@spinajs/authz-queue 0.0.0-stage → 3.0.0

package/lib/mjs/bus/change-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bus.js","sourceRoot":"","sources":["../../../src/bus/change-bus.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAS9C,0GAA0G;AAEnG,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,UAAU;CAG/C,CAAA;AAHY,gBAAgB;IAD5B,KAAK,EAAE;GACK,gBAAgB,CAG5B;;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,GAAiB,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE7E,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgD,CAAC;QAC7D,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpH,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/G,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,GAAI,CAAC,CAAC,IAAiB,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,SAAS;IAAtC;;QACc,SAAI,GAAG,UAAU,EAAE,CAAC;QACtB,gBAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QAClD,QAAG,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAE5C,YAAO,GAAG,KAAK,CAAC;QAChB,aAAQ,GAAG,KAAK,CAAC;QAEf,YAAO,GAAG,IAAI,CAAC;IAiG3B,CAAC;IA/FC,KAAK,CAAC,OAAO,CAAC,MAAmB;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACrG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,EAA4B;QACpC,MAAM,KAAK,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,eAAe;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CACf,GAAG,EAAE;YACH,qEAAqE;YACrE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO;YACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7C,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,OAAO;YAAE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;IAED,4GAA4G;IAClG,KAAK,CAAC,YAAY;QAC1B,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAES,KAAK;QACb,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,8CAA8C;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;gBACpB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAmB,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAmB;QACjC,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAY,CAAC;gBAChC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,IAAI,KAAK,UAAU;oBAAG,CAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClK,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAY;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;IAChF,CAAC;CACF,CAAA;AAzGY,cAAc;IAF1B,SAAS,EAAE;IACX,UAAU,CAAC,SAAS,CAAC;GACT,cAAc,CAyG1B"}

package/lib/mjs/bus/index.d.ts

@@ -0,0 +1,3 @@
+export * from './change-bus.js';
+export * from './route-source.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/bus/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/bus/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/lib/mjs/bus/index.js

@@ -0,0 +1,3 @@
+export * from './change-bus.js';
+export * from './route-source.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/bus/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/bus/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/lib/mjs/bus/route-source.d.ts

@@ -0,0 +1,11 @@
+import { ConfigurationSource } from '@spinajs/configuration';
+import type { Configuration, IConfigLike } from '@spinajs/configuration';
+/**
+ * `authz.bus.topic` becomes the channel of `AuthzChangeEvent` unless `queue.routing` already routes it.
+ * Order 2 loads after the file sources (1), so it sees the application's topic and routing.
+ */
+export declare class AuthzBusRouteSource extends ConfigurationSource {
+    get Order(): number;
+    Load(configuration: Configuration): Promise<IConfigLike>;
+}
+//# sourceMappingURL=route-source.d.ts.map

package/lib/mjs/bus/route-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-source.d.ts","sourceRoot":"","sources":["../../../src/bus/route-source.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIzE;;;GAGG;AACH,qBACa,mBAAoB,SAAQ,mBAAmB;IAC1D,IAAW,KAAK,IAAI,MAAM,CAEzB;IAEM,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAK9D;CACF"}

package/lib/mjs/bus/route-source.js

@@ -0,0 +1,29 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { ConfigurationSource } from '@spinajs/configuration';
+import { AuthzChangeEvent } from './change-bus.js';
+/**
+ * `authz.bus.topic` becomes the channel of `AuthzChangeEvent` unless `queue.routing` already routes it.
+ * Order 2 loads after the file sources (1), so it sees the application's topic and routing.
+ */
+let AuthzBusRouteSource = class AuthzBusRouteSource extends ConfigurationSource {
+    get Order() {
+        return 2;
+    }
+    Load(configuration) {
+        const route = ['queue', 'routing', AuthzChangeEvent.name];
+        const topic = configuration.get(['authz', 'bus', 'topic']);
+        const skip = configuration.get(route) !== undefined || typeof topic !== 'string' || topic === '';
+        return Promise.resolve((skip ? {} : { queue: { routing: { [AuthzChangeEvent.name]: { channel: topic } } } }));
+    }
+};
+AuthzBusRouteSource = __decorate([
+    Injectable(ConfigurationSource)
+], AuthzBusRouteSource);
+export { AuthzBusRouteSource };
+//# sourceMappingURL=route-source.js.map

