@spinajs/authz-http-admin 0.0.0-stage → 3.0.0

package/lib/mjs/controllers/AuthzAdminController.js

@@ -0,0 +1,546 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { AuthzAdminFailure, AuthzDomains } from '@spinajs/authz';
+import { Config } from '@spinajs/configuration';
+import { Autoinject } from '@spinajs/di';
+import { BadRequestResponse, BaseController, BasePath, Conflict, Del, ForbiddenResponse, Get, NotFound, Ok, Patch, Policy, Post, Put, Req } from '@spinajs/http';
+import { IsAuthenticated } from '@spinajs/authz-http';
+import { isPlainObject } from '@spinajs/util';
+import '../schemas/provider.js';
+import { decodeCommand, decodeCommands } from '../routes/decode.js';
+import { readAssignmentsQuery, readHoldersQuery, readPageQuery, readWriteOptions } from '../routes/query.js';
+import { adminErrorStatus, resultsStatus } from '../routes/status.js';
+const PATCH_KEYS = ['tags', 'addTags', 'removeTags', 'expiresAt'];
+const PATCH_KINDS = { tags: 'assignment.setTags', addTags: 'assignment.addTags', removeTags: 'assignment.removeTags' };
+function respond(status, body) {
+    switch (status) {
+        case 200:
+            return new Ok(body);
+        case 403:
+            return new ForbiddenResponse(body);
+        case 404:
+            return new NotFound(body);
+        case 409:
+            return new Conflict(body);
+        default:
+            return new BadRequestResponse(body);
+    }
+}
+function refused(e) {
+    return respond(adminErrorStatus(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
+}
+function badRequest(message, field) {
+    throw new AuthzAdminFailure('invalid_request', message, field);
+}
+function objectBody(body, what) {
+    if (!isPlainObject(body))
+        badRequest(`the body must be ${what}`);
+    return body;
+}
+/** The body of PUT /authz/rules/:id or /authz/policies/:id with the path id; an id in the body must equal it. */
+function withPathId(body, id, what) {
+    const o = objectBody(body, what);
+    if (o.id !== undefined && o.id !== id)
+        badRequest(`the body id ${JSON.stringify(o.id)} is not the path id ${JSON.stringify(id)}`, 'id');
+    return { ...o, id };
+}
+const LINK_PATCH_KEYS = ['expiresAt', 'attributes', 'role', 'tags'];
+/** PATCH /authz/links/:id as one link.update; like the assignment patch, a key it does not serve is refused, not ignored. */
+function linkUpdate(body, id) {
+    const patch = withPathId(body, id, 'an object { expiresAt?, attributes?, role?, tags? }');
+    const unknown = Object.keys(patch).find((k) => k !== 'id' && !LINK_PATCH_KEYS.includes(k));
+    if (unknown !== undefined)
+        badRequest(`a link patch takes ${LINK_PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
+    if (!LINK_PATCH_KEYS.some((k) => k in patch))
+        badRequest(`a link patch needs one of ${LINK_PATCH_KEYS.join(', ')}`);
+    return decodeCommand({ ...patch, kind: 'link.update' });
+}
+/** For answers that may hold a link token: no proxy or browser cache may keep one. Set first, so it goes out with any answer the route gives. */
+function noStore(req) {
+    req.res?.setHeader('Cache-Control', 'no-store');
+    req.res?.setHeader('Pragma', 'no-cache');
+}
+const query = (req) => (req.query ?? {});
+const param = (req, name) => req.params[name];
+const actorOf = (req) => req.storage.Principal;
+const scopeOf = (req) => ({ type: param(req, 'type'), id: param(req, 'id') });
+/**
+ * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
+ *
+ * The routes check authentication only: the actor is always the request principal, and every
+ * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
+ * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
+ * `{ results }`, one entry per command.
+ *
+ * @tags Authz admin
+ */
+let AuthzAdminController = class AuthzAdminController extends BaseController {
+    /** Runs a route on the domain's AuthzAdmin; an AuthzAdminFailure becomes its status with `{ error }`, anything else propagates. */
+    async guarded(fn) {
+        const admin = (await this.Domains.service(this.AdminDomain)).admin();
+        try {
+            return await fn(admin);
+        }
+        catch (e) {
+            if (e instanceof AuthzAdminFailure)
+                return refused(e);
+            throw e;
+        }
+    }
+    /** One batch built from the route, with the options of the query string. */
+    single(req, build) {
+        return this.guarded(async (admin) => {
+            const opts = readWriteOptions(query(req));
+            return results(await admin.execute(actorOf(req), build(), opts));
+        });
+    }
+    list(req, build) {
+        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())));
+    }
+    /**
+     * Run a batch of commands
+     * Runs the commands in order in one transaction on the configured domain; the first failure rolls the batch back and its status is the answer.
