@spinajs/authz-http-admin 0.0.0-stage → 3.0.1

package/lib/mjs/routes/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../../src/routes/decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAG,+FAA+F,CAAC;AAE7H,gEAAgE;AAChE,SAAS,UAAU,CAAC,CAAkB;IACpC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,GAA4C;IAC1D,kBAAkB,EAAE,IAAI;IACxB,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,QAAQ;CACvB,CAAC;AAEF,SAAS,MAAM,CAAC,CAAU;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAW,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,CAA0B;IAC1C,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5H,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACpF,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1E,CAAC"}

package/lib/mjs/routes/index.d.ts

@@ -0,0 +1,4 @@
+export * from './decode.js';
+export * from './query.js';
+export * from './status.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/mjs/routes/index.js

@@ -0,0 +1,4 @@
+export * from './decode.js';
+export * from './query.js';
+export * from './status.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/mjs/routes/query.d.ts

@@ -0,0 +1,16 @@
+import type { AssignmentSubject, AuthzAdminOptions, AuthzAdminQuery, ResourceRef } from '@spinajs/authz';
+/** A parsed query string (express: string, string[] or a nested object per key). */
+export type QueryInput = Readonly<Record<string, unknown>>;
+/** `<type>` or `<type>:<id>`, split at the first `:` (ids may hold more); `$global` is GLOBAL. */
+export declare function parseResourceRef(value: string, field: string): ResourceRef;
+/** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
+export declare function parseAssignmentSubject(value: string, field?: string): AssignmentSubject;
+/** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset`. */
+export declare function readAssignmentsQuery(q: QueryInput): AuthzAdminQuery;
+/** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset`. */
+export declare function readHoldersQuery(q: QueryInput): AuthzAdminQuery;
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset`. */
+export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: QueryInput): AuthzAdminQuery;
+/** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
+export declare function readWriteOptions(q: QueryInput): AuthzAdminOptions;
+//# sourceMappingURL=query.d.ts.map

package/lib/mjs/routes/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEzG,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAe3D,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AA6BD,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAYnE;AAED,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAa/D;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,eAAe,CAElG;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,iBAAiB,CASjE"}

package/lib/mjs/routes/query.js

@@ -0,0 +1,120 @@
+import { AuthzAdminFailure, GLOBAL } from '@spinajs/authz';
+function invalid(field, message) {
+    throw new AuthzAdminFailure('invalid_query', message, field);
+}
+function text(q, field) {
+    const v = q[field];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== 'string')
+        invalid(field, `${field} must be given once, as text`);
+    return v;
+}
+/** `<type>` or `<type>:<id>`, split at the first `:` (ids may hold more); `$global` is GLOBAL. */
+export function parseResourceRef(value, field) {
+    if (value === GLOBAL.type)
+        return GLOBAL;
+    const at = value.indexOf(':');
+    const type = at < 0 ? value : value.slice(0, at);
+    if (type === '')
+        invalid(field, `${field} must be <type> or <type>:<id>, got ${JSON.stringify(value)}`);
+    if (at < 0)
+        return { type };
+    const id = value.slice(at + 1);
+    if (id === '')
+        invalid(field, `${field} must be <type> or <type>:<id>, got ${JSON.stringify(value)}`);
+    return { type, id };
+}
+/** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
+export function parseAssignmentSubject(value, field = 'subject') {
+    const bad = () => invalid(field, `${field} must be <type>:<id> or set:<role>@<type>:<id>, got ${JSON.stringify(value)}`);
+    if (value.startsWith('set:')) {
+        const rest = value.slice('set:'.length);
+        const at = rest.indexOf('@');
+        if (at <= 0)
+            return bad();
+        const scope = rest.slice(at + 1);
+        if (scope === '' || scope.endsWith(':'))
+            return bad();
+        return { set: { role: rest.slice(0, at), scope: parseResourceRef(scope, field) } };
+    }
+    const at = value.indexOf(':');
+    if (at <= 0 || at === value.length - 1)
+        return bad();
+    return { type: value.slice(0, at), id: value.slice(at + 1) };
+}
+function flag(q, field) {
+    const v = text(q, field);
+    if (v === undefined)
+        return undefined;
+    if (v !== 'true' && v !== 'false')
+        invalid(field, `${field} must be true or false`);
+    return v === 'true';
+}
+function count(q, field) {
+    const v = text(q, field);
+    if (v === undefined)
+        return undefined;
+    if (!/^\d+$/.test(v))
+        invalid(field, `${field} must be a non-negative integer`);
+    return Number(v);
+}
+/** `limit` and `offset` as AuthzAdmin's page, only the ones given; AuthzAdmin defaults the rest. */
+function page(q) {
+    const limit = count(q, 'limit');
+    const offset = count(q, 'offset');
+    if (limit === undefined && offset === undefined)
+        return {};
+    return { page: { ...(limit === undefined ? {} : { limit }), ...(offset === undefined ? {} : { offset }) } };
+}
+function scope(q) {
+    const v = text(q, 'scope');
+    return v === undefined ? {} : { scope: parseResourceRef(v, 'scope') };
+}
+/** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset`. */
+export function readAssignmentsQuery(q) {
+    const subject = text(q, 'subject');
+    const role = text(q, 'role');
+    const includeExpired = flag(q, 'includeExpired');
+    return {
+        kind: 'assignments',
+        ...scope(q),
+        ...(subject === undefined ? {} : { subject: parseAssignmentSubject(subject) }),
+        ...(role === undefined ? {} : { role }),
+        ...(includeExpired === undefined ? {} : { includeExpired }),
+        ...page(q),
+    };
+}
+/** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset`. */
+export function readHoldersQuery(q) {
+    const scope = text(q, 'scope');
+    const permission = text(q, 'permission');
+    if (scope === undefined)
+        invalid('scope', 'scope is required');
+    if (permission === undefined || permission === '')
+        invalid('permission', 'permission is required');
+    const expandSets = flag(q, 'expandSets');
+    return {
+        kind: 'holders',
+        scope: parseResourceRef(scope, 'scope'),
+        permission,
+        ...(expandSets === undefined ? {} : { expandSets }),
+        ...page(q),
+    };
+}
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset`. */
+export function readPageQuery(kind, q) {
+    return { kind, ...scope(q), ...page(q) };
+}
+/** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
+export function readWriteOptions(q) {
+    const reason = text(q, 'reason');
+    const idempotencyKey = text(q, 'idempotencyKey');
+    const dryRun = flag(q, 'dryRun');
+    return {
+        ...(reason === undefined ? {} : { reason }),
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        ...(dryRun === undefined ? {} : { dryRun }),
+    };
+}
+//# sourceMappingURL=query.js.map

