@spinajs/authz-http-admin 3.0.3 → 3.0.5

package/lib/cjs/schemas/registry.d.ts

@@ -0,0 +1,21 @@
+import type { IContainer } from '@spinajs/di';
+import type { JsonSchema } from './primitives.js';
+/**
+ * The JSON schemas of one model's admin commands, by command kind. Each model contributes one with
+ * `@Injectable(AuthzCommandSchemaSource)`; the batch body of POST /authz/commands lists every registered kind.
+ */
+export declare abstract class AuthzCommandSchemaSource {
+    /** Command kind -> the JSON schema of that command, `kind` included. */
+    abstract schemas(): Readonly<Record<string, object>>;
+}
+/** The command schemas of every registered AuthzCommandSchemaSource, read on each call so a late registration counts. */
+export declare class AuthzCommandSchemaRegistry {
+    protected readonly container: IContainer;
+    constructor(container: IContainer);
+    /** Command kind -> JSON schema, merged from the sources of this container and its ancestors. */
+    commands(): Readonly<Record<string, JsonSchema>>;
+    /** The body of POST /authz/commands over the registered command kinds (schema AuthzAdminBatch). */
+    batch(): JsonSchema;
+    private sources;
+}
+//# sourceMappingURL=registry.d.ts.map

package/lib/cjs/schemas/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/schemas/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AACH,8BAAsB,wBAAwB;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AASD,yHAAyH;AACzH,qBAEa,0BAA0B;IACzB,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU;IAApD,YAA+B,SAAS,EAAE,UAAU,EAAI;IAExD,gGAAgG;IACzF,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CActD;IAED,mGAAmG;IAC5F,KAAK,IAAI,UAAU,CAEzB;IAED,OAAO,CAAC,OAAO;CAShB"}

package/lib/cjs/schemas/registry.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzCommandSchemaRegistry = exports.AuthzCommandSchemaSource = void 0;
+const authz_1 = require("@spinajs/authz");
+const di_1 = require("@spinajs/di");
+const primitives_js_1 = require("./primitives.js");
+/**
+ * The JSON schemas of one model's admin commands, by command kind. Each model contributes one with
+ * `@Injectable(AuthzCommandSchemaSource)`; the batch body of POST /authz/commands lists every registered kind.
+ */
+class AuthzCommandSchemaSource {
+}
+exports.AuthzCommandSchemaSource = AuthzCommandSchemaSource;
+const q = (v) => JSON.stringify(v);
+function namesKind(schema, kind) {
+    const property = schema.properties?.kind;
+    return Array.isArray(property?.enum) && property.enum.length === 1 && property.enum[0] === kind;
+}
+/** The command schemas of every registered AuthzCommandSchemaSource, read on each call so a late registration counts. */
+let AuthzCommandSchemaRegistry = class AuthzCommandSchemaRegistry {
+    constructor(container) {
+        this.container = container;
+    }
+    /** Command kind -> JSON schema, merged from the sources of this container and its ancestors. */
+    commands() {
+        const out = {};
+        const owners = new Map();
+        for (const source of this.sources()) {
+            const name = source.constructor.name;
+            for (const [kind, schema] of Object.entries(source.schemas())) {
+                const other = owners.get(kind);
+                if (other !== undefined)
+                    throw new authz_1.AuthzConfigError(`Two AuthzCommandSchemaSources describe command kind ${q(kind)}: ${other} and ${name}`);
+                if (!namesKind(schema, kind))
+                    throw new authz_1.AuthzConfigError(`${name}: the schema of command kind ${q(kind)} must have properties.kind.enum [${q(kind)}]`);
+                owners.set(kind, name);
+                out[kind] = schema;
+            }
+        }
+        return out;
+    }
+    /** The body of POST /authz/commands over the registered command kinds (schema AuthzAdminBatch). */
+    batch() {
+        return (0, primitives_js_1.commandBatch)(Object.values(this.commands()));
+    }
+    sources() {
+        const sources = this.container.resolve(Array.chainOf(AuthzCommandSchemaSource));
+        // SchemaProvider.getSchema is synchronous, so the sources must be too.
+        if (sources instanceof Promise) {
+            sources.catch(() => undefined);
+            throw new authz_1.AuthzConfigError('An AuthzCommandSchemaSource must not be an AsyncService');
+        }
+        return [...sources];
+    }
+};
+exports.AuthzCommandSchemaRegistry = AuthzCommandSchemaRegistry;
+exports.AuthzCommandSchemaRegistry = AuthzCommandSchemaRegistry = __decorate([
+    (0, di_1.Singleton)(),
+    (0, di_1.Inject)(di_1.Container),
+    __metadata("design:paramtypes", [Object])
+], AuthzCommandSchemaRegistry);
+//# sourceMappingURL=registry.js.map

