@spinajs/authz-http-admin 3.0.12 → 3.0.14

package/lib/cjs/dto/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/dto/rules.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0CAAwC;AACxC,oDAA6C;AAE7C,wDAA8D;AAE9D,yCAA6C;AAE7C,MAAM,cAAc,GAAG,CAAC,IAAgB,EAA8B,EAAE;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAwC,CAAC;IACjE,OAAO,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,EAAE,CAAC;AACtG,CAAC,CAAC;AAEW,QAAA,gBAAgB,GAAG,EAAE,GAAG,IAAA,cAAM,EAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,sBAAQ,CAAC,EAAE,2BAA2B,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;AAErM,QAAA,kBAAkB,GAAG,EAAE,GAAG,IAAA,cAAM,EAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,wBAAU,CAAC,EAAE,6BAA6B,CAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;AAErO,wFAAwF;AAEjF,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,0BAAe;CAGjD,CAAA;;wBAHY,aAAa;IADzB,IAAA,mBAAM,EAAC,QAAA,gBAAgB,CAAC;GACZ,aAAa,CAGzB;AAED,gGAAgG;AAEzF,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,0BAAe;CAGnD,CAAA;;0BAHY,eAAe;IAD3B,IAAA,mBAAM,EAAC,QAAA,kBAAkB,CAAC;GACd,eAAe,CAG3B"}

package/lib/cjs/index.d.ts

@@ -1,4 +1,5 @@
 export * from './controllers/AuthzAdminController.js';
+export * from './dto/index.js';
 export * from './routes/index.js';
 export * from './schemas/index.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/lib/cjs/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./controllers/AuthzAdminController.js"), exports);
+__exportStar(require("./dto/index.js"), exports);
 __exportStar(require("./routes/index.js"), exports);
 __exportStar(require("./schemas/index.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wEAAsD;AACtD,oDAAkC;AAClC,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wEAAsD;AACtD,iDAA+B;AAC/B,oDAAkC;AAClC,qDAAmC"}

package/lib/cjs/routes/answers.d.ts

@@ -0,0 +1,22 @@
+import { AuthzAdminFailure } from '@spinajs/authz';
+import type { Response } from '@spinajs/http';
+import type { IValidationError } from '@spinajs/validation';
+export declare function respond(status: number, body: unknown): Response;
+/** The answer of an AuthzAdminFailure: its status with `{ error: { code, message, field? } }`. */
+export declare function refused(e: AuthzAdminFailure): Response;
+/**
+ * The failure `code` for input that broke its schema, naming the first offending field. `prefix` is
+ * the path of the validated value inside the request (a command of a batch), `fallbackField` the
+ * name of a scalar input such as a path parameter. Messages never quote the input.
+ */
+export declare function inputFailure(code: string, errors: readonly IValidationError[] | null, prefix?: readonly string[], fallbackField?: string): AuthzAdminFailure;
+/**
+ * `@OnError` handler of the admin routes for the arguments stage (D2): input that breaks its schema
+ * answers the route's `{ error: { code, field } }`, as AuthzAdmin's own refusals do.
+ * - ValidationFailed of a body or a path parameter: 400 invalid_request.
+ * - InvalidArgument (a body that is not JSON): 400 invalid_request.
+ * - AuthzAdminFailure from the query, batch and body args: its code and status.
+ * - UnknownAuthzDomain: 403 unknown_domain.
+ */
+export declare function adminInputAnswer(err: Error): Response | undefined;
+//# sourceMappingURL=answers.d.ts.map

package/lib/cjs/routes/answers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers.d.ts","sourceRoot":"","sources":["../../../src/routes/answers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAInD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI5D,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAe/D;AAED,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,CAAC,EAAE,iBAAiB,GAAG,QAAQ,CAEtD;AAuDD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EAAE,MAAM,GAAE,SAAS,MAAM,EAAO,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAMhK;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAUjE"}

