@stacksjs/auth 0.72.98 → 0.72.100

package/dist/gate.d.ts

@@ -1,4 +1,41 @@
 import type { UserModel as OrmUserModel } from '@stacksjs/orm';
+/**
+ * Define the application's gates, policy mappings and before/after callbacks.
+ *
+ * The `define*` helper for `app/Gates.ts`. Both halves of `policies` are
+ * checked - the key names a model that exists, the value names a policy file
+ * that exists - where the type used to be
+ * `Record<string, string | { policy: string }>` on both sides, so a mapping to
+ * a policy that is not there registered nothing and denied every check on that
+ * model with no error anywhere.
+ *
+ * The `const` type parameter keeps the ability names, which is what
+ * `storage/framework/types/gates.d.ts` reads back to fill `AppGates`.
+ *
+ * The second half of the constraint is what rejects a key that is not a model,
+ * and it is not redundant with `PolicyMapping`. Excess-property checking is a
+ * freshness rule on the object literal and stops applying as soon as inference
+ * has a matching property to work with: `{ Psot: 'PostPolicy' }` alone was
+ * caught, and the same typo beside one correct entry was not. Requiring every
+ * key outside the model list to hold something no policy name can be makes the
+ * check structural.
+ *
+ * @example
+ * ```ts
+ * // app/Gates.ts
+ * import { defineGates } from '@stacksjs/auth'
+ *
+ * export default defineGates({
+ *   gates: {
+ *     'access-admin': user => user?.email?.endsWith('@stacksjs.org') ?? false,
+ *   },
+ *   policies: {
+ *     Post: 'PostPolicy',
+ *   },
+ * })
+ * ```
+ */
+export declare function defineGates<const T extends GatesDefinition>(definition: T & { policies?: OnlyKnownModels<T['policies']> }): T;
 /**
  * Define a new authorization gate
  *
@@ -14,7 +51,7 @@ export declare function define<T = any>(ability: string, callback: GateCallback<
  * policy('Post', PostPolicy)
  * policy(Post, PostPolicy)
  */
-export declare function policy(model: string | { name: string }, policyClass: new () => Policy): void;
+export declare function policy(model: PolicyModelName | { name: PolicyModelName }, policyClass: new () => Policy): void;
 /**
  * Register a callback to run before all gate checks
  *
@@ -24,11 +61,11 @@ export declare function policy(model: string | { name: string }, policyClass: ne
  *   return null // Continue to normal checks
  * })
  */
-export declare function before(callback: (user: UserModel | null, ability: string, args: any[]) => boolean | null | Promise<boolean | null>): void;
+export declare function before(callback: GateBeforeCallback): void;
 /**
  * Register a callback to run after all gate checks
  */
-export declare function after(callback: (user: UserModel | null, ability: string, result: boolean, args: any[]) => boolean | void | Promise<boolean | void>): void;
+export declare function after(callback: GateAfterCallback): void;
 /**
  * Check if the user is allowed to perform an ability
  *
@@ -36,51 +73,51 @@ export declare function after(callback: (user: UserModel | null, ability: string
  * if (await allows('edit-settings', user)) { ... }
  * if (await allows('update', user, post)) { ... }
  */
-export declare function allows(ability: string, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function allows(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user is denied from performing an ability
  *
  * @example
  * if (await denies('delete', user, post)) { ... }
  */
-export declare function denies(ability: string, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function denies(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user can perform an ability (alias for allows)
  */
-export declare function can(ability: string, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function can(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user cannot perform an ability (alias for denies)
  */
-export declare function cannot(ability: string, user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function cannot(ability: Ability, user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user can perform any of the given abilities
  *
  * @example
  * if (await any(['update', 'delete'], user, post)) { ... }
  */
-export declare function any(abilities: string[], user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function any(abilities: readonly Ability[], user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user can perform all of the given abilities
