.AuthzAdminBatch = (0, primitives_js_1.obj)(['commands'], { commands: { type: 'array', items: { oneOf: commands_js_1.commandSchemas } }, ...writeOptions }, 'POST /authz/commands: the commands run in one transaction, in order; the first failure rolls the batch back');
+exports.AuthzAssignmentGrant = (0, primitives_js_1.obj)(['subject', 'role', 'scope'], { subject: primitives_js_1.assignmentSubject, role: primitives_js_1.text, scope: primitives_js_1.resourceRef, tags: primitives_js_1.tags, expiresAt: primitives_js_1.nullableDateTime, replaceLadder: { type: 'boolean' } }, 'POST /authz/assignments: the fields of assignment.grant (reason, idempotencyKey and dryRun go in the query string)');
+exports.AuthzAssignmentPatch = {
+    ...(0, primitives_js_1.obj)([], { tags: { ...primitives_js_1.tags, description: 'replaces the tags' }, addTags: primitives_js_1.tags, removeTags: primitives_js_1.tags, expiresAt: primitives_js_1.nullableDateTime }, 'PATCH /authz/assignments/{id}: at least one key; the keys run as assignment.setTags, addTags, removeTags and setExpiry in one batch'),
+    additionalProperties: false,
+    anyOf: ['tags', 'addTags', 'removeTags', 'expiresAt'].map((k) => ({ required: [k] })),
+};
+exports.AuthzLinkCreate = (0, primitives_js_1.obj)(['scope', 'role'], { scope: primitives_js_1.resourceRef, role: primitives_js_1.text, tags: primitives_js_1.tags, expiresAt: primitives_js_1.nullableDateTime, attributes: primitives_js_1.anyObject }, 'POST /authz/links: the fields of link.create; the answer carries the token, shown once and sent with Cache-Control: no-store (reason, idempotencyKey and dryRun go in the query string)');
+exports.AuthzLinkPatch = {
+    ...(0, primitives_js_1.obj)([], { id: { ...primitives_js_1.text, description: 'optional; must equal the path id' }, expiresAt: primitives_js_1.nullableDateTime, attributes: primitives_js_1.anyObject, role: primitives_js_1.text, tags: { ...primitives_js_1.tags, description: 'replaces the tags of the role the link grants' } }, 'PATCH /authz/links/{id}: at least one of expiresAt, attributes, role, tags; runs as one link.update'),
+    additionalProperties: false,
+    anyOf: ['expiresAt', 'attributes', 'role', 'tags'].map((k) => ({ required: [k] })),
+};
+exports.AuthzRuleBody = (0, primitives_js_1.obj)(['kind', 'scope'], ruleFields, 'PUT /authz/rules/{id}: a rule; an `id` in the body must equal the path id');
+exports.AuthzPolicyBody = (0, primitives_js_1.obj)(['effect', 'permissions'], policyFields, 'PUT /authz/policies/{id}: a policy; an `id` in the body must equal the path id');
+exports.AuthzAttributesPatch = { ...primitives_js_1.anyObject, description: 'PATCH /authz/scopes/{type}/{id}/attributes: deep merge; null deletes a path' };
+exports.AuthzAttributesBody = { ...primitives_js_1.anyObject, description: 'PUT /authz/scopes/{type}/{id}/attributes: replaces all attributes' };
+const errorShape = (0, primitives_js_1.obj)(['code', 'message'], { code: primitives_js_1.text, message: primitives_js_1.text, field: { ...primitives_js_1.text, description: 'the offending field, when one is known' } });
+exports.AuthzAdminError = (0, primitives_js_1.obj)(['error'], { error: errorShape }, 'The body of a refused request. Codes: invalid_request, invalid_query, invalid_batch, invalid_command, unknown_role, not_assignable, wrong_scope_type, unknown_ladder, unknown_permission, rule_not_compilable, invalid_attributes, set_cycle, set_too_deep (400); forbidden, escalation, last_holder, self_lockout, protected_role (403); not_found (404); conflict (409)');