package/lib/cjs/routes/answers.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.respond = respond;
+exports.refused = refused;
+exports.inputFailure = inputFailure;
+exports.adminInputAnswer = adminInputAnswer;
+const authz_1 = require("@spinajs/authz");
+const authz_http_1 = require("@spinajs/authz-http");
+const exceptions_1 = require("@spinajs/exceptions");
+const http_1 = require("@spinajs/http");
+const validation_1 = require("@spinajs/validation");
+const status_js_1 = require("./status.js");
+function respond(status, body) {
+    switch (status) {
+        case 200:
+            return new http_1.Ok(body);
+        case 403:
+            return new http_1.ForbiddenResponse(body);
+        case 404:
+            return new http_1.NotFound(body);
+        case 409:
+            return new http_1.Conflict(body);
+        case 500:
+            return new http_1.ServerError(body);
+        default:
+            return new http_1.BadRequestResponse(body);
+    }
+}
+/** The answer of an AuthzAdminFailure: its status with `{ error: { code, message, field? } }`. */
+function refused(e) {
+    return respond((0, status_js_1.adminErrorStatus)(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
+}
+const COMPOSITE = new Set(['anyOf', 'oneOf', 'allOf', 'if', 'not']);
+const inBranch = (e) => /\/(anyOf|oneOf|allOf)\/\d+\//.test(e.schemaPath);
+/** The error that names the input best: an unknown key, else an error outside the branches of anyOf/oneOf, else the composite itself. */
+function primary(errors) {
+    const own = errors.filter((e) => !inBranch(e));
+    return own.find((e) => e.keyword === 'additionalProperties') ?? own.find((e) => !COMPOSITE.has(e.keyword)) ?? own[0] ?? errors[0];
+}
+/** `/commands/0/expiresAt` as `commands.0.expiresAt`; the key a `required` or `additionalProperties` error names is appended. */
+function pathOf(e) {
+    const params = e.params;
+    // http's required-parameter check names the argument, not a JSON pointer.
+    if (params.missingParameter !== undefined)
+        return [];
+    const path = e.instancePath === '' ? [] : e.instancePath.slice(1).split('/').map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    if (e.keyword === 'required' && params.missingProperty !== undefined)
+        path.push(params.missingProperty);
+    if (e.keyword === 'additionalProperties' && params.additionalProperty !== undefined)
+        path.push(params.additionalProperty);
+    return path;
+}
+const LIMIT_WORDS = {
+    maxLength: 'exceeds the limit of',
+    maxItems: 'exceeds the limit of',
+    maximum: 'exceeds the limit of',
+    minLength: 'is below the minimum of',
+    minItems: 'is below the minimum of',
+    minimum: 'is below the minimum of',
+};
+function describe(e, field, errors) {
+    const what = field ?? 'the input';
+    const params = e.params;
+    if (Object.hasOwn(LIMIT_WORDS, e.keyword))
+        return `${what} ${LIMIT_WORDS[e.keyword]} ${String(params.limit)}`;
+    switch (e.keyword) {
+        case 'additionalProperties':
+            return `${what} is not a field of this request`;
+        case 'required':
+            return `${what} is required`;
+        case 'type':
+            return `${what} must be of type ${String(params.type)}`;
+        case 'anyOf': {
+            const keys = errors.filter((x) => x.keyword === 'required' && inBranch(x)).map((x) => x.params.missingProperty);
+            return keys.length > 0 ? `${what} needs one of ${keys.join(', ')}` : `${what} matches none of the allowed shapes`;
+        }
+        case 'oneOf':
+            return `${what} matches none of the allowed shapes`;
+        case 'format':
+            return `${what} must be a ${String(params.format)}`;
+        default:
+            return `${what} is invalid (${e.keyword})`;
+    }
+}
+/**
+ * The failure `code` for input that broke its schema, naming the first offending field. `prefix` is
+ * the path of the validated value inside the request (a command of a batch), `fallbackField` the
+ * name of a scalar input such as a path parameter. Messages never quote the input.
+ */
+function inputFailure(code, errors, prefix = [], fallbackField) {
+    const e = primary(errors ?? []);
+    if (!e)
+        return new authz_1.AuthzAdminFailure(code, 'the input is invalid', fallbackField);
+    const path = [...prefix, ...pathOf(e)];
+    const field = path.length > 0 ? path.join('.') : fallbackField;
+    return new authz_1.AuthzAdminFailure(code, describe(e, field, errors ?? []), field);
+}
+const PARAM_ID = 'authz.admin.param.';
+/**
+ * `@OnError` handler of the admin routes for the arguments stage (D2): input that breaks its schema
+ * answers the route's `{ error: { code, field } }`, as AuthzAdmin's own refusals do.
+ * - ValidationFailed of a body or a path parameter: 400 invalid_request.
+ * - InvalidArgument (a body that is not JSON): 400 invalid_request.
+ * - AuthzAdminFailure from the query, batch and body args: its code and status.
+ * - UnknownAuthzDomain: 403 unknown_domain.
+ */
+function adminInputAnswer(err) {
+    if (err instanceof authz_1.AuthzAdminFailure)
+        return refused(err);
+    if (err instanceof authz_http_1.UnknownAuthzDomain)
+        return respond(403, { error: { code: 'unknown_domain', message: err.message } });
+    if (err instanceof validation_1.ValidationFailed) {
+        const id = err.schema?.$id;
+        const param = typeof id === 'string' && id.startsWith(PARAM_ID) ? id.slice(PARAM_ID.length) : undefined;
+        return refused(inputFailure('invalid_request', err.parameter, [], param));
+    }
+    if (err instanceof exceptions_1.InvalidArgument)
+        return refused(new authz_1.AuthzAdminFailure('invalid_request', 'the body must be a JSON object'));
+    return undefined;
+}
+//# sourceMappingURL=answers.js.map

