@spinajs/authz-http-admin 3.0.13 → 3.0.15

package/lib/mjs/routes/answers.d.ts

@@ -0,0 +1,22 @@
+import { AuthzAdminFailure } from '@spinajs/authz';
+import type { Response } from '@spinajs/http';
+import type { IValidationError } from '@spinajs/validation';
+export declare function respond(status: number, body: unknown): Response;
+/** The answer of an AuthzAdminFailure: its status with `{ error: { code, message, field? } }`. */
+export declare function refused(e: AuthzAdminFailure): Response;
+/**
+ * The failure `code` for input that broke its schema, naming the first offending field. `prefix` is
+ * the path of the validated value inside the request (a command of a batch), `fallbackField` the
+ * name of a scalar input such as a path parameter. Messages never quote the input.
+ */
+export declare function inputFailure(code: string, errors: readonly IValidationError[] | null, prefix?: readonly string[], fallbackField?: string): AuthzAdminFailure;
+/**
+ * `@OnError` handler of the admin routes for the arguments stage (D2): input that breaks its schema
+ * answers the route's `{ error: { code, field } }`, as AuthzAdmin's own refusals do.
+ * - ValidationFailed of a body or a path parameter: 400 invalid_request.
+ * - InvalidArgument (a body that is not JSON): 400 invalid_request.
+ * - AuthzAdminFailure from the query, batch and body args: its code and status.
+ * - UnknownAuthzDomain: 403 unknown_domain.
+ */
+export declare function adminInputAnswer(err: Error): Response | undefined;
+//# sourceMappingURL=answers.d.ts.map

package/lib/mjs/routes/answers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers.d.ts","sourceRoot":"","sources":["../../../src/routes/answers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAInD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI5D,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAe/D;AAED,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,CAAC,EAAE,iBAAiB,GAAG,QAAQ,CAEtD;AAuDD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EAAE,MAAM,GAAE,SAAS,MAAM,EAAO,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAMhK;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAUjE"}