+     * Body: { commands, reason?, idempotencyKey?, dryRun? } (schema AuthzAdminBatch); `commands` lists the command kinds of AuthzCommand, with dates as ISO 8601 strings. The options go in the body, not the query string.
+     * The result of a link.create carries the link token, shown once: every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token), and a retried or dry-run batch answers without the token.
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async commands(req) {
+        noStore(req);
+        return this.guarded(async (admin) => {
+            const body = objectBody(req.body, 'an object { commands, reason?, idempotencyKey?, dryRun? }');
+            const opts = {};
+            for (const key of ['reason', 'idempotencyKey', 'dryRun'])
+                if (key in body)
+                    opts[key] = body[key];
+            return results(await admin.execute(actorOf(req), decodeCommands(body.commands), opts));
+        });
+    }
+    /**
+     * List assignments
+     * Lists assignments, filtered by the query.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listAssignments(req) {
+        return this.list(req, () => readAssignmentsQuery(query(req)));
+    }
+    /**
+     * List holders
+     * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
+     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of holders
+     * @response 400 {AuthzAdminError} invalid_query: a malformed or missing query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
+     */
+    async listHolders(req) {
+        return this.list(req, () => readHoldersQuery(query(req)));
+    }
+    /**
+     * Grant a role
+     * Grants a role to a subject at a scope (assignment.grant).
+     * Body: the fields of assignment.grant without `kind` (schema AuthzAssignmentGrant).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async grant(req) {
+        return this.single(req, () => [decodeCommand({ ...objectBody(req.body, 'the fields of assignment.grant'), kind: 'assignment.grant' })]);
+    }
+    /**
+     * Change an assignment
+     * Changes the tags or the expiry of an assignment.
+     * Body: { tags?, addTags?, removeTags?, expiresAt? } with at least one key (schema AuthzAssignmentPatch); the keys run as one batch.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchAssignment(req) {
+        return this.single(req, () => {
+            const body = objectBody(req.body, 'an object { tags?, addTags?, removeTags?, expiresAt? }');
+            const unknown = Object.keys(body).find((k) => !PATCH_KEYS.includes(k));
+            if (unknown !== undefined)
+                badRequest(`an assignment patch takes ${PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
+            const id = param(req, 'id');
+            const commands = [];
+            for (const key of ['tags', 'addTags', 'removeTags'])
+                if (key in body)
+                    commands.push({ kind: PATCH_KINDS[key], id, tags: body[key] });
+            if ('expiresAt' in body)
+                commands.push(decodeCommand({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
+            if (commands.length === 0)
+                badRequest(`an assignment patch needs one of ${PATCH_KEYS.join(', ')}`);
+            return commands;
+        });
+    }
+    /**
+     * Revoke an assignment
+     * Revokes the assignment with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async revoke(req) {
+        return this.single(req, () => [{ kind: 'assignment.revoke', id: param(req, 'id') }]);
+    }
+    /**
+     * List share links
+     * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listLinks(req) {
+        return this.list(req, () => readPageQuery('links', query(req)));
+    }
+    /**
+     * Create a share link
+     * Creates a share link that grants a role at a scope (link.create). The result carries the link id and its token: the token is shown once, here, and every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token). A dry run or a retried request (same idempotency key) answers without the token.
+     * Body: the fields of link.create without `kind` (schema AuthzLinkCreate).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} The link was created; results[0] holds its id and token
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async createLink(req) {
+        noStore(req);
+        return this.single(req, () => [decodeCommand({ ...objectBody(req.body, 'the fields of link.create'), kind: 'link.create' })]);
+    }
+    /**
+     * Change a share link
+     * Changes the expiry, attributes, role or tags of the link with the path id (link.update). The answer never carries the token.
+     * Body: { expiresAt?, attributes?, role?, tags? } with at least one key (schema AuthzLinkPatch); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchLink(req) {
+        return this.single(req, () => [linkUpdate(req.body, param(req, 'id'))]);
+    }
+    /**
+     * Revoke a share link
+     * Revokes the link with the path id and the role it grants (link.revoke); its token opens nothing from then on.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async revokeLink(req) {
+        return this.single(req, () => [{ kind: 'link.revoke', id: param(req, 'id') }]);
+    }
+    /**
+     * List rules
+     * Lists the RBAC rules held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listRules(req) {
+        return this.list(req, () => readPageQuery('rules', query(req)));
+    }
+    /**
+     * Put a rule
+     * Inserts or replaces the RBAC rule with the path id.
