@spinajs/authz-queue 0.0.0-stage → 3.0.0

package/lib/cjs/hook/initiator.js

@@ -0,0 +1,128 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StampedInitiatorPrincipalFactory = exports.InitiatorPrincipalFactory = void 0;
+exports.reviveCeiling = reviveCeiling;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const authz_1 = require("@spinajs/authz");
+const util_1 = require("@spinajs/util");
+/**
+ * Builds the principal a job runs as from the `Initiator` on its message. An app that must reload
+ * the user (attributes, deactivation) registers its own with `DI.register(X).as(InitiatorPrincipalFactory)`.
+ * Return `UNATTENDED` for an initiator that can no longer act; throw only for a failure worth a retry.
+ */
+class InitiatorPrincipalFactory {
+}
+exports.InitiatorPrincipalFactory = InitiatorPrincipalFactory;
+// null counts as absent, as in the engine's ceiling reader.
+function reviveDate(v) {
+    const d = v instanceof Date ? v : typeof v === 'string' || typeof v === 'number' ? new Date(v) : undefined;
+    return d !== undefined && !Number.isNaN(d.getTime()) ? d : undefined;
+}
+/** Rebuilds a Ceiling that went through a JSON broker (`expiresAt` is a string there); undefined when the shape is wrong. */
+function reviveCeiling(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const c = Object.fromEntries(Object.entries(raw).filter(([, v]) => v !== null));
+    const out = {};
+    if (c.roles !== undefined) {
+        if (!(0, util_1.isStringArray)(c.roles))
+            return undefined;
+        out.roles = [...c.roles];
+    }
+    if (c.permissions !== undefined) {
+        if (!(0, util_1.isStringArray)(c.permissions))
+            return undefined;
+        out.permissions = [...c.permissions];
+    }
+    if (c.resources !== undefined) {
+        if (!Array.isArray(c.resources))
+            return undefined;
+        const resources = [];
+        for (const r of c.resources) {
+            if (r === null || typeof r !== 'object')
+                return undefined;
+            const { type, id } = r;
+            if (typeof type !== 'string' || (id !== undefined && typeof id !== 'string'))
+                return undefined;
+            resources.push(id === undefined ? { type } : { type, id });
+        }
+        out.resources = resources;
+    }
+    if (c.expiresAt !== undefined) {
+        const expiresAt = reviveDate(c.expiresAt);
+        if (expiresAt === undefined)
+            return undefined;
+        out.expiresAt = expiresAt;
+    }
+    if (c.reason !== undefined) {
+        if (typeof c.reason !== 'string')
+            return undefined;
+        out.reason = c.reason;
+    }
+    return out;
+}
+/** Trusts the stamp: type, id and ceiling are all the principal has. A malformed stamp yields `UNATTENDED`. */
+let StampedInitiatorPrincipalFactory = class StampedInitiatorPrincipalFactory extends InitiatorPrincipalFactory {
+    /**
+     * `warn` decides the one-time warning without reading the config, for a wrapper built with `new` that does reload the user.
+     * Without it, `authz.queue.stampedInitiatorWarning` decides, so a `new` instance needs a resolved Configuration.
+     */
+    constructor(options = {}) {
+        super();
+        this.warned = false;
+        this.Log = (0, authz_1.engineLog)('authz-queue');
+        this.warn = options.warn;
+    }
+    async principalOf(initiator) {
+        if (!this.warned) {
+            // The schema default keeps the warning; so does a value the schema never saw.
+            const warn = this.warn ?? this.WarningSwitch !== false;
+            this.warned = true;
+            if (warn)
+                this.Log.warn('authz-queue: jobs run as their initiator from the stamp alone; register an InitiatorPrincipalFactory that reloads the user so deactivated users stop acting');
+        }
+        if (initiator === null || typeof initiator !== 'object')
+            return authz_1.UNATTENDED;
+        const { type, id, ceiling } = initiator;
+        if (typeof type !== 'string' || type === '' || typeof id !== 'string' || id === '')
+            return authz_1.UNATTENDED;
+        if (type === 'system')
+            return authz_1.SYSTEM;
+        if (type === 'unattended')
+            return authz_1.UNATTENDED;
+        let revived;
+        if (ceiling !== undefined && ceiling !== null) {
+            revived = reviveCeiling(ceiling);
+            if (revived === undefined)
+                return authz_1.UNATTENDED;
+        }
+        return Object.freeze({
+            type,
+            id,
+            authenticated: type !== 'anonymous',
+            source: 'queue',
+            attributes: Object.freeze({}),
+            ...(revived ? { ceiling: revived } : {}),
+        });
+    }
+};
+exports.StampedInitiatorPrincipalFactory = StampedInitiatorPrincipalFactory;
+__decorate([
+    (0, configuration_1.Config)('authz.queue.stampedInitiatorWarning'),
+    __metadata("design:type", Boolean)
+], StampedInitiatorPrincipalFactory.prototype, "WarningSwitch", void 0);
+exports.StampedInitiatorPrincipalFactory = StampedInitiatorPrincipalFactory = __decorate([
+    (0, di_1.Injectable)(InitiatorPrincipalFactory),
+    __metadata("design:paramtypes", [Object])
+], StampedInitiatorPrincipalFactory);
+//# sourceMappingURL=initiator.js.map