package/lib/mjs/routes/answers.js

@@ -0,0 +1,115 @@
+import { AuthzAdminFailure } from '@spinajs/authz';
+import { UnknownAuthzDomain } from '@spinajs/authz-http';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { BadRequestResponse, Conflict, ForbiddenResponse, NotFound, Ok, ServerError } from '@spinajs/http';
+import { ValidationFailed } from '@spinajs/validation';
+import { adminErrorStatus } from './status.js';
+export function respond(status, body) {
+    switch (status) {
+        case 200:
+            return new Ok(body);
+        case 403:
+            return new ForbiddenResponse(body);
+        case 404:
+            return new NotFound(body);
+        case 409:
+            return new Conflict(body);
+        case 500:
+            return new ServerError(body);
+        default:
+            return new BadRequestResponse(body);
+    }
+}
+/** The answer of an AuthzAdminFailure: its status with `{ error: { code, message, field? } }`. */
+export function refused(e) {
+    return respond(adminErrorStatus(e.code), { error: { code: e.code, message: e.message, ...(e.field === undefined ? {} : { field: e.field }) } });
+}
+const COMPOSITE = new Set(['anyOf', 'oneOf', 'allOf', 'if', 'not']);
+const inBranch = (e) => /\/(anyOf|oneOf|allOf)\/\d+\//.test(e.schemaPath);
+/** The error that names the input best: an unknown key, else an error outside the branches of anyOf/oneOf, else the composite itself. */
+function primary(errors) {
+    const own = errors.filter((e) => !inBranch(e));
+    return own.find((e) => e.keyword === 'additionalProperties') ?? own.find((e) => !COMPOSITE.has(e.keyword)) ?? own[0] ?? errors[0];
+}
+/** `/commands/0/expiresAt` as `commands.0.expiresAt`; the key a `required` or `additionalProperties` error names is appended. */
+function pathOf(e) {
+    const params = e.params;
+    // http's required-parameter check names the argument, not a JSON pointer.
+    if (params.missingParameter !== undefined)
+        return [];
+    const path = e.instancePath === '' ? [] : e.instancePath.slice(1).split('/').map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    if (e.keyword === 'required' && params.missingProperty !== undefined)
+        path.push(params.missingProperty);
+    if (e.keyword === 'additionalProperties' && params.additionalProperty !== undefined)
+        path.push(params.additionalProperty);
+    return path;
+}
+const LIMIT_WORDS = {
+    maxLength: 'exceeds the limit of',
+    maxItems: 'exceeds the limit of',
+    maximum: 'exceeds the limit of',
+    minLength: 'is below the minimum of',
+    minItems: 'is below the minimum of',
+    minimum: 'is below the minimum of',
+};
+function describe(e, field, errors) {
+    const what = field ?? 'the input';
+    const params = e.params;
+    if (Object.hasOwn(LIMIT_WORDS, e.keyword))
+        return `${what} ${LIMIT_WORDS[e.keyword]} ${String(params.limit)}`;
+    switch (e.keyword) {
+        case 'additionalProperties':
+            return `${what} is not a field of this request`;
+        case 'required':
+            return `${what} is required`;
+        case 'type':
+            return `${what} must be of type ${String(params.type)}`;
+        case 'anyOf': {
+            const keys = errors.filter((x) => x.keyword === 'required' && inBranch(x)).map((x) => x.params.missingProperty);
+            return keys.length > 0 ? `${what} needs one of ${keys.join(', ')}` : `${what} matches none of the allowed shapes`;
+        }
+        case 'oneOf':
+            return `${what} matches none of the allowed shapes`;
+        case 'format':
+            return `${what} must be a ${String(params.format)}`;
+        default:
+            return `${what} is invalid (${e.keyword})`;
+    }
+}
+/**
+ * The failure `code` for input that broke its schema, naming the first offending field. `prefix` is
+ * the path of the validated value inside the request (a command of a batch), `fallbackField` the
+ * name of a scalar input such as a path parameter. Messages never quote the input.
+ */
+export function inputFailure(code, errors, prefix = [], fallbackField) {
+    const e = primary(errors ?? []);
+    if (!e)
+        return new AuthzAdminFailure(code, 'the input is invalid', fallbackField);
+    const path = [...prefix, ...pathOf(e)];
+    const field = path.length > 0 ? path.join('.') : fallbackField;
+    return new AuthzAdminFailure(code, describe(e, field, errors ?? []), field);
+}
+const PARAM_ID = 'authz.admin.param.';
+/**
+ * `@OnError` handler of the admin routes for the arguments stage (D2): input that breaks its schema
+ * answers the route's `{ error: { code, field } }`, as AuthzAdmin's own refusals do.
+ * - ValidationFailed of a body or a path parameter: 400 invalid_request.
+ * - InvalidArgument (a body that is not JSON): 400 invalid_request.
+ * - AuthzAdminFailure from the query, batch and body args: its code and status.
+ * - UnknownAuthzDomain: 403 unknown_domain.
+ */
+export function adminInputAnswer(err) {
+    if (err instanceof AuthzAdminFailure)
+        return refused(err);
+    if (err instanceof UnknownAuthzDomain)
+        return respond(403, { error: { code: 'unknown_domain', message: err.message } });
+    if (err instanceof ValidationFailed) {
+        const id = err.schema?.$id;
+        const param = typeof id === 'string' && id.startsWith(PARAM_ID) ? id.slice(PARAM_ID.length) : undefined;
+        return refused(inputFailure('invalid_request', err.parameter, [], param));
+    }
+    if (err instanceof InvalidArgument)
+        return refused(new AuthzAdminFailure('invalid_request', 'the body must be a JSON object'));
+    return undefined;
+}
+//# sourceMappingURL=answers.js.map

package/lib/mjs/routes/answers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answers.js","sourceRoot":"","sources":["../../../src/routes/answers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,IAAa;IACnD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B;YACE,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,OAAO,CAAC,CAAoB;IAC1C,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClJ,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAErG,yIAAyI;AACzI,SAAS,OAAO,CAAC,MAAmC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,iIAAiI;AACjI,SAAS,MAAM,CAAC,CAAmB;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAA8F,CAAC;IAChH,0EAA0E;IAC1E,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnI,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC1H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAqC;IACpD,SAAS,EAAE,sBAAsB;IACjC,QAAQ,EAAE,sBAAsB;IAChC,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,yBAAyB;CACnC,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAmB,EAAE,KAAyB,EAAE,MAAmC;IACnG,MAAM,IAAI,GAAG,KAAK,IAAI,WAAW,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAiC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9G,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,sBAAsB;YACzB,OAAO,GAAG,IAAI,iCAAiC,CAAC;QAClD,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,cAAc,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,MAAuC,CAAC,eAAe,CAAC,CAAC;YAClJ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,qCAAqC,CAAC;QACpH,CAAC;QACD,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACtD,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,cAAc,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD;YACE,OAAO,GAAG,IAAI,gBAAgB,CAAC,CAAC,OAAO,GAAG,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAA0C,EAAE,MAAM,GAAsB,EAAE,EAAE,aAAsB;IAC3I,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/D,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAU;IACzC,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxH,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAI,GAAG,CAAC,MAAwC,EAAE,GAAG,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,OAAO,OAAO,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC/H,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/lib/mjs/routes/args.d.ts