  *
  * @example
  * if (await all(['view', 'update'], user, post)) { ... }
  */
-export declare function all(abilities: string[], user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function all(abilities: readonly Ability[], user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Check if the user can perform none of the given abilities
  */
-export declare function none(abilities: string[], user: UserModel | null, ...args: any[]): Promise<boolean>;
+export declare function none(abilities: readonly Ability[], user: UserModel | null, ...args: any[]): Promise<boolean>;
 /**
  * Authorize an ability or throw an exception
  *
  * @example
  * await authorize('update', user, post) // Throws if not allowed
  */
-export declare function authorize(ability: string, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
+export declare function authorize(ability: Ability, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
 /**
  * Get detailed inspection result for an ability check
  */
-export declare function inspect(ability: string, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
+export declare function inspect(ability: Ability, user: UserModel | null, ...args: any[]): Promise<AuthorizationResponse>;
 /**
  * Get a policy instance for a model
  */
@@ -88,7 +125,7 @@ export declare function getPolicyFor<T = any>(model: T): Policy<T> | null;
 /**
  * Check if a gate is defined
  */
-export declare function has(ability: string): boolean;
+export declare function has(ability: Ability): boolean;
 /**
  * Check if a policy is registered for a model
  */
@@ -126,6 +163,48 @@ export declare const Gate: {
   AuthorizationResponse: typeof AuthorizationResponse;
   AuthorizationException: typeof AuthorizationException
 };
+/**
+ * Augmentation target: the ability names this application's own gates define.
+ *
+ * Derived from `app/Gates.ts` itself by
+ * `storage/framework/types/gates.d.ts`, so it cannot drift from the file it
+ * describes - the gates are the declaration.
+ *
+ * @example
+ * ```ts
+ * declare module '@stacksjs/auth' {
+ *   interface AppGates {
+ *     'access-admin': true
+ *   }
+ * }
+ * ```
+ */
+// eslint-disable-next-line ts/no-empty-object-type -- augmentation target; empty by design
+export declare interface AppGates {}
+/**
+ * Augmentation target: the policy classes under `app/Policies/`, and the
+ * framework defaults behind it, by filename.
+ *
+ * Filled by `storage/framework/types/registries.d.ts`, which reads the same
+ * name map `findPolicyFile` resolves through.
+ */
+// eslint-disable-next-line ts/no-empty-object-type -- augmentation target; empty by design
+export declare interface PolicyClasses {}
+/**
+ * Augmentation target: the models a policy may be registered for.
+ *
+ * Derived from the models barrel, so it is the models that exist rather than a
+ * list somebody maintains alongside them.
+ */
+// eslint-disable-next-line ts/no-empty-object-type -- augmentation target; empty by design
+export declare interface PolicyModels {}
+/** The shape of `app/Gates.ts`. */
+export declare interface GatesDefinition {
+  gates: Readonly<Record<string, GateCallback>>
+  policies?: PolicyMapping
+  before?: readonly GateBeforeCallback[]
+  after?: readonly GateAfterCallback[]
+}
 /**
  * Policy class interface
  */
@@ -148,6 +227,56 @@ declare type UserModel = OrmUserModel;
  * Gate callback function type
  */
 export type GateCallback<T = any> = (_user: UserModel | null, ..._args: T[]) => boolean | Promise<boolean> | AuthorizationResponse;
+/** An ability name defined by one of the application's gates. */
+export type GateName = keyof AppGates extends never ? string : keyof AppGates & string;
+/**
+ * The abilities `BasePolicy` resolves. A policy may add its own methods, which
+ * is why `Ability` below stays open.
+ */
+export type PolicyAbility = 'viewAny' | 'view' | 'create' | 'update' | 'delete' | 'restore' | 'forceDelete';
+/**
+ * Any ability that can be checked.
+ *
+ * Deliberately open. An ability is legitimately dynamic - a `/can/:ability`
+ * route passes one straight through, which is the reason
+ * `RESERVED_POLICY_MEMBERS` exists at all - so narrowing this to the declared
+ * set would reject correct code and break the fail-closed tests that check
+ * what an UNKNOWN ability does. The union is here for the editor: the gates
+ * and policy abilities are offered, and anything else still compiles.
