@stacksjs/auth 0.70.88 → 0.70.91

package/dist/rbac-store-bqb.d.ts

@@ -0,0 +1,18 @@
+import { isUniqueViolation } from '@stacksjs/orm';
+import type { PermissionRecord, RbacStore, RoleRecord } from './rbac';
+/**
+ * Swallow unique-constraint violations. Anything else is re-thrown so a
+ * "connection lost" mid-INSERT doesn't get silently treated as
+ * "already assigned".
+ *
+ * Exported for direct unit testing — the live pivot helpers below also use it.
+ */
+export declare function swallowDuplicate(err: unknown): void;
+/**
+ * Map a raw DB row to a typed record. Both `roles` and `permissions` share
+ * the same shape, so one mapper covers both — the call site provides the
+ * generic. Exported for unit testing.
+ */
+export declare function toRecord<T extends RoleRecord | PermissionRecord>(row: Record<string, unknown> | undefined): T | null;
+export declare function createBqbRbacStore(): RbacStore;
+export { isUniqueViolation };

package/dist/rbac-store-bqb.js

@@ -0,0 +1,180 @@
+import { db } from "@stacksjs/database";
+import { isUniqueViolation } from "@stacksjs/orm";
+
+export { isUniqueViolation };
+export function swallowDuplicate(err) {
+  if (!isUniqueViolation(err))
+    throw err;
+}
+export function toRecord(row) {
+  if (!row)
+    return null;
+  return {
+    id: Number(row.id),
+    name: String(row.name),
+    guard_name: String(row.guard_name),
+    description: row.description == null ? void 0 : String(row.description),
+    created_at: row.created_at == null ? void 0 : String(row.created_at),
+    updated_at: row.updated_at == null ? void 0 : String(row.updated_at)
+  };
+}
+async function insertAndFetch(table, name, guardName, description) {
+  await db.insertInto(table).values({ name, guard_name: guardName, description: description ?? null }).execute();
+  const row = await db.selectFrom(table).selectAll().where("name", "=", name).where("guard_name", "=", guardName).orderBy("id", "desc").limit(1).executeTakeFirst(), rec = toRecord(row);
+  if (!rec)
+    throw Error(`[rbac] insertAndFetch(${table}, ${name}, ${guardName}) succeeded but follow-up SELECT returned nothing`);
+  return rec;
+}
+async function pivotAttach(table, cols) {
+  let q = db.selectFrom(table).select("user_id" in cols ? "user_id" : "role_id");
+  for (const [k, v] of Object.entries(cols))
+    q = q.where(k, "=", v);
+  if (await q.limit(1).executeTakeFirst())
+    return;
+  try {
+    await db.insertInto(table).values(cols).execute();
+  } catch (err) {
+    swallowDuplicate(err);
+  }
+}
+async function pivotDetach(table, cols) {
+  let q = db.deleteFrom(table);
+  for (const [k, v] of Object.entries(cols))
+    q = q.where(k, "=", v);
+  await q.execute();
+}
+async function pivotDetachAll(table, column, value) {
+  await db.deleteFrom(table).where(column, "=", value).execute();
+}
+async function pivotSync(table, ownerColumn, ownerId, targetColumn, targetIds) {
+  const unique = Array.from(new Set(targetIds));
+  await db.transaction(async (rawTrx) => {
+    const trx = rawTrx;
+    await trx.deleteFrom(table).where(ownerColumn, "=", ownerId).execute();
+    if (unique.length === 0)
+      return;
+    const rows = unique.map((id) => ({ [ownerColumn]: ownerId, [targetColumn]: id }));
+    try {
+      await trx.insertInto(table).values(rows).execute();
+    } catch (err) {
+      swallowDuplicate(err);
+      for (const id of unique)
+        try {
+          await trx.insertInto(table).values({ [ownerColumn]: ownerId, [targetColumn]: id }).execute();
+        } catch (innerErr) {
+          swallowDuplicate(innerErr);
+        }
+    }
+  });
+}
+export function createBqbRbacStore() {
+  return {
+    async findRoleByName(name, guardName = "web") {
+      const row = await db.selectFrom("roles").selectAll().where("name", "=", name).where("guard_name", "=", guardName).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async findRoleById(id) {
+      const row = await db.selectFrom("roles").selectAll().where("id", "=", id).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async createRole(name, guardName = "web", description) {
+      return await insertAndFetch("roles", name, guardName, description);
+    },
+    async deleteRole(id) {
+      await db.deleteFrom("user_roles").where("role_id", "=", id).execute();
+      await db.deleteFrom("role_permissions").where("role_id", "=", id).execute();
+      await db.deleteFrom("roles").where("id", "=", id).execute();
+    },
+    async getAllRoles(guardName) {
+      let q = db.selectFrom("roles").selectAll();
+      if (guardName)
+        q = q.where("guard_name", "=", guardName);
+      return (await q.orderBy("id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    async findPermissionByName(name, guardName = "web") {
+      const row = await db.selectFrom("permissions").selectAll().where("name", "=", name).where("guard_name", "=", guardName).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async findPermissionById(id) {
+      const row = await db.selectFrom("permissions").selectAll().where("id", "=", id).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async createPermission(name, guardName = "web", description) {