@@ -0,0 +1,59 @@
+import { RouteArgs } from '@spinajs/http';
+import type { IRoute, IRouteCall, IRouteParameter, Req } from '@spinajs/http';
+import type * as express from 'express';
+import type { AuthzAdminCommandBatch } from '../dto/batch.js';
+import { AuthzCommandSchemaRegistry } from '../schemas/registry.js';
+type Decorator = ReturnType<typeof Req>;
+/** Route arg of `@AdminQuery()`: the whole query string as the parameter's DTO class, validated against its `@Schema`; a failure is 400 invalid_query. */
+export declare class AuthzAdminQueryArg extends RouteArgs {
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: object;
+    }>;
+}
+/** Route arg of `@AdminBody()`: the whole body as the parameter's DTO class. Unlike `@Body()`, a body key named as the parameter is not taken for the body. */
+export declare class AuthzAdminBodyArg extends RouteArgs {
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], param: IRouteParameter, req: express.Request, _res: express.Response, route: IRoute): Promise<{
+        CallData: IRouteCall;
+        Args: any;
+    }>;
+}
+/**
+ * Route arg of `@AdminBatch()`: the body of POST /authz/commands. The envelope is checked against
+ * BATCH_ENVELOPE_SCHEMA and each command against the schema AuthzCommandSchemaRegistry holds for its
+ * kind, read on each request so that a late AuthzCommandSchemaSource counts; a kind no source
+ * describes is refused. A failure is 400 invalid_request (not an object) or invalid_batch.
+ */
+export declare class AuthzAdminBatchArg extends RouteArgs {
+    protected Registry: AuthzCommandSchemaRegistry;
+    private strictCopies;
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], _param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: AuthzAdminCommandBatch;
+    }>;
+    /** The command schema under an `authz.` id, which the validation package checks without coercion. */
+    private strict;
+}
+/** Route arg of `@AdminDomain()`: the authz domain of the request as the AuthzDomainResolver names it, `authz.http.admin.domain` being its fallback. */
+export declare class AuthzAdminDomainArg extends RouteArgs {
+    Priority: number;
+    protected FallbackDomain: string;
+    get SupportedType(): string;
+    extract(callData: IRouteCall, _args: unknown[], _param: IRouteParameter, req: express.Request): Promise<{
+        CallData: IRouteCall;
+        Args: string;
+    }>;
+}
+/** The whole query string as the parameter's `@Schema` DTO class; 400 invalid_query when it breaks the schema. */
+export declare function AdminQuery(): Decorator;
+/** The whole body as the parameter's `@Schema` DTO class; 400 invalid_request when it breaks the schema. */
+export declare function AdminBody(): Decorator;
+/** The body of POST /authz/commands as AuthzAdminCommandBatch. */
+export declare function AdminBatch(): Decorator;
+/** The authz domain the admin routes run in for this request. */
+export declare function AdminDomain(): Decorator;
+export {};
+//# sourceMappingURL=args.d.ts.map

package/lib/mjs/routes/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/routes/args.ts"],"names":[],"mappings":"AAIA,OAAO,EAAoB,SAAS,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,EAAW,MAAM,eAAe,CAAC;AAEvF,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,CAAC;AAGxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAIpE,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;AAiBxC,0JAA0J;AAC1J,qBACa,kBAAmB,SAAQ,SAAS;IAC/C,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAOxG;CACF;AAED,+JAA+J;AAC/J,qBACa,iBAAkB,SAAQ,SAAS;IAC9C,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM;;;OAE/I;CACF;AAED;;;;;GAKG;AACH,qBACa,kBAAmB,SAAQ,SAAS;IAE/C,SAAS,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAG/C,OAAO,CAAC,YAAY,CAA6B;IAEjD,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAkBzG;IAED,qGAAqG;IACrG,OAAO,CAAC,MAAM;CAMf;AAED,wJAAwJ;AACxJ,qBACa,mBAAoB,SAAQ,SAAS;IAEzC,QAAQ,SAAM;IAGrB,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC;IAEjC,IAAW,aAAa,IAAI,MAAM,CAEjC;IAEY,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO;;;OAEzG;CACF;AAED,kHAAkH;AAClH,wBAAgB,UAAU,IAAI,SAAS,CAEtC;AAED,4GAA4G;AAC5G,wBAAgB,SAAS,IAAI,SAAS,CAErC;AAED,kEAAkE;AAClE,wBAAgB,UAAU,IAAI,SAAS,CAEtC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,SAAS,CAEvC"}