package/lib/mjs/routes/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAQ3D,SAAS,OAAO,CAAC,KAAa,EAAE,OAAe;IAC7C,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,CAAa,EAAE,KAAa;IACxC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAClF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAa;IAC3D,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,KAAK,GAAG,SAAS;IACrE,MAAM,GAAG,GAAG,GAAU,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChI,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,CAAa,EAAE,KAAa;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,CAAa,EAAE,KAAa;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,SAAS,IAAI,CAAC,CAAa;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,KAAK,CAAC,CAAa;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,CAAa;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,GAAG,KAAK,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC,CAAC;KACQ,CAAC;AACvB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;QACvC,UAAU;QACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,IAAI,CAAC,CAAC,CAAC;KACQ,CAAC;AACvB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,IAAoC,EAAE,CAAa;IAC/E,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAqB,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/lib/mjs/routes/status.d.ts

@@ -0,0 +1,6 @@
+import type { AuthzCommandResult } from '@spinajs/authz';
+/** The HTTP status of an AuthzAdminError code: refusals 403, not_found 404, conflict 409, the rest (validation) 400. */
+export declare function adminErrorStatus(code: string): number;
+/** 200 when every command succeeded, else the status of the failed one (a batch reports its first failure). */
+export declare function resultsStatus(results: readonly AuthzCommandResult[]): number;
+//# sourceMappingURL=status.d.ts.map

package/lib/mjs/routes/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/routes/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIzD,wHAAwH;AACxH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAG5E"}

package/lib/mjs/routes/status.js

@@ -0,0 +1,17 @@
+const REFUSED = new Set(['forbidden', 'escalation', 'last_holder', 'self_lockout', 'protected_role']);
+/** The HTTP status of an AuthzAdminError code: refusals 403, not_found 404, conflict 409, the rest (validation) 400. */
+export function adminErrorStatus(code) {
+    if (REFUSED.has(code))
+        return 403;
+    if (code === 'not_found')
+        return 404;
+    if (code === 'conflict')
+        return 409;
+    return 400;
+}
+/** 200 when every command succeeded, else the status of the failed one (a batch reports its first failure). */
+export function resultsStatus(results) {
+    const failed = results.find((r) => !r.ok);
+    return failed && !failed.ok ? adminErrorStatus(failed.error.code) : 200;
+}
+//# sourceMappingURL=status.js.map

package/lib/mjs/routes/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/routes/status.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEtG,wHAAwH;AACxH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,OAAsC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1E,CAAC"}

package/lib/mjs/schemas/bodies.d.ts

@@ -0,0 +1,16 @@
+import type { JsonSchema } from './primitives.js';
+export declare const AuthzAdminBatch: JsonSchema;
+export declare const AuthzAssignmentGrant: JsonSchema;
+export declare const AuthzAssignmentPatch: JsonSchema;
+export declare const AuthzLinkCreate: JsonSchema;
+export declare const AuthzLinkPatch: JsonSchema;
+export declare const AuthzRuleBody: JsonSchema;
+export declare const AuthzPolicyBody: JsonSchema;
+export declare const AuthzAttributesPatch: JsonSchema;
+export declare const AuthzAttributesBody: JsonSchema;
+export declare const AuthzAdminError: JsonSchema;
+export declare const AuthzCommandResult: JsonSchema;
+export declare const AuthzAdminResults: JsonSchema;
+export declare const AuthzAdminPage: JsonSchema;
+export declare const AuthzAdminAttributes: JsonSchema;
+//# sourceMappingURL=bodies.d.ts.map