package/lib/cjs/hook/initiator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiator.js","sourceRoot":"","sources":["../../../src/hook/initiator.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAgD;AAChD,0CAA+D;AAE/D,wCAA8C;AAG9C;;;;GAIG;AACH;CAEC;;AAED,4DAA4D;AAC5D,SAAS,UAAU,CAAC,CAAU;IAC5B,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6HAA6H;AAC7H,uBAA8B,GAAY;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,CAAC,GAA4B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACnH,MAAM,GAAG,GAAmD,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAsB,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAqC,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/F,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnD,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAExG,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,yBAAyB;IAS7E;;;OAGG;IACH,YAAY,OAAO,GAAgC,EAAE;QACnD,KAAK,EAAE,CAAC;QAbF,WAAM,GAAG,KAAK,CAAC;QAGb,QAAG,GAAY,IAAA,iBAAS,EAAC,aAAa,CAAC,CAAC;QAWhD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAoB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,8EAA8E;YAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6JAA6J,CAAC,CAAC;QACzL,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,kBAAU,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,SAAgE,CAAC;QAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,kBAAU,CAAC;QACtG,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAM,CAAC;QACrC,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,kBAAU,CAAC;QAE7C,IAAI,OAA4B,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,kBAAU,CAAC;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,EAAE;YACF,aAAa,EAAE,IAAI,KAAK,WAAW;YACnC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;;AAvCW;IADT,IAAA,sBAAM,EAAC,qCAAqC,CAAC;;uEACb;2CAPtB,gCAAgC;IAD5C,IAAA,eAAU,EAAC,yBAAyB,CAAC;;GACzB,gCAAgC,CA8C5C"}

package/lib/cjs/index.d.ts

@@ -0,0 +1,5 @@
+export * from './api.js';
+export * from './hook/index.js';
+export * from './bus/index.js';
+export * from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/lib/cjs/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./api.js"), exports);
+__exportStar(require("./hook/index.js"), exports);
+__exportStar(require("./bus/index.js"), exports);
+__exportStar(require("./schema.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,kDAAgC;AAChC,iDAA+B;AAC/B,8CAA4B"}

package/lib/cjs/job/index.d.ts

@@ -0,0 +1,2 @@
+export * from './job-resource.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/job/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/job/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/lib/cjs/job/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./job-resource.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/job/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/job/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC"}

package/lib/cjs/job/job-grant.d.ts

@@ -0,0 +1,12 @@
+import { ConfigurationSource } from '@spinajs/configuration';
+import type { IConfigLike } from '@spinajs/configuration';
+/**
+ * Every user holds job:read on the jobs they emitted (the `owner` relation is the job's initiator). It is a source and not a
+ * config file because every installed package's config dir is read whether or not the package is imported, and a
+ * grant of a permission nothing registered fails the boot. Order 0 loads before the file sources.
+ */
+export declare class JobGrantSource extends ConfigurationSource {
+    get Order(): number;
+    Load(): Promise<IConfigLike>;
+}
+//# sourceMappingURL=job-grant.d.ts.map

package/lib/cjs/job/job-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-grant.d.ts","sourceRoot":"","sources":["../../../src/job/job-grant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;GAIG;AACH,qBACa,cAAe,SAAQ,mBAAmB;IACrD,IAAW,KAAK,IAAI,MAAM,CAEzB;IAEM,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,CAElC;CACF"}