package/lib/mjs/bus/route-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-source.js","sourceRoot":"","sources":["../../../src/bus/route-source.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,mBAAmB;IAC1D,IAAW,KAAK;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAEM,IAAI,CAAC,aAA4B;QACtC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAU,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1G,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAA2B,CAAC,CAAC;IAC1I,CAAC;CACF,CAAA;AAXY,mBAAmB;IAD/B,UAAU,CAAC,mBAAmB,CAAC;GACnB,mBAAmB,CAW/B"}

package/lib/mjs/hook/hook.d.ts

@@ -0,0 +1,21 @@
+import { AuthzDomains } from '@spinajs/authz';
+import type { AuthzService, Principal } from '@spinajs/authz';
+import { QueueMessageHook } from '@spinajs/queue';
+import type { IQueueMessage } from '@spinajs/queue';
+import type { Initiator } from '../api.js';
+import { InitiatorPrincipalFactory } from './initiator.js';
+/**
+ * Stamps who emitted a message and decides whose authority its handler has (design §14.2, B30).
+ * A handler runs unattended unless its `@Job` says `runAs: 'initiator'` or `'system'`.
+ */
+export declare class AuthzQueueHook extends QueueMessageHook {
+    /** The authz domain whose principal is stamped and whose `runAs` the handler uses. */
+    protected Domain: string;
+    protected Initiators: InitiatorPrincipalFactory;
+    protected Domains: AuthzDomains;
+    beforeEmit(message: IQueueMessage): Promise<void>;
+    aroundHandle<T>(message: IQueueMessage, next: () => Promise<T>): Promise<T>;
+    protected initiator(initiator: Initiator): Promise<Principal>;
+    protected service(): Promise<AuthzService>;
+}
+//# sourceMappingURL=hook.d.ts.map

package/lib/mjs/hook/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../../src/hook/hook.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAsB,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAiB,MAAM,gBAAgB,CAAC;AAO1E;;;GAGG;AACH,qBACa,cAAe,SAAQ,gBAAgB;IAClD,sFAAsF;IAEtF,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAGhD,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAE1B,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtD;IAEK,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAUhF;IAED,UAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAElE;IAED,UAAgB,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAE/C;CACF"}

package/lib/mjs/hook/hook.js

@@ -0,0 +1,78 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { AuthzDomains, SYSTEM, UNATTENDED } from '@spinajs/authz';
+import { QueueMessageHook, jobOptions } from '@spinajs/queue';
+import { InitiatorPrincipalFactory, reviveCeiling } from './initiator.js';
+// The engine reads a ceiling whose expiresAt is not a Date, or whose reason is empty, as deny-all; revival must not repair it.
+const isStrictCeiling = (c) => (c.expiresAt === undefined || c.expiresAt instanceof Date) && (c.reason === undefined || (typeof c.reason === 'string' && c.reason !== ''));
+const isPlain = (v) => v !== null && typeof v === 'object' && Object.getPrototypeOf(v) === Object.prototype;
+/**
+ * Stamps who emitted a message and decides whose authority its handler has (design §14.2, B30).
+ * A handler runs unattended unless its `@Job` says `runAs: 'initiator'` or `'system'`.
+ */
+let AuthzQueueHook = class AuthzQueueHook extends QueueMessageHook {
+    async beforeEmit(message) {
+        // Whatever the caller put there is dropped: only the ambient principal may be named.
+        delete message.Initiator;
+        const principal = (await this.service()).current();
+        if (principal === UNATTENDED || principal.type === 'unattended')
+            return;
+        // A system-typed principal that is not the singleton is forged; stamping it would later become SYSTEM.
+        if (principal.type === 'system' && principal !== SYSTEM)
+            return;
+        // The stamp cannot carry these; rebuilding without them would widen the job's authority.
+        if (principal.onBehalfOf !== undefined || principal.delegation !== undefined || principal.authn?.impersonator !== undefined)
+            return;
+        const stamp = { type: principal.type, id: String(principal.id) };
+        if (principal.ceiling === undefined) {
+            message.Initiator = stamp;
+            return;
+        }
+        // A ceiling that is not a plain, well-formed one is stamped as deny-all, never as no restriction.
+        const ceiling = isPlain(principal.ceiling) && isStrictCeiling(principal.ceiling) ? reviveCeiling(principal.ceiling) : undefined;
+        message.Initiator = { ...stamp, ceiling: ceiling ?? { permissions: [] } };
+    }
+    async aroundHandle(message, next) {
+        const service = await this.service();
+        const { runAs } = jobOptions(message);
+        let principal = UNATTENDED;
+        if (runAs === 'system')
+            principal = SYSTEM;
+        else if (runAs === 'initiator' && message.Initiator)
+            principal = await this.initiator(message.Initiator);
+        // Also for unattended: a consumer running inside the emitter's async context must not inherit its principal.
+        return service.runAs(principal, `job:${message.Name}`, next);
+    }
+    async initiator(initiator) {
+        return this.Initiators.principalOf(initiator);
+    }
+    async service() {
+        return this.Domains.service(this.Domain);
+    }
+};
+__decorate([
+    Config('authz.queue.domain'),
+    __metadata("design:type", String)
+], AuthzQueueHook.prototype, "Domain", void 0);
+__decorate([
+    Autoinject(InitiatorPrincipalFactory),
+    __metadata("design:type", InitiatorPrincipalFactory)
+], AuthzQueueHook.prototype, "Initiators", void 0);
+__decorate([
+    Autoinject(AuthzDomains),
+    __metadata("design:type", AuthzDomains)
+], AuthzQueueHook.prototype, "Domains", void 0);
+AuthzQueueHook = __decorate([
+    Injectable(QueueMessageHook)
+], AuthzQueueHook);
+export { AuthzQueueHook };
+//# sourceMappingURL=hook.js.map