+     * Body: a rule (schema AuthzRuleBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async putRule(req) {
+        return this.single(req, () => [decodeCommand({ kind: 'rule.put', rule: withPathId(req.body, param(req, 'id'), 'a rule') })]);
+    }
+    /**
+     * Delete a rule
+     * Deletes the RBAC rule with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async deleteRule(req) {
+        return this.single(req, () => [{ kind: 'rule.delete', id: param(req, 'id') }]);
+    }
+    /**
+     * List policies
+     * Lists the ABAC policies held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async listPolicies(req) {
+        return this.list(req, () => readPageQuery('policies', query(req)));
+    }
+    /**
+     * Put a policy
+     * Inserts or replaces the ABAC policy with the path id.
+     * Body: a policy (schema AuthzPolicyBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async putPolicy(req) {
+        return this.single(req, () => [decodeCommand({ kind: 'policy.put', policy: withPathId(req.body, param(req, 'id'), 'a policy') })]);
+    }
+    /**
+     * Delete a policy
+     * Deletes the ABAC policy with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async deletePolicy(req) {
+        return this.single(req, () => [{ kind: 'policy.delete', id: param(req, 'id') }]);
+    }
+    /**
+     * Read scope attributes
+     * Returns the attributes of the scope node `<type>:<id>`.
+     * @response 200 {AuthzAdminPage} items holds one entry, the attributes object of the scope; total is 1
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    async attributes(req) {
+        return this.list(req, () => ({ kind: 'attributes', scope: scopeOf(req) }));
+    }
+    /**
+     * Merge scope attributes
+     * Deep-merges the body into the attributes of the scope node; null deletes a path.
+     * Body: an object (schema AuthzAttributesPatch).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async patchAttributes(req) {
+        return this.single(req, () => [{ kind: 'scope.setAttributes', scope: scopeOf(req), patch: req.body }]);
+    }
+    /**
+     * Replace scope attributes
+     * Replaces all attributes of the scope node with the body.
+     * Body: an object (schema AuthzAttributesBody).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    async replaceAttributes(req) {
+        return this.single(req, () => [{ kind: 'scope.replaceAttributes', scope: scopeOf(req), attributes: req.body }]);
+    }
+};
+__decorate([
+    Config('authz.http.admin.domain'),
+    __metadata("design:type", String)
+], AuthzAdminController.prototype, "AdminDomain", void 0);
+__decorate([
+    Autoinject(AuthzDomains),
+    __metadata("design:type", AuthzDomains)
+], AuthzAdminController.prototype, "Domains", void 0);
+__decorate([
+    Post('commands'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "commands", null);
+__decorate([
+    Get('assignments'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listAssignments", null);
+__decorate([
+    Get('holders'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listHolders", null);
+__decorate([
+    Post('assignments'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "grant", null);
+__decorate([
+    Patch('assignments/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchAssignment", null);
+__decorate([
+    Del('assignments/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "revoke", null);
+__decorate([
+    Get('links'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listLinks", null);
+__decorate([
+    Post('links'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "createLink", null);
+__decorate([
+    Patch('links/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchLink", null);
+__decorate([
+    Del('links/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "revokeLink", null);
+__decorate([
+    Get('rules'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listRules", null);
+__decorate([
+    Put('rules/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "putRule", null);
+__decorate([
+    Del('rules/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "deleteRule", null);
+__decorate([
+    Get('policies'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "listPolicies", null);
+__decorate([
+    Put('policies/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "putPolicy", null);
+__decorate([
+    Del('policies/:id'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "deletePolicy", null);
+__decorate([
+    Get('scopes/:type/:id/attributes'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "attributes", null);
+__decorate([
+    Patch('scopes/:type/:id/attributes'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "patchAttributes", null);
+__decorate([
+    Put('scopes/:type/:id/attributes'),