+      return await insertAndFetch("permissions", name, guardName, description);
+    },
+    async deletePermission(id) {
+      await db.deleteFrom("user_permissions").where("permission_id", "=", id).execute();
+      await db.deleteFrom("role_permissions").where("permission_id", "=", id).execute();
+      await db.deleteFrom("permissions").where("id", "=", id).execute();
+    },
+    async getAllPermissions(guardName) {
+      let q = db.selectFrom("permissions").selectAll();
+      if (guardName)
+        q = q.where("guard_name", "=", guardName);
+      return (await q.orderBy("id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    async getUserRoles(userId) {
+      return (await db.selectFrom("roles").innerJoin("user_roles", "user_roles.role_id", "=", "roles.id").select([
+        "roles.id as id",
+        "roles.name as name",
+        "roles.guard_name as guard_name",
+        "roles.description as description",
+        "roles.created_at as created_at",
+        "roles.updated_at as updated_at"
+      ]).where("user_roles.user_id", "=", userId).orderBy("roles.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignRoleToUser(userId, roleId) {
+      return pivotAttach("user_roles", { user_id: userId, role_id: roleId });
+    },
+    removeRoleFromUser(userId, roleId) {
+      return pivotDetach("user_roles", { user_id: userId, role_id: roleId });
+    },
+    removeAllRolesFromUser(userId) {
+      return pivotDetachAll("user_roles", "user_id", userId);
+    },
+    syncUserRoles(userId, roleIds) {
+      return pivotSync("user_roles", "user_id", userId, "role_id", roleIds);
+    },
+    async getUserDirectPermissions(userId) {
+      return (await db.selectFrom("permissions").innerJoin("user_permissions", "user_permissions.permission_id", "=", "permissions.id").select([
+        "permissions.id as id",
+        "permissions.name as name",
+        "permissions.guard_name as guard_name",
+        "permissions.description as description",
+        "permissions.created_at as created_at",
+        "permissions.updated_at as updated_at"
+      ]).where("user_permissions.user_id", "=", userId).orderBy("permissions.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignPermissionToUser(userId, permissionId) {
+      return pivotAttach("user_permissions", { user_id: userId, permission_id: permissionId });
+    },
+    removePermissionFromUser(userId, permissionId) {
+      return pivotDetach("user_permissions", { user_id: userId, permission_id: permissionId });
+    },
+    removeAllPermissionsFromUser(userId) {
+      return pivotDetachAll("user_permissions", "user_id", userId);
+    },
+    syncUserPermissions(userId, permissionIds) {
+      return pivotSync("user_permissions", "user_id", userId, "permission_id", permissionIds);
+    },
+    async getRolePermissions(roleId) {
+      return (await db.selectFrom("permissions").innerJoin("role_permissions", "role_permissions.permission_id", "=", "permissions.id").select([
+        "permissions.id as id",
+        "permissions.name as name",
+        "permissions.guard_name as guard_name",
+        "permissions.description as description",
+        "permissions.created_at as created_at",
+        "permissions.updated_at as updated_at"
+      ]).where("role_permissions.role_id", "=", roleId).orderBy("permissions.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignPermissionToRole(roleId, permissionId) {
+      return pivotAttach("role_permissions", { role_id: roleId, permission_id: permissionId });
+    },
+    removePermissionFromRole(roleId, permissionId) {
+      return pivotDetach("role_permissions", { role_id: roleId, permission_id: permissionId });
+    },
+    syncRolePermissions(roleId, permissionIds) {
+      return pivotSync("role_permissions", "role_id", roleId, "permission_id", permissionIds);
+    }
+  };
+}

package/dist/rbac.d.ts

@@ -0,0 +1,265 @@
+import type { UserModel as OrmUserModel } from '@stacksjs/orm';
+/**
+ * Set the RBAC store implementation
+ */
+export declare function setRbacStore(rbacStore: RbacStore): void;
+/**
+ * Flush the RBAC cache
+ */
+export declare function flushRbacCache(): void;
+/**
+ * Create a new role
+ */
+export declare function createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>;
+/**
+ * Find a role by name
+ */
+export declare function findRole(name: string, guardName?: string): Promise<RoleRecord | null>;
+/**
+ * Delete a role
+ */
+export declare function deleteRole(name: string, guardName?: string): Promise<void>;
+/**
+ * Get all roles
+ */
+export declare function getAllRoles(guardName?: string): Promise<RoleRecord[]>;
+/**
+ * Create a new permission
+ */
+export declare function createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>;
+/**
+ * Find a permission by name
+ */
+export declare function findPermission(name: string, guardName?: string): Promise<PermissionRecord | null>;
+/**
+ * Delete a permission
+ */
+export declare function deletePermission(name: string, guardName?: string): Promise<void>;
+/**
+ * Get all permissions
+ */
+export declare function getAllPermissions(guardName?: string): Promise<PermissionRecord[]>;
+/**
+ * Get all roles for a user
+ */