+ */
+// eslint-disable-next-line ts/ban-types -- `string & {}` keeps literal completions alive
+export type Ability = GateName | PolicyAbility | (string & {});
+/** A policy class name, as narrow as the application has made it. */
+export type PolicyName = keyof PolicyClasses extends never ? string : keyof PolicyClasses & string;
+/** A model name a policy may be registered for. */
+export type PolicyModelName = keyof PolicyModels extends never ? string : keyof PolicyModels & string;
+/** Runs before every check. `true` allows, `false` denies, `null` continues. */
+export type GateBeforeCallback = (_user: UserModel | null, _ability: string, _args: unknown[]) => boolean | null | Promise<boolean | null>;
+/** Runs after every check. A boolean overrides the result; anything else keeps it. */
+export type GateAfterCallback = (_user: UserModel | null, _ability: string, _result: boolean, _args: unknown[]) => boolean | void | Promise<boolean | void>;
+/**
+ * How `app/Gates.ts` maps a model to the policy that authorizes it.
+ *
+ * Every key optional: a mapping is written only for the models whose policy
+ * does not follow the `<Model>Policy` convention.
+ */
+export type PolicyMapping = {
+  readonly [K in PolicyModelName]?: PolicyName | { policy: PolicyName, model?: PolicyModelName }
+}
+/**
+ * Every key of a policy map that is not a model, required to hold something no
+ * policy name can be.
+ *
+ * Applied to the PARAMETER rather than to the type parameter's constraint: a
+ * constraint that reads `T['policies']` is a self-reference and TypeScript
+ * refuses it, while the parameter may name `T` freely because inference has
+ * already run against the `T &` half.
+ */
+declare type OnlyKnownModels<TPolicies> = {
+  [K in keyof TPolicies]: K extends PolicyModelName
+    ? TPolicies[K]
+    : { 'this is not a model in this application': never }
+}
 /**
  * Policy method type. The return type intentionally allows `null` so that
  * a policy's `before()` hook (which returns `null` to delegate to the

package/dist/gate.js

@@ -1 +1 @@
-const RESERVED_POLICY_MEMBERS=new Set(["before","allow","deny","denyIf","denyUnless","allowIf","constructor"]);export class AuthorizationResponse{isAllowed;message;code;constructor(allowed,message,code){this.isAllowed=allowed;this.message=message;this.code=code}static allow(message){return new AuthorizationResponse(!0,message)}static deny(message,code){return new AuthorizationResponse(!1,message||"This action is unauthorized.",code)}allowed(){return this.isAllowed}denied(){return!this.isAllowed}authorize(){if(!this.isAllowed)throw new AuthorizationException(this.message||"This action is unauthorized.",this.code)}}export class AuthorizationException extends Error{code;status;constructor(message="This action is unauthorized.",code,status=403){super(message);this.code=code;this.status=status;this.name="AuthorizationException"}}const state={gates:new Map,policies:new Map,beforeCallbacks:[],afterCallbacks:[]};export function define(ability,callback){state.gates.set(ability,callback)}export function policy(model,policyClass){const modelName=typeof model==="string"?model:model.name;state.policies.set(modelName,policyClass)}export function before(callback){state.beforeCallbacks.push(callback)}export function after(callback){state.afterCallbacks.push(callback)}export async function allows(ability,user,...args){return check(ability,user,...args)}export async function denies(ability,user,...args){return!await check(ability,user,...args)}export async function can(ability,user,...args){return check(ability,user,...args)}export async function cannot(ability,user,...args){return!await check(ability,user,...args)}export async function any(abilities,user,...args){for(const ability of abilities)if(await check(ability,user,...args))return!0;return!1}export async function all(abilities,user,...args){for(const ability of abilities)if(!await check(ability,user,...args))return!1;return!0}export async function none(abilities,user,...args){return!await any(abilities,user,...args)}export async function authorize(ability,user,...args){const result=await inspect(ability,user,...args);if(!result.isAllowed)throw new AuthorizationException(result.message,result.code);return result}export async function inspect(ability,user,...args){let response=null;for(const callback of state.beforeCallbacks){const beforeResult=await