package/lib/mjs/routes/args.js

@@ -0,0 +1,160 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AuthzAdminFailure } from '@spinajs/authz';
+import { resolveAuthzDomain } from '@spinajs/authz-http';
+import { Config } from '@spinajs/configuration';
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Parameter, Route, RouteArgs } from '@spinajs/http';
+import { isPlainObject } from '@spinajs/util';
+import { BATCH_ENVELOPE_SCHEMA } from '../dto/batch.js';
+import { AuthzCommandSchemaRegistry } from '../schemas/registry.js';
+import { inputFailure } from './answers.js';
+import { decodeCommands } from './decode.js';
+const q = (v) => JSON.stringify(v);
+/** A query string value as the type its schema property names: the query string itself has none, and the admin schemas are validated without coercion. */
+function typedQuery(schema, query) {
+    const out = {};
+    for (const [key, value] of Object.entries(query)) {
+        const type = schema?.properties?.[key]?.type;
+        if (type === 'integer' && typeof value === 'string' && /^\d{1,15}$/.test(value))
+            out[key] = Number(value);
+        else if (type === 'boolean' && (value === 'true' || value === 'false'))
+            out[key] = value === 'true';
+        else
+            out[key] = value;
+    }
+    return out;
+}
+/** Route arg of `@AdminQuery()`: the whole query string as the parameter's DTO class, validated against its `@Schema`; a failure is 400 invalid_query. */
+let AuthzAdminQueryArg = class AuthzAdminQueryArg extends RouteArgs {
+    get SupportedType() {
+        return 'AuthzAdminQueryArg';
+    }
+    async extract(callData, _args, param, req) {
+        const Dto = param.RuntimeType;
+        const schema = this.Validator.extractSchema(Dto);
+        const input = typedQuery(schema, req.query ?? {});
+        const [valid, errors] = this.Validator.tryValidate(schema, input);
+        if (!valid)
+            throw inputFailure('invalid_query', errors);
+        return { CallData: callData, Args: new Dto(input) };
+    }
+};
+AuthzAdminQueryArg = __decorate([
+    Injectable()
+], AuthzAdminQueryArg);
+export { AuthzAdminQueryArg };
+/** Route arg of `@AdminBody()`: the whole body as the parameter's DTO class. Unlike `@Body()`, a body key named as the parameter is not taken for the body. */
+let AuthzAdminBodyArg = class AuthzAdminBodyArg extends RouteArgs {
+    get SupportedType() {
+        return 'AuthzAdminBodyArg';
+    }
+    async extract(callData, _args, param, req, _res, route) {
+        return { CallData: callData, Args: await this.tryHydrateParam(req.body ?? null, param, route) };
+    }
+};
+AuthzAdminBodyArg = __decorate([
+    Injectable()
+], AuthzAdminBodyArg);
+export { AuthzAdminBodyArg };
+/**
+ * Route arg of `@AdminBatch()`: the body of POST /authz/commands. The envelope is checked against
+ * BATCH_ENVELOPE_SCHEMA and each command against the schema AuthzCommandSchemaRegistry holds for its
+ * kind, read on each request so that a late AuthzCommandSchemaSource counts; a kind no source
+ * describes is refused. A failure is 400 invalid_request (not an object) or invalid_batch.
+ */
+let AuthzAdminBatchArg = class AuthzAdminBatchArg extends RouteArgs {
+    constructor() {
+        super(...arguments);
+        // Ajv caches every schema object it compiled for good, so the copies are keyed by content: sources may build fresh objects per call.
+        this.strictCopies = new Map();
+    }
+    get SupportedType() {
+        return 'AuthzAdminBatchArg';
+    }
+    async extract(callData, _args, _param, req) {
+        const body = req.body;