package/lib/mjs/hook/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/hook/hook.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E,+HAA+H;AAC/H,MAAM,eAAe,GAAG,CAAC,CAA4C,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC;AAE/N,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC;AAE9H;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,gBAAgB;IAWlD,KAAK,CAAC,UAAU,CAAC,OAAsB;QACrC,qFAAqF;QACrF,OAAO,OAAO,CAAC,SAAS,CAAC;QAEzB,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACxE,uGAAuG;QACvG,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM;YAAE,OAAO;QAEhE,yFAAyF;QACzF,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS;YAAE,OAAO;QAEpI,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChI,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,YAAY,CAAI,OAAsB,EAAE,IAAsB;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,SAAS,GAAc,UAAU,CAAC;QACtC,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC;aACtC,IAAI,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS;YAAE,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;QAEtH,6GAA6G;QAC7G,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,SAAoB;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AAjDW;IADT,MAAM,CAAC,oBAAoB,CAAC;;8CACJ;AAGf;IADT,UAAU,CAAC,yBAAyB,CAAC;8BAChB,yBAAyB;kDAAC;AAGtC;IADT,UAAU,CAAC,YAAY,CAAC;8BACN,YAAY;+CAAC;AATrB,cAAc;IAD1B,UAAU,CAAC,gBAAgB,CAAC;GAChB,cAAc,CAoD1B"}

package/lib/mjs/hook/index.d.ts

@@ -0,0 +1,3 @@
+export * from './hook.js';
+export * from './initiator.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/hook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hook/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/hook/index.js

@@ -0,0 +1,3 @@
+export * from './hook.js';
+export * from './initiator.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/hook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hook/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/hook/initiator.d.ts

@@ -0,0 +1,28 @@
+import type { Ceiling, HostLog, Principal } from '@spinajs/authz';
+import type { Initiator } from '../api.js';
+/**
+ * Builds the principal a job runs as from the `Initiator` on its message. An app that must reload
+ * the user (attributes, deactivation) registers its own with `DI.register(X).as(InitiatorPrincipalFactory)`.
+ * Return `UNATTENDED` for an initiator that can no longer act; throw only for a failure worth a retry.
+ */
+export declare abstract class InitiatorPrincipalFactory {
+    abstract principalOf(initiator: Initiator): Promise<Principal>;
+}
+/** Rebuilds a Ceiling that went through a JSON broker (`expiresAt` is a string there); undefined when the shape is wrong. */
+export declare function reviveCeiling(raw: unknown): Ceiling | undefined;
+/** Trusts the stamp: type, id and ceiling are all the principal has. A malformed stamp yields `UNATTENDED`. */
+export declare class StampedInitiatorPrincipalFactory extends InitiatorPrincipalFactory {
+    private warned;
+    private readonly warn;
+    protected Log: HostLog;
+    protected WarningSwitch: boolean;
+    /**
+     * `warn` decides the one-time warning without reading the config, for a wrapper built with `new` that does reload the user.
+     * Without it, `authz.queue.stampedInitiatorWarning` decides, so a `new` instance needs a resolved Configuration.
+     */
+    constructor(options?: {
+        readonly warn?: boolean;
+    });
+    principalOf(initiator: Initiator): Promise<Principal>;
+}
+//# sourceMappingURL=initiator.d.ts.map