package/lib/cjs/job/job-grant.js

@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JobGrantSource = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+/**
+ * Every user holds job:read on the jobs they emitted (the `owner` relation is the job's initiator). It is a source and not a
+ * config file because every installed package's config dir is read whether or not the package is imported, and a
+ * grant of a permission nothing registered fails the boot. Order 0 loads before the file sources.
+ */
+let JobGrantSource = class JobGrantSource extends configuration_1.ConfigurationSource {
+    get Order() {
+        return 0;
+    }
+    Load() {
+        return Promise.resolve({ authz: { rbac: { roles: { user: { grants: [{ permission: 'job:read', relation: 'owner' }] } } } } });
+    }
+};
+exports.JobGrantSource = JobGrantSource;
+exports.JobGrantSource = JobGrantSource = __decorate([
+    (0, di_1.Injectable)(configuration_1.ConfigurationSource)
+], JobGrantSource);
+//# sourceMappingURL=job-grant.js.map

package/lib/cjs/job/job-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-grant.js","sourceRoot":"","sources":["../../../src/job/job-grant.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,0DAA6D;AAG7D;;;;GAIG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,mCAAmB;IACrD,IAAW,KAAK;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAEM,IAAI;QACT,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAA4B,CAAC,CAAC;IAC1J,CAAC;CACF,CAAA;;yBARY,cAAc;IAD1B,IAAA,eAAU,EAAC,mCAAmB,CAAC;GACnB,cAAc,CAQ1B"}

package/lib/cjs/job/job-resource.d.ts

@@ -0,0 +1,10 @@
+import { AuthzDomains } from '@spinajs/authz';
+import { QueueTrackingHook } from '@spinajs/queue';
+import './job-grant.js';
+/** The queue's own job-row queries run as SYSTEM: the job's principal may not touch the table. */
+export declare class AuthzQueueTrackingHook extends QueueTrackingHook {
+    protected Domain: string;
+    protected Domains: AuthzDomains;
+    aroundTracking<T>(next: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=job-resource.d.ts.map

package/lib/cjs/job/job-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-resource.d.ts","sourceRoot":"","sources":["../../../src/job/job-resource.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAU,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAY,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,gBAAgB,CAAC;AAKxB,kGAAkG;AAClG,qBACa,sBAAuB,SAAQ,iBAAiB;IAE3D,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAE1B,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE1D;CACF"}

package/lib/cjs/job/job-resource.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzQueueTrackingHook = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const authz_orm_1 = require("@spinajs/authz-orm");
+const authz_1 = require("@spinajs/authz");
+const queue_1 = require("@spinajs/queue");
+require("./job-grant.js");
+// The initiator may be any principal type, so the owner relation compares the type column too.
+(0, authz_orm_1.registerAccessResource)(queue_1.JobModel, 'job', { owner: { column: 'InitiatorId', typeColumn: 'InitiatorType' } });
+/** The queue's own job-row queries run as SYSTEM: the job's principal may not touch the table. */
+let AuthzQueueTrackingHook = class AuthzQueueTrackingHook extends queue_1.QueueTrackingHook {
+    async aroundTracking(next) {
+        return (await this.Domains.service(this.Domain)).runAs(authz_1.SYSTEM, 'queue:tracking', next);
+    }
+};
+exports.AuthzQueueTrackingHook = AuthzQueueTrackingHook;
+__decorate([
+    (0, configuration_1.Config)('authz.queue.domain'),
+    __metadata("design:type", String)
+], AuthzQueueTrackingHook.prototype, "Domain", void 0);
+__decorate([
+    (0, di_1.Autoinject)(authz_1.AuthzDomains),
+    __metadata("design:type", authz_1.AuthzDomains)
+], AuthzQueueTrackingHook.prototype, "Domains", void 0);
+exports.AuthzQueueTrackingHook = AuthzQueueTrackingHook = __decorate([
+    (0, di_1.Injectable)(queue_1.QueueTrackingHook)
+], AuthzQueueTrackingHook);
+//# sourceMappingURL=job-resource.js.map

package/lib/cjs/job/job-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-resource.js","sourceRoot":"","sources":["../../../src/job/job-resource.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,0DAAgD;AAChD,kDAA4D;AAC5D,0CAAsD;AACtD,0CAA6D;AAE7D,0BAAwB;AAExB,+FAA+F;AAC/F,IAAA,kCAAsB,EAAC,gBAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;AAE3G,kGAAkG;AAE3F,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,yBAAiB;IAO3D,KAAK,CAAC,cAAc,CAAI,IAAsB;QAC5C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;CACF,CAAA;;AARW;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;sDACJ;AAGf;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACN,oBAAY;uDAAC;iCALrB,sBAAsB;IADlC,IAAA,eAAU,EAAC,yBAAiB,CAAC;GACjB,sBAAsB,CAUlC"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/schema.d.ts