package/lib/mjs/schemas/bodies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodies.d.ts","sourceRoot":"","sources":["../../../src/schemas/bodies.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAWlD,eAAO,MAAM,eAAe,EAAE,UAAiO,CAAC;AAEhQ,eAAO,MAAM,oBAAoB,EAAE,UAA2S,CAAC;AAE/U,eAAO,MAAM,oBAAoB,EAAE,UAIlC,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAA4T,CAAC;AAE3V,eAAO,MAAM,cAAc,EAAE,UAI5B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAA4H,CAAC;AACzJ,eAAO,MAAM,eAAe,EAAE,UAA2I,CAAC;AAC1K,eAAO,MAAM,oBAAoB,EAAE,UAAyH,CAAC;AAC7J,eAAO,MAAM,mBAAmB,EAAE,UAA+G,CAAC;AAIlJ,eAAO,MAAM,eAAe,EAAE,UAA+Z,CAAC;AAM9b,eAAO,MAAM,kBAAkB,EAAE,UAA4E,CAAC;AAE9G,eAAO,MAAM,iBAAiB,EAAE,UAAyR,CAAC;AAE1T,eAAO,MAAM,cAAc,EAAE,UAA0L,CAAC;AAExN,eAAO,MAAM,oBAAoB,EAAE,UAAuE,CAAC"}

package/lib/mjs/schemas/bodies.js

@@ -0,0 +1,36 @@
+import { commandSchemas, policyBody, ruleBody } from './commands.js';
+import { anyObject, assignmentSubject, nullableDateTime, obj, resourceRef, tags, text } from './primitives.js';
+const { id: _ruleId, ...ruleFields } = ruleBody.properties;
+const { id: _policyId, ...policyFields } = policyBody.properties;
+const writeOptions = {
+    reason: { ...text, description: 'goes to the audit trail' },
+    idempotencyKey: { ...text, description: 'a retried batch with the same key returns the first result' },
+    dryRun: { type: 'boolean', description: 'validate and guard, then roll back' },
+};
+export const AuthzAdminBatch = obj(['commands'], { commands: { type: 'array', items: { oneOf: commandSchemas } }, ...writeOptions }, 'POST /authz/commands: the commands run in one transaction, in order; the first failure rolls the batch back');
+export const AuthzAssignmentGrant = obj(['subject', 'role', 'scope'], { subject: assignmentSubject, role: text, scope: resourceRef, tags, expiresAt: nullableDateTime, replaceLadder: { type: 'boolean' } }, 'POST /authz/assignments: the fields of assignment.grant (reason, idempotencyKey and dryRun go in the query string)');
+export const AuthzAssignmentPatch = {
+    ...obj([], { tags: { ...tags, description: 'replaces the tags' }, addTags: tags, removeTags: tags, expiresAt: nullableDateTime }, 'PATCH /authz/assignments/{id}: at least one key; the keys run as assignment.setTags, addTags, removeTags and setExpiry in one batch'),
+    additionalProperties: false,
+    anyOf: ['tags', 'addTags', 'removeTags', 'expiresAt'].map((k) => ({ required: [k] })),
+};
+export const AuthzLinkCreate = obj(['scope', 'role'], { scope: resourceRef, role: text, tags, expiresAt: nullableDateTime, attributes: anyObject }, 'POST /authz/links: the fields of link.create; the answer carries the token, shown once and sent with Cache-Control: no-store (reason, idempotencyKey and dryRun go in the query string)');
+export const AuthzLinkPatch = {
+    ...obj([], { id: { ...text, description: 'optional; must equal the path id' }, expiresAt: nullableDateTime, attributes: anyObject, role: text, tags: { ...tags, description: 'replaces the tags of the role the link grants' } }, 'PATCH /authz/links/{id}: at least one of expiresAt, attributes, role, tags; runs as one link.update'),
+    additionalProperties: false,
+    anyOf: ['expiresAt', 'attributes', 'role', 'tags'].map((k) => ({ required: [k] })),
+};
+export const AuthzRuleBody = obj(['kind', 'scope'], ruleFields, 'PUT /authz/rules/{id}: a rule; an `id` in the body must equal the path id');
+export const AuthzPolicyBody = obj(['effect', 'permissions'], policyFields, 'PUT /authz/policies/{id}: a policy; an `id` in the body must equal the path id');
+export const AuthzAttributesPatch = { ...anyObject, description: 'PATCH /authz/scopes/{type}/{id}/attributes: deep merge; null deletes a path' };
+export const AuthzAttributesBody = { ...anyObject, description: 'PUT /authz/scopes/{type}/{id}/attributes: replaces all attributes' };
+const errorShape = obj(['code', 'message'], { code: text, message: text, field: { ...text, description: 'the offending field, when one is known' } });
+export const AuthzAdminError = obj(['error'], { error: errorShape }, 'The body of a refused request. Codes: invalid_request, invalid_query, invalid_batch, invalid_command, unknown_role, not_assignable, wrong_scope_type, unknown_ladder, unknown_permission, rule_not_compilable, invalid_attributes, set_cycle, set_too_deep (400); forbidden, escalation, last_holder, self_lockout, protected_role (403); not_found (404); conflict (409)');
+const commandResult = {
+    oneOf: [obj(['ok', 'kind', 'affected'], { ok: { type: 'boolean', enum: [true] }, kind: text, id: text, token: { ...text, description: 'link.create only, shown once' }, affected: { type: 'integer' } }), obj(['ok', 'kind', 'error'], { ok: { type: 'boolean', enum: [false] }, kind: text, error: errorShape })],
+};
+export const AuthzCommandResult = { ...commandResult, description: 'The outcome of one command' };
+export const AuthzAdminResults = obj(['results'], { results: { type: 'array', items: commandResult, description: 'one per command, in order; the first failure ends the list' } }, 'The answer of a write route: 200 when every command succeeded, else the status of the first failure, with the same body');
+export const AuthzAdminPage = obj(['items', 'total'], { items: { type: 'array', items: anyObject }, total: { type: 'integer', description: 'rows matching before paging' } }, 'The answer of a list route');
+export const AuthzAdminAttributes = { ...anyObject, description: 'The attributes of a scope' };
+//# sourceMappingURL=bodies.js.map