package/lib/cjs/schemas/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/schemas/registry.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAkD;AAClD,oCAA2D;AAG3D,mDAA+C;AAG/C;;;GAGG;AACH;CAGC;;AAED,MAAM,CAAC,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEpD,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY;IAC7C,MAAM,QAAQ,GAAI,MAAyD,CAAC,UAAU,EAAE,IAAI,CAAC;IAC7F,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAClG,CAAC;AAED,yHAAyH;AAGlH,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAA+B,SAAqB;yBAArB,SAAS;IAAe,CAAC;IAExD,gGAAgG;IACzF,QAAQ;QACb,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,IAAI,wBAAgB,CAAC,uDAAuD,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC5I,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC;oBAAE,MAAM,IAAI,wBAAgB,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvJ,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,GAAG,MAAoB,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mGAAmG;IAC5F,KAAK;QACV,OAAO,IAAA,4BAAY,EAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,OAAO;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAChF,uEAAuE;QACvE,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/B,MAAM,IAAI,wBAAgB,CAAC,yDAAyD,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;CACF,CAAA;;qCAlCY,0BAA0B;IAFtC,IAAA,cAAS,GAAE;IACX,IAAA,WAAM,EAAC,cAAS,CAAC;;GACL,0BAA0B,CAkCtC"}

package/lib/mjs/controllers/AuthzAdminController.d.ts

@@ -16,8 +16,11 @@ import '../schemas/provider.js';
 export declare class AuthzAdminController extends BaseController {
     protected AdminDomain: string;
     protected Domains: AuthzDomains;
-    /** Runs a route on the domain's AuthzAdmin; an AuthzAdminFailure becomes its status with `{ error }`, anything else propagates. */
-    protected guarded(fn: (admin: AuthzAdmin) => Promise<Response>): Promise<Response>;
+    /**
+     * Runs a route on the AuthzAdmin of the domain the AuthzDomainResolver names for `req`, `authz.http.admin.domain` being its fallback and the domain without a request.
+     * An AuthzAdminFailure becomes its status with `{ error }`, a domain no live domain bears 403 `unknown_domain`, anything else propagates.
+     */
+    protected guarded(fn: (admin: AuthzAdmin) => Promise<Response>, req?: Request): Promise<Response>;
     /** One batch built from the route, with the options of the query string. */
     protected single(req: Request, build: () => AuthzCommand[]): Promise<Response<any>>;
     protected list(req: Request, build: () => AuthzAdminQuery): Promise<Response<any>>;
@@ -29,15 +32,16 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     commands(req: Request): Promise<Response<any>>;
     /**
      * List assignments
      * Lists assignments, filtered by the query.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -47,7 +51,7 @@ export declare class AuthzAdminController extends BaseController {
     /**
      * List holders
      * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
-     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset`.
+     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of holders
      * @response 400 {AuthzAdminError} invalid_query: a malformed or missing query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -62,9 +66,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     grant(req: Request): Promise<Response<any>>;
     /**
@@ -75,9 +80,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     patchAssignment(req: Request): Promise<Response<any>>;
     /**
@@ -87,15 +93,16 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     revoke(req: Request): Promise<Response<any>>;
     /**
      * List share links
      * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -110,9 +117,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} The link was created; results[0] holds its id and token
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     createLink(req: Request): Promise<Response<any>>;
     /**
@@ -123,9 +131,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     patchLink(req: Request): Promise<Response<any>>;
     /**
@@ -135,15 +144,16 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     revokeLink(req: Request): Promise<Response<any>>;
     /**
      * List rules
      * Lists the RBAC rules held as rows.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -158,9 +168,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     putRule(req: Request): Promise<Response<any>>;
     /**
@@ -170,9 +181,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     deleteRule(req: Request): Promise<Response<any>>;
     /**
@@ -193,9 +205,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     putPolicy(req: Request): Promise<Response<any>>;
     /**
@@ -205,9 +218,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     deletePolicy(req: Request): Promise<Response<any>>;
     /**
@@ -227,9 +241,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     patchAttributes(req: Request): Promise<Response<any>>;
     /**
@@ -240,9 +255,10 @@ export declare class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     replaceAttributes(req: Request): Promise<Response<any>>;
 }