+const commandResult = {
+    oneOf: [(0, primitives_js_1.obj)(['ok', 'kind', 'affected'], { ok: { type: 'boolean', enum: [true] }, kind: primitives_js_1.text, id: primitives_js_1.text, token: { ...primitives_js_1.text, description: 'link.create only, shown once' }, affected: { type: 'integer' } }), (0, primitives_js_1.obj)(['ok', 'kind', 'error'], { ok: { type: 'boolean', enum: [false] }, kind: primitives_js_1.text, error: errorShape })],
+};
+exports.AuthzCommandResult = { ...commandResult, description: 'The outcome of one command' };
+exports.AuthzAdminResults = (0, primitives_js_1.obj)(['results'], { results: { type: 'array', items: commandResult, description: 'one per command, in order; the first failure ends the list' } }, 'The answer of a write route: 200 when every command succeeded, else the status of the first failure, with the same body');
+exports.AuthzAdminPage = (0, primitives_js_1.obj)(['items', 'total'], { items: { type: 'array', items: primitives_js_1.anyObject }, total: { type: 'integer', description: 'rows matching before paging' } }, 'The answer of a list route');
+exports.AuthzAdminAttributes = { ...primitives_js_1.anyObject, description: 'The attributes of a scope' };
+//# sourceMappingURL=bodies.js.map

package/lib/cjs/schemas/bodies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodies.js","sourceRoot":"","sources":["../../../src/schemas/bodies.ts"],"names":[],"mappings":";;;AAAA,+CAAqE;AACrE,mDAA+G;AAG/G,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,sBAAQ,CAAC,UAAwC,CAAC;AACzF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,wBAAU,CAAC,UAAwC,CAAC;AAE/F,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC3D,cAAc,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACtG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE;CAC/E,CAAC;AAEW,QAAA,eAAe,GAAe,IAAA,mBAAG,EAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,4BAAc,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,6GAA6G,CAAC,CAAC;AAEnP,QAAA,oBAAoB,GAAe,IAAA,mBAAG,EAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,iCAAiB,EAAE,IAAI,EAAE,oBAAI,EAAE,KAAK,EAAE,2BAAW,EAAE,IAAI,EAAJ,oBAAI,EAAE,SAAS,EAAE,gCAAgB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,oHAAoH,CAAC,CAAC;AAElU,QAAA,oBAAoB,GAAe;IAC9C,GAAG,IAAA,mBAAG,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,oBAAI,EAAE,UAAU,EAAE,oBAAI,EAAE,SAAS,EAAE,gCAAgB,EAAE,EAAE,qIAAqI,CAAC;IACxQ,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CACtF,CAAC;AAEW,QAAA,eAAe,GAAe,IAAA,mBAAG,EAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,IAAI,EAAE,oBAAI,EAAE,IAAI,EAAJ,oBAAI,EAAE,SAAS,EAAE,gCAAgB,EAAE,UAAU,EAAE,yBAAS,EAAE,EAAE,yLAAyL,CAAC,CAAC;AAE9U,QAAA,cAAc,GAAe;IACxC,GAAG,IAAA,mBAAG,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,SAAS,EAAE,gCAAgB,EAAE,UAAU,EAAE,yBAAS,EAAE,IAAI,EAAE,oBAAI,EAAE,IAAI,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,+CAA+C,EAAE,EAAE,EAAE,qGAAqG,CAAC;IACxU,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF,CAAC;AAEW,QAAA,aAAa,GAAe,IAAA,mBAAG,EAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,2EAA2E,CAAC,CAAC;AAC5I,QAAA,eAAe,GAAe,IAAA,mBAAG,EAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,gFAAgF,CAAC,CAAC;AAC7J,QAAA,oBAAoB,GAAe,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,6EAA6E,EAAE,CAAC;AAChJ,QAAA,mBAAmB,GAAe,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;AAElJ,MAAM,UAAU,GAAG,IAAA,mBAAG,EAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAI,EAAE,OAAO,EAAE,oBAAI,EAAE,KAAK,