@spinajs/authz-http-admin 3.0.13 → 3.0.15

package/lib/mjs/controllers/AuthzAdminController.js

@@ -13,96 +13,50 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { AuthzAdminFailure, AuthzDomains } from '@spinajs/authz';
 import { Config } from '@spinajs/configuration';
 import { Autoinject } from '@spinajs/di';
-import { BadRequestResponse, BaseController, BasePath, Conflict, Del, ForbiddenResponse, Get, NotFound, Ok, Patch, Policy, Post, Put, Req, ServerError } from '@spinajs/http';
-import { IsAuthenticated, UnknownAuthzDomain, resolveAuthzDomain } from '@spinajs/authz-http';
-import { isPlainObject } from '@spinajs/util';
+import { BaseController, BasePath, Body, Del, Get, Middleware, OnError, Param, Patch, Policy, Post, Put } from '@spinajs/http';
+import { CurrentPrincipal, IsAuthenticated, UnknownAuthzDomain } from '@spinajs/authz-http';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { ValidationFailed } from '@spinajs/validation';
 import '../schemas/provider.js';
-import { decodeCommand, decodeCommands } from '../routes/decode.js';
+import { AuthzAssignmentGrant, AuthzAssignmentPatch } from '../dto/assignments.js';
+import { AuthzAttributesBody, AuthzAttributesPatch } from '../dto/attributes.js';
+import { AuthzLinkCreate, AuthzLinkPatch } from '../dto/links.js';
+import { ID_PARAM, TYPE_PARAM } from '../dto/params.js';
+import { AuthzAssignmentsQuery, AuthzHoldersQuery, AuthzListQuery, AuthzOffsetListQuery, AuthzWriteOptionsQuery } from '../dto/queries.js';
+import { AuthzPolicyBody, AuthzRuleBody } from '../dto/rules.js';
+import { adminInputAnswer, refused, respond } from '../routes/answers.js';
+import { AdminBatch, AdminBody, AdminDomain, AdminQuery } from '../routes/args.js';
+import { decodeCommand } from '../routes/decode.js';
+import { NoStore } from '../routes/no-store.js';
 import { readAssignmentsQuery, readHoldersQuery, readPageQuery, readWriteOptions } from '../routes/query.js';
-import { adminErrorStatus, resultsStatus } from '../routes/status.js';
-const PATCH_KEYS = ['tags', 'addTags', 'removeTags', 'expiresAt'];
+import { resultsStatus } from '../routes/status.js';
 const PATCH_KINDS = { tags: 'assignment.setTags', addTags: 'assignment.addTags', removeTags: 'assignment.removeTags' };
-function respond(status, body) {
-    switch (status) {
-        case 200:
-            return new Ok(body);
-        case 403:
-            return new ForbiddenResponse(body);
-        case 404:
-            return new NotFound(body);
-        case 409:
-            return new Conflict(body);
-        case 500:
-            return new ServerError(body);
-        default:
-            return new BadRequestResponse(body);
-    }
-}
-function refused(e) {
-    return respond(adminErrorStatus(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
-}
-function badRequest(message, field) {
-    throw new AuthzAdminFailure('invalid_request', message, field);
-}
-function objectBody(body, what) {
-    if (!isPlainObject(body))
-        badRequest(`the body must be ${what}`);
-    return body;
-}
-/** The body of PUT /authz/rules/:id or /authz/policies/:id with the path id; an id in the body must equal it. */
-function withPathId(body, id, what) {
-    const o = objectBody(body, what);
-    if (o.id !== undefined && o.id !== id)
-        badRequest(`the body id ${JSON.stringify(o.id)} is not the path id ${JSON.stringify(id)}`, 'id');
-    return { ...o, id };
+/** A body the route runs under its path id; an id in the body must equal it. */
+function withPathId(body, id) {
+    if (body.id !== undefined && body.id !== id)
+        throw new AuthzAdminFailure('invalid_request', `the body id ${JSON.stringify(body.id)} is not the path id ${JSON.stringify(id)}`, 'id');
+    return { ...body, id };
 }
 // The routes serve the RBAC and ABAC commands, whose AuthzCommandMap entries this package does not import.