+        if (!isPlainObject(body))
+            throw new AuthzAdminFailure('invalid_request', 'the body must be an object { commands, reason?, idempotencyKey?, dryRun? }');
+        const [valid, errors] = this.Validator.tryValidate(BATCH_ENVELOPE_SCHEMA, body);
+        if (!valid)
+            throw inputFailure('invalid_batch', errors);
+        const schemas = this.Registry.commands();
+        const commands = body.commands;
+        commands.forEach((command, i) => {
+            if (!Object.hasOwn(schemas, command.kind))
+                throw new AuthzAdminFailure('invalid_batch', `command ${i} has kind ${q(command.kind)}, which no AuthzCommandSchemaSource describes`, `commands.${i}.kind`);
+            const [ok, failures] = this.Validator.tryValidate(this.strict(command.kind, schemas[command.kind]), command);
+            if (!ok)
+                throw inputFailure('invalid_batch', failures, ['commands', String(i)]);
+        });
+        const options = {};
+        for (const key of ['reason', 'idempotencyKey', 'dryRun'])
+            if (key in body)
+                options[key] = body[key];
+        const batch = { commands: decodeCommands(commands), options };
+        return { CallData: callData, Args: batch };
+    }
+    /** The command schema under an `authz.` id, which the validation package checks without coercion. */
+    strict(kind, schema) {
+        const key = `${kind}\n${JSON.stringify(schema)}`;
+        let copy = this.strictCopies.get(key);
+        if (!copy)
+            this.strictCopies.set(key, (copy = { ...schema, $id: `authz.admin.command.${kind}` }));
+        return copy;
+    }
+};
+__decorate([
+    Autoinject(AuthzCommandSchemaRegistry),
+    __metadata("design:type", AuthzCommandSchemaRegistry)
+], AuthzAdminBatchArg.prototype, "Registry", void 0);
+AuthzAdminBatchArg = __decorate([
+    Injectable()
+], AuthzAdminBatchArg);
+export { AuthzAdminBatchArg };
+/** Route arg of `@AdminDomain()`: the authz domain of the request as the AuthzDomainResolver names it, `authz.http.admin.domain` being its fallback. */
+let AuthzAdminDomainArg = class AuthzAdminDomainArg extends RouteArgs {
+    constructor() {
+        super(...arguments);
+        // Before the inputs, so that an unknown domain is refused before the input is checked.
+        this.Priority = 10;
+    }
+    get SupportedType() {
+        return 'AuthzAdminDomainArg';
+    }
+    async extract(callData, _args, _param, req) {
+        return { CallData: callData, Args: await resolveAuthzDomain(req, this.FallbackDomain) };
+    }
+};
+__decorate([
+    Config('authz.http.admin.domain'),
+    __metadata("design:type", String)
+], AuthzAdminDomainArg.prototype, "FallbackDomain", void 0);
+AuthzAdminDomainArg = __decorate([
+    Injectable()
+], AuthzAdminDomainArg);
+export { AuthzAdminDomainArg };
+/** The whole query string as the parameter's `@Schema` DTO class; 400 invalid_query when it breaks the schema. */
+export function AdminQuery() {
+    return Route(Parameter('AuthzAdminQueryArg', null));
+}
+/** The whole body as the parameter's `@Schema` DTO class; 400 invalid_request when it breaks the schema. */
+export function AdminBody() {
+    return Route(Parameter('AuthzAdminBodyArg', null, { required: true }));
+}
+/** The body of POST /authz/commands as AuthzAdminCommandBatch. */
+export function AdminBatch() {
+    return Route(Parameter('AuthzAdminBatchArg', null));
+}
+/** The authz domain the admin routes run in for this request. */
+export function AdminDomain() {
+    return Route(Parameter('AuthzAdminDomainArg', null));
+}
+//# sourceMappingURL=args.js.map