package/lib/cjs/routes/answers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers.js","sourceRoot":"","sources":["../../../src/routes/answers.ts"],"names":[],"mappings":";;;;;;AAAA,0CAAmD;AACnD,oDAAyD;AACzD,oDAAsD;AACtD,wCAA2G;AAE3G,oDAAuD;AAGvD,2CAA+C;AAE/C,iBAAwB,MAAc,EAAE,IAAa;IACnD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,IAAI,wBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,GAAG;YACN,OAAO,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,eAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,kBAAW,CAAC,IAAI,CAAC,CAAC;QAC/B;YACE,OAAO,IAAI,yBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,iBAAwB,CAAoB;IAC1C,OAAO,OAAO,CAAC,IAAA,4BAAgB,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClJ,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAErG,yIAAyI;AACzI,SAAS,OAAO,CAAC,MAAmC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,iIAAiI;AACjI,SAAS,MAAM,CAAC,CAAmB;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAA8F,CAAC;IAChH,0EAA0E;IAC1E,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnI,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC1H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAqC;IACpD,SAAS,EAAE,sBAAsB;IACjC,QAAQ,EAAE,sBAAsB;IAChC,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,yBAAyB;CACnC,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAmB,EAAE,KAAyB,EAAE,MAAmC;IACnG,MAAM,IAAI,GAAG,KAAK,IAAI,WAAW,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAiC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9G,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,sBAAsB;YACzB,OAAO,GAAG,IAAI,iCAAiC,CAAC;QAClD,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,cAAc,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,MAAuC,CAAC,eAAe,CAAC,CAAC;YAClJ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,qCAAqC,CAAC;QACpH,CAAC;QACD,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACtD,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,cAAc,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD;YACE,OAAO,GAAG,IAAI,gBAAgB,CAAC,CAAC,OAAO,GAAG,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,sBAA6B,IAAY,EAAE,MAA0C,EAAE,MAAM,GAAsB,EAAE,EAAE,aAAsB;IAC3I,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,yBAAiB,CAAC,IAAI,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/D,OAAO,IAAI,yBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC;;;;;;;GAOG;AACH,0BAAiC,GAAU;IACzC,IAAI,GAAG,YAAY,yBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,YAAY,+BAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxH,IAAI,GAAG,YAAY,6BAAgB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAI,GAAG,CAAC,MAAwC,EAAE,GAAG,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,OAAO,OAAO,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,YAAY,4BAAe;QAAE,OAAO,OAAO,CAAC,IAAI,yBAAiB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC/H,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/lib/cjs/routes/args.d.ts