@@ -0,0 +1,34 @@
+import { Bootstrapper } from '@spinajs/di';
+export declare const AUTHZ_QUEUE_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        domain: {
+            type: string;
+            minLength: number;
+            default: string;
+        };
+        stampedInitiatorWarning: {
+            type: string;
+            default: boolean;
+        };
+    };
+};
+export declare const AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        topic: {
+            type: string;
+            minLength: number;
+        };
+    };
+};
+export declare class AuthzQueueConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=schema.d.ts.map

package/lib/cjs/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,gCAAgC;;;;;;;;;;;;YASd,IAAI;YAAa,OAAO;;;CAEtD,CAAC;AAGF,eAAO,MAAM,oCAAoC;IAC/C,GAAG;IACH,oBAAoB;IACpB,WAAW;IACX,IAAI;IACJ,UAAU;QAAI,KAAK;;;;;CACpB,CAAC;AAKF,qBACa,4BAA6B,SAAQ,YAAY;IACrD,SAAS,IAAI,IAAI,CAGvB;CACF"}

package/lib/cjs/schema.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzQueueConfigBootstrapper = exports.AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA = exports.AUTHZ_QUEUE_CONFIGURATION_SCHEMA = void 0;
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const name = { type: 'string', minLength: 1 };
+exports.AUTHZ_QUEUE_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-queue.configuration.schema.json',
+    $configurationModule: 'authz.queue',
+    description: 'Queue authorization configuration (authz.queue.*)',
+    type: 'object',
+    properties: {
+        // The authz domain whose principal a message carries and whose runAs its handler uses.
+        domain: { ...name, default: 'root' },
+        // Whether StampedInitiatorPrincipalFactory warns, once, that jobs run from the stamp alone; false for an app that accepts that.
+        stampedInitiatorWarning: { type: 'boolean', default: true },
+    },
+};
+// authz.bus belongs to the core schema, which leaves it open; the topic is the queue bus's own key.
+exports.AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-queue-bus.configuration.schema.json',
+    $configurationModule: 'authz.bus',
+    description: 'Queue change bus configuration (authz.bus.topic)',
+    type: 'object',
+    properties: { topic: name },
+};
+(0, configuration_1.registerConfigurationSchemaAtImport)(exports.AUTHZ_QUEUE_CONFIGURATION_SCHEMA);
+(0, configuration_1.registerConfigurationSchemaAtImport)(exports.AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA);
+let AuthzQueueConfigBootstrapper = class AuthzQueueConfigBootstrapper extends di_1.Bootstrapper {
+    bootstrap() {
+        (0, configuration_1.registerConfigurationSchema)(exports.AUTHZ_QUEUE_CONFIGURATION_SCHEMA);
+        (0, configuration_1.registerConfigurationSchema)(exports.AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA);
+    }
+};
+exports.AuthzQueueConfigBootstrapper = AuthzQueueConfigBootstrapper;
+exports.AuthzQueueConfigBootstrapper = AuthzQueueConfigBootstrapper = __decorate([
+    (0, di_1.Injectable)(di_1.Bootstrapper)
+], AuthzQueueConfigBootstrapper);
+//# sourceMappingURL=schema.js.map

package/lib/cjs/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0DAA0G;AAC1G,oCAAuD;AAEvD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAEjC,QAAA,gCAAgC,GAAG;IAC9C,GAAG,EAAE,+CAA+C;IACpD,oBAAoB,EAAE,aAAa;IACnC,WAAW,EAAE,mDAAmD;IAChE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,uFAAuF;QACvF,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACpC,gIAAgI;QAChI,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;KAC5D;CACF,CAAC;AAEF,oGAAoG;AACvF,QAAA,oCAAoC,GAAG;IAClD,GAAG,EAAE,mDAAmD;IACxD,oBAAoB,EAAE,WAAW;IACjC,WAAW,EAAE,kDAAkD;IAC/D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;CAC5B,CAAC;AAEF,IAAA,mDAAmC,EAAC,QAAA,gCAAgC,CAAC,CAAC;AACtE,IAAA,mDAAmC,EAAC,QAAA,oCAAoC,CAAC,CAAC;AAGnE,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,iBAAY;IACrD,SAAS;QACd,IAAA,2CAA2B,EAAC,QAAA,gCAAgC,CAAC,CAAC;QAC9D,IAAA,2CAA2B,EAAC,QAAA,oCAAoC,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;;uCALY,4BAA4B;IADxC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,4BAA4B,CAKxC"}

package/lib/mjs/api.d.ts

@@ -0,0 +1,9 @@
+import type { Ceiling, PrincipalType } from '@spinajs/authz';
+export { QueueMessageHook } from '@spinajs/queue';
+export type { JobOptions } from '@spinajs/queue';
+export interface Initiator {
+    readonly type: PrincipalType;
+    readonly id: string;
+    readonly ceiling?: Ceiling;
+}
+//# sourceMappingURL=api.d.ts.map

package/lib/mjs/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/lib/mjs/api.js