+export declare function getUserRoles(user: UserModel | { id: number } | number): Promise<RoleRecord[]>;
+/**
+ * Assign a role to a user
+ */
+export declare function assignRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
+/**
+ * Remove a role from a user
+ */
+export declare function removeRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
+/**
+ * Remove all roles from a user
+ */
+export declare function removeAllRoles(user: UserModel | { id: number } | number): Promise<void>;
+/**
+ * Sync roles for a user (replaces all current roles)
+ */
+export declare function syncRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<void>;
+/**
+ * Check if a user has a specific role
+ */
+export declare function hasRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<boolean>;
+/**
+ * Check if a user has any of the given roles
+ */
+export declare function hasAnyRole(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
+/**
+ * Check if a user has all of the given roles
+ */
+export declare function hasAllRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
+/**
+ * Get all permissions for a user (direct + via roles)
+ */
+export declare function getUserPermissions(user: UserModel | { id: number } | number): Promise<PermissionRecord[]>;
+/**
+ * Give a direct permission to a user
+ */
+export declare function givePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
+/**
+ * Revoke a direct permission from a user
+ */
+export declare function revokePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
+/**
+ * Revoke all direct permissions from a user
+ */
+export declare function revokeAllPermissions(user: UserModel | { id: number } | number): Promise<void>;
+/**
+ * Sync direct permissions for a user
+ */
+export declare function syncPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<void>;
+/**
+ * Check if a user has a specific permission (direct or via role)
+ */
+export declare function hasPermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<boolean>;
+/**
+ * Check if a user has any of the given permissions
+ */
+export declare function hasAnyPermission(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
+/**
+ * Check if a user has all of the given permissions
+ */
+export declare function hasAllPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
+/**
+ * Get all permissions for a role
+ */
+export declare function getRolePermissions(roleId: number): Promise<PermissionRecord[]>;
+/**
+ * Assign a permission to a role
+ */
+export declare function givePermissionToRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
+/**
+ * Remove a permission from a role
+ */
+export declare function revokePermissionFromRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
+/**
+ * Sync permissions for a role
+ */
+export declare function syncRolePermissions(roleName: string, permissionNames: string[], guardName?: string): Promise<void>;
+/**
+ * Add RBAC methods to a user object
+ *
+ * @example
+ * const user = withRbac(authenticatedUser)
+ * if (await user.hasRole('admin')) { ... }
+ * await user.assignRole('editor')
+ */
+export declare function withRbac<T extends UserModel | { id: number }>(user: T): T & RbacMethods;
+/**
+ * RBAC facade for convenient access
+ */
+export declare const Rbac: {
+  setStore: unknown;
+  flushCache: unknown;
+  createRole: typeof createRole;
+  findRole: typeof findRole;
+  deleteRole: typeof deleteRole;
+  getAllRoles: typeof getAllRoles;
+  createPermission: typeof createPermission;
+  findPermission: typeof findPermission;
+  deletePermission: typeof deletePermission;
+  getAllPermissions: typeof getAllPermissions;
+  getUserRoles: typeof getUserRoles;
+  assignRole: typeof assignRole;
+  removeRole: typeof removeRole;
+  removeAllRoles: typeof removeAllRoles;
+  syncRoles: typeof syncRoles;
+  hasRole: typeof hasRole;
+  hasAnyRole: typeof hasAnyRole;
+  hasAllRoles: typeof hasAllRoles;
+  getUserPermissions: typeof getUserPermissions;
+  givePermission: typeof givePermission;
+  revokePermission: typeof revokePermission;
+  revokeAllPermissions: typeof revokeAllPermissions;
+  syncPermissions: typeof syncPermissions;
+  hasPermission: typeof hasPermission;
+  hasAnyPermission: typeof hasAnyPermission;
+  hasAllPermissions: typeof hasAllPermissions;
+  getRolePermissions: typeof getRolePermissions;
+  givePermissionToRole: typeof givePermissionToRole;
+  revokePermissionFromRole: typeof revokePermissionFromRole;
+  syncRolePermissions: typeof syncRolePermissions;
+  withRbac: typeof withRbac
+};
+export declare interface RoleRecord {
+  id: number
+  name: string
+  guard_name: string
+  description?: string
+  created_at?: string
+  updated_at?: string
+}
+export declare interface PermissionRecord {
+  id: number
+  name: string
+  guard_name: string
+  description?: string
+  created_at?: string
+  updated_at?: string
+}
+export declare interface RolePermissionPivot {
+  role_id: number
+  permission_id: number
+  created_at?: string
+}
+export declare interface UserRolePivot {
+  user_id: number
+  role_id: number
+  created_at?: string
+}
+export declare interface UserPermissionPivot {
+  user_id: number
+  permission_id: number
+  created_at?: string
+}
+/**
+ * RBAC database adapter interface.