package/lib/mjs/schemas/bodies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodies.js","sourceRoot":"","sources":["../../../src/schemas/bodies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG/G,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,UAAwC,CAAC;AACzF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,UAAU,CAAC,UAAwC,CAAC;AAE/F,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC3D,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACtG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE;CAC/E,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,6GAA6G,CAAC,CAAC;AAEhQ,MAAM,CAAC,MAAM,oBAAoB,GAAe,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,oHAAoH,CAAC,CAAC;AAE/U,MAAM,CAAC,MAAM,oBAAoB,GAAe;IAC9C,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,qIAAqI,CAAC;IACxQ,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yLAAyL,CAAC,CAAC;AAE3V,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,+CAA+C,EAAE,EAAE,EAAE,qGAAqG,CAAC;IACxU,oBAAoB,EAAE,KAAK;IAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAe,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,2EAA2E,CAAC,CAAC;AACzJ,MAAM,CAAC,MAAM,eAAe,GAAe,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,gFAAgF,CAAC,CAAC;AAC1K,MAAM,CAAC,MAAM,oBAAoB,GAAe,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,6EAA6E,EAAE,CAAC;AAC7J,MAAM,CAAC,MAAM,mBAAmB,GAAe,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;AAElJ,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAC;AAEtJ,MAAM,CAAC,MAAM,eAAe,GAAe,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,2WAA2W,CAAC,CAAC;AAE9b,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;CACnT,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAe,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;AAE9G,MAAM,CAAC,MAAM,iBAAiB,GAAe,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,4DAA4D,EAAE,EAAE,EAAE,yHAAyH,CAAC,CAAC;AAE1T,MAAM,CAAC,MAAM,cAAc,GAAe,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAExN,MAAM,CAAC,MAAM,oBAAoB,GAAe,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC"}

package/lib/mjs/schemas/commands.d.ts

@@ -0,0 +1,9 @@
+import type { JsonSchema } from './primitives.js';
+/** A rule as `rule.put` takes it; the condition language is described by @spinajs/authz. */
+export declare const ruleBody: JsonSchema;
+/** A policy as `policy.put` takes it. */
+export declare const policyBody: JsonSchema;
+/** The command kinds of AuthzCommand (packages/authz/src/contracts/admin.ts), in declaration order. */
+export declare const COMMAND_KINDS: readonly ['assignment.grant', 'assignment.revoke', 'assignment.revokeWhere', 'assignment.setTags', 'assignment.addTags', 'assignment.removeTags', 'assignment.setExpiry', 'set.addMember', 'set.removeMember', 'link.create', 'link.update', 'link.revoke', 'rule.put', 'rule.delete', 'policy.put', 'policy.delete', 'scope.setAttributes', 'scope.replaceAttributes', 'scope.forget'];
+export declare const commandSchemas: readonly JsonSchema[];
+//# sourceMappingURL=commands.d.ts.map

package/lib/mjs/schemas/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/schemas/commands.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD,4FAA4F;AAC5F,eAAO,MAAM,QAAQ,EAAE,UAsBtB,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,UAAU,EAAE,UAiBxB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,aAAa,YAAI,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,cAAc,CAAU,CAAC;AAErZ,eAAO,MAAM,cAAc,EAAE,SAAS,UAAU,EAoB/C,CAAC"}