package/lib/mjs/routes/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../src/routes/args.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEpD,0JAA0J;AAC1J,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAwC;IACtF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;aACrG,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC;;YAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0JAA0J;AAEnJ,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,SAAS;IAC/C,IAAW,aAAa;QACtB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,KAAsB,EAAE,GAAoB;QACvG,MAAM,GAAG,GAAG,KAAK,CAAC,WAA4C,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAoB,CAAC;QACpE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAA;AAbY,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAa9B;;AAED,+JAA+J;AAExJ,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,SAAS;IAC9C,IAAW,aAAa;QACtB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,KAAsB,EAAE,GAAoB,EAAE,IAAsB,EAAE,KAAa;QAC9I,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAClG,CAAC;CACF,CAAA;AARY,iBAAiB;IAD7B,UAAU,EAAE;GACA,iBAAiB,CAQ7B;;AAED;;;;;GAKG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,SAAS;IAA1C;;QAIL,qIAAqI;QAC7H,iBAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAiCnD,CAAC;IA/BC,IAAW,aAAa;QACtB,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,MAAuB,EAAE,GAAoB;QACxG,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,4EAA4E,CAAC,CAAC;QACvJ,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK;YAAE,MAAM,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA8B,CAAC;QACrD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,+CAA+C,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACvM,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7G,IAAI,CAAC,EAAE;gBAAE,MAAM,YAAY,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAU;YAAE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7G,MAAM,KAAK,GAA2B,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAuB,EAAE,OAAO,EAAE,CAAC;QAC5G,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,qGAAqG;IAC7F,MAAM,CAAC,IAAY,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,uBAAuB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AApCW;IADT,UAAU,CAAC,0BAA0B,CAAC;8BACnB,0BAA0B;oDAAC;AAFpC,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAsC9B;;AAED,wJAAwJ;AAEjJ,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,SAAS;IAA3C;;QACL,uFAAuF;QAChF,aAAQ,GAAG,EAAE,CAAC;IAYvB,CAAC;IAPC,IAAW,aAAa;QACtB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAoB,EAAE,KAAgB,EAAE,MAAuB,EAAE,GAAoB;QACxG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC,GAAc,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;IACrG,CAAC;CACF,CAAA;AATW;IADT,MAAM,CAAC,yBAAyB,CAAC;;2DACD;AALtB,mBAAmB;IAD/B,UAAU,EAAE;GACA,mBAAmB,CAc/B;;AAED,kHAAkH;AAClH,MAAM,UAAU,UAAU;IACxB,OAAO,KAAK,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU;IACxB,OAAO,KAAK,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/lib/mjs/routes/index.d.ts

@@ -1,4 +1,7 @@
+export * from './answers.js';
+export * from './args.js';
 export * from './decode.js';
+export * from './no-store.js';
 export * from './query.js';
 export * from './status.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/mjs/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/mjs/routes/index.js

@@ -1,4 +1,7 @@
+export * from './answers.js';
+export * from './args.js';
 export * from './decode.js';
+export * from './no-store.js';
 export * from './query.js';
 export * from './status.js';
 //# sourceMappingURL=index.js.map

package/lib/mjs/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/lib/mjs/routes/no-store.d.ts

@@ -0,0 +1,10 @@
+import { RouteMiddleware } from '@spinajs/http';
+import type * as express from 'express';
+/** For routes whose answer may hold a link token: no proxy or browser cache may keep one. Set before the route runs, so it goes out with any answer it gives. */
+export declare class NoStore extends RouteMiddleware {
+    isEnabled(): boolean;
+    onBefore(_req: express.Request, res: express.Response): Promise<void>;
+    onAfter(): Promise<void>;
+    onResponse(): Promise<void>;
+}
+//# sourceMappingURL=no-store.d.ts.map

package/lib/mjs/routes/no-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-store.d.ts","sourceRoot":"","sources":["../../../src/routes/no-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,CAAC;AAExC,iKAAiK;AACjK,qBAAa,OAAQ,SAAQ,eAAe;IACnC,SAAS,IAAI,OAAO,CAE1B;IAEY,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAE3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;CAC5C"}

package/lib/mjs/routes/no-store.js

@@ -0,0 +1,14 @@
+import { RouteMiddleware } from '@spinajs/http';
+/** For routes whose answer may hold a link token: no proxy or browser cache may keep one. Set before the route runs, so it goes out with any answer it gives. */
+export class NoStore extends RouteMiddleware {
+    isEnabled() {
+        return true;
+    }
+    async onBefore(_req, res) {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Pragma', 'no-cache');
+    }
+    async onAfter() { }
+    async onResponse() { }
+}
+//# sourceMappingURL=no-store.js.map

package/lib/mjs/routes/no-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-store.js","sourceRoot":"","sources":["../../../src/routes/no-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,iKAAiK;AACjK,MAAM,OAAO,OAAQ,SAAQ,eAAe;IACnC,SAAS;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,IAAqB,EAAE,GAAqB;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,KAAmB,CAAC;IAEjC,KAAK,CAAC,UAAU,KAAmB,CAAC;CAC5C"}

