@spinajs/authz-http-admin 3.0.12 → 3.0.14

package/lib/cjs/controllers/AuthzAdminController.js

@@ -18,112 +18,63 @@ const configuration_1 = require("@spinajs/configuration");
 const di_1 = require("@spinajs/di");
 const http_1 = require("@spinajs/http");
 const authz_http_1 = require("@spinajs/authz-http");
-const util_1 = require("@spinajs/util");
+const exceptions_1 = require("@spinajs/exceptions");
+const validation_1 = require("@spinajs/validation");
 require("../schemas/provider.js");
+const assignments_js_1 = require("../dto/assignments.js");
+const attributes_js_1 = require("../dto/attributes.js");
+const links_js_1 = require("../dto/links.js");
+const params_js_1 = require("../dto/params.js");
+const queries_js_1 = require("../dto/queries.js");
+const rules_js_1 = require("../dto/rules.js");
+const answers_js_1 = require("../routes/answers.js");
+const args_js_1 = require("../routes/args.js");
 const decode_js_1 = require("../routes/decode.js");
+const no_store_js_1 = require("../routes/no-store.js");
 const query_js_1 = require("../routes/query.js");
 const status_js_1 = require("../routes/status.js");
-const PATCH_KEYS = ['tags', 'addTags', 'removeTags', 'expiresAt'];
 const PATCH_KINDS = { tags: 'assignment.setTags', addTags: 'assignment.addTags', removeTags: 'assignment.removeTags' };
-function respond(status, body) {
-    switch (status) {
-        case 200:
-            return new http_1.Ok(body);
-        case 403:
-            return new http_1.ForbiddenResponse(body);
-        case 404:
-            return new http_1.NotFound(body);
-        case 409:
-            return new http_1.Conflict(body);
-        case 500:
-            return new http_1.ServerError(body);
-        default:
-            return new http_1.BadRequestResponse(body);
-    }
-}
-function refused(e) {
-    return respond((0, status_js_1.adminErrorStatus)(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
-}
-function badRequest(message, field) {
-    throw new authz_1.AuthzAdminFailure('invalid_request', message, field);
-}
-function objectBody(body, what) {
-    if (!(0, util_1.isPlainObject)(body))
-        badRequest(`the body must be ${what}`);
-    return body;
-}
-/** The body of PUT /authz/rules/:id or /authz/policies/:id with the path id; an id in the body must equal it. */
-function withPathId(body, id, what) {
-    const o = objectBody(body, what);
-    if (o.id !== undefined && o.id !== id)
-        badRequest(`the body id ${JSON.stringify(o.id)} is not the path id ${JSON.stringify(id)}`, 'id');
-    return { ...o, id };
+/** A body the route runs under its path id; an id in the body must equal it. */
+function withPathId(body, id) {
+    if (body.id !== undefined && body.id !== id)
+        throw new authz_1.AuthzAdminFailure('invalid_request', `the body id ${JSON.stringify(body.id)} is not the path id ${JSON.stringify(id)}`, 'id');
+    return { ...body, id };
 }
 // The routes serve the RBAC and ABAC commands, whose AuthzCommandMap entries this package does not import.
 const byId = (kind, id) => ({ kind, id });
-const LINK_PATCH_KEYS = ['expiresAt', 'attributes', 'role', 'tags'];
-/** PATCH /authz/links/:id as one link.update; like the assignment patch, a key it does not serve is refused, not ignored. */
-function linkUpdate(body, id) {
-    const patch = withPathId(body, id, 'an object { expiresAt?, attributes?, role?, tags? }');
-    const unknown = Object.keys(patch).find((k) => k !== 'id' && !LINK_PATCH_KEYS.includes(k));
-    if (unknown !== undefined)
-        badRequest(`a link patch takes ${LINK_PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
-    if (!LINK_PATCH_KEYS.some((k) => k in patch))
-        badRequest(`a link patch needs one of ${LINK_PATCH_KEYS.join(', ')}`);
-    return (0, decode_js_1.decodeCommand)({ ...patch, kind: 'link.update' });
-}
-/** For answers that may hold a link token: no proxy or browser cache may keep one. Set first, so it goes out with any answer the route gives. */
-function noStore(req) {
-    req.res?.setHeader('Cache-Control', 'no-store');
-    req.res?.setHeader('Pragma', 'no-cache');
-}
-const query = (req) => (req.query ?? {});
-const param = (req, name) => req.params[name];
-const actorOf = (req) => req.storage.Principal;
-const scopeOf = (req) => ({ type: param(req, 'type'), id: param(req, 'id') });
+const asCommand = (c) => (0, decode_js_1.decodeCommand)(c);
 /**
  * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
  *
  * The routes check authentication only: the actor is always the request principal, and every
- * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
- * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
- * `{ results }`, one entry per command.