@@ -0,0 +1,59 @@
+import { RouteArgs } from '@spinajs/http';
+import type { IRoute, IRouteCall, IRouteParameter, Req } from '@spinajs/http';
+import type * as express from 'express';
+import type { AuthzAdminCommandBatch } from '../dto/batch.js';
+import { AuthzCommandSchemaRegistry } from '../schemas/registry.js';
+type Decorator = ReturnType<typeof Req>;
+/** Route arg of `@AdminQuery()`: the whole query string as the parameter's DTO class, validated against its `@Schema`; a failure is 400 invalid_query. */
+export declare class AuthzAdminQueryArg extends RouteArgs {
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: object;
+    }>;
+}
+/** Route arg of `@AdminBody()`: the whole body as the parameter's DTO class. Unlike `@Body()`, a body key named as the parameter is not taken for the body. */
+export declare class AuthzAdminBodyArg extends RouteArgs {
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], param: IRouteParameter, req: express.Request, _res: express.Response, route: IRoute): Promise<{
+        CallData: IRouteCall;
+        Args: any;
+    }>;
+}
+/**
+ * Route arg of `@AdminBatch()`: the body of POST /authz/commands. The envelope is checked against
+ * BATCH_ENVELOPE_SCHEMA and each command against the schema AuthzCommandSchemaRegistry holds for its
+ * kind, read on each request so that a late AuthzCommandSchemaSource counts; a kind no source
+ * describes is refused. A failure is 400 invalid_request (not an object) or invalid_batch.
+ */
+export declare class AuthzAdminBatchArg extends RouteArgs {
+    protected Registry: AuthzCommandSchemaRegistry;
+    private strictCopies;
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], _param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: AuthzAdminCommandBatch;
+    }>;
+    /** The command schema under an `authz.` id, which the validation package checks without coercion. */
+    private strict;
+}
+/** Route arg of `@AdminDomain()`: the authz domain of the request as the AuthzDomainResolver names it, `authz.http.admin.domain` being its fallback. */
+export declare class AuthzAdminDomainArg extends RouteArgs {
+    Priority: number;
+    protected FallbackDomain: string;
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], _param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: string;
+    }>;
+}
+/** The whole query string as the parameter's `@Schema` DTO class; 400 invalid_query when it breaks the schema. */
+export declare function AdminQuery(): Decorator;
+/** The whole body as the parameter's `@Schema` DTO class; 400 invalid_request when it breaks the schema. */
+export declare function AdminBody(): Decorator;
+/** The body of POST /authz/commands as AuthzAdminCommandBatch. */
+export declare function AdminBatch(): Decorator;
+/** The authz domain the admin routes run in for this request. */
+export declare function AdminDomain(): Decorator;
+export {};
+//# sourceMappingURL=args.d.ts.map

package/lib/cjs/routes/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/routes/args.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoB,SAAS,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,EAAW,MAAM,eAAe,CAAC;AAEvF,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIpE,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;AAiBxC,0JAA0J;AAC1J,qBACa,kBAAmB,SAAQ,SAAS;IAC/C,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAOxG;CACF;AAED,+JAA+J;AAC/J,qBACa,iBAAkB,SAAQ,SAAS;IAC9C,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM;;;OAE/I;CACF;AAED;;;;;GAKG;AACH,qBACa,kBAAmB,SAAQ,SAAS;IAE/C,SAAS,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAG/C,OAAO,CAAC,YAAY,CAA6B;IAEjD,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAkBzG;IAED,qGAAqG;IACrG,OAAO,CAAC,MAAM;CAMf;AAED,wJAAwJ;AACxJ,qBACa,mBAAoB,SAAQ,SAAS;IAEzC,QAAQ,SAAM;IAGrB,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC;IAEjC,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAEzG;CACF;AAED,kHAAkH;AAClH,wBAAgB,UAAU,IAAI,SAAS,CAEtC;AAED,4GAA4G;AAC5G,wBAAgB,SAAS,IAAI,SAAS,CAErC;AAED,kEAAkE;AAClE,wBAAgB,UAAU,IAAI,SAAS,CAEtC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,SAAS,CAEvC"}