 const byId = (kind, id) => ({ kind, id });
-const LINK_PATCH_KEYS = ['expiresAt', 'attributes', 'role', 'tags'];
-/** PATCH /authz/links/:id as one link.update; like the assignment patch, a key it does not serve is refused, not ignored. */
-function linkUpdate(body, id) {
-    const patch = withPathId(body, id, 'an object { expiresAt?, attributes?, role?, tags? }');
-    const unknown = Object.keys(patch).find((k) => k !== 'id' && !LINK_PATCH_KEYS.includes(k));
-    if (unknown !== undefined)
-        badRequest(`a link patch takes ${LINK_PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
-    if (!LINK_PATCH_KEYS.some((k) => k in patch))
-        badRequest(`a link patch needs one of ${LINK_PATCH_KEYS.join(', ')}`);
-    return decodeCommand({ ...patch, kind: 'link.update' });
-}
-/** For answers that may hold a link token: no proxy or browser cache may keep one. Set first, so it goes out with any answer the route gives. */
-function noStore(req) {
-    req.res?.setHeader('Cache-Control', 'no-store');
-    req.res?.setHeader('Pragma', 'no-cache');
-}
-const query = (req) => (req.query ?? {});
-const param = (req, name) => req.params[name];
-const actorOf = (req) => req.storage.Principal;
-const scopeOf = (req) => ({ type: param(req, 'type'), id: param(req, 'id') });
+const asCommand = (c) => decodeCommand(c);
 /**
  * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
  *
  * The routes check authentication only: the actor is always the request principal, and every
- * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
- * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
- * `{ results }`, one entry per command.
+ * permission and guard check runs in AuthzAdmin, as for an in-process caller (design §6.6.5). The
+ * inputs are DTOs checked against their schemas first; a refused request answers
+ * `{ error: { code, message, field? } }`, a write `{ results }`, one entry per command.
  *
  * @tags Authz admin
  */
 let AuthzAdminController = class AuthzAdminController extends BaseController {
     /**
-     * Runs a route on the AuthzAdmin of the domain the AuthzDomainResolver names for `req`, `authz.http.admin.domain` being its fallback and the domain without a request.
-     * An AuthzAdminFailure becomes its status with `{ error }`, a domain no live domain bears 403 `unknown_domain`, anything else propagates.
+     * Runs a route on the AuthzAdmin of `domain` (the one `@AdminDomain()` resolved), `authz.http.admin.domain` without one.
+     * An AuthzAdminFailure becomes its status with `{ error }`, anything else propagates.
      */
-    async guarded(fn, req) {
-        let admin;
-        try {
-            admin = (await this.Domains.service(req ? await resolveAuthzDomain(req, this.AdminDomain) : this.AdminDomain)).admin();
-        }
-        catch (e) {
-            if (e instanceof UnknownAuthzDomain)
-                return respond(403, { error: { code: 'unknown_domain', message: e.message } });
-            throw e;
-        }
+    async guarded(fn, domain) {
+        const admin = (await this.Domains.service(domain ?? this.AdminDomain)).admin();
         try {
             return await fn(admin);
         }
@@ -113,14 +67,11 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
         }
     }
     /** One batch built from the route, with the options of the query string. */
-    single(req, build) {
-        return this.guarded(async (admin) => {
-            const opts = readWriteOptions(query(req));
-            return results(await admin.execute(actorOf(req), build(), opts));
-        }, req);
+    single(domain, actor, options, build) {
+        return this.guarded(async (admin) => results(await admin.execute(actor, build(), readWriteOptions(options))), domain);
     }
-    list(req, build) {
-        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())), req);
+    list(domain, actor, build) {
+        return this.guarded(async (admin) => respond(200, await admin.list(actor, build())), domain);
     }
     /**
      * Run a batch of commands
@@ -135,16 +86,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async commands(req) {
-        noStore(req);
-        return this.guarded(async (admin) => {
-            const body = objectBody(req.body, 'an object { commands, reason?, idempotencyKey?, dryRun? }');
-            const opts = {};
-            for (const key of ['reason', 'idempotencyKey', 'dryRun'])
-                if (key in body)
-                    opts[key] = body[key];
-            return results(await admin.execute(actorOf(req), decodeCommands(body.commands), opts));
-        }, req);
+    async commands(domain, actor, batch) {
+        return this.guarded(async (admin) => results(await admin.execute(actor, batch.commands, batch.options)), domain);
     }
     /**
      * List assignments
@@ -155,8 +98,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listAssignments(req) {
-        return this.list(req, () => readAssignmentsQuery(query(req)));
+    async listAssignments(domain, actor, query) {
+        return this.list(domain, actor, () => readAssignmentsQuery(query));
     }
     /**
      * List holders
@@ -167,8 +110,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
      */
-    async listHolders(req) {
-        return this.list(req, () => readHoldersQuery(query(req)));
+    async listHolders(domain, actor, query) {
+        return this.list(domain, actor, () => readHoldersQuery(query));
     }
     /**
      * Grant a role
@@ -183,8 +126,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async grant(req) {
-        return this.single(req, () => [decodeCommand({ ...objectBody(req.body, 'the fields of assignment.grant'), kind: 'assignment.grant' })]);