package/lib/mjs/schemas/commands.js

@@ -0,0 +1,61 @@
+import { anyObject, assignmentSubject, command, nullableDateTime, obj, principalRef, resourceRef, roleSet, tags, text } from './primitives.js';
+const idOnly = { id: { ...text, description: 'the id of the row' } };
+/** A rule as `rule.put` takes it; the condition language is described by @spinajs/authz. */
+export const ruleBody = obj(['id', 'kind', 'scope'], {
+    id: text,
+    kind: { type: 'string', enum: ['restrict', 'cap', 'threshold'] },
+    scope: resourceRef,
+    resourceTypes: { type: 'array', items: text },
+    subjects: { ...anyObject, description: 'SubjectSelector: principalTypes, actorTypes, refs, rank, when' },
+    when: { ...anyObject, description: 'a Condition' },
+    expiresAt: nullableDateTime,
+    allow: { type: 'array', items: assignmentSubject },
+    ladder: text,
+    maxRole: { description: 'a role id, { ref } or null (drops the assignment)', nullable: true, oneOf: [text, anyObject] },
+    stripTags: { type: 'boolean' },
+    assignments: anyObject,
+    permissions: { type: 'array', items: text },
+    resource: { ...anyObject, description: 'a Condition on the resource' },
+    minRole: { description: 'a role id or { ref }', oneOf: [text, anyObject] },
+    at: text,
+    reason: { ...anyObject, description: 'DenyReason: code, payload, priority, sortKey' },
+}, 'A RBAC rule in SQL form; the server sets `source`');
+/** A policy as `policy.put` takes it. */
+export const policyBody = obj(['id', 'effect', 'permissions'], {
+    id: text,
+    effect: { type: 'string', enum: ['permit', 'deny'] },
+    permissions: { type: 'array', items: text, description: 'permission globs' },
+    resourceTypes: { type: 'array', items: text },
+    principalTypes: { type: 'array', items: text },
+    actorTypes: { type: 'array', items: text },
+    scope: resourceRef,
+    when: { ...anyObject, description: 'a Condition' },
+    fields: { ...anyObject, description: 'a FieldSet' },
+    reason: text,
+    priority: { type: 'integer', description: 'default 500' },
+    expiresAt: nullableDateTime,
+}, 'An ABAC policy; the server sets `source`');
+/** The command kinds of AuthzCommand (packages/authz/src/contracts/admin.ts), in declaration order. */
+export const COMMAND_KINDS = ['assignment.grant', 'assignment.revoke', 'assignment.revokeWhere', 'assignment.setTags', 'assignment.addTags', 'assignment.removeTags', 'assignment.setExpiry', 'set.addMember', 'set.removeMember', 'link.create', 'link.update', 'link.revoke', 'rule.put', 'rule.delete', 'policy.put', 'policy.delete', 'scope.setAttributes', 'scope.replaceAttributes', 'scope.forget'];
+export const commandSchemas = [
+    command('assignment.grant', ['subject', 'role', 'scope'], { subject: assignmentSubject, role: text, scope: resourceRef, tags, expiresAt: nullableDateTime, replaceLadder: { type: 'boolean', description: "revoke the subject's other roles of the same ladder at this scope" } }, 'Grants a role to a subject at a scope'),
+    command('assignment.revoke', ['id'], idOnly, 'Revokes one assignment'),
+    command('assignment.revokeWhere', ['scope'], { scope: resourceRef, subject: assignmentSubject, role: text }, 'Revokes the assignments at a scope, narrowed by subject and role'),
+    command('assignment.setTags', ['id', 'tags'], { ...idOnly, tags }, 'Replaces the tags of an assignment'),
+    command('assignment.addTags', ['id', 'tags'], { ...idOnly, tags }, 'Adds tags to an assignment'),
+    command('assignment.removeTags', ['id', 'tags'], { ...idOnly, tags }, 'Removes tags from an assignment'),
+    command('assignment.setExpiry', ['id', 'expiresAt'], { ...idOnly, expiresAt: nullableDateTime }, 'Sets or clears the expiry of an assignment'),
+    command('set.addMember', ['set', 'member'], { set: roleSet, member: principalRef, expiresAt: nullableDateTime }, 'Adds a principal to a subject set (group.member at group:G)'),
+    command('set.removeMember', ['set', 'member'], { set: roleSet, member: principalRef }, 'Removes a principal from a subject set'),
+    command('link.create', ['scope', 'role'], { scope: resourceRef, role: text, tags, expiresAt: nullableDateTime, attributes: anyObject }, 'Creates a share link; the answer carries its token, shown once'),
+    command('link.update', ['id'], { ...idOnly, expiresAt: nullableDateTime, attributes: anyObject, role: text, tags }, 'Changes a share link'),
+    command('link.revoke', ['id'], idOnly, 'Revokes a share link'),
+    command('rule.put', ['rule'], { rule: ruleBody }, 'Inserts or replaces a RBAC rule by id'),
+    command('rule.delete', ['id'], idOnly, 'Deletes a RBAC rule'),
+    command('policy.put', ['policy'], { policy: policyBody }, 'Inserts or replaces an ABAC policy by id'),
+    command('policy.delete', ['id'], idOnly, 'Deletes an ABAC policy'),
+    command('scope.setAttributes', ['scope', 'patch'], { scope: resourceRef, patch: { ...anyObject, description: 'deep merge; null deletes a path' } }, 'Merges a patch into the attributes of a scope'),
+    command('scope.replaceAttributes', ['scope', 'attributes'], { scope: resourceRef, attributes: anyObject }, 'Replaces the attributes of a scope'),
+    command('scope.forget', ['scope'], { scope: resourceRef }, 'Removes everything held AT a scope node (assignments, links, rules, policies, attributes)'),
+];
+//# sourceMappingURL=commands.js.map