package/lib/cjs/routes/args.js

@@ -0,0 +1,167 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzAdminDomainArg = exports.AuthzAdminBatchArg = exports.AuthzAdminBodyArg = exports.AuthzAdminQueryArg = void 0;
+exports.AdminQuery = AdminQuery;
+exports.AdminBody = AdminBody;
+exports.AdminBatch = AdminBatch;
+exports.AdminDomain = AdminDomain;
+const authz_1 = require("@spinajs/authz");
+const authz_http_1 = require("@spinajs/authz-http");
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const http_1 = require("@spinajs/http");
+const util_1 = require("@spinajs/util");
+const batch_js_1 = require("../dto/batch.js");
+const registry_js_1 = require("../schemas/registry.js");
+const answers_js_1 = require("./answers.js");
+const decode_js_1 = require("./decode.js");
+const q = (v) => JSON.stringify(v);
+/** A query string value as the type its schema property names: the query string itself has none, and the admin schemas are validated without coercion. */
+function typedQuery(schema, query) {
+    const out = {};
+    for (const [key, value] of Object.entries(query)) {
+        const type = schema?.properties?.[key]?.type;
+        if (type === 'integer' && typeof value === 'string' && /^\d{1,15}$/.test(value))
+            out[key] = Number(value);
+        else if (type === 'boolean' && (value === 'true' || value === 'false'))
+            out[key] = value === 'true';
+        else
+            out[key] = value;
+    }
+    return out;
+}
+/** Route arg of `@AdminQuery()`: the whole query string as the parameter's DTO class, validated against its `@Schema`; a failure is 400 invalid_query. */
+let AuthzAdminQueryArg = class AuthzAdminQueryArg extends http_1.RouteArgs {
+    get SupportedType() {
+        return 'AuthzAdminQueryArg';
+    }
+    async extract(callData, _args, param, req) {
+        const Dto = param.RuntimeType;
+        const schema = this.Validator.extractSchema(Dto);
+        const input = typedQuery(schema, req.query ?? {});
+        const [valid, errors] = this.Validator.tryValidate(schema, input);
+        if (!valid)
+            throw (0, answers_js_1.inputFailure)('invalid_query', errors);
+        return { CallData: callData, Args: new Dto(input) };
+    }
+};
+exports.AuthzAdminQueryArg = AuthzAdminQueryArg;
+exports.AuthzAdminQueryArg = AuthzAdminQueryArg = __decorate([
+    (0, di_1.Injectable)()
+], AuthzAdminQueryArg);
+/** Route arg of `@AdminBody()`: the whole body as the parameter's DTO class. Unlike `@Body()`, a body key named as the parameter is not taken for the body. */
+let AuthzAdminBodyArg = class AuthzAdminBodyArg extends http_1.RouteArgs {
+    get SupportedType() {
+        return 'AuthzAdminBodyArg';
+    }
+    async extract(callData, _args, param, req, _res, route) {
+        return { CallData: callData, Args: await this.tryHydrateParam(req.body ?? null, param, route) };
+    }
+};
+exports.AuthzAdminBodyArg = AuthzAdminBodyArg;
+exports.AuthzAdminBodyArg = AuthzAdminBodyArg = __decorate([
+    (0, di_1.Injectable)()
+], AuthzAdminBodyArg);
+/**
+ * Route arg of `@AdminBatch()`: the body of POST /authz/commands. The envelope is checked against
+ * BATCH_ENVELOPE_SCHEMA and each command against the schema AuthzCommandSchemaRegistry holds for its
+ * kind, read on each request so that a late AuthzCommandSchemaSource counts; a kind no source
+ * describes is refused. A failure is 400 invalid_request (not an object) or invalid_batch.
+ */
+let AuthzAdminBatchArg = class AuthzAdminBatchArg extends http_1.RouteArgs {
+    constructor() {
+        super(...arguments);
+        // Ajv caches every schema object it compiled for good, so the copies are keyed by content: sources may build fresh objects per call.
+        this.strictCopies = new Map();
+    }
+    get SupportedType() {
+        return 'AuthzAdminBatchArg';
+    }
+    async extract(callData, _args, _param, req) {
+        const body = req.body;
+        if (!(0, util_1.isPlainObject)(body))