package/lib/mjs/hook/initiator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiator.d.ts","sourceRoot":"","sources":["../../../src/hook/initiator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AACH,8BAAsB,yBAAyB;IAC7C,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAQD,6HAA6H;AAC7H,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAiC/D;AAED,+GAA+G;AAC/G,qBACa,gCAAiC,SAAQ,yBAAyB;IAC7E,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAE3C,SAAS,CAAC,GAAG,EAAE,OAAO,CAA4B;IAGlD,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;IAEjC;;;OAGG;IACH,YAAY,OAAO,GAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,EAGpD;IAEK,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA2B1D;CACF"}

package/lib/mjs/hook/initiator.js

@@ -0,0 +1,123 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { SYSTEM, UNATTENDED, engineLog } from '@spinajs/authz';
+import { isStringArray } from '@spinajs/util';
+/**
+ * Builds the principal a job runs as from the `Initiator` on its message. An app that must reload
+ * the user (attributes, deactivation) registers its own with `DI.register(X).as(InitiatorPrincipalFactory)`.
+ * Return `UNATTENDED` for an initiator that can no longer act; throw only for a failure worth a retry.
+ */
+export class InitiatorPrincipalFactory {
+}
+// null counts as absent, as in the engine's ceiling reader.
+function reviveDate(v) {
+    const d = v instanceof Date ? v : typeof v === 'string' || typeof v === 'number' ? new Date(v) : undefined;
+    return d !== undefined && !Number.isNaN(d.getTime()) ? d : undefined;
+}
+/** Rebuilds a Ceiling that went through a JSON broker (`expiresAt` is a string there); undefined when the shape is wrong. */
+export function reviveCeiling(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const c = Object.fromEntries(Object.entries(raw).filter(([, v]) => v !== null));
+    const out = {};
+    if (c.roles !== undefined) {
+        if (!isStringArray(c.roles))
+            return undefined;
+        out.roles = [...c.roles];
+    }
+    if (c.permissions !== undefined) {
+        if (!isStringArray(c.permissions))
+            return undefined;
+        out.permissions = [...c.permissions];
+    }
+    if (c.resources !== undefined) {
+        if (!Array.isArray(c.resources))
+            return undefined;
+        const resources = [];
+        for (const r of c.resources) {
+            if (r === null || typeof r !== 'object')
+                return undefined;
+            const { type, id } = r;
+            if (typeof type !== 'string' || (id !== undefined && typeof id !== 'string'))
+                return undefined;
+            resources.push(id === undefined ? { type } : { type, id });
+        }
+        out.resources = resources;
+    }
+    if (c.expiresAt !== undefined) {
+        const expiresAt = reviveDate(c.expiresAt);
+        if (expiresAt === undefined)
+            return undefined;
+        out.expiresAt = expiresAt;
+    }
+    if (c.reason !== undefined) {
+        if (typeof c.reason !== 'string')
+            return undefined;
+        out.reason = c.reason;
+    }
+    return out;
+}
+/** Trusts the stamp: type, id and ceiling are all the principal has. A malformed stamp yields `UNATTENDED`. */
+let StampedInitiatorPrincipalFactory = class StampedInitiatorPrincipalFactory extends InitiatorPrincipalFactory {
+    /**
+     * `warn` decides the one-time warning without reading the config, for a wrapper built with `new` that does reload the user.
+     * Without it, `authz.queue.stampedInitiatorWarning` decides, so a `new` instance needs a resolved Configuration.
+     */
+    constructor(options = {}) {
+        super();
+        this.warned = false;
+        this.Log = engineLog('authz-queue');
+        this.warn = options.warn;
+    }
+    async principalOf(initiator) {
+        if (!this.warned) {
+            // The schema default keeps the warning; so does a value the schema never saw.
+            const warn = this.warn ?? this.WarningSwitch !== false;
+            this.warned = true;
+            if (warn)
+                this.Log.warn('authz-queue: jobs run as their initiator from the stamp alone; register an InitiatorPrincipalFactory that reloads the user so deactivated users stop acting');
+        }
+        if (initiator === null || typeof initiator !== 'object')
+            return UNATTENDED;
+        const { type, id, ceiling } = initiator;
+        if (typeof type !== 'string' || type === '' || typeof id !== 'string' || id === '')
+            return UNATTENDED;
+        if (type === 'system')
+            return SYSTEM;
+        if (type === 'unattended')
+            return UNATTENDED;
+        let revived;
+        if (ceiling !== undefined && ceiling !== null) {
+            revived = reviveCeiling(ceiling);
+            if (revived === undefined)
+                return UNATTENDED;
+        }
+        return Object.freeze({
+            type,
+            id,
+            authenticated: type !== 'anonymous',
+            source: 'queue',
+            attributes: Object.freeze({}),
+            ...(revived ? { ceiling: revived } : {}),
+        });
+    }
+};
+__decorate([
+    Config('authz.queue.stampedInitiatorWarning'),
+    __metadata("design:type", Boolean)
+], StampedInitiatorPrincipalFactory.prototype, "WarningSwitch", void 0);
+StampedInitiatorPrincipalFactory = __decorate([
+    Injectable(InitiatorPrincipalFactory),
+    __metadata("design:paramtypes", [Object])
+], StampedInitiatorPrincipalFactory);
+export { StampedInitiatorPrincipalFactory };
+//# sourceMappingURL=initiator.js.map