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAC;AAEzI,QAAA,eAAe,GAAe,IAAA,mBAAG,EAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,2WAA2W,CAAC,CAAC;AAE9b,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,CAAC,IAAA,mBAAG,EAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAI,EAAE,EAAE,EAAE,oBAAI,EAAE,KAAK,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,IAAA,mBAAG,EAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;CACnT,CAAC;AAEW,QAAA,kBAAkB,GAAe,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;AAEjG,QAAA,iBAAiB,GAAe,IAAA,mBAAG,EAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,4DAA4D,EAAE,EAAE,EAAE,yHAAyH,CAAC,CAAC;AAE7S,QAAA,cAAc,GAAe,IAAA,mBAAG,EAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAE3M,QAAA,oBAAoB,GAAe,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC"}

package/lib/cjs/schemas/commands.d.ts

@@ -0,0 +1,9 @@
+import type { JsonSchema } from './primitives.js';
+/** A rule as `rule.put` takes it; the condition language is described by @spinajs/authz. */
+export declare const ruleBody: JsonSchema;
+/** A policy as `policy.put` takes it. */
+export declare const policyBody: JsonSchema;
+/** The command kinds of AuthzCommand (packages/authz/src/contracts/admin.ts), in declaration order. */
+export declare const COMMAND_KINDS: readonly ['assignment.grant', 'assignment.revoke', 'assignment.revokeWhere', 'assignment.setTags', 'assignment.addTags', 'assignment.removeTags', 'assignment.setExpiry', 'set.addMember', 'set.removeMember', 'link.create', 'link.update', 'link.revoke', 'rule.put', 'rule.delete', 'policy.put', 'policy.delete', 'scope.setAttributes', 'scope.replaceAttributes', 'scope.forget'];
+export declare const commandSchemas: readonly JsonSchema[];
+//# sourceMappingURL=commands.d.ts.map

package/lib/cjs/schemas/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/schemas/commands.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD,4FAA4F;AAC5F,eAAO,MAAM,QAAQ,EAAE,UAsBtB,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,UAAU,EAAE,UAiBxB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,aAAa,YAAI,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,cAAc,CAAU,CAAC;AAErZ,eAAO,MAAM,cAAc,EAAE,SAAS,UAAU,EAoB/C,CAAC"}

package/lib/cjs/schemas/commands.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSchemas = exports.COMMAND_KINDS = exports.policyBody = exports.ruleBody = void 0;
+const primitives_js_1 = require("./primitives.js");
+const idOnly = { id: { ...primitives_js_1.text, description: 'the id of the row' } };
+/** A rule as `rule.put` takes it; the condition language is described by @spinajs/authz. */
+exports.ruleBody = (0, primitives_js_1.obj)(['id', 'kind', 'scope'], {
+    id: primitives_js_1.text,
+    kind: { type: 'string', enum: ['restrict', 'cap', 'threshold'] },
+    scope: primitives_js_1.resourceRef,
+    resourceTypes: { type: 'array', items: primitives_js_1.text },
+    subjects: { ...primitives_js_1.anyObject, description: 'SubjectSelector: principalTypes, actorTypes, refs, rank, when' },
+    when: { ...primitives_js_1.anyObject, description: 'a Condition' },
+    expiresAt: primitives_js_1.nullableDateTime,
+    allow: { type: 'array', items: primitives_js_1.assignmentSubject },
+    ladder: primitives_js_1.text,
+    maxRole: { description: 'a role id, { ref } or null (drops the assignment)', nullable: true, oneOf: [primitives_js_1.text, primitives_js_1.anyObject] },
+    stripTags: { type: 'boolean' },
+    assignments: primitives_js_1.anyObject,