+            throw new authz_1.AuthzAdminFailure('invalid_request', 'the body must be an object { commands, reason?, idempotencyKey?, dryRun? }');
+        const [valid, errors] = this.Validator.tryValidate(batch_js_1.BATCH_ENVELOPE_SCHEMA, body);
+        if (!valid)
+            throw (0, answers_js_1.inputFailure)('invalid_batch', errors);
+        const schemas = this.Registry.commands();
+        const commands = body.commands;
+        commands.forEach((command, i) => {
+            if (!Object.hasOwn(schemas, command.kind))
+                throw new authz_1.AuthzAdminFailure('invalid_batch', `command ${i} has kind ${q(command.kind)}, which no AuthzCommandSchemaSource describes`, `commands.${i}.kind`);
+            const [ok, failures] = this.Validator.tryValidate(this.strict(command.kind, schemas[command.kind]), command);
+            if (!ok)
+                throw (0, answers_js_1.inputFailure)('invalid_batch', failures, ['commands', String(i)]);
+        });
+        const options = {};
+        for (const key of ['reason', 'idempotencyKey', 'dryRun'])
+            if (key in body)
+                options[key] = body[key];
+        const batch = { commands: (0, decode_js_1.decodeCommands)(commands), options };
+        return { CallData: callData, Args: batch };
+    }
+    /** The command schema under an `authz.` id, which the validation package checks without coercion. */
+    strict(kind, schema) {
+        const key = `${kind}\n${JSON.stringify(schema)}`;
+        let copy = this.strictCopies.get(key);
+        if (!copy)
+            this.strictCopies.set(key, (copy = { ...schema, $id: `authz.admin.command.${kind}` }));
+        return copy;
+    }
+};
+exports.AuthzAdminBatchArg = AuthzAdminBatchArg;
+__decorate([
+    (0, di_1.Autoinject)(registry_js_1.AuthzCommandSchemaRegistry),
+    __metadata("design:type", registry_js_1.AuthzCommandSchemaRegistry)
+], AuthzAdminBatchArg.prototype, "Registry", void 0);
+exports.AuthzAdminBatchArg = AuthzAdminBatchArg = __decorate([
+    (0, di_1.Injectable)()
+], AuthzAdminBatchArg);
+/** Route arg of `@AdminDomain()`: the authz domain of the request as the AuthzDomainResolver names it, `authz.http.admin.domain` being its fallback. */
+let AuthzAdminDomainArg = class AuthzAdminDomainArg extends http_1.RouteArgs {
+    constructor() {
+        super(...arguments);
+        // Before the inputs, so that an unknown domain is refused before the input is checked.
+        this.Priority = 10;
+    }
+    get SupportedType() {
+        return 'AuthzAdminDomainArg';
+    }
+    async extract(callData, _args, _param, req) {
+        return { CallData: callData, Args: await (0, authz_http_1.resolveAuthzDomain)(req, this.FallbackDomain) };
+    }
+};
+exports.AuthzAdminDomainArg = AuthzAdminDomainArg;
+__decorate([
+    (0, configuration_1.Config)('authz.http.admin.domain'),
+    __metadata("design:type", String)
+], AuthzAdminDomainArg.prototype, "FallbackDomain", void 0);
+exports.AuthzAdminDomainArg = AuthzAdminDomainArg = __decorate([
+    (0, di_1.Injectable)()
+], AuthzAdminDomainArg);
+/** The whole query string as the parameter's `@Schema` DTO class; 400 invalid_query when it breaks the schema. */
+function AdminQuery() {
+    return (0, http_1.Route)((0, http_1.Parameter)('AuthzAdminQueryArg', null));
+}
+/** The whole body as the parameter's `@Schema` DTO class; 400 invalid_request when it breaks the schema. */
+function AdminBody() {
+    return (0, http_1.Route)((0, http_1.Parameter)('AuthzAdminBodyArg', null, { required: true }));
+}
+/** The body of POST /authz/commands as AuthzAdminCommandBatch. */
+function AdminBatch() {
+    return (0, http_1.Route)((0, http_1.Parameter)('AuthzAdminBatchArg', null));
+}
+/** The authz domain the admin routes run in for this request. */
+function AdminDomain() {
+    return (0, http_1.Route)((0, http_1.Parameter)('AuthzAdminDomainArg', null));
+}
+//# sourceMappingURL=args.js.map

