@stigmer/server 3.40.1 → 3.41.0

package/dist/authorization/authorizer.d.ts

@@ -57,21 +57,25 @@ import type { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/serve
 import type { Logger } from "../boot/logger.js";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { Authorizer } from "../extensions/authorizer.js";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
 import type { Store } from "../store/interface.js";
 import type { Model } from "./model/index.js";
 import type { AccountsByCaller } from "./person.js";
 /**
  * Kinds whose missing row is a denial, never `not-found` (arm 4): the
  * cloud's `PROBE_EXEMPT_KINDS` (stigmer-cloud
- * src/authorizer/fga-authorizer.ts) restricted to the kinds this edition
- * serves — `platform`, `identity_provider` and `invitation` are refused by
- * arm 2 before any row is asked about. The cloud exempts them because
- * their rows live in its own tables, out of its probe's reach; matching
- * the set here keeps the wire identical across editions (an unknown
- * platform client's id is PERMISSION_DENIED with the annotation's copy in
- * both). The cloud pins every kind here inside its own
- * `PROBE_EXEMPT_KINDS`, which is why this set is exported; a kind that
- * moves into open source joins this set in the same change.
+ * src/authorizer/fga-authorizer.ts), the same set. The cloud exempts them
+ * because their rows live in its own tables, out of its probe's reach;
+ * matching the set here keeps the wire identical across editions (an
+ * unknown platform client's id is PERMISSION_DENIED with the annotation's
+ * copy in both), so a member cannot learn which provider, invitation or
+ * team ids exist in an organization they may not read. In open source,
+ * `platform`, `identity_provider`, `invitation` and `team` are refused by
+ * arm 2 before any row is asked about, so their entries matter only to an
+ * edition that serves them. `platform` also has no row at all
+ * (model/bindings.ts, ROWLESS): outside this set every check on it would
+ * answer not-found without evaluating. The cloud pins every kind here
+ * inside its own `PROBE_EXEMPT_KINDS`, which is why this set is exported.
  *
  * `iam_policy` is reachable as a target through the IamPolicy RPCs' own
  * `resource.kind` (a caller may name it); the grant scope refuses such a
@@ -92,9 +96,11 @@ export interface BuiltInAuthorizerDeps {
     readonly policies: IamPolicyStore;
     /** The account port: the caller's account, and identity_account targets. */
     readonly accounts: AccountsByCaller;
-    /** The served edition (`extensions.edition`); the built-in posture pins it to `oss` at boot. */
+    /** The served edition (`extensions.edition`); above `oss`, boot has checked every served kind's rows are readable. */
     readonly edition: ServerEdition;
     readonly logger: Logger;
+    /** The readers of the kinds units keep themselves (`drivers.resourceRowReaders`), handed to every