package/lib/mjs/controllers/AuthzAdminController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthzAdminController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAqB,eAAe,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAC3H,OAAO,EAAsB,cAAc,EAAgG,MAAM,eAAe,CAAC;AACjK,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIvD,OAAO,wBAAwB,CAAC;AAkEhC;;;;;;;;;GASG;AACH,qBAEa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC,mIAAmI;IACnI,UAAgB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQvF;IAED,4EAA4E;IAC5E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,0BAKzD;IAED,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,0BAExD;IAED;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAQ,GAAG,EAAE,OAAO,0BAQxC;IAED;;;;;;;;OAQG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAQ,GAAG,EAAE,OAAO,0BAE3C;IAED;;;;;;;;;;;OAWG;IAEU,KAAK,CAAQ,GAAG,EAAE,OAAO,0BAErC;IAED;;;;;;;;;;;OAWG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAY/C;IAED;;;;;;;;;;OAUG;IAEU,MAAM,CAAQ,GAAG,EAAE,OAAO,0BAEtC;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAG1C;IAED;;;;;;;;;;;OAWG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;OAUG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,OAAO,CAAQ,GAAG,EAAE,OAAO,0BAEvC;IAED;;;;;;;;;;OAUG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;;;;;OAWG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;OAUG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;OAOG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;;;;OAWG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;;;;OAWG;IAEU,iBAAiB,CAAQ,GAAG,EAAE,OAAO,0BAEjD;CACF"}
+{"version":3,"file":"AuthzAdminController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAqB,eAAe,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAC3H,OAAO,EAAsB,cAAc,EAA6G,MAAM,eAAe,CAAC;AAC9K,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIvD,OAAO,wBAAwB,CAAC;AAuEhC;;;;;;;;;GASG;AACH,qBAEa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC;;;OAGG;IACH,UAAgB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CActG;IAED,4EAA4E;IAC5E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,0BAKzD;IAED,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,0BAExD;IAED;;;;;;;;;;;;OAYG;IAEU,QAAQ,CAAQ,GAAG,EAAE,OAAO,0BAQxC;IAED;;;;;;;;OAQG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAQ,GAAG,EAAE,OAAO,0BAE3C;IAED;;;;;;;;;;;;OAYG;IAEU,KAAK,CAAQ,GAAG,EAAE,OAAO,0BAErC;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAY/C;IAED;;;;;;;;;;;OAWG;IAEU,MAAM,CAAQ,GAAG,EAAE,OAAO,0BAEtC;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;;OAYG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAG1C;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;;OAYG;IAEU,OAAO,CAAQ,GAAG,EAAE,OAAO,0BAEvC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;OAOG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;;;;;OAYG;IAEU,iBAAiB,CAAQ,GAAG,EAAE,OAAO,0BAEjD;CACF"}