@@ -0,0 +1,2 @@
+export { QueueMessageHook } from '@spinajs/queue';
+//# sourceMappingURL=api.js.map

package/lib/mjs/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/mjs/bus/change-bus.d.ts

@@ -0,0 +1,44 @@
+import { ChangeBus } from '@spinajs/authz';
+import type { AuthzChange } from '@spinajs/authz';
+import { QueueEvent, QueueService } from '@spinajs/queue';
+interface WireChange {
+    domain?: unknown;
+    tags?: unknown;
+    actor?: unknown;
+    at?: unknown;
+}
+/** What nodes send each other: the change, and the node that made it so that it can skip its own echo. */
+export declare class AuthzChangeEvent extends QueueEvent {
+    Node: string;
+    Change: WireChange;
+}
+/** Rebuilds a change that went through a JSON broker; undefined when it cannot be one. */
+export declare function reviveChange(raw: unknown): AuthzChange | undefined;
+/**
+ * A ChangeBus that carries changes to the other nodes over the queue (design §14.2).
+ * Select it with `authz.bus.service: 'QueueChangeBus'`. Subscribers on this node hear a change at once;
+ * the copy that comes back from the broker is skipped.
+ */
+export declare class QueueChangeBus extends ChangeBus {
+    protected readonly node: `${string}-${string}-${string}-${string}-${string}`;
+    private readonly subscribers;
+    private readonly log;
+    private queue?;
+    private retried;
+    private disposed;
+    private timer?;
+    protected retryMs: number;
+    publish(change: AuthzChange): Promise<void>;
+    subscribe(fn: (c: AuthzChange) => void): () => void;
+    /** AuthzService subscribes once, at boot: a queue that is not ready yet must not leave the node deaf. */
+    private listenWithRetry;
+    dispose(): Promise<void>;
+    /** Resolved per start, not injected: a queue that cannot start yet must not fail the bus, which retries. */
+    protected queueService(): Promise<QueueService>;
+    protected start(): Promise<QueueService>;
+    private listen;
+    private deliver;
+    private fail;
+}
+export {};
+//# sourceMappingURL=change-bus.d.ts.map

package/lib/mjs/bus/change-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bus.d.ts","sourceRoot":"","sources":["../../../src/bus/change-bus.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAA0B,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAS,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED,0GAA0G;AAC1G,qBACa,gBAAiB,SAAQ,UAAU;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CAC3B;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAoBlE;AAED;;;;GAIG;AACH,qBAEa,cAAe,SAAQ,SAAS;IAC3C,SAAS,CAAC,QAAQ,CAAC,IAAI,sDAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAwB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,SAAS,CAAC,OAAO,SAAQ;IAEnB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhD;IAED,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAOlD;IAED,yGAAyG;IACzG,OAAO,CAAC,eAAe;IAsBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ7B;IAED,4GAA4G;IAC5G,UAAgB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAEpD;IAED,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,CASvC;YAEa,MAAM;IAcpB,OAAO,CAAC,OAAO;IAWf,OAAO,CAAC,IAAI;CAGb"}