package/lib/mjs/routes/query.d.ts

@@ -1,6 +1,5 @@
 import type { AuthzAdminOptions, AuthzAdminQuery, PrincipalRef, ResourceRef } from '@spinajs/authz';
-/** A parsed query string (express: string, string[] or a nested object per key). */
-export type QueryInput = Readonly<Record<string, unknown>>;
+import type { AuthzAdminPageQuery, AuthzAssignmentsQuery, AuthzHoldersQuery, AuthzWriteOptionsQuery } from '../dto/queries.js';
 /** authz-rbac's AssignmentSubject; the list queries belong to models this package does not import. */
 type AssignmentSubject = PrincipalRef | {
     readonly set: {
@@ -13,12 +12,12 @@ export declare function parseResourceRef(value: string, field: string): Resource
 /** `<type>:<id>` (a principal) or `set:<role>@<type>:<id>` (a subject set). */
 export declare function parseAssignmentSubject(value: string, field?: string): AssignmentSubject;
 /** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset` or `after`. */
-export declare function readAssignmentsQuery(q: QueryInput): AuthzAdminQuery;
+export declare function readAssignmentsQuery(q: AuthzAssignmentsQuery): AuthzAdminQuery;
 /** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset` or `after`. */
-export declare function readHoldersQuery(q: QueryInput): AuthzAdminQuery;
-/** GET /authz/links and /authz/rules: `scope`, `limit`, `offset` or `after`; GET /authz/policies has no `after`. */
-export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: QueryInput): AuthzAdminQuery;
+export declare function readHoldersQuery(q: AuthzHoldersQuery): AuthzAdminQuery;
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset` or `after` (policies have no `after`, which their query DTO refuses). */
+export declare function readPageQuery(kind: 'links' | 'rules' | 'policies', q: AuthzAdminPageQuery): AuthzAdminQuery;
 /** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
-export declare function readWriteOptions(q: QueryInput): AuthzAdminOptions;
+export declare function readWriteOptions(q: AuthzWriteOptionsQuery): AuthzAdminOptions;
 export {};
 //# sourceMappingURL=query.d.ts.map

package/lib/mjs/routes/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpG,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAI3D,sGAAsG;AACtG,KAAK,iBAAiB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAA;CAAE,CAAC;AAajH,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AAsCD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAYnE;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,eAAe,CAa/D;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,eAAe,CAGlG;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,iBAAiB,CASjE"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/routes/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpG,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAI/H,sGAAsG;AACtG,KAAK,iBAAiB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,CAAA;CAAE,CAAC;AAMjH,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAS1E;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,iBAAiB,CAa1F;AAcD,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAS9E;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,iBAAiB,GAAG,eAAe,CAStE;AAED,2JAA2J;AAC3J,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,EAAE,mBAAmB,GAAG,eAAe,CAE3G;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,sBAAsB,GAAG,iBAAiB,CAM7E"}