package/lib/mjs/schemas/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/schemas/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG/I,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,EAAE,CAAC;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,QAAQ,GAAe,GAAG,CACrC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EACvB;IACE,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE;IAChE,KAAK,EAAE,WAAW;IAClB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IAC7C,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE;IACxG,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IAClD,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAClD,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;IACvH,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IAC3C,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACtE,OAAO,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;IAC1E,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,8CAA8C,EAAE;CACtF,EACD,mDAAmD,CACpD,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,UAAU,GAAe,GAAG,CACvC,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,EAC/B;IACE,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;IACpD,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IAC7C,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IAC1C,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IAClD,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE;IACnD,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE;IACzD,SAAS,EAAE,gBAAgB;CAC5B,EACD,0CAA0C,CAC3C,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,cAAc,CAAU,CAAC;AAErZ,MAAM,CAAC,MAAM,cAAc,GAA0B;IACnD,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE,EAAE,EAAE,uCAAuC,CAAC;IAC3T,OAAO,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC;IACtE,OAAO,CAAC,wBAAwB,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,kEAAkE,CAAC;IAChL,OAAO,CAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,oCAAoC,CAAC;IACxG,OAAO,CAAC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,4BAA4B,CAAC;IAChG,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC;IACxG,OAAO,CAAC,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,4CAA4C,CAAC;IAC9I,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,6DAA6D,CAAC;IAC/K,OAAO,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,wCAAwC,CAAC;IAChI,OAAO,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,gEAAgE,CAAC;IACzM,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC;IAC3I,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC;IAC9D,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC;IAC1F,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC;IAC7D,OAAO,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,0CAA0C,CAAC;IACrG,OAAO,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC;IAClE,OAAO,CAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,iCAAiC,EAAE,EAAE,EAAE,+CAA+C,CAAC;IACpM,OAAO,CAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,oCAAoC,CAAC;IAChJ,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,2FAA2F,CAAC;CACxJ,CAAC"}

package/lib/mjs/schemas/document.d.ts

@@ -0,0 +1,19 @@
+interface RouteDoc {
+    readonly method: 'get' | 'post' | 'put' | 'patch' | 'delete';
+    readonly path: string;
+    readonly body?: string;
+    readonly query?: readonly string[];
+    readonly requiredQuery?: readonly string[];
+}
+/** What each route takes that the controller's signature cannot say: its body and its query string. */
+export declare const AUTHZ_ADMIN_ROUTES: readonly RouteDoc[];
+/**
+ * http-swagger describes a route's body and query string from decorated arguments, and the admin
+ * routes read both from `@Req()` so that no http-layer step can refuse what AuthzAdmin would answer.
+ * This adds what the builder cannot see to an OpenAPI document it built: the request bodies, the
+ * query parameters, the path parameter text and the body schemas as components. Operations are
+ * matched by method and path suffix, so a route prefix does not matter. Changes the document in place.
+ */
+export declare function describeAuthzAdminDocument<T extends object>(doc: T): T;
+export {};
+//# sourceMappingURL=document.d.ts.map

package/lib/mjs/schemas/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/schemas/document.ts"],"names":[],"mappings":"AAIA,UAAU,QAAQ;IAChB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAuBD,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,EAAE,SAAS,QAAQ,EAoBjD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAmBtE"}