+ * permission and guard check runs in AuthzAdmin, as for an in-process caller (design §6.6.5). The
+ * inputs are DTOs checked against their schemas first; a refused request answers
+ * `{ error: { code, message, field? } }`, a write `{ results }`, one entry per command.
  *
  * @tags Authz admin
  */
 let AuthzAdminController = class AuthzAdminController extends http_1.BaseController {
     /**
-     * Runs a route on the AuthzAdmin of the domain the AuthzDomainResolver names for `req`, `authz.http.admin.domain` being its fallback and the domain without a request.
-     * An AuthzAdminFailure becomes its status with `{ error }`, a domain no live domain bears 403 `unknown_domain`, anything else propagates.
+     * Runs a route on the AuthzAdmin of `domain` (the one `@AdminDomain()` resolved), `authz.http.admin.domain` without one.
+     * An AuthzAdminFailure becomes its status with `{ error }`, anything else propagates.
      */
-    async guarded(fn, req) {
-        let admin;
-        try {
-            admin = (await this.Domains.service(req ? await (0, authz_http_1.resolveAuthzDomain)(req, this.AdminDomain) : this.AdminDomain)).admin();
-        }
-        catch (e) {
-            if (e instanceof authz_http_1.UnknownAuthzDomain)
-                return respond(403, { error: { code: 'unknown_domain', message: e.message } });
-            throw e;
-        }
+    async guarded(fn, domain) {
+        const admin = (await this.Domains.service(domain ?? this.AdminDomain)).admin();
         try {
             return await fn(admin);
         }
         catch (e) {
             if (e instanceof authz_1.AuthzAdminFailure)
-                return refused(e);
+                return (0, answers_js_1.refused)(e);
             throw e;
         }
     }
     /** One batch built from the route, with the options of the query string. */
-    single(req, build) {
-        return this.guarded(async (admin) => {
-            const opts = (0, query_js_1.readWriteOptions)(query(req));
-            return results(await admin.execute(actorOf(req), build(), opts));
-        }, req);
+    single(domain, actor, options, build) {
+        return this.guarded(async (admin) => results(await admin.execute(actor, build(), (0, query_js_1.readWriteOptions)(options))), domain);
     }
-    list(req, build) {
-        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())), req);
+    list(domain, actor, build) {
+        return this.guarded(async (admin) => (0, answers_js_1.respond)(200, await admin.list(actor, build())), domain);
     }
     /**
      * Run a batch of commands
@@ -138,16 +89,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async commands(req) {
-        noStore(req);
-        return this.guarded(async (admin) => {
-            const body = objectBody(req.body, 'an object { commands, reason?, idempotencyKey?, dryRun? }');
-            const opts = {};
-            for (const key of ['reason', 'idempotencyKey', 'dryRun'])
-                if (key in body)
-                    opts[key] = body[key];
-            return results(await admin.execute(actorOf(req), (0, decode_js_1.decodeCommands)(body.commands), opts));
-        }, req);
+    async commands(domain, actor, batch) {
+        return this.guarded(async (admin) => results(await admin.execute(actor, batch.commands, batch.options)), domain);
     }
     /**
      * List assignments
@@ -158,8 +101,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listAssignments(req) {
-        return this.list(req, () => (0, query_js_1.readAssignmentsQuery)(query(req)));
+    async listAssignments(domain, actor, query) {
+        return this.list(domain, actor, () => (0, query_js_1.readAssignmentsQuery)(query));
     }
     /**
      * List holders
@@ -170,8 +113,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
      */
-    async listHolders(req) {
-        return this.list(req, () => (0, query_js_1.readHoldersQuery)(query(req)));
+    async listHolders(domain, actor, query) {
+        return this.list(domain, actor, () => (0, query_js_1.readHoldersQuery)(query));
     }
     /**
      * Grant a role
@@ -186,8 +129,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async grant(req) {
-        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ ...objectBody(req.body, 'the fields of assignment.grant'), kind: 'assignment.grant' })]);
+    async grant(domain, actor, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...body, kind: 'assignment.grant' })]);
     }
     /**
      * Change an assignment
@@ -202,21 +145,14 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchAssignment(req) {
-        return this.single(req, () => {
-            const body = objectBody(req.body, 'an object { tags?, addTags?, removeTags?, expiresAt? }');
-            const unknown = Object.keys(body).find((k) => !PATCH_KEYS.includes(k));
-            if (unknown !== undefined)
-                badRequest(`an assignment patch takes ${PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
-            const id = param(req, 'id');
+    async patchAssignment(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => {
             const commands = [];
             for (const key of ['tags', 'addTags', 'removeTags'])
-                if (key in body)
+                if (body[key] !== undefined)
                     commands.push({ kind: PATCH_KINDS[key], id, tags: body[key] });
-            if ('expiresAt' in body)
-                commands.push((0, decode_js_1.decodeCommand)({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
-            if (commands.length === 0)
-                badRequest(`an assignment patch needs one of ${PATCH_KEYS.join(', ')}`);