package/lib/mjs/hook/initiator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiator.js","sourceRoot":"","sources":["../../../src/hook/initiator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C;;;;GAIG;AACH,MAAM,OAAgB,yBAAyB;CAE9C;AAED,4DAA4D;AAC5D,SAAS,UAAU,CAAC,CAAU;IAC5B,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,CAAC,GAA4B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACnH,MAAM,GAAG,GAAmD,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAsB,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAqC,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/F,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnD,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAExG,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,yBAAyB;IAS7E;;;OAGG;IACH,YAAY,OAAO,GAAgC,EAAE;QACnD,KAAK,EAAE,CAAC;QAbF,WAAM,GAAG,KAAK,CAAC;QAGb,QAAG,GAAY,SAAS,CAAC,aAAa,CAAC,CAAC;QAWhD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAoB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,8EAA8E;YAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6JAA6J,CAAC,CAAC;QACzL,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,SAAgE,CAAC;QAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,UAAU,CAAC;QACtG,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACrC,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,UAAU,CAAC;QAE7C,IAAI,OAA4B,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,UAAU,CAAC;QAC/C,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,EAAE;YACF,aAAa,EAAE,IAAI,KAAK,WAAW;YACnC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvCW;IADT,MAAM,CAAC,qCAAqC,CAAC;;uEACb;AAPtB,gCAAgC;IAD5C,UAAU,CAAC,yBAAyB,CAAC;;GACzB,gCAAgC,CA8C5C"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,5 @@
+export * from './api.js';
+export * from './hook/index.js';
+export * from './bus/index.js';
+export * from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,5 @@
+export * from './api.js';
+export * from './hook/index.js';
+export * from './bus/index.js';
+export * from './schema.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/lib/mjs/job/index.d.ts

@@ -0,0 +1,2 @@
+export * from './job-resource.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/job/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/job/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/lib/mjs/job/index.js

@@ -0,0 +1,2 @@
+export * from './job-resource.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/job/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/job/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/lib/mjs/job/job-grant.d.ts

@@ -0,0 +1,12 @@
+import { ConfigurationSource } from '@spinajs/configuration';
+import type { IConfigLike } from '@spinajs/configuration';
+/**
+ * Every user holds job:read on the jobs they emitted (the `owner` relation is the job's initiator). It is a source and not a
+ * config file because every installed package's config dir is read whether or not the package is imported, and a
+ * grant of a permission nothing registered fails the boot. Order 0 loads before the file sources.
+ */
+export declare class JobGrantSource extends ConfigurationSource {
+    get Order(): number;
+    Load(): Promise<IConfigLike>;
+}
+//# sourceMappingURL=job-grant.d.ts.map