package/lib/cjs/routes/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../src/routes/args.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAmD;AACnD,oDAAyD;AACzD,0DAAgD;AAChD,oCAAqD;AACrD,wCAA4D;AAE5D,wCAA8C;AAG9C,8CAAwD;AAExD,wDAAoE;AACpE,6CAA4C;AAC5C,2CAA6C;AAK7C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEpD,0JAA0J;AAC1J,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAwC;IACtF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;aACrG,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC;;YAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0JAA0J;AAEnJ,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,gBAAS;IAC/C,IAAW,aAAa;QACtB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,KAAsB,EAAE,GAAoB;QACvG,MAAM,GAAG,GAAG,KAAK,CAAC,WAA4C,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAoB,CAAC;QACpE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAA,yBAAY,EAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAA;;6BAbY,kBAAkB;IAD9B,IAAA,eAAU,GAAE;GACA,kBAAkB,CAa9B;AAED,+JAA+J;AAExJ,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,gBAAS;IAC9C,IAAW,aAAa;QACtB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,KAAsB,EAAE,GAAoB,EAAE,IAAsB,EAAE,KAAa;QAC9I,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAClG,CAAC;CACF,CAAA;;4BARY,iBAAiB;IAD7B,IAAA,eAAU,GAAE;GACA,iBAAiB,CAQ7B;AAED;;;;;GAKG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,gBAAS;IAA1C;;QAIL,qIAAqI;QAC7H,iBAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAiCnD,CAAC;IA/BC,IAAW,aAAa;QACtB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,MAAuB,EAAE,GAAoB;QACxG,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC;YAAE,MAAM,IAAI,yBAAiB,CAAC,iBAAiB,EAAE,4EAA4E,CAAC,CAAC;QACvJ,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gCAAqB,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAA,yBAAY,EAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;QACrD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,yBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,+CAA+C,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACvM,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7G,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAA,yBAAY,EAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU;YAAE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7G,MAAM,KAAK,GAA2B,EAAE,QAAQ,EAAE,IAAA,0BAAc,EAAC,QAAQ,CAAuB,EAAE,OAAO,EAAE,CAAC;QAC5G,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,qGAAqG;IAC7F,MAAM,CAAC,IAAY,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,uBAAuB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;;AApCW;IADT,IAAA,eAAU,EAAC,wCAA0B,CAAC;8BACnB,wCAA0B;oDAAC;6BAFpC,kBAAkB;IAD9B,IAAA,eAAU,GAAE;GACA,kBAAkB,CAsC9B;AAED,wJAAwJ;AAEjJ,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAS;IAA3C;;QACL,uFAAuF;QAChF,aAAQ,GAAG,EAAE,CAAC;IAYvB,CAAC;IAPC,IAAW,aAAa;QACtB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,MAAuB,EAAE,GAAoB;QACxG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAA,+BAAkB,EAAC,GAAc,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;IACrG,CAAC;CACF,CAAA;;AATW;IADT,IAAA,sBAAM,EAAC,yBAAyB,CAAC;;2DACD;8BALtB,mBAAmB;IAD/B,IAAA,eAAU,GAAE;GACA,mBAAmB,CAc/B;AAED,kHAAkH;AAClH;IACE,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,4GAA4G;AAC5G;IACE,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE;IACE,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE;IACE,OAAO,IAAA,YAAK,EAAC,IAAA,gBAAS,EAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/lib/cjs/routes/index.d.ts