+    async grant(domain, actor, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...body, kind: 'assignment.grant' })]);
     }
     /**
      * Change an assignment
@@ -199,21 +142,14 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchAssignment(req) {
-        return this.single(req, () => {
-            const body = objectBody(req.body, 'an object { tags?, addTags?, removeTags?, expiresAt? }');
-            const unknown = Object.keys(body).find((k) => !PATCH_KEYS.includes(k));
-            if (unknown !== undefined)
-                badRequest(`an assignment patch takes ${PATCH_KEYS.join(', ')}, not ${JSON.stringify(unknown)}`, unknown);
-            const id = param(req, 'id');
+    async patchAssignment(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => {
             const commands = [];
             for (const key of ['tags', 'addTags', 'removeTags'])
-                if (key in body)
+                if (body[key] !== undefined)
                     commands.push({ kind: PATCH_KINDS[key], id, tags: body[key] });
-            if ('expiresAt' in body)
-                commands.push(decodeCommand({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
-            if (commands.length === 0)
-                badRequest(`an assignment patch needs one of ${PATCH_KEYS.join(', ')}`);
+            if (body.expiresAt !== undefined)
+                commands.push(asCommand({ kind: 'assignment.setExpiry', id, expiresAt: body.expiresAt }));
             return commands;
         });
     }
@@ -229,8 +165,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async revoke(req) {
-        return this.single(req, () => [byId('assignment.revoke', param(req, 'id'))]);
+    async revoke(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('assignment.revoke', id)]);
     }
     /**
      * List share links
@@ -241,8 +177,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listLinks(req) {
-        return this.list(req, () => readPageQuery('links', query(req)));
+    async listLinks(domain, actor, query) {
+        return this.list(domain, actor, () => readPageQuery('links', query));
     }
     /**
      * Create a share link
@@ -257,9 +193,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async createLink(req) {
-        noStore(req);
-        return this.single(req, () => [decodeCommand({ ...objectBody(req.body, 'the fields of link.create'), kind: 'link.create' })]);
+    async createLink(domain, actor, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...body, kind: 'link.create' })]);
     }
     /**
      * Change a share link
@@ -274,8 +209,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchLink(req) {
-        return this.single(req, () => [linkUpdate(req.body, param(req, 'id'))]);
+    async patchLink(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ ...withPathId(body, id), kind: 'link.update' })]);
     }
     /**
      * Revoke a share link
@@ -289,8 +224,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async revokeLink(req) {
-        return this.single(req, () => [byId('link.revoke', param(req, 'id'))]);
+    async revokeLink(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('link.revoke', id)]);
     }
     /**
      * List rules
@@ -301,8 +236,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listRules(req) {
-        return this.list(req, () => readPageQuery('rules', query(req)));
+    async listRules(domain, actor, query) {
+        return this.list(domain, actor, () => readPageQuery('rules', query));
     }
     /**
      * Put a rule
@@ -317,8 +252,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async putRule(req) {
-        return this.single(req, () => [decodeCommand({ kind: 'rule.put', rule: withPathId(req.body, param(req, 'id'), 'a rule') })]);
+    async putRule(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ kind: 'rule.put', rule: withPathId(body, id) })]);
     }
     /**
      * Delete a rule
@@ -332,8 +267,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async deleteRule(req) {
-        return this.single(req, () => [byId('rule.delete', param(req, 'id'))]);
+    async deleteRule(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('rule.delete', id)]);
     }
     /**
      * List policies
@@ -344,8 +279,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async listPolicies(req) {
-        return this.list(req, () => readPageQuery('policies', query(req)));
+    async listPolicies(domain, actor, query) {
+        return this.list(domain, actor, () => readPageQuery('policies', query));
     }
     /**
      * Put a policy
@@ -360,8 +295,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async putPolicy(req) {
-        return this.single(req, () => [decodeCommand({ kind: 'policy.put', policy: withPathId(req.body, param(req, 'id'), 'a policy') })]);
+    async putPolicy(domain, actor, id, body, options) {
+        return this.single(domain, actor, options, () => [asCommand({ kind: 'policy.put', policy: withPathId(body, id) })]);
     }
     /**
      * Delete a policy
@@ -375,8 +310,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async deletePolicy(req) {
-        return this.single(req, () => [byId('policy.delete', param(req, 'id'))]);
+    async deletePolicy(domain, actor, id, options) {
+        return this.single(domain, actor, options, () => [byId('policy.delete', id)]);
     }
     /**
      * Read scope attributes
@@ -386,8 +321,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    async attributes(req) {
-        return this.list(req, () => ({ kind: 'attributes', scope: scopeOf(req) }));
+    async attributes(domain, actor, type, id) {
+        return this.list(domain, actor, () => ({ kind: 'attributes', scope: { type, id } }));