+ * Implement this to connect RBAC to your database layer.
+ */
+export declare interface RbacStore {
+  findRoleByName(name: string, guardName?: string): Promise<RoleRecord | null>
+  findRoleById(id: number): Promise<RoleRecord | null>
+  createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>
+  deleteRole(id: number): Promise<void>
+  getAllRoles(guardName?: string): Promise<RoleRecord[]>
+  findPermissionByName(name: string, guardName?: string): Promise<PermissionRecord | null>
+  findPermissionById(id: number): Promise<PermissionRecord | null>
+  createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>
+  deletePermission(id: number): Promise<void>
+  getAllPermissions(guardName?: string): Promise<PermissionRecord[]>
+  getUserRoles(userId: number): Promise<RoleRecord[]>
+  assignRoleToUser(userId: number, roleId: number): Promise<void>
+  removeRoleFromUser(userId: number, roleId: number): Promise<void>
+  removeAllRolesFromUser(userId: number): Promise<void>
+  syncUserRoles(userId: number, roleIds: number[]): Promise<void>
+  getUserDirectPermissions(userId: number): Promise<PermissionRecord[]>
+  assignPermissionToUser(userId: number, permissionId: number): Promise<void>
+  removePermissionFromUser(userId: number, permissionId: number): Promise<void>
+  removeAllPermissionsFromUser(userId: number): Promise<void>
+  syncUserPermissions(userId: number, permissionIds: number[]): Promise<void>
+  getRolePermissions(roleId: number): Promise<PermissionRecord[]>
+  assignPermissionToRole(roleId: number, permissionId: number): Promise<void>
+  removePermissionFromRole(roleId: number, permissionId: number): Promise<void>
+  syncRolePermissions(roleId: number, permissionIds: number[]): Promise<void>
+}
+// ─── Authorizable Mixin (add to user objects) ───────────────────
+export declare interface RbacMethods {
+  hasRole(roleName: string, guardName?: string): Promise<boolean>
+  hasAnyRole(roleNames: string[], guardName?: string): Promise<boolean>
+  hasAllRoles(roleNames: string[], guardName?: string): Promise<boolean>
+  hasPermission(permissionName: string, guardName?: string): Promise<boolean>
+  hasAnyPermission(permissionNames: string[], guardName?: string): Promise<boolean>
+  hasAllPermissions(permissionNames: string[], guardName?: string): Promise<boolean>
+  getRoles(): Promise<RoleRecord[]>
+  getPermissions(): Promise<PermissionRecord[]>
+  assignRole(roleName: string, guardName?: string): Promise<void>
+  removeRole(roleName: string, guardName?: string): Promise<void>
+  syncRoles(roleNames: string[], guardName?: string): Promise<void>
+  givePermission(permissionName: string, guardName?: string): Promise<void>
+  revokePermission(permissionName: string, guardName?: string): Promise<void>
+  syncPermissions(permissionNames: string[], guardName?: string): Promise<void>
+}
+// Use the row/instance shape from orm so role helpers operate on the
+// authenticated user object, not the User class constructor.
+declare type UserModel = OrmUserModel;
+/**
+ * FIFO-bounded Map. Wraps Map with a hard size cap; on overflow, the
+ * oldest entry (Map insertion order) is evicted. Used for the RBAC
+ * per-user caches because the previous unbounded `Map<number, ...>`
+ * grew without limit across the process lifetime — a long-running
+ * server serving many distinct users would OOM eventually
+ * (stacksjs/stacks#1860 M-5). Same shape as `BoundedMap` in
+ * `@stacksjs/router/stacks-router.ts`.
+ */
+declare class BoundedMap<K, V> {
+  constructor(max: number);
+  get(key: K): V | undefined;
+  has(key: K): boolean;
+  set(key: K, value: V): this;
+  delete(key: K): boolean;
+  clear(): void;
+}
+export default Rbac;