+    permissions: { type: 'array', items: primitives_js_1.text },
+    resource: { ...primitives_js_1.anyObject, description: 'a Condition on the resource' },
+    minRole: { description: 'a role id or { ref }', oneOf: [primitives_js_1.text, primitives_js_1.anyObject] },
+    at: primitives_js_1.text,
+    reason: { ...primitives_js_1.anyObject, description: 'DenyReason: code, payload, priority, sortKey' },
+}, 'A RBAC rule in SQL form; the server sets `source`');
+/** A policy as `policy.put` takes it. */
+exports.policyBody = (0, primitives_js_1.obj)(['id', 'effect', 'permissions'], {
+    id: primitives_js_1.text,
+    effect: { type: 'string', enum: ['permit', 'deny'] },
+    permissions: { type: 'array', items: primitives_js_1.text, description: 'permission globs' },
+    resourceTypes: { type: 'array', items: primitives_js_1.text },
+    principalTypes: { type: 'array', items: primitives_js_1.text },
+    actorTypes: { type: 'array', items: primitives_js_1.text },
+    scope: primitives_js_1.resourceRef,
+    when: { ...primitives_js_1.anyObject, description: 'a Condition' },
+    fields: { ...primitives_js_1.anyObject, description: 'a FieldSet' },
+    reason: primitives_js_1.text,
+    priority: { type: 'integer', description: 'default 500' },
+    expiresAt: primitives_js_1.nullableDateTime,
+}, 'An ABAC policy; the server sets `source`');
+/** The command kinds of AuthzCommand (packages/authz/src/contracts/admin.ts), in declaration order. */
+exports.COMMAND_KINDS = ['assignment.grant', 'assignment.revoke', 'assignment.revokeWhere', 'assignment.setTags', 'assignment.addTags', 'assignment.removeTags', 'assignment.setExpiry', 'set.addMember', 'set.removeMember', 'link.create', 'link.update', 'link.revoke', 'rule.put', 'rule.delete', 'policy.put', 'policy.delete', 'scope.setAttributes', 'scope.replaceAttributes', 'scope.forget'];
+exports.commandSchemas = [
+    (0, primitives_js_1.command)('assignment.grant', ['subject', 'role', 'scope'], { subject: primitives_js_1.assignmentSubject, role: primitives_js_1.text, scope: primitives_js_1.resourceRef, tags: primitives_js_1.tags, expiresAt: primitives_js_1.nullableDateTime, replaceLadder: { type: 'boolean', description: "revoke the subject's other roles of the same ladder at this scope" } }, 'Grants a role to a subject at a scope'),
+    (0, primitives_js_1.command)('assignment.revoke', ['id'], idOnly, 'Revokes one assignment'),
+    (0, primitives_js_1.command)('assignment.revokeWhere', ['scope'], { scope: primitives_js_1.resourceRef, subject: primitives_js_1.assignmentSubject, role: primitives_js_1.text }, 'Revokes the assignments at a scope, narrowed by subject and role'),
+    (0, primitives_js_1.command)('assignment.setTags', ['id', 'tags'], { ...idOnly, tags: primitives_js_1.tags }, 'Replaces the tags of an assignment'),
+    (0, primitives_js_1.command)('assignment.addTags', ['id', 'tags'], { ...idOnly, tags: primitives_js_1.tags }, 'Adds tags to an assignment'),
+    (0, primitives_js_1.command)('assignment.removeTags', ['id', 'tags'], { ...idOnly, tags: primitives_js_1.tags }, 'Removes tags from an assignment'),
+    (0, primitives_js_1.command)('assignment.setExpiry', ['id', 'expiresAt'], { ...idOnly, expiresAt: primitives_js_1.nullableDateTime }, 'Sets or clears the expiry of an assignment'),
+    (0, primitives_js_1.command)('set.addMember', ['set', 'member'], { set: primitives_js_1.roleSet, member: primitives_js_1.principalRef, expiresAt: primitives_js_1.nullableDateTime }, 'Adds a principal to a subject set (group.member at group:G)'),