+            if (body.expiresAt !== undefined)
+                commands.push(asCommand({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
             return commands;
         });
     }
@@ -232,8 +168,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async revoke(req) {
-        return this.single(req, () => [byId('assignment.revoke', param(req, 'id'))]);
+    async revoke(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('assignment.revoke', id)]);
     }
     /**
      * List share links
@@ -244,8 +180,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listLinks(req) {
-        return this.list(req, () => (0, query_js_1.readPageQuery)('links', query(req)));
+    async listLinks(domain, actor, query) {
+        return this.list(domain, actor, () => (0, query_js_1.readPageQuery)('links', query));
     }
     /**
      * Create a share link
@@ -260,9 +196,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async createLink(req) {
-        noStore(req);
-        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ ...objectBody(req.body, 'the fields of link.create'), kind: 'link.create' })]);
+    async createLink(domain, actor, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...body, kind: 'link.create' })]);
     }
     /**
      * Change a share link
@@ -277,8 +212,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchLink(req) {
-        return this.single(req, () => [linkUpdate(req.body, param(req, 'id'))]);
+    async patchLink(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...withPathId(body, id), kind: 'link.update' })]);
     }
     /**
      * Revoke a share link
@@ -292,8 +227,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async revokeLink(req) {
-        return this.single(req, () => [byId('link.revoke', param(req, 'id'))]);
+    async revokeLink(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('link.revoke', id)]);
     }
     /**
      * List rules
@@ -304,8 +239,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listRules(req) {
-        return this.list(req, () => (0, query_js_1.readPageQuery)('rules', query(req)));
+    async listRules(domain, actor, query) {
+        return this.list(domain, actor, () => (0, query_js_1.readPageQuery)('rules', query));
     }
     /**
      * Put a rule
@@ -320,8 +255,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async putRule(req) {
-        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ kind: 'rule.put', rule: withPathId(req.body, param(req, 'id'), 'a rule') })]);
+    async putRule(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ kind: 'rule.put', rule: withPathId(body, id) })]);
     }
     /**
      * Delete a rule
@@ -335,8 +270,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async deleteRule(req) {
-        return this.single(req, () => [byId('rule.delete', param(req, 'id'))]);
+    async deleteRule(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('rule.delete', id)]);
     }
     /**
      * List policies
@@ -347,8 +282,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listPolicies(req) {
-        return this.list(req, () => (0, query_js_1.readPageQuery)('policies', query(req)));
+    async listPolicies(domain, actor, query) {
+        return this.list(domain, actor, () => (0, query_js_1.readPageQuery)('policies', query));
     }
     /**
      * Put a policy
@@ -363,8 +298,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async putPolicy(req) {
-        return this.single(req, () => [(0, decode_js_1.decodeCommand)({ kind: 'policy.put', policy: withPathId(req.body, param(req, 'id'), 'a policy') })]);
+    async putPolicy(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ kind: 'policy.put', policy: withPathId(body, id) })]);
     }
     /**
      * Delete a policy
@@ -378,8 +313,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async deletePolicy(req) {
-        return this.single(req, () => [byId('policy.delete', param(req, 'id'))]);
+    async deletePolicy(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('policy.delete', id)]);
     }
     /**
      * Read scope attributes
@@ -389,8 +324,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async attributes(req) {
-        return this.list(req, () => ({ kind: 'attributes', scope: scopeOf(req) }));
+    async attributes(domain, actor, type, id) {
+        return this.list(domain, actor, () => ({ kind: 'attributes', scope: { type, id } }));
     }
     /**
      * Merge scope attributes
@@ -405,8 +340,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchAttributes(req) {
-        return this.single(req, () => [{ kind: 'scope.setAttributes', scope: scopeOf(req), patch: req.body }]);
+    async patchAttributes(domain, actor, type, id, body, options) {
+        return this.single(domain, actor, options, () => [{ kind: 'scope.setAttributes', scope: { type, id }, patch: { ...body } }]);
     }
     /**
      * Replace scope attributes
@@ -421,8 +356,8 @@ let AuthzAdminController = class AuthzAdminController extends http_1.BaseControl
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async replaceAttributes(req) {
-        return this.single(req, () => [{ kind: 'scope.replaceAttributes', scope: scopeOf(req), attributes: req.body }]);
+    async replaceAttributes(domain, actor, type, id, body, options) {
+        return this.single(domain, actor, options, () => [{ kind: 'scope.replaceAttributes', scope: { type, id }, attributes: { ...body } }]);
     }
 };
 exports.AuthzAdminController = AuthzAdminController;
@@ -436,142 +371,204 @@ __decorate([
 ], AuthzAdminController.prototype, "Domains", void 0);
 __decorate([
     (0, http_1.Post)('commands'),