package/lib/mjs/controllers/AuthzAdminController.js

@@ -13,8 +13,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { AuthzAdminFailure, AuthzDomains } from '@spinajs/authz';
 import { Config } from '@spinajs/configuration';
 import { Autoinject } from '@spinajs/di';
-import { BadRequestResponse, BaseController, BasePath, Conflict, Del, ForbiddenResponse, Get, NotFound, Ok, Patch, Policy, Post, Put, Req } from '@spinajs/http';
-import { IsAuthenticated } from '@spinajs/authz-http';
+import { BadRequestResponse, BaseController, BasePath, Conflict, Del, ForbiddenResponse, Get, NotFound, Ok, Patch, Policy, Post, Put, Req, ServerError } from '@spinajs/http';
+import { IsAuthenticated, UnknownAuthzDomain, resolveAuthzDomain } from '@spinajs/authz-http';
 import { isPlainObject } from '@spinajs/util';
 import '../schemas/provider.js';
 import { decodeCommand, decodeCommands } from '../routes/decode.js';
@@ -32,6 +32,8 @@ function respond(status, body) {
             return new NotFound(body);
         case 409:
             return new Conflict(body);
+        case 500:
+            return new ServerError(body);
         default:
             return new BadRequestResponse(body);
     }
@@ -54,6 +56,8 @@ function withPathId(body, id, what) {
         badRequest(`the body id ${JSON.stringify(o.id)} is not the path id ${JSON.stringify(id)}`, 'id');
     return { ...o, id };
 }
+// The routes serve the RBAC and ABAC commands, whose AuthzCommandMap entries this package does not import.
+const byId = (kind, id) => ({ kind, id });
 const LINK_PATCH_KEYS = ['expiresAt', 'attributes', 'role', 'tags'];
 /** PATCH /authz/links/:id as one link.update; like the assignment patch, a key it does not serve is refused, not ignored. */
 function linkUpdate(body, id) {
@@ -85,9 +89,20 @@ const scopeOf = (req) => ({ type: param(req, 'type'), id: param(req, 'id') });
  * @tags Authz admin
  */
 let AuthzAdminController = class AuthzAdminController extends BaseController {
-    /** Runs a route on the domain's AuthzAdmin; an AuthzAdminFailure becomes its status with `{ error }`, anything else propagates. */
-    async guarded(fn) {
-        const admin = (await this.Domains.service(this.AdminDomain)).admin();
+    /**
+     * Runs a route on the AuthzAdmin of the domain the AuthzDomainResolver names for `req`, `authz.http.admin.domain` being its fallback and the domain without a request.
+     * An AuthzAdminFailure becomes its status with `{ error }`, a domain no live domain bears 403 `unknown_domain`, anything else propagates.
+     */
+    async guarded(fn, req) {
+        let admin;
+        try {
+            admin = (await this.Domains.service(req ? await resolveAuthzDomain(req, this.AdminDomain) : this.AdminDomain)).admin();
+        }
+        catch (e) {
+            if (e instanceof UnknownAuthzDomain)
+                return respond(403, { error: { code: 'unknown_domain', message: e.message } });
+            throw e;
+        }
         try {
             return await fn(admin);
         }
@@ -102,10 +117,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
         return this.guarded(async (admin) => {
             const opts = readWriteOptions(query(req));
             return results(await admin.execute(actorOf(req), build(), opts));
-        });
+        }, req);
     }
     list(req, build) {
-        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())));
+        return this.guarded(async (admin) => respond(200, await admin.list(actorOf(req), build())), req);
     }
     /**
      * Run a batch of commands
@@ -115,9 +130,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async commands(req) {
         noStore(req);
@@ -128,12 +144,12 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
                 if (key in body)
                     opts[key] = body[key];
             return results(await admin.execute(actorOf(req), decodeCommands(body.commands), opts));
-        });
+        }, req);
     }
     /**
      * List assignments
      * Lists assignments, filtered by the query.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -145,7 +161,7 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
     /**
      * List holders
      * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
-     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset`.
+     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of holders
      * @response 400 {AuthzAdminError} invalid_query: a malformed or missing query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -162,9 +178,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async grant(req) {
         return this.single(req, () => [decodeCommand({ ...objectBody(req.body, 'the fields of assignment.grant'), kind: 'assignment.grant' })]);
@@ -177,9 +194,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async patchAssignment(req) {
         return this.single(req, () => {
@@ -206,17 +224,18 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async revoke(req) {
-        return this.single(req, () => [{ kind: 'assignment.revoke', id: param(req, 'id') }]);
+        return this.single(req, () => [byId('assignment.revoke', param(req, 'id'))]);
     }
     /**
      * List share links
      * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -233,9 +252,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} The link was created; results[0] holds its id and token
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async createLink(req) {
         noStore(req);
@@ -249,9 +269,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async patchLink(req) {
         return this.single(req, () => [linkUpdate(req.body, param(req, 'id'))]);
@@ -263,17 +284,18 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async revokeLink(req) {
-        return this.single(req, () => [{ kind: 'link.revoke', id: param(req, 'id') }]);
+        return this.single(req, () => [byId('link.revoke', param(req, 'id'))]);
     }
     /**
      * List rules
      * Lists the RBAC rules held as rows.
-     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset` or `after` (the `next` of the previous page).
      * @response 200 {AuthzAdminPage} One page of rows
      * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
      * @response 401 Unauthorized: a valid session or token is required
@@ -290,9 +312,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async putRule(req) {
         return this.single(req, () => [decodeCommand({ kind: 'rule.put', rule: withPathId(req.body, param(req, 'id'), 'a rule') })]);
@@ -304,12 +327,13 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async deleteRule(req) {
-        return this.single(req, () => [{ kind: 'rule.delete', id: param(req, 'id') }]);
+        return this.single(req, () => [byId('rule.delete', param(req, 'id'))]);
     }
     /**
      * List policies
@@ -331,9 +355,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async putPolicy(req) {
         return this.single(req, () => [decodeCommand({ kind: 'policy.put', policy: withPathId(req.body, param(req, 'id'), 'a policy') })]);
@@ -345,12 +370,13 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async deletePolicy(req) {
-        return this.single(req, () => [{ kind: 'policy.delete', id: param(req, 'id') }]);
+        return this.single(req, () => [byId('policy.delete', param(req, 'id'))]);
     }
     /**
      * Read scope attributes
@@ -371,9 +397,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async patchAttributes(req) {
         return this.single(req, () => [{ kind: 'scope.setAttributes', scope: scopeOf(req), patch: req.body }]);
@@ -386,9 +413,10 @@ let AuthzAdminController = class AuthzAdminController extends BaseController {
      * @response 200 {AuthzAdminResults} Every command succeeded
      * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
      * @response 401 Unauthorized: a valid session or token is required
-     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout, protected_role or hook:<code> (an action hook refused)
      * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
     async replaceAttributes(req) {
         return this.single(req, () => [{ kind: 'scope.replaceAttributes', scope: scopeOf(req), attributes: req.body }]);
@@ -537,7 +565,7 @@ __decorate([
 ], AuthzAdminController.prototype, "replaceAttributes", null);
 AuthzAdminController = __decorate([
     Policy(IsAuthenticated),
-    BasePath('authz')
+    BasePath({ config: 'authz.http.admin.basePath', default: 'authz' })
 ], AuthzAdminController);
 export { AuthzAdminController };
 function results(r) {