+    __param(0, Req()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthzAdminController.prototype, "replaceAttributes", null);
+AuthzAdminController = __decorate([
+    Policy(IsAuthenticated),
+    BasePath('authz')
+], AuthzAdminController);
+export { AuthzAdminController };
+function results(r) {
+    return respond(resultsStatus(r), { results: r });
+}
+//# sourceMappingURL=AuthzAdminController.js.map

package/lib/mjs/controllers/AuthzAdminController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthzAdminController.js","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEjK,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE7G,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEtE,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAC3E,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,uBAAuB,EAAW,CAAC;AAEhI,SAAS,OAAO,CAAC,MAAc,EAAE,IAAa;IAC5C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B;YACE,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAoB;IACnC,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAAc;IACjD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,IAAY;IAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,UAAU,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iHAAiH;AACjH,SAAS,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE;QAAE,UAAU,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxI,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE7E,6HAA6H;AAC7H,SAAS,UAAU,CAAC,IAAa,EAAE,EAAU;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,qDAAqD,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,OAAO,KAAK,SAAS;QAAE,UAAU,CAAC,sBAAsB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,UAAU,CAAC,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpH,OAAO,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAiB,CAAC;AAC1E,CAAC;AAED,iJAAiJ;AACjJ,SAAS,OAAO,CAAC,GAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,GAAY,EAAc,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAe,CAAC;AAC5E,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC;AACjF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAU,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,GAAY,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAEpG;;;;;;;;;GASG;AAGI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,cAAc;IAOtD,mIAAmI;IACzH,KAAK,CAAC,OAAO,CAAC,EAA4C;QAClE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,iBAAiB;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,4EAA4E;IAClE,MAAM,CAAC,GAAY,EAAE,KAA2B;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAES,IAAI,CAAC,GAAY,EAAE,KAA4B;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAQ,GAAY;QACvC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,2DAA2D,CAAC,CAAC;YAC/F,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU;gBAAE,IAAI,GAAG,IAAI,IAAI;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1G,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAmB,EAAE,IAAyB,CAAC,CAAC,CAAC;QAChI,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAQ,GAAY;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,gCAAgC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAiB,CAAC,CAAC,CAAC;IAC1J,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE;YAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,IAAI,OAAO,KAAK,SAAS;gBAAE,UAAU,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACrI,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAU;gBAAE,IAAI,GAAG,IAAI,IAAI;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9I,IAAI,WAAW,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACvH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,UAAU,CAAC,oCAAoC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnG,OAAO,QAA0B,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAiB,CAAC,CAAC,CAAC;IAChJ,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,OAAO,CAAQ,GAAY;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAiB,CAAC,CAAC,CAAC;IAC/I,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,EAAE,CAAiB,CAAC,CAAC,CAAC;IACrJ,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IAEU,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,iBAAiB,CAAQ,GAAY;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClH,CAAC;CACF,CAAA;AAxVW;IADT,MAAM,CAAC,yBAAyB,CAAC;;yDACJ;AAGpB;IADT,UAAU,CAAC,YAAY,CAAC;8BACN,YAAY;qDAAC;AAsCnB;IADZ,IAAI,CAAC,UAAU,CAAC;IACM,WAAA,GAAG,EAAE,CAAA;;;;oDAQ3B;AAYY;IADZ,GAAG,CAAC,aAAa,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;2DAElC;AAYY;IADZ,GAAG,CAAC,SAAS,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;uDAE9B;AAeY;IADZ,IAAI,CAAC,aAAa,CAAC;IACA,WAAA,GAAG,EAAE,CAAA;;;;iDAExB;AAeY;IADZ,KAAK,CAAC,iBAAiB,CAAC;IACK,WAAA,GAAG,EAAE,CAAA;;;;2DAYlC;AAcY;IADZ,GAAG,CAAC,iBAAiB,CAAC;IACF,WAAA,GAAG,EAAE,CAAA;;;;kDAEzB;AAYY;IADZ,GAAG,CAAC,OAAO,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