package/lib/mjs/schemas/document.js

@@ -0,0 +1,72 @@
+import { AUTHZ_ADMIN_SCHEMAS } from './provider.js';
+const WRITE_OPTIONS = ['reason', 'idempotencyKey', 'dryRun'];
+const QUERY = {
+    scope: { schema: { type: 'string' }, description: '`<type>` or `<type>:<id>`, split at the first `:`; `$global` is the global scope' },
+    subject: { schema: { type: 'string' }, description: '`<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set)' },
+    role: { schema: { type: 'string' }, description: 'only assignments of this role' },
+    permission: { schema: { type: 'string' }, description: 'the permission whose holders are listed (required)' },
+    expandSets: { schema: { type: 'boolean' }, description: '`true` also lists the members of each subject set, next to the set itself' },
+    includeExpired: { schema: { type: 'boolean' }, description: '`true` or `false`' },
+    limit: { schema: { type: 'integer', minimum: 0 }, description: 'page size; the server sets the default' },
+    offset: { schema: { type: 'integer', minimum: 0 }, description: 'rows to skip' },
+    reason: { schema: { type: 'string' }, description: 'goes to the audit trail' },
+    idempotencyKey: { schema: { type: 'string' }, description: 'a retried request with the same key returns the first result' },
+    dryRun: { schema: { type: 'boolean' }, description: '`true` validates and guards, then rolls back' },
+};
+const PATH_PARAMS = {
+    id: 'the id of the row (assignment, link, rule, policy) or of the scope node',
+    type: 'the resource type of the scope node',
+};
+/** What each route takes that the controller's signature cannot say: its body and its query string. */
+export const AUTHZ_ADMIN_ROUTES = [
+    { method: 'post', path: '/authz/commands', body: 'AuthzAdminBatch' },
+    { method: 'get', path: '/authz/assignments', query: ['scope', 'subject', 'role', 'includeExpired', 'limit', 'offset'] },
+    { method: 'get', path: '/authz/holders', query: ['scope', 'permission', 'expandSets', 'limit', 'offset'], requiredQuery: ['scope', 'permission'] },
+    { method: 'post', path: '/authz/assignments', body: 'AuthzAssignmentGrant', query: WRITE_OPTIONS },
+    { method: 'patch', path: '/authz/assignments/{id}', body: 'AuthzAssignmentPatch', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/assignments/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/links', query: ['scope', 'limit', 'offset'] },
+    { method: 'post', path: '/authz/links', body: 'AuthzLinkCreate', query: WRITE_OPTIONS },
+    { method: 'patch', path: '/authz/links/{id}', body: 'AuthzLinkPatch', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/links/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/rules', query: ['scope', 'limit', 'offset'] },
+    { method: 'put', path: '/authz/rules/{id}', body: 'AuthzRuleBody', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/rules/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/policies', query: ['scope', 'limit', 'offset'] },
+    { method: 'put', path: '/authz/policies/{id}', body: 'AuthzPolicyBody', query: WRITE_OPTIONS },
+    { method: 'delete', path: '/authz/policies/{id}', query: WRITE_OPTIONS },
+    { method: 'get', path: '/authz/scopes/{type}/{id}/attributes' },
+    { method: 'patch', path: '/authz/scopes/{type}/{id}/attributes', body: 'AuthzAttributesPatch', query: WRITE_OPTIONS },
+    { method: 'put', path: '/authz/scopes/{type}/{id}/attributes', body: 'AuthzAttributesBody', query: WRITE_OPTIONS },
+];
+/**
+ * http-swagger describes a route's body and query string from decorated arguments, and the admin
+ * routes read both from `@Req()` so that no http-layer step can refuse what AuthzAdmin would answer.
+ * This adds what the builder cannot see to an OpenAPI document it built: the request bodies, the
+ * query parameters, the path parameter text and the body schemas as components. Operations are
+ * matched by method and path suffix, so a route prefix does not matter. Changes the document in place.
+ */
+export function describeAuthzAdminDocument(doc) {
+    const document = doc;
+    const components = ((document.components ??= {}).schemas ??= {});
+    for (const [name, schema] of Object.entries(AUTHZ_ADMIN_SCHEMAS))
+        components[name] ??= schema;
+    for (const route of AUTHZ_ADMIN_ROUTES) {
+        const path = Object.keys(document.paths ?? {}).find((p) => p === route.path || p.endsWith(route.path));
+        const operation = path ? document.paths[path][route.method] : undefined;
+        if (!operation)
+            continue;
+        if (route.body)
+            operation.requestBody = { required: true, content: { 'application/json': { schema: { $ref: `#/components/schemas/${route.body}` } } } };
+        const parameters = (operation.parameters ??= []);
+        for (const p of parameters)
+            if (p.in === 'path' && !p.description)
+                p.description = PATH_PARAMS[p.name];
+        for (const name of route.query ?? []) {
+            if (!parameters.some((p) => p.in === 'query' && p.name === name))
+                parameters.push({ name, in: 'query', required: route.requiredQuery?.includes(name) === true, ...QUERY[name] });
+        }
+    }
+    return doc;
+}
+//# sourceMappingURL=document.js.map

package/lib/mjs/schemas/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../src/schemas/document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAYpD,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU,CAAC;AAEtE,MAAM,KAAK,GAAmC;IAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE;IACtI,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,yEAAyE,EAAE;IAC/H,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAClF,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,oDAAoD,EAAE;IAC7G,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE;IACrI,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE;IACzG,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;IAChF,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC9E,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE;IAC3H,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE;CACrG,CAAC;AAEF,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,yEAAyE;IAC7E,IAAI,EAAE,qCAAqC;CAC5C,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAwB;IACrD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACpE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IACvH,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;IAClJ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IAClG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACxG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC3E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE;IACvF,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC5F,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE;IACzF,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;IAC/E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE;IAC9F,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACxE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC/D,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE;IACrH,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;CACnH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAmB,GAAM;IACjE,MAAM,QAAQ,GAAG,GAAW,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,OAAO,KAAK,EAAE,CAAS,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;IAE9F,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,IAAI,KAAK,CAAC,IAAI;YAAE,SAAS,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAExJ,MAAM,UAAU,GAAW,CAAC,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvG,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/mjs/schemas/index.d.ts