package/lib/mjs/job/job-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-grant.d.ts","sourceRoot":"","sources":["../../../src/job/job-grant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;GAIG;AACH,qBACa,cAAe,SAAQ,mBAAmB;IACrD,IAAW,KAAK,IAAI,MAAM,CAEzB;IAEM,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,CAElC;CACF"}

package/lib/mjs/job/job-grant.js

@@ -0,0 +1,26 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { ConfigurationSource } from '@spinajs/configuration';
+/**
+ * Every user holds job:read on the jobs they emitted (the `owner` relation is the job's initiator). It is a source and not a
+ * config file because every installed package's config dir is read whether or not the package is imported, and a
+ * grant of a permission nothing registered fails the boot. Order 0 loads before the file sources.
+ */
+let JobGrantSource = class JobGrantSource extends ConfigurationSource {
+    get Order() {
+        return 0;
+    }
+    Load() {
+        return Promise.resolve({ authz: { rbac: { roles: { user: { grants: [{ permission: 'job:read', relation: 'owner' }] } } } } });
+    }
+};
+JobGrantSource = __decorate([
+    Injectable(ConfigurationSource)
+], JobGrantSource);
+export { JobGrantSource };
+//# sourceMappingURL=job-grant.js.map

package/lib/mjs/job/job-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-grant.js","sourceRoot":"","sources":["../../../src/job/job-grant.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D;;;;GAIG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,mBAAmB;IACrD,IAAW,KAAK;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAEM,IAAI;QACT,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAA4B,CAAC,CAAC;IAC1J,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,UAAU,CAAC,mBAAmB,CAAC;GACnB,cAAc,CAQ1B"}

package/lib/mjs/job/job-resource.d.ts

@@ -0,0 +1,10 @@
+import { AuthzDomains } from '@spinajs/authz';
+import { QueueTrackingHook } from '@spinajs/queue';
+import './job-grant.js';
+/** The queue's own job-row queries run as SYSTEM: the job's principal may not touch the table. */
+export declare class AuthzQueueTrackingHook extends QueueTrackingHook {
+    protected Domain: string;
+    protected Domains: AuthzDomains;
+    aroundTracking<T>(next: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=job-resource.d.ts.map

package/lib/mjs/job/job-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-resource.d.ts","sourceRoot":"","sources":["../../../src/job/job-resource.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAU,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAY,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,gBAAgB,CAAC;AAKxB,kGAAkG;AAClG,qBACa,sBAAuB,SAAQ,iBAAiB;IAE3D,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAE1B,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE1D;CACF"}

package/lib/mjs/job/job-resource.js

@@ -0,0 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { registerAccessResource } from '@spinajs/authz-orm';
+import { AuthzDomains, SYSTEM } from '@spinajs/authz';
+import { JobModel, QueueTrackingHook } from '@spinajs/queue';
+import './job-grant.js';
+// The initiator may be any principal type, so the owner relation compares the type column too.
+registerAccessResource(JobModel, 'job', { owner: { column: 'InitiatorId', typeColumn: 'InitiatorType' } });
+/** The queue's own job-row queries run as SYSTEM: the job's principal may not touch the table. */
+let AuthzQueueTrackingHook = class AuthzQueueTrackingHook extends QueueTrackingHook {
+    async aroundTracking(next) {
+        return (await this.Domains.service(this.Domain)).runAs(SYSTEM, 'queue:tracking', next);
+    }
+};
+__decorate([
+    Config('authz.queue.domain'),
+    __metadata("design:type", String)
+], AuthzQueueTrackingHook.prototype, "Domain", void 0);
+__decorate([
+    Autoinject(AuthzDomains),
+    __metadata("design:type", AuthzDomains)
+], AuthzQueueTrackingHook.prototype, "Domains", void 0);
+AuthzQueueTrackingHook = __decorate([
+    Injectable(QueueTrackingHook)
+], AuthzQueueTrackingHook);
+export { AuthzQueueTrackingHook };
+//# sourceMappingURL=job-resource.js.map

package/lib/mjs/job/job-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-resource.js","sourceRoot":"","sources":["../../../src/job/job-resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,gBAAgB,CAAC;AAExB,+FAA+F;AAC/F,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;AAE3G,kGAAkG;AAE3F,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,iBAAiB;IAO3D,KAAK,CAAC,cAAc,CAAI,IAAsB;QAC5C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;CACF,CAAA;AARW;IADT,MAAM,CAAC,oBAAoB,CAAC;;sDACJ;AAGf;IADT,UAAU,CAAC,YAAY,CAAC;8BACN,YAAY;uDAAC;AALrB,sBAAsB;IADlC,UAAU,CAAC,iBAAiB,CAAC;GACjB,sBAAsB,CAUlC"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/schema.d.ts