+    (0, primitives_js_1.command)('set.removeMember', ['set', 'member'], { set: primitives_js_1.roleSet, member: primitives_js_1.principalRef }, 'Removes a principal from a subject set'),
+    (0, primitives_js_1.command)('link.create', ['scope', 'role'], { scope: primitives_js_1.resourceRef, role: primitives_js_1.text, tags: primitives_js_1.tags, expiresAt: primitives_js_1.nullableDateTime, attributes: primitives_js_1.anyObject }, 'Creates a share link; the answer carries its token, shown once'),
+    (0, primitives_js_1.command)('link.update', ['id'], { ...idOnly, expiresAt: primitives_js_1.nullableDateTime, attributes: primitives_js_1.anyObject, role: primitives_js_1.text, tags: primitives_js_1.tags }, 'Changes a share link'),
+    (0, primitives_js_1.command)('link.revoke', ['id'], idOnly, 'Revokes a share link'),
+    (0, primitives_js_1.command)('rule.put', ['rule'], { rule: exports.ruleBody }, 'Inserts or replaces a RBAC rule by id'),
+    (0, primitives_js_1.command)('rule.delete', ['id'], idOnly, 'Deletes a RBAC rule'),
+    (0, primitives_js_1.command)('policy.put', ['policy'], { policy: exports.policyBody }, 'Inserts or replaces an ABAC policy by id'),
+    (0, primitives_js_1.command)('policy.delete', ['id'], idOnly, 'Deletes an ABAC policy'),
+    (0, primitives_js_1.command)('scope.setAttributes', ['scope', 'patch'], { scope: primitives_js_1.resourceRef, patch: { ...primitives_js_1.anyObject, description: 'deep merge; null deletes a path' } }, 'Merges a patch into the attributes of a scope'),
+    (0, primitives_js_1.command)('scope.replaceAttributes', ['scope', 'attributes'], { scope: primitives_js_1.resourceRef, attributes: primitives_js_1.anyObject }, 'Replaces the attributes of a scope'),
+    (0, primitives_js_1.command)('scope.forget', ['scope'], { scope: primitives_js_1.resourceRef }, 'Removes everything held AT a scope node (assignments, links, rules, policies, attributes)'),
+];
+//# sourceMappingURL=commands.js.map

package/lib/cjs/schemas/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/schemas/commands.ts"],"names":[],"mappings":";;;AAAA,mDAA+I;AAG/I,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,oBAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,CAAC;AAErE,4FAA4F;AAC/E,QAAA,QAAQ,GAAe,IAAA,mBAAG,EACrC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EACvB;IACE,EAAE,EAAE,oBAAI;IACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE;IAChE,KAAK,EAAE,2BAAW;IAClB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE;IAC7C,QAAQ,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE;IACxG,IAAI,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IAClD,SAAS,EAAE,gCAAgB;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iCAAiB,EAAE;IAClD,MAAM,EAAE,oBAAI;IACZ,OAAO,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,oBAAI,EAAE,yBAAS,CAAC,EAAE;IACvH,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,WAAW,EAAE,yBAAS;IACtB,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE;IAC3C,QAAQ,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACtE,OAAO,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,oBAAI,EAAE,yBAAS,CAAC,EAAE;IAC1E,EAAE,EAAE,oBAAI;IACR,MAAM,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,8CAA8C,EAAE;CACtF,EACD,mDAAmD,CACpD,CAAC;AAEF,yCAAyC;AAC5B,QAAA,UAAU,GAAe,IAAA,mBAAG,EACvC,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,EAC/B;IACE,EAAE,EAAE,oBAAI;IACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;IACpD,