package/lib/mjs/routes/query.js

@@ -2,14 +2,6 @@ import { AuthzAdminFailure, GLOBAL } from '@spinajs/authz';
 function invalid(field, message) {
     throw new AuthzAdminFailure('invalid_query', message, field);
 }
-function text(q, field) {
-    const v = q[field];
-    if (v === undefined)
-        return undefined;
-    if (typeof v !== 'string')
-        invalid(field, `${field} must be given once, as text`);
-    return v;
-}
 /** `<type>` or `<type>:<id>`, split at the first `:` (ids may hold more); `$global` is GLOBAL. */
 export function parseResourceRef(value, field) {
     if (value === GLOBAL.type)
@@ -43,90 +35,51 @@ export function parseAssignmentSubject(value, field = 'subject') {
         return bad();
     return { type: value.slice(0, at), id: value.slice(at + 1) };
 }
-function flag(q, field) {
-    const v = text(q, field);
-    if (v === undefined)
-        return undefined;
-    if (v !== 'true' && v !== 'false')
-        invalid(field, `${field} must be true or false`);
-    return v === 'true';
-}
-function count(q, field) {
-    const v = text(q, field);
-    if (v === undefined)
-        return undefined;
-    if (!/^\d+$/.test(v))
-        invalid(field, `${field} must be a non-negative integer`);
-    return Number(v);
-}
-/** `after`, the `next` of the previous page; it replaces `offset`. */
-function cursor(q, offset) {
-    const after = text(q, 'after');
-    if (after === '')
-        invalid('after', 'after must not be empty');
+/** `limit`, `offset` and `after` as AuthzAdmin's page, only the ones given; AuthzAdmin defaults the rest. `after` replaces `offset`. */
+function page(q) {
+    const { limit, offset, after } = q;
     if (after !== undefined && offset !== undefined)
         invalid('after', 'after replaces offset: give one of them');
-    return after;
-}
-/** `limit`, `offset` and `after` as AuthzAdmin's page, only the ones given; AuthzAdmin defaults the rest. */
-function page(q) {
-    const limit = count(q, 'limit');
-    const offset = count(q, 'offset');
-    const after = cursor(q, offset);
     if (limit === undefined && offset === undefined && after === undefined)
         return {};
     return { page: { ...(limit === undefined ? {} : { limit }), ...(offset === undefined ? {} : { offset }), ...(after === undefined ? {} : { after }) } };
 }
 function scope(q) {
-    const v = text(q, 'scope');
-    return v === undefined ? {} : { scope: parseResourceRef(v, 'scope') };
+    return q.scope === undefined ? {} : { scope: parseResourceRef(q.scope, 'scope') };
 }
 /** GET /authz/assignments: `scope`, `subject`, `role`, `includeExpired`, `limit`, `offset` or `after`. */
 export function readAssignmentsQuery(q) {
-    const subject = text(q, 'subject');
-    const role = text(q, 'role');
-    const includeExpired = flag(q, 'includeExpired');
     return {
         kind: 'assignments',
         ...scope(q),
-        ...(subject === undefined ? {} : { subject: parseAssignmentSubject(subject) }),
-        ...(role === undefined ? {} : { role }),
-        ...(includeExpired === undefined ? {} : { includeExpired }),
+        ...(q.subject === undefined ? {} : { subject: parseAssignmentSubject(q.subject) }),
+        ...(q.role === undefined ? {} : { role: q.role }),
+        ...(q.includeExpired === undefined ? {} : { includeExpired: q.includeExpired }),
         ...page(q),
     };
 }
 /** GET /authz/holders: `scope` and `permission` (both required), `expandSets`, `limit`, `offset` or `after`. */
 export function readHoldersQuery(q) {
-    const scope = text(q, 'scope');
-    const permission = text(q, 'permission');
-    if (scope === undefined)
+    if (q.scope === undefined)
         invalid('scope', 'scope is required');
-    if (permission === undefined || permission === '')
-        invalid('permission', 'permission is required');
-    const expandSets = flag(q, 'expandSets');
     return {
         kind: 'holders',
-        scope: parseResourceRef(scope, 'scope'),
-        permission,
-        ...(expandSets === undefined ? {} : { expandSets }),
+        scope: parseResourceRef(q.scope, 'scope'),
+        permission: q.permission,
+        ...(q.expandSets === undefined ? {} : { expandSets: q.expandSets }),
         ...page(q),
     };
 }
-/** GET /authz/links and /authz/rules: `scope`, `limit`, `offset` or `after`; GET /authz/policies has no `after`. */
+/** GET /authz/links, /authz/rules and /authz/policies: `scope`, `limit`, `offset` or `after` (policies have no `after`, which their query DTO refuses). */
 export function readPageQuery(kind, q) {
-    if (kind === 'policies' && text(q, 'after') !== undefined)
-        invalid('after', 'policies are paged by offset: after is not supported');
     return { kind, ...scope(q), ...page(q) };
 }
 /** The AuthzAdminOptions of a single-command route: `reason`, `idempotencyKey`, `dryRun`. */
 export function readWriteOptions(q) {
-    const reason = text(q, 'reason');
-    const idempotencyKey = text(q, 'idempotencyKey');
-    const dryRun = flag(q, 'dryRun');
     return {
-        ...(reason === undefined ? {} : { reason }),
-        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
-        ...(dryRun === undefined ? {} : { dryRun }),
+        ...(q.reason === undefined ? {} : { reason: q.reason }),
+        ...(q.idempotencyKey === undefined ? {} : { idempotencyKey: q.idempotencyKey }),
+        ...(q.dryRun === undefined ? {} : { dryRun: q.dryRun }),
     };
 }
 //# sourceMappingURL=query.js.map