@@ -0,0 +1,34 @@
+import { Bootstrapper } from '@spinajs/di';
+export declare const AUTHZ_QUEUE_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        domain: {
+            type: string;
+            minLength: number;
+            default: string;
+        };
+        stampedInitiatorWarning: {
+            type: string;
+            default: boolean;
+        };
+    };
+};
+export declare const AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        topic: {
+            type: string;
+            minLength: number;
+        };
+    };
+};
+export declare class AuthzQueueConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=schema.d.ts.map

package/lib/mjs/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,gCAAgC;;;;;;;;;;;;YASd,IAAI;YAAa,OAAO;;;CAEtD,CAAC;AAGF,eAAO,MAAM,oCAAoC;IAC/C,GAAG;IACH,oBAAoB;IACpB,WAAW;IACX,IAAI;IACJ,UAAU;QAAI,KAAK;;;;;CACpB,CAAC;AAKF,qBACa,4BAA6B,SAAQ,YAAY;IACrD,SAAS,IAAI,IAAI,CAGvB;CACF"}

package/lib/mjs/schema.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { registerConfigurationSchema, registerConfigurationSchemaAtImport } from '@spinajs/configuration';
+import { Bootstrapper, Injectable } from '@spinajs/di';
+const name = { type: 'string', minLength: 1 };
+export const AUTHZ_QUEUE_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-queue.configuration.schema.json',
+    $configurationModule: 'authz.queue',
+    description: 'Queue authorization configuration (authz.queue.*)',
+    type: 'object',
+    properties: {
+        // The authz domain whose principal a message carries and whose runAs its handler uses.
+        domain: { ...name, default: 'root' },
+        // Whether StampedInitiatorPrincipalFactory warns, once, that jobs run from the stamp alone; false for an app that accepts that.
+        stampedInitiatorWarning: { type: 'boolean', default: true },
+    },
+};
+// authz.bus belongs to the core schema, which leaves it open; the topic is the queue bus's own key.
+export const AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authz-queue-bus.configuration.schema.json',
+    $configurationModule: 'authz.bus',
+    description: 'Queue change bus configuration (authz.bus.topic)',
+    type: 'object',
+    properties: { topic: name },
+};
+registerConfigurationSchemaAtImport(AUTHZ_QUEUE_CONFIGURATION_SCHEMA);
+registerConfigurationSchemaAtImport(AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA);
+let AuthzQueueConfigBootstrapper = class AuthzQueueConfigBootstrapper extends Bootstrapper {
+    bootstrap() {
+        registerConfigurationSchema(AUTHZ_QUEUE_CONFIGURATION_SCHEMA);
+        registerConfigurationSchema(AUTHZ_BUS_TOPIC_CONFIGURATION_SCHEMA);
+    }
+};
+AuthzQueueConfigBootstrapper = __decorate([
+    Injectable(Bootstrapper)
+], AuthzQueueConfigBootstrapper);
+export { AuthzQueueConfigBootstrapper };
+//# sourceMappingURL=schema.js.map

package/lib/mjs/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,2BAA2B,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAE9C,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,EAAE,+CAA+C;IACpD,oBAAoB,EAAE,aAAa;IACnC,WAAW,EAAE,mDAAmD;IAChE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,uFAAuF;QACvF,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QACpC,gIAAgI;QAChI,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;KAC5D;CACF,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,GAAG,EAAE,mDAAmD;IACxD,oBAAoB,EAAE,WAAW;IACjC,WAAW,EAAE,kDAAkD;IAC/D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;CAC5B,CAAC;AAEF,mCAAmC,CAAC,gCAAgC,CAAC,CAAC;AACtE,mCAAmC,CAAC,oCAAoC,CAAC,CAAC;AAGnE,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,YAAY;IACrD,SAAS;QACd,2BAA2B,CAAC,gCAAgC,CAAC,CAAC;QAC9D,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;AALY,4BAA4B;IADxC,UAAU,CAAC,YAAY,CAAC;GACZ,4BAA4B,CAKxC"}