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE;IAC7C,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE;IAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAI,EAAE;IAC1C,KAAK,EAAE,2BAAW;IAClB,IAAI,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IAClD,MAAM,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,YAAY,EAAE;IACnD,MAAM,EAAE,oBAAI;IACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IACzD,SAAS,EAAE,gCAAgB;CAC5B,EACD,0CAA0C,CAC3C,CAAC;AAEF,uGAAuG;AAC1F,QAAA,aAAa,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,cAAc,CAAU,CAAC;AAExY,QAAA,cAAc,GAA0B;IACnD,IAAA,uBAAO,EAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,iCAAiB,EAAE,IAAI,EAAE,oBAAI,EAAE,KAAK,EAAE,2BAAW,EAAE,IAAI,EAAJ,oBAAI,EAAE,SAAS,EAAE,gCAAgB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE,EAAE,EAAE,uCAAuC,CAAC;IAC3T,IAAA,uBAAO,EAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC;IACtE,IAAA,uBAAO,EAAC,wBAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,OAAO,EAAE,iCAAiB,EAAE,IAAI,EAAE,oBAAI,EAAE,EAAE,kEAAkE,CAAC;IAChL,IAAA,uBAAO,EAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAJ,oBAAI,EAAE,EAAE,oCAAoC,CAAC;IACxG,IAAA,uBAAO,EAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAJ,oBAAI,EAAE,EAAE,4BAA4B,CAAC;IAChG,IAAA,uBAAO,EAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAJ,oBAAI,EAAE,EAAE,iCAAiC,CAAC;IACxG,IAAA,uBAAO,EAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,gCAAgB,EAAE,EAAE,4CAA4C,CAAC;IAC9I,IAAA,uBAAO,EAAC,eAAe,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,uBAAO,EAAE,MAAM,EAAE,4BAAY,EAAE,SAAS,EAAE,gCAAgB,EAAE,EAAE,6DAA6D,CAAC;IAC/K,IAAA,uBAAO,EAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,uBAAO,EAAE,MAAM,EAAE,4BAAY,EAAE,EAAE,wCAAwC,CAAC;IAChI,IAAA,uBAAO,EAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,IAAI,EAAE,oBAAI,EAAE,IAAI,EAAJ,oBAAI,EAAE,SAAS,EAAE,gCAAgB,EAAE,UAAU,EAAE,yBAAS,EAAE,EAAE,gEAAgE,CAAC;IACzM,IAAA,uBAAO,EAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,gCAAgB,EAAE,UAAU,EAAE,yBAAS,EAAE,IAAI,EAAE,oBAAI,EAAE,IAAI,EAAJ,oBAAI,EAAE,EAAE,sBAAsB,CAAC;IAC3I,IAAA,uBAAO,EAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC;IAC9D,IAAA,uBAAO,EAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAA,QAAQ,EAAE,EAAE,uCAAuC,CAAC;IAC1F,IAAA,uBAAO,EAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC;IAC7D,IAAA,uBAAO,EAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAA,UAAU,EAAE,EAAE,0CAA0C,CAAC;IACrG,IAAA,uBAAO,EAAC,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC;IAClE,IAAA,uBAAO,EAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,KAAK,EAAE,EAAE,GAAG,yBAAS,EAAE,WAAW,EAAE,iCAAiC,EAAE,EAAE,EAAE,+CAA+C,CAAC;IACpM,IAAA,uBAAO,EAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,UAAU,EAAE,yBAAS,EAAE,EAAE,oCAAoC,CAAC;IAChJ,IAAA,uBAAO,EAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,2BAAW,EAAE,EAAE,2FAA2F,CAAC;CACxJ,CAAC"}

package/lib/cjs/schemas/document.d.ts

@@ -0,0 +1,19 @@
+interface RouteDoc {
+    readonly method: 'get' | 'post' | 'put' | 'patch' | 'delete';
+    readonly path: string;
+    readonly body?: string;
+    readonly query?: readonly string[];
+    readonly requiredQuery?: readonly string[];
+}
+/** What each route takes that the controller's signature cannot say: its body and its query string. */
+export declare const AUTHZ_ADMIN_ROUTES: readonly RouteDoc[];
+/**
+ * http-swagger describes a route's body and query string from decorated arguments, and the admin
+ * routes read both from `@Req()` so that no http-layer step can refuse what AuthzAdmin would answer.