@@ -1,4 +1,7 @@
+export * from './answers.js';
+export * from './args.js';
 export * from './decode.js';
+export * from './no-store.js';
 export * from './query.js';
 export * from './status.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/cjs/routes/index.js

@@ -14,7 +14,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./answers.js"), exports);
+__exportStar(require("./args.js"), exports);
 __exportStar(require("./decode.js"), exports);
+__exportStar(require("./no-store.js"), exports);
 __exportStar(require("./query.js"), exports);
 __exportStar(require("./status.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,6CAA2B;AAC3B,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,6CAA2B;AAC3B,8CAA4B"}

package/lib/cjs/routes/no-store.d.ts

@@ -0,0 +1,10 @@
+import { RouteMiddleware } from '@spinajs/http';
+import type * as express from 'express';
+/** For routes whose answer may hold a link token: no proxy or browser cache may keep one. Set before the route runs, so it goes out with any answer it gives. */
+export declare class NoStore extends RouteMiddleware {
+    isEnabled(): boolean;
+    onBefore(_req: express.Request, res: express.Response): Promise<void>;
+    onAfter(): Promise<void>;
+    onResponse(): Promise<void>;
+}
+//# sourceMappingURL=no-store.d.ts.map

package/lib/cjs/routes/no-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-store.d.ts","sourceRoot":"","sources":["../../../src/routes/no-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,CAAC;AAExC,iKAAiK;AACjK,qBAAa,OAAQ,SAAQ,eAAe;IACnC,SAAS,IAAI,OAAO,CAE1B;IAEY,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAE3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;CAC5C"}

package/lib/cjs/routes/no-store.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoStore = void 0;
+const http_1 = require("@spinajs/http");
+/** For routes whose answer may hold a link token: no proxy or browser cache may keep one. Set before the route runs, so it goes out with any answer it gives. */
+class NoStore extends http_1.RouteMiddleware {
+    isEnabled() {
+        return true;
+    }
+    async onBefore(_req, res) {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Pragma', 'no-cache');
+    }
+    async onAfter() { }
+    async onResponse() { }
+}
+exports.NoStore = NoStore;
+//# sourceMappingURL=no-store.js.map

package/lib/cjs/routes/no-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-store.js","sourceRoot":"","sources":["../../../src/routes/no-store.ts"],"names":[],"mappings":";;;AAAA,wCAAgD;AAGhD,iKAAiK;AACjK,aAAqB,SAAQ,sBAAe;IACnC,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,IAAqB,EAAE,GAAqB;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,KAAmB,CAAC;IAEjC,KAAK,CAAC,UAAU,KAAmB,CAAC;CAC5C"}

package/lib/cjs/routes/query.d.ts

@@ -1,6 +1,5 @@
 import type { AuthzAdminOptions, AuthzAdminQuery, PrincipalRef, ResourceRef } from '@spinajs/authz';
-/** A parsed query string (express: string, string[] or a nested object per key). */
-export type QueryInput = Readonly<Record<string, unknown>>;
+import type { AuthzAdminPageQuery, AuthzAssignmentsQuery, AuthzHoldersQuery, AuthzWriteOptionsQuery } from '../dto/queries.js';
 /** authz-rbac's AssignmentSubject; the list queries belong to models this package does not import. */
 type AssignmentSubject = PrincipalRef | {
     readonly set: {
@@ -13,12 +12,12 @@ export declare function parseResourceRef(value: string, field: string): Resource
 /** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
 export declare function parseAssignmentSubject(value: string, field?: string): AssignmentSubject;
 /** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset` or `after`. */
-export declare function readAssignmentsQuery(q: QueryInput): AuthzAdminQuery;
+export declare function readAssignmentsQuery(q: AuthzAssignmentsQuery): AuthzAdminQuery;
 /** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset` or `after`. */
-export declare function readHoldersQuery(q: QueryInput): AuthzAdminQuery;
-/** GET /authz/links and /authz/rules: `scope`, `limit`, `offset` or `after`; GET /authz/policies has no `after`. */
-export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: QueryInput): AuthzAdminQuery;
+export declare function readHoldersQuery(q: AuthzHoldersQuery): AuthzAdminQuery;
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset` or `after` (policies have no `after`, which their query DTO refuses). */
+export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: AuthzAdminPageQuery): AuthzAdminQuery;
 /** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
-export declare function readWriteOptions(q: QueryInput): AuthzAdminOptions;
+export declare function readWriteOptions(q: AuthzWriteOptionsQuery): AuthzAdminOptions;
 export {};
 //# sourceMappingURL=query.d.ts.map

package/lib/cjs/routes/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpG,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAI3D,sGAAsG;AACtG,KAAK,iBAAiB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAA;CAAE,CAAC;AAajH,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AAsCD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAYnE;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAa/D;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,eAAe,CAGlG;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,iBAAiB,CASjE"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpG,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAI/H,sGAAsG;AACtG,KAAK,iBAAiB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAA;CAAE,CAAC;AAMjH,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AAcD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAS9E;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,iBAAiB,GAAG,eAAe,CAStE;AAED,2JAA2J;AAC3J,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,mBAAmB,GAAG,eAAe,CAE3G;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,sBAAsB,GAAG,iBAAiB,CAM7E"}