@stacksjs/auth 0.70.94 → 0.70.95

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './tokens';
 export * from './gate';
 export * from './policy';
 export * from './authorizable';
+export * from './permissions';
 // Role-Based Access Control (RBAC)
 export * from './rbac';
 export { createBqbRbacStore } from './rbac-store-bqb';

package/dist/index.js

@@ -11,6 +11,7 @@ export * from "./tokens";
 export * from "./gate";
 export * from "./policy";
 export * from "./authorizable";
+export * from "./permissions";
 export * from "./rbac";
 export { createBqbRbacStore } from "./rbac-store-bqb";
 export { DEFAULT_ROLE_PACKS, seedDefaultRoles } from "./rbac-seed";

package/dist/permissions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Define a typed, deterministic role-to-permission resolver.
+ *
+ * This complements the database-backed `Rbac` facade for applications whose
+ * role grants live in source control, or whose tenant membership is the
+ * authorization subject rather than the authenticated user record itself.
+ */
+export declare function defineRolePermissions<const TRole extends string, const TPermission extends string>(grants: RolePermissionMap<TRole, TPermission>): RolePermissions<TRole, TPermission>;
+export declare interface RolePermissions<TRole extends string, TPermission extends string> {
+  roleCan: (role: TRole | null | undefined, permission: TPermission) => boolean
+  can: (subject: { role: TRole } | null | undefined, permission: TPermission) => boolean
+  canAny: (subject: { role: TRole } | null | undefined, permissions: readonly TPermission[]) => boolean
+  canAll: (subject: { role: TRole } | null | undefined, permissions: readonly TPermission[]) => boolean
+  forRole: (role: TRole | null | undefined) => readonly TPermission[]
+}
+export type RolePermissionMap<TRole extends string, TPermission extends string> = Record<TRole, readonly TPermission[]>;

package/dist/permissions.js

@@ -0,0 +1,4 @@
+export function defineRolePermissions(grants) {
+  const frozenGrants = Object.fromEntries(Object.entries(grants).map(([role, permissions]) => [role, Object.freeze([...permissions])])), forRole = (role) => role ? frozenGrants[role] ?? [] : [], roleCan = (role, permission) => forRole(role).includes(permission), can = (subject, permission) => roleCan(subject?.role, permission);
+  return Object.freeze({ roleCan, can, canAny: (subject, permissions) => permissions.some((permission) => can(subject, permission)), canAll: (subject, permissions) => permissions.every((permission) => can(subject, permission)), forRole });
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.94",
+  "version": "0.70.95",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.16",
-    "@stacksjs/error-handling": "0.70.94",
-    "@stacksjs/router": "0.70.94"
+    "@stacksjs/error-handling": "0.70.95",
+    "@stacksjs/router": "0.70.95"
   }
 }