+ * This adds what the builder cannot see to an OpenAPI document it built: the request bodies, the
+ * query parameters, the path parameter text and the body schemas as components. Operations are
+ * matched by method and path suffix, so a route prefix does not matter. Changes the document in place.
+ */
+export declare function describeAuthzAdminDocument<T extends object>(doc: T): T;
+export {};
+//# sourceMappingURL=document.d.ts.map

package/lib/cjs/schemas/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/schemas/document.ts"],"names":[],"mappings":"AAIA,UAAU,QAAQ;IAChB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAuBD,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,EAAE,SAAS,QAAQ,EAoBjD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAmBtE"}

package/lib/cjs/schemas/document.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHZ_ADMIN_ROUTES = void 0;
+exports.describeAuthzAdminDocument = describeAuthzAdminDocument;
+const provider_js_1 = require("./provider.js");
+const WRITE_OPTIONS = ['reason', 'idempotencyKey', 'dryRun'];
+const QUERY = {
+    scope: { schema: { type: 'string' }, description: '`<type>` or `<type>:<id>`, split at the first `:`; `$global` is the global scope' },
+    subject: { schema: { type: 'string' }, description: '`<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set)' },
+    role: { schema: { type: 'string' }, description: 'only assignments of this role' },
+    permission: { schema: { type: 'string' }, description: 'the permission whose holders are listed (required)' },
+    expandSets: { schema: { type: 'boolean' }, description: '`true` also lists the members of each subject set, next to the set itself' },
+    includeExpired: { schema: { type: 'boolean' }, description: '`true` or `false`' },
+    limit: { schema: { type: 'integer', minimum: 0 }, description: 'page size; the server sets the default' },
+    offset: { schema: { type: 'integer', minimum: 0 }, description: 'rows to skip' },
+    reason: { schema: { type: 'string' }, description: 'goes to the audit trail' },
+    idempotencyKey: { schema: { type: 'string' }, description: 'a retried request with the same key returns the first result' },
+    dryRun: { schema: { type: 'boolean' }, description: '`true` validates and guards, then rolls back' },
+};
+const PATH_PARAMS = {
+    id: 'the id of the row (assignment, link, rule, policy) or of the scope node',
+    type: 'the resource type of the scope node',
+};
+/** What each route takes that the controller's signature cannot say: its body and its query string. */
+exports.AUTHZ_ADMIN_ROUTES = [
+    { method: 'post', path: '/authz/commands', body: 'AuthzAdminBatch' },
+    { method: 'get', path: '/authz/assignments', query: ['scope', 'subject', 'role', 'includeExpired', 'limit', 'offset'] },
+    { method: 'get', path: '/authz/holders', query: ['scope', 'permission', 'expandSets', 'limit', 'offset'], requiredQuery: ['scope', 'permission'] },
+    { method: 'post', path: '/authz/assignments', body: 'AuthzAssignmentGrant', query: WRITE_OPTIONS },
+    { method: 'patch', path: '/authz/assignments/{id}', body: 'AuthzAssignmentPatch', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/assignments/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/links', query: ['scope', 'limit', 'offset'] },
+    { method: 'post', path: '/authz/links', body: 'AuthzLinkCreate', query: WRITE_OPTIONS },
+    { method: 'patch', path: '/authz/links/{id}', body: 'AuthzLinkPatch', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/links/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/rules', query: ['scope', 'limit', 'offset'] },
+    { method: 'put', path: '/authz/rules/{id}', body: 'AuthzRuleBody', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/rules/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/policies', query: ['scope', 'limit', 'offset'] },
+    { method: 'put', path: '/authz/policies/{id}', body: 'AuthzPolicyBody', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/policies/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/scopes/{type}/{id}/attributes' },
+    { method: 'patch', path: '/authz/scopes/{type}/{id}/attributes', body: 'AuthzAttributesPatch', query: WRITE_OPTIONS },
+    { method: 'put', path: '/authz/scopes/{type}/{id}/attributes', body: 'AuthzAttributesBody', query: WRITE_OPTIONS },
+];
+/**
+ * http-swagger describes a route's body and query string from decorated arguments, and the admin
+ * routes read both from `@Req()` so that no http-layer step can refuse what AuthzAdmin would answer.