-    __param(0, (0, http_1.Req)()),
+    (0, http_1.Middleware)(no_store_js_1.NoStore),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminBatch)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "commands", null);
 __decorate([
     (0, http_1.Get)('assignments'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, queries_js_1.AuthzAssignmentsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listAssignments", null);
 __decorate([
     (0, http_1.Get)('holders'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, queries_js_1.AuthzHoldersQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listHolders", null);
 __decorate([
     (0, http_1.Post)('assignments'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Body)({ required: true })),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, assignments_js_1.AuthzAssignmentGrant, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "grant", null);
 __decorate([
     (0, http_1.Patch)('assignments/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, http_1.Body)({ required: true })),
+    __param(4, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, assignments_js_1.AuthzAssignmentPatch, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchAssignment", null);
 __decorate([
     (0, http_1.Del)('assignments/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "revoke", null);
 __decorate([
     (0, http_1.Get)('links'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, queries_js_1.AuthzListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listLinks", null);
 __decorate([
     (0, http_1.Post)('links'),
-    __param(0, (0, http_1.Req)()),
+    (0, http_1.Middleware)(no_store_js_1.NoStore),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Body)({ required: true })),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, links_js_1.AuthzLinkCreate, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "createLink", null);
 __decorate([
     (0, http_1.Patch)('links/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, http_1.Body)({ required: true })),
+    __param(4, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, links_js_1.AuthzLinkPatch, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchLink", null);
 __decorate([
     (0, http_1.Del)('links/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "revokeLink", null);
 __decorate([
     (0, http_1.Get)('rules'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, queries_js_1.AuthzListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listRules", null);
 __decorate([
     (0, http_1.Put)('rules/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, http_1.Body)({ required: true })),
+    __param(4, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, rules_js_1.AuthzRuleBody, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "putRule", null);
 __decorate([
     (0, http_1.Del)('rules/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "deleteRule", null);
 __decorate([
     (0, http_1.Get)('policies'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, queries_js_1.AuthzOffsetListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listPolicies", null);
 __decorate([
     (0, http_1.Put)('policies/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, http_1.Body)({ required: true })),
+    __param(4, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, rules_js_1.AuthzPolicyBody, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "putPolicy", null);
 __decorate([
     (0, http_1.Del)('policies/:id'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(3, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "deletePolicy", null);
 __decorate([
     (0, http_1.Get)('scopes/:type/:id/attributes'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.TYPE_PARAM)),
+    __param(3, (0, http_1.Param)(params_js_1.ID_PARAM)),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "attributes", null);
 __decorate([
     (0, http_1.Patch)('scopes/:type/:id/attributes'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.TYPE_PARAM)),
+    __param(3, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(4, (0, args_js_1.AdminBody)()),
+    __param(5, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String, attributes_js_1.AuthzAttributesPatch, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchAttributes", null);
 __decorate([
     (0, http_1.Put)('scopes/:type/:id/attributes'),
-    __param(0, (0, http_1.Req)()),
+    __param(0, (0, args_js_1.AdminDomain)()),
+    __param(1, (0, authz_http_1.CurrentPrincipal)()),
+    __param(2, (0, http_1.Param)(params_js_1.TYPE_PARAM)),
+    __param(3, (0, http_1.Param)(params_js_1.ID_PARAM)),
+    __param(4, (0, args_js_1.AdminBody)()),
+    __param(5, (0, args_js_1.AdminQuery)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String, attributes_js_1.AuthzAttributesBody, queries_js_1.AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "replaceAttributes", null);
 exports.AuthzAdminController = AuthzAdminController = __decorate([
     (0, http_1.Policy)(authz_http_1.IsAuthenticated),
-    (0, http_1.BasePath)({ config: 'authz.http.admin.basePath', default: 'authz' })
+    (0, http_1.BasePath)({ config: 'authz.http.admin.basePath', default: 'authz' }),
+    (0, http_1.OnError)([validation_1.ValidationFailed, exceptions_1.InvalidArgument, authz_1.AuthzAdminFailure, authz_http_1.UnknownAuthzDomain], answers_js_1.adminInputAnswer, { stages: ['arguments'] })
 ], AuthzAdminController);
 function results(r) {
-    return respond((0, status_js_1.resultsStatus)(r), { results: r });
+    return (0, answers_js_1.respond)((0, status_js_1.resultsStatus)(r), { results: r });
 }
 //# sourceMappingURL=AuthzAdminController.js.map