@@ -0,0 +1,6 @@
+export type { JsonSchema } from './primitives.js';
+export * from './commands.js';
+export * from './bodies.js';
+export * from './provider.js';
+export * from './document.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC"}

package/lib/mjs/schemas/index.js

@@ -0,0 +1,5 @@
+export * from './commands.js';
+export * from './bodies.js';
+export * from './provider.js';
+export * from './document.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AACA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC"}

package/lib/mjs/schemas/primitives.d.ts

@@ -0,0 +1,13 @@
+export type JsonSchema = Record<string, unknown>;
+export declare const text: JsonSchema;
+export declare const nullableDateTime: JsonSchema;
+export declare const tags: JsonSchema;
+export declare const anyObject: JsonSchema;
+export declare const resourceRef: JsonSchema;
+export declare const principalRef: JsonSchema;
+export declare const roleSet: JsonSchema;
+export declare const subjectSet: JsonSchema;
+export declare const assignmentSubject: JsonSchema;
+export declare function obj(required: readonly string[], properties: Record<string, JsonSchema>, description?: string): JsonSchema;
+export declare function command(kind: string, required: readonly string[], properties: Record<string, JsonSchema>, description: string): JsonSchema;
+//# sourceMappingURL=primitives.d.ts.map

package/lib/mjs/schemas/primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,eAAO,MAAM,IAAI,EAAE,UAA+B,CAAC;AACnD,eAAO,MAAM,gBAAgB,EAAE,UAAmK,CAAC;AACnM,eAAO,MAAM,IAAI,EAAE,UAA2C,CAAC;AAC/D,eAAO,MAAM,SAAS,EAAE,UAA2D,CAAC;AAEpF,eAAO,MAAM,WAAW,EAAE,UAIzB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,UAI1B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,UAA4G,CAAC;AAEnI,eAAO,MAAM,UAAU,EAAE,UAAgF,CAAC;AAE1G,eAAO,MAAM,iBAAiB,EAAE,UAAmH,CAAC;AAEpJ,wBAAgB,GAAG,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAEzH;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAE1I"}

package/lib/mjs/schemas/primitives.js

@@ -0,0 +1,24 @@
+export const text = { type: 'string' };
+export const nullableDateTime = { type: 'string', format: 'date-time', nullable: true, description: 'ISO 8601 date-time with Z or an offset, read as a Date; null clears the expiry' };
+export const tags = { type: 'array', items: text };
+export const anyObject = { type: 'object', additionalProperties: true };
+export const resourceRef = {
+    type: 'object',
+    required: ['type'],
+    properties: { type: text, id: { ...text, description: 'absent for a type-level scope' } },
+};
+export const principalRef = {
+    type: 'object',
+    required: ['type', 'id'],
+    properties: { type: text, id: text },
+};
+export const roleSet = { type: 'object', required: ['role', 'scope'], properties: { role: text, scope: resourceRef } };
+export const subjectSet = { type: 'object', required: ['set'], properties: { set: roleSet } };
+export const assignmentSubject = { description: 'A principal, or the holders of a role at a scope', oneOf: [principalRef, subjectSet] };
+export function obj(required, properties, description) {
+    return { type: 'object', ...(description ? { description } : {}), ...(required.length ? { required } : {}), properties };
+}
+export function command(kind, required, properties, description) {
+    return obj(['kind', ...required], { kind: { type: 'string', enum: [kind] }, ...properties }, description);
+}
+//# sourceMappingURL=primitives.js.map

package/lib/mjs/schemas/primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;AACnM,MAAM,CAAC,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AAEpF,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,EAAE;CAC1F,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAe;IACtC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;AAEnI,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;AAE1G,MAAM,CAAC,MAAM,iBAAiB,GAAe,EAAE,WAAW,EAAE,kDAAkD,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;AAEpJ,MAAM,UAAU,GAAG,CAAC,QAA2B,EAAE,UAAsC,EAAE,WAAoB;IAC3G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,QAA2B,EAAE,UAAsC,EAAE,WAAmB;IAC5H,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC5G,CAAC"}

package/lib/mjs/schemas/provider.d.ts

@@ -0,0 +1,13 @@
+import { SchemaProvider } from '@spinajs/validation';
+import type { JsonSchema } from './primitives.js';
+/** Every schema of the admin routes by name, as the swagger document names them. */
+export declare const AUTHZ_ADMIN_SCHEMAS: Readonly<Record<string, JsonSchema>>;
+/**
+ * Serves the schemas to http-swagger by the type names the controller's `@response` tags use.
+ * Nothing but the swagger builder asks a SchemaProvider: request validation reads `@Schema`
+ * metadata and route argument schemas, neither of which these routes carry.
+ */
+export declare class AuthzAdminSchemaProvider extends SchemaProvider {
+    getSchema(typeName: string): Record<string, unknown> | undefined;
+}
+//# sourceMappingURL=provider.d.ts.map

package/lib/mjs/schemas/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/schemas/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAiB,CAAC;AAEvF;;;;GAIG;AACH,qBACa,wBAAyB,SAAQ,cAAc;IACnD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAEtE;CACF"}