package/lib/mjs/bus/change-bus.js

@@ -0,0 +1,155 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { randomUUID } from 'node:crypto';
+import { DI, Injectable, Singleton } from '@spinajs/di';
+import { ChangeBus, engineLog, thrownError } from '@spinajs/authz';
+import { Event, QueueEvent, QueueService } from '@spinajs/queue';
+import { isStringArray } from '@spinajs/util';
+/** What nodes send each other: the change, and the node that made it so that it can skip its own echo. */
+let AuthzChangeEvent = class AuthzChangeEvent extends QueueEvent {
+};
+AuthzChangeEvent = __decorate([
+    Event()
+], AuthzChangeEvent);
+export { AuthzChangeEvent };
+/** Rebuilds a change that went through a JSON broker; undefined when it cannot be one. */
+export function reviveChange(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return undefined;
+    const c = raw;
+    if (!isStringArray(c.tags))
+        return undefined;
+    if (c.domain !== undefined && typeof c.domain !== 'string')
+        return undefined;
+    let actor;
+    if (c.actor !== undefined) {
+        const a = c.actor;
+        if (a === null || typeof a !== 'object' || typeof a.type !== 'string' || typeof a.id !== 'string')
+            return undefined;
+        actor = { type: a.type, id: a.id };
+    }
+    const at = new Date(typeof c.at === 'string' || typeof c.at === 'number' || c.at instanceof Date ? c.at : NaN);
+    return {
+        ...(c.domain === undefined ? {} : { domain: c.domain }),
+        tags: [...c.tags],
+        ...(actor ? { actor } : {}),
+        at: Number.isNaN(at.getTime()) ? new Date() : at,
+    };
+}
+/**
+ * A ChangeBus that carries changes to the other nodes over the queue (design §14.2).
+ * Select it with `authz.bus.service: 'QueueChangeBus'`. Subscribers on this node hear a change at once;
+ * the copy that comes back from the broker is skipped.
+ */
+let QueueChangeBus = class QueueChangeBus extends ChangeBus {
+    constructor() {
+        super(...arguments);
+        this.node = randomUUID();
+        this.subscribers = new Set();
+        this.log = engineLog('authz-queue-bus');
+        this.retried = false;
+        this.disposed = false;
+        this.retryMs = 5000;
+    }
+    async publish(change) {
+        this.deliver(change);
+        const queue = await this.start();
+        const event = new AuthzChangeEvent();
+        event.Node = this.node;
+        event.Change = { domain: change.domain, tags: [...change.tags], actor: change.actor, at: change.at };
+        await queue.emit(event);
+    }
+    subscribe(fn) {
+        const entry = (c) => fn(c);
+        this.subscribers.add(entry);
+        this.listenWithRetry();
+        return () => {
+            this.subscribers.delete(entry);
+        };
+    }
+    /** AuthzService subscribes once, at boot: a queue that is not ready yet must not leave the node deaf. */
+    listenWithRetry() {
+        this.start().then(() => {
+            // Changes made while the node was deaf are unknown: drop everything.
+            if (this.retried) {
+                this.retried = false;
+                this.deliver({ tags: ['*'], at: new Date() });
+            }
+        }, (err) => {
+            this.log.error({ error: thrownError(err) }, 'authz change bus: cannot listen on the queue, retrying');
+            this.retried = true;
+            if (this.disposed || this.timer)
+                return;
+            this.timer = setTimeout(() => {
+                this.timer = undefined;
+                if (!this.disposed)
+                    this.listenWithRetry();
+            }, this.retryMs);
+            this.timer.unref?.();
+        });
+    }
+    async dispose() {
+        this.disposed = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+        this.subscribers.clear();
+        const started = this.queue;
+        this.queue = undefined;
+        if (started)
+            await (await started.catch(() => undefined))?.stopConsuming(AuthzChangeEvent);
+    }
+    /** Resolved per start, not injected: a queue that cannot start yet must not fail the bus, which retries. */
+    async queueService() {
+        return DI.resolve(QueueService);
+    }
+    start() {
+        if (this.queue === undefined) {
+            this.queue = this.listen();
+            // A failed start is retried by the next call.
+            this.queue.catch(() => {
+                this.queue = undefined;
+            });
+        }
+        return this.queue;
+    }
+    async listen() {
+        const queue = await this.queueService();
+        await queue.consume(AuthzChangeEvent, async (e) => {
+            if (e.Node === this.node)
+                return;
+            const change = reviveChange(e.Change);
+            if (change === undefined) {
+                this.log.warn('authz change bus: dropped a malformed change');
+                return;
+            }
+            this.deliver(change);
+        });
+        return queue;
+    }
+    deliver(change) {
+        for (const fn of [...this.subscribers]) {
+            try {
+                const r = fn(change);
+                if (r !== null && typeof r === 'object' && typeof r.then === 'function')
+                    r.then(undefined, (err) => this.fail(err));
+            }
+            catch (err) {
+                this.fail(err);
+            }
+        }
+    }
+    fail(err) {
+        this.log.error({ error: thrownError(err) }, 'authz change subscriber failed');
+    }
+};
+QueueChangeBus = __decorate([
+    Singleton(),
+    Injectable(ChangeBus)
+], QueueChangeBus);
+export { QueueChangeBus };
+//# sourceMappingURL=change-bus.js.map