+ * This adds what the builder cannot see to an OpenAPI document it built: the request bodies, the
+ * query parameters, the path parameter text and the body schemas as components. Operations are
+ * matched by method and path suffix, so a route prefix does not matter. Changes the document in place.
+ */
+function describeAuthzAdminDocument(doc) {
+    const document = doc;
+    const components = ((document.components ??= {}).schemas ??= {});
+    for (const [name, schema] of Object.entries(provider_js_1.AUTHZ_ADMIN_SCHEMAS))
+        components[name] ??= schema;
+    for (const route of exports.AUTHZ_ADMIN_ROUTES) {
+        const path = Object.keys(document.paths ?? {}).find((p) => p === route.path || p.endsWith(route.path));
+        const operation = path ? document.paths[path][route.method] : undefined;
+        if (!operation)
+            continue;
+        if (route.body)
+            operation.requestBody = { required: true, content: { 'application/json': { schema: { $ref: `#/components/schemas/${route.body}` } } } };
+        const parameters = (operation.parameters ??= []);
+        for (const p of parameters)
+            if (p.in === 'path' && !p.description)
+                p.description = PATH_PARAMS[p.name];
+        for (const name of route.query ?? []) {
+            if (!parameters.some((p) => p.in === 'query' && p.name === name))
+                parameters.push({ name, in: 'query', required: route.requiredQuery?.includes(name) === true, ...QUERY[name] });
+        }
+    }
+    return doc;
+}
+//# sourceMappingURL=document.js.map

package/lib/cjs/schemas/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../src/schemas/document.ts"],"names":[],"mappings":";;;;AAAA,+CAAoD;AAYpD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU,CAAC;AAEtE,MAAM,KAAK,GAAmC;IAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE;IACtI,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,yEAAyE,EAAE;IAC/H,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAClF,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oDAAoD,EAAE;IAC7G,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE;IACrI,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE;IACzG,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;IAChF,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC9E,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE;IAC3H,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE;CACrG,CAAC;AAEF,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,yEAAyE;IAC7E,IAAI,EAAE,qCAAqC;CAC5C,CAAC;AAEF,uGAAuG;AAC1F,QAAA,kBAAkB,GAAwB;IACrD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACpE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IACvH,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;IAClJ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IAClG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACxG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC3E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE;IACvF,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC5F,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE;IACzF,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC/E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC9F,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACxE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC/D,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrH,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;CACnH,CAAC;AAEF;;;;;;GAMG;AACH,oCAA6D,GAAM;IACjE,MAAM,QAAQ,GAAG,GAAW,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,OAAO,KAAK,EAAE,CAAS,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iCAAmB,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;IAE9F,KAAK,MAAM,KAAK,IAAI,QAAA,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,IAAI,KAAK,CAAC,IAAI;YAAE,SAAS,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAExJ,MAAM,UAAU,GAAW,CAAC,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvG,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/cjs/schemas/index.d.ts

@@ -0,0 +1,6 @@
+export type { JsonSchema } from './primitives.js';
+export * from './commands.js';
+export * from './bodies.js';
+export * from './provider.js';
+export * from './document.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC"}