callback(user,ability,args);if(beforeResult===!0){response=AuthorizationResponse.allow();break}if(beforeResult===!1){response=AuthorizationResponse.deny();break}}if(!response)response=await resolveAbility(ability,user,args);for(const callback of state.afterCallbacks){const afterResult=await callback(user,ability,response.isAllowed,args);if(typeof afterResult==="boolean")return afterResult?AuthorizationResponse.allow():AuthorizationResponse.deny()}return response}async function resolveAbility(ability,user,args){const model=args[0];if(model&&typeof model==="object"){const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass){const policyInstance=new policyClass;if(policyInstance.before){const beforeResult=await policyInstance.before(user,ability);if(beforeResult===!0)return AuthorizationResponse.allow();if(beforeResult===!1)return AuthorizationResponse.deny()}const method=RESERVED_POLICY_MEMBERS.has(ability)?void 0:policyInstance[ability];if(typeof method==="function"){const result=await method.call(policyInstance,user,...args);return normalizeResponse(result??!1)}}}const gate=state.gates.get(ability);if(gate)return normalizeResponse(await gate(user,...args));return AuthorizationResponse.deny(`No gate or policy defined for ability: ${ability}`)}async function check(ability,user,...args){return(await inspect(ability,user,...args)).isAllowed}function normalizeResponse(result){if(result instanceof AuthorizationResponse)return result;if(typeof result!=="boolean")throw TypeError(`[gate] Policy must return boolean or AuthorizationResponse; got ${typeof result}. If you returned a model/value by mistake, return \`true\`/\`false\` instead.`);return result?AuthorizationResponse.allow():AuthorizationResponse.deny()}export function getPolicyFor(model){if(!model||typeof model!=="object")return null;const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass)return new policyClass;return null}export function has(ability){return state.gates.has(ability)}export function hasPolicy(model){const modelName=typeof model==="string"?model:model.name;return state.policies.has(modelName)}export function abilities(){return Array.from(state.gates.keys())}export function flush(){state.gates.clear();state.policies.clear();state.beforeCallbacks=[];state.afterCallbacks=[]}export const Gate={define,policy,before,after,allows,denies,can,cannot,any,all,none,authorize,inspect,has,hasPolicy,abilities,getPolicyFor,flush,AuthorizationResponse,AuthorizationException};export default Gate;
+export function defineGates(definition){return definition}const RESERVED_POLICY_MEMBERS=new Set(["before","allow","deny","denyIf","denyUnless","allowIf","constructor"]);export class AuthorizationResponse{isAllowed;message;code;constructor(allowed,message,code){this.isAllowed=allowed;this.message=message;this.code=code}static allow(message){return new AuthorizationResponse(!0,message)}static deny(message,code){return new AuthorizationResponse(!1,message||"This action is unauthorized.",code)}allowed(){return this.isAllowed}denied(){return!this.isAllowed}authorize(){if(!this.isAllowed)throw new AuthorizationException(this.message||"This action is unauthorized.",this.code)}}export class AuthorizationException extends Error{code;status;constructor(message="This action is unauthorized.",code,status=403){super(message);this.code=code;this.status=status;this.name="AuthorizationException"}}const state={gates:new Map,policies:new Map,beforeCallbacks:[],afterCallbacks:[]};export function define(ability,callback){state.gates.set(ability,callback)}export function policy(model,policyClass){const modelName=typeof model==="string"?model:model.name;state.policies.set(modelName,policyClass)}export function before(callback){state.beforeCallbacks.push(callback)}export function after(callback){state.afterCallbacks.push(callback)}export async function allows(ability,user,...args){return check(ability,user,...args)}export async function denies(ability,user,...args){return!await check(ability,user,...args)}export async function can(ability,user,...args){return check(ability,user,...args)}export async function cannot(ability,user,...args){return!await check(ability,user,...args)}export async function any(abilities,user,...args){for(const ability of abilities)if(await check(ability,user,...args))return!0;return!1}export async function all(abilities,user,...args){for(const ability of abilities)if(!await check(ability,user,...args))return!1;return!0}export async function none(abilities,user,...args){return!await any(abilities,user,...args)}export