;qDAE5B;AAeY;IADZ,IAAI,CAAC,OAAO,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;sDAG7B;AAeY;IADZ,KAAK,CAAC,WAAW,CAAC;IACK,WAAA,GAAG,EAAE,CAAA;;;;qDAE5B;AAcY;IADZ,GAAG,CAAC,WAAW,CAAC;IACQ,WAAA,GAAG,EAAE,CAAA;;;;sDAE7B;AAYY;IADZ,GAAG,CAAC,OAAO,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;qDAE5B;AAeY;IADZ,GAAG,CAAC,WAAW,CAAC;IACK,WAAA,GAAG,EAAE,CAAA;;;;mDAE1B;AAcY;IADZ,GAAG,CAAC,WAAW,CAAC;IACQ,WAAA,GAAG,EAAE,CAAA;;;;sDAE7B;AAYY;IADZ,GAAG,CAAC,UAAU,CAAC;IACW,WAAA,GAAG,EAAE,CAAA;;;;wDAE/B;AAeY;IADZ,GAAG,CAAC,cAAc,CAAC;IACI,WAAA,GAAG,EAAE,CAAA;;;;qDAE5B;AAcY;IADZ,GAAG,CAAC,cAAc,CAAC;IACO,WAAA,GAAG,EAAE,CAAA;;;;wDAE/B;AAWY;IADZ,GAAG,CAAC,6BAA6B,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;sDAE7B;AAeY;IADZ,KAAK,CAAC,6BAA6B,CAAC;IACP,WAAA,GAAG,EAAE,CAAA;;;;2DAElC;AAeY;IADZ,GAAG,CAAC,6BAA6B,CAAC;IACH,WAAA,GAAG,EAAE,CAAA;;;;6DAEpC;AAzVU,oBAAoB;IAFhC,MAAM,CAAC,eAAe,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC;GACL,oBAAoB,CA0VhC;;AAED,SAAS,OAAO,CAAC,CAA6C;IAC5D,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,4 @@
+export * from './controllers/AuthzAdminController.js';
+export * from './routes/index.js';
+export * from './schemas/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,4 @@
+export * from './controllers/AuthzAdminController.js';
+export * from './routes/index.js';
+export * from './schemas/index.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/routes/decode.d.ts

@@ -0,0 +1,11 @@
+/** Date, time (seconds and fraction optional) and `Z` or an offset: the only strings read as a Date. */
+export declare const ISO_DATE_TIME: RegExp;
+/**
+ * A command as JSON carries its expiry dates as strings; this copy holds Dates at the known expiry
+ * paths. Anything else, including a string that is not an ISO date-time, stays as it came, so
+ * AuthzAdmin refuses it as it would refuse it in-process.
+ */
+export declare function decodeCommand(command: unknown): unknown;
+/** decodeCommand for each entry of a list; anything else goes through for AuthzAdmin to refuse. */
+export declare function decodeCommands(commands: unknown): unknown;
+//# sourceMappingURL=decode.d.ts.map

package/lib/mjs/routes/decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.d.ts","sourceRoot":"","sources":["../../../src/routes/decode.ts"],"names":[],"mappings":"AAEA,wGAAwG;AACxG,eAAO,MAAM,aAAa,QAAkG,CAAC;AA+B7H;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAMvD;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAEzD"}

package/lib/mjs/routes/decode.js

@@ -0,0 +1,48 @@
+import { isPlainObject } from '@spinajs/util';
+/** Date, time (seconds and fraction optional) and `Z` or an offset: the only strings read as a Date. */
+export const ISO_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,9})?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
+// Date rolls 2027-02-30 over to 2 March instead of refusing it.
+function realFields(m) {
+    const [y, mo, d, h, mi, s, oh, om] = m.slice(1).map((x) => Number(x ?? 0));
+    const day = new Date(Date.UTC(y, mo - 1, d));
+    return day.getUTCFullYear() === y && day.getUTCMonth() === mo - 1 && day.getUTCDate() === d && h < 24 && mi < 60 && s < 60 && oh < 24 && om < 60;
+}
+/** Command kinds whose top-level `expiresAt`, or `expiresAt` inside one nested object, is a Date. */
+const DATE_PATHS = {
+    'assignment.grant': null,
+    'assignment.setExpiry': null,
+    'set.addMember': null,
+    'link.create': null,
+    'link.update': null,
+    'rule.put': 'rule',
+    'policy.put': 'policy',
+};
+function toDate(v) {
+    const m = typeof v === 'string' ? ISO_DATE_TIME.exec(v) : null;
+    if (!m || !realFields(m))
+        return v;
+    const at = new Date(v);
+    return Number.isNaN(at.getTime()) ? v : at;
+}
+function withDate(o) {
+    return 'expiresAt' in o ? { ...o, expiresAt: toDate(o.expiresAt) } : o;
+}
+/**
+ * A command as JSON carries its expiry dates as strings; this copy holds Dates at the known expiry
+ * paths. Anything else, including a string that is not an ISO date-time, stays as it came, so
+ * AuthzAdmin refuses it as it would refuse it in-process.
+ */
+export function decodeCommand(command) {
+    if (!isPlainObject(command) || typeof command.kind !== 'string' || !Object.hasOwn(DATE_PATHS, command.kind))
+        return command;
+    const nested = DATE_PATHS[command.kind];
+    if (nested === null)
+        return withDate(command);
+    const inner = command[nested];
+    return isPlainObject(inner) ? { ...command, [nested]: withDate(inner) } : command;
+}
+/** decodeCommand for each entry of a list; anything else goes through for AuthzAdmin to refuse. */
+export function decodeCommands(commands) {
+    return Array.isArray(commands) ? commands.map(decodeCommand) : commands;
+}
+//# sourceMappingURL=decode.js.map