     }
     /**
      * Merge scope attributes
@@ -402,8 +337,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async patchAttributes(req) {
-        return this.single(req, () => [{ kind: 'scope.setAttributes', scope: scopeOf(req), patch: req.body }]);
+    async patchAttributes(domain, actor, type, id, body, options) {
+        return this.single(domain, actor, options, () => [{ kind: 'scope.setAttributes', scope: { type, id }, patch: { ...body } }]);
     }
     /**
      * Replace scope attributes
@@ -418,8 +353,8 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    async replaceAttributes(req) {
-        return this.single(req, () => [{ kind: 'scope.replaceAttributes', scope: scopeOf(req), attributes: req.body }]);
+    async replaceAttributes(domain, actor, type, id, body, options) {
+        return this.single(domain, actor, options, () => [{ kind: 'scope.replaceAttributes', scope: { type, id }, attributes: { ...body } }]);
     }
 };
 __decorate([
@@ -432,140 +367,202 @@ __decorate([
 ], AuthzAdminController.prototype, "Domains", void 0);
 __decorate([
     Post('commands'),
-    __param(0, Req()),
+    Middleware(NoStore),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminBatch()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "commands", null);
 __decorate([
     Get('assignments'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzAssignmentsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listAssignments", null);
 __decorate([
     Get('holders'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzHoldersQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listHolders", null);
 __decorate([
     Post('assignments'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Body({ required: true })),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzAssignmentGrant, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "grant", null);
 __decorate([
     Patch('assignments/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, Body({ required: true })),
+    __param(4, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzAssignmentPatch, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchAssignment", null);
 __decorate([
     Del('assignments/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "revoke", null);
 __decorate([
     Get('links'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listLinks", null);
 __decorate([
     Post('links'),
-    __param(0, Req()),
+    Middleware(NoStore),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Body({ required: true })),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzLinkCreate, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "createLink", null);
 __decorate([
     Patch('links/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, Body({ required: true })),
+    __param(4, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzLinkPatch, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchLink", null);
 __decorate([
     Del('links/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "revokeLink", null);
 __decorate([
     Get('rules'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listRules", null);
 __decorate([
     Put('rules/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, Body({ required: true })),
+    __param(4, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzRuleBody, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "putRule", null);
 __decorate([
     Del('rules/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "deleteRule", null);
 __decorate([
     Get('policies'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, AuthzOffsetListQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "listPolicies", null);
 __decorate([
     Put('policies/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, Body({ required: true })),
+    __param(4, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzPolicyBody, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "putPolicy", null);
 __decorate([
     Del('policies/:id'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(ID_PARAM)),
+    __param(3, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "deletePolicy", null);
 __decorate([
     Get('scopes/:type/:id/attributes'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(TYPE_PARAM)),
+    __param(3, Param(ID_PARAM)),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "attributes", null);
 __decorate([
     Patch('scopes/:type/:id/attributes'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(TYPE_PARAM)),
+    __param(3, Param(ID_PARAM)),
+    __param(4, AdminBody()),
+    __param(5, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String, AuthzAttributesPatch, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "patchAttributes", null);
 __decorate([
     Put('scopes/:type/:id/attributes'),
-    __param(0, Req()),
+    __param(0, AdminDomain()),
+    __param(1, CurrentPrincipal()),
+    __param(2, Param(TYPE_PARAM)),
+    __param(3, Param(ID_PARAM)),
+    __param(4, AdminBody()),
+    __param(5, AdminQuery()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [String, Object, String, String, AuthzAttributesBody, AuthzWriteOptionsQuery]),
     __metadata("design:returntype", Promise)
 ], AuthzAdminController.prototype, "replaceAttributes", null);
 AuthzAdminController = __decorate([
     Policy(IsAuthenticated),
-    BasePath({ config: 'authz.http.admin.basePath', default: 'authz' })
+    BasePath({ config: 'authz.http.admin.basePath', default: 'authz' }),
+    OnError([ValidationFailed, InvalidArgument, AuthzAdminFailure, UnknownAuthzDomain], adminInputAnswer, { stages: ['arguments'] })
 ], AuthzAdminController);
 export { AuthzAdminController };
 function results(r) {