async function authorize(ability,user,...args){const result=await inspect(ability,user,...args);if(!result.isAllowed)throw new AuthorizationException(result.message,result.code);return result}export async function inspect(ability,user,...args){let response=null;for(const callback of state.beforeCallbacks){const beforeResult=await callback(user,ability,args);if(beforeResult===!0){response=AuthorizationResponse.allow();break}if(beforeResult===!1){response=AuthorizationResponse.deny();break}}if(!response)response=await resolveAbility(ability,user,args);for(const callback of state.afterCallbacks){const afterResult=await callback(user,ability,response.isAllowed,args);if(typeof afterResult==="boolean")return afterResult?AuthorizationResponse.allow():AuthorizationResponse.deny()}return response}async function resolveAbility(ability,user,args){const model=args[0];if(model&&typeof model==="object"){const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass){const policyInstance=new policyClass;if(policyInstance.before){const beforeResult=await policyInstance.before(user,ability);if(beforeResult===!0)return AuthorizationResponse.allow();if(beforeResult===!1)return AuthorizationResponse.deny()}const method=RESERVED_POLICY_MEMBERS.has(ability)?void 0:policyInstance[ability];if(typeof method==="function"){const result=await method.call(policyInstance,user,...args);return normalizeResponse(result??!1)}}}const gate=state.gates.get(ability);if(gate)return normalizeResponse(await gate(user,...args));return AuthorizationResponse.deny(`No gate or policy defined for ability: ${ability}`)}async function check(ability,user,...args){return(await inspect(ability,user,...args)).isAllowed}function normalizeResponse(result){if(result instanceof AuthorizationResponse)return result;if(typeof result!=="boolean")throw TypeError(`[gate] Policy must return boolean or AuthorizationResponse; got ${typeof result}. If you returned a model/value by mistake, return \`true\`/\`false\` instead.`);return result?AuthorizationResponse.allow():AuthorizationResponse.deny()}export function getPolicyFor(model){if(!model||typeof model!=="object")return null;const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass)return new policyClass;return null}export function has(ability){return state.gates.has(ability)}export function hasPolicy(model){const modelName=typeof model==="string"?model:model.name;return state.policies.has(modelName)}export function abilities(){return Array.from(state.gates.keys())}export function flush(){state.gates.clear();state.policies.clear();state.beforeCallbacks=[];state.afterCallbacks=[]}export const Gate={define,policy,before,after,allows,denies,can,cannot,any,all,none,authorize,inspect,has,hasPolicy,abilities,getPolicyFor,flush,AuthorizationResponse,AuthorizationException};export default Gate;

package/dist/policy.d.ts

@@ -1,7 +1,11 @@
 import { AuthorizationResponse } from './gate';
 import type { UserModel as OrmUserModel } from '@stacksjs/orm';
+/** For tests, and for a dev server that regenerated the registry. */
+export declare function resetPolicyRegistry(): void;
 /**
- * Discover and register policies from app/Policies directory
+ * Discover and register policies: the explicit mappings in `app/Gates.ts`
+ * first, then anything under `app/Policies/` that follows the `ModelPolicy`
+ * convention.
  */
 export declare function discoverPolicies(): Promise<void>;
 /**
@@ -9,7 +13,20 @@ export declare function discoverPolicies(): Promise<void>;
  */
 export declare function registerGates(): Promise<void>;
 /**
- * Initialize authorization system
+ * Initialize the authorization system: register the gates and before/after
+ * callbacks from `app/Gates.ts`, then the policies.
+ *
+ * Called from `injectGlobalAutoImports()`, which is the one place every entry
+ * point comes through - HTTP, `buddy seed`, a scheduled job, a console command.
+ * Nothing called it before. It was exported, documented, and dead, so every
+ * gate an application defined was never registered and every `Gate.allows(...)`
+ * fell through to the default deny. That is the failure mode authorization is
+ * least able to report, because a gate that denies everything and a gate that
+ * was never registered are the same answer.
+ *
+ * Never throws: an application that cannot boot over a typo in a gate is worse
+ * than one that logs the typo. A `Gates.ts` that fails to load is reported at
+ * error level, not swallowed at debug.
  */
 export declare function initializeAuthorization(): Promise<void>;
 // Use the row/instance shape from orm so policies operate on the

package/dist/policy.js

@@ -1 +1 @@
-import{AuthorizationResponse}from"./gate";export class BasePolicy{allow(message){return AuthorizationResponse.allow(message)}deny(message,code){return AuthorizationResponse.deny(message,code)}denyIf(condition,message){if(condition)return this.deny(message);return!0}denyUnless(condition,message){if(!condition)return this.deny(message);return!0}allowIf(condition,message){if(condition)return this.allow(message);return!1}}import{log}from"@stacksjs/logging";import*as p from"@stacksjs/path";import{policy as registerPolicy}from"./gate";export async function discoverPolicies(){const{fs}=await import("@stacksjs/storage"),policiesDir=p.appPath("Policies");if(!fs.existsSync(policiesDir)){log.debug("No Policies directory found");return}try{const mappings=(await import(p.appPath("Gates.ts"))).policies||{};for(const[modelName,config]of Object.entries(mappings)){const policyFile=typeof config==="string"?config:config.policy,policyPath=`${policiesDir}/${policyFile}.ts`;if(fs.existsSync(policyPath)){const policyModule=await import(policyPath),PolicyClass=policyModule.default||policyModule[policyFile];if(PolicyClass){registerPolicy(modelName,PolicyClass);log.debug(`Registered policy: ${policyFile} for ${modelName}`)}}}}catch{log.debug("No Gates.ts found, using convention-based discovery")}const policyFiles=fs.readdirSync(policiesDir).filter((file)=>file.endsWith("Policy.ts"));for(const file of policyFiles){const policyName=file.replace(".ts",""),modelName=policyName.replace("Policy",""),policyPath=`${policiesDir}/${file}`;try{const policyModule=await import(policyPath),PolicyClass=policyModule.default||policyModule[policyName];if(PolicyClass){registerPolicy(modelName,PolicyClass);log.debug(`Auto-discovered policy: ${policyName} for ${modelName}`)}}catch(error){log.error(`Failed to load policy ${policyName}:`,error)}}}export async function registerGates(){const{define,before,after}=await import("./gate");try{const gatesModule=await import(p.appPath("Gates.ts")),gates=gatesModule.gates||gatesModule.default?.gates||{};for(const[ability,callback]of Object.entries(gates))if(typeof callback==="function"){define(ability,callback);log.debug(`Registered gate: ${ability}`)}const beforeCallbacks=gatesModule.before||gatesModule.default?.before||[];for(const callback of beforeCallbacks)if(typeof callback==="function")before(callback);const afterCallbacks=gatesModule.after||gatesModule.default?.after||[];for(const callback of afterCallbacks)if(typeof callback==="function")after(callback);log.debug("Gates registered successfully")}catch{log.debug("No Gates.ts found or failed to load")}}export async function initializeAuthorization(){await registerGates();await discoverPolicies()}export{AuthorizationResponse};
+import{AuthorizationResponse}from"./gate";export class BasePolicy{allow(message){return AuthorizationResponse.allow(message)}deny(message,code){return AuthorizationResponse.deny(message,code)}denyIf(condition,message){if(condition)return this.deny(message);return!0}denyUnless(condition,message){if(!condition)return this.deny(message);return!0}allowIf(condition,message){if(condition)return this.allow(message);return!1}}import{log}from"@stacksjs/logging";import*as p from"@stacksjs/path";import{policy as registerPolicy}from"./gate";let policyRegistry=null;async function loadPolicyRegistry(){if(policyRegistry)return policyRegistry;policyRegistry=(async()=>{try{const dir=p.storagePath("framework/auto-imports"),module=await import(`${dir}/policies.ts`);if(!module.policies)return null;const{resolve}=await import("node:path");return Object.fromEntries(Object.entries(module.policies).map(([name,file])=>[name,resolve(dir,file)]))}catch{return null}})();return policyRegistry}function policyDirectories(){return[p.appPath("Policies"),p.storagePath("framework/defaults/app/Policies")]}async function findPolicyFile(name){const registry=await loadPolicyRegistry();if(registry)return registry[name]??null;const{fs}=await import("@stacksjs/storage");for(const dir of policyDirectories()){const candidate=`${dir}/${name}.ts`;if(fs.existsSync(candidate))return candidate}return null}export function resetPolicyRegistry(){policyRegistry=null}export async function discoverPolicies(){const{fs}=await import("@stacksjs/storage"),explicit=new Set,mappings=(await loadGatesModule())?.policies??{};for(const[modelName,config]of Object.entries(mappings)){const policyFile=typeof config==="string"?config:config.policy,policyPath=await findPolicyFile(policyFile);if(!policyPath){log.warn(`[auth] app/Gates.ts maps ${modelName} to ${policyFile}, and no such policy exists`);continue}try{const policyModule=await import(policyPath),PolicyClass=policyModule.default||policyModule[policyFile];if(!PolicyClass){log.warn(`[auth] ${policyPath} has no default export, so ${modelName} has no policy`);continue}registerPolicy(modelName,PolicyClass);explicit.add(modelName);log.debug(`Registered policy: ${policyFile} for ${modelName}`)}catch(error){log.error(`Failed to load policy ${policyFile}:`,error)}}const registry=await loadPolicyRegistry();let discovered;if(registry)discovered=Object.entries(registry).filter(([name])=>name.endsWith("Policy")).map(([policyName,policyPath])=>({policyName,policyPath}));else{const policiesDir=p.appPath("Policies");if(!fs.existsSync(policiesDir)){log.debug("No Policies directory found");return}discovered=fs.readdirSync(policiesDir).filter((file)=>file.endsWith("Policy.ts")).map((file)=>({policyName:file.replace(".ts",""),policyPath:`${policiesDir}/${file}`}))}for(const{policyName,policyPath}of discovered){const modelName=policyName.replace("Policy","");if(explicit.has(modelName))continue;try{const policyModule=await import(policyPath),PolicyClass=policyModule.default||policyModule[policyName];if(PolicyClass){registerPolicy(modelName,PolicyClass);log.debug(`Auto-discovered policy: ${policyName} for ${modelName}`)}}catch(error){log.error(`Failed to load policy ${policyName}:`,error)}}}async function loadGatesModule(){const{fs}=await import("@stacksjs/storage"),gatesPath=p.appPath("Gates.ts");if(!fs.existsSync(gatesPath))return null;const module=await import(gatesPath);return{gates:module.default?.gates??module.gates,policies:module.default?.policies??module.policies,before:module.default?.before??module.before,after:module.default?.after??module.after}}export async function registerGates(){const{define,before,after}=await import("./gate"),authorization=await loadGatesModule();if(!authorization){log.debug("No Gates.ts found");return}for(const[ability,callback]of Object.entries(authorization.gates??{}))if(typeof callback==="function"){define(ability,callback);log.debug(`Registered gate: ${ability}`)}for(const callback of authorization.before??[])if(typeof callback==="function")before(callback);for(const callback of authorization.after??[])if(typeof callback==="function")after(callback);log.debug("Gates registered successfully")}export async function initializeAuthorization(){try{await registerGates()}catch(error){log.error("[auth] app/Gates.ts failed to load - no gates are registered and every Gate check will deny:",error)}try{await discoverPolicies()}catch(error){log.error("[auth] policy discovery failed - model authorization will deny:",error)}}export{AuthorizationResponse};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.98",
+  "version": "0.72.100",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -53,6 +53,7 @@
   "scripts": {
     "build": "bun build.ts",
     "typecheck": "bun tsc --noEmit",
+    "typecheck:types": "bun tsc --noEmit -p tsconfig.type-tests.json --pretty false",
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
@@ -61,7 +62,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.24",
-    "@stacksjs/error-handling": "0.72.98",
-    "@stacksjs/router": "0.72.98"
+    "@stacksjs/error-handling": "0.72.100",
+    "@stacksjs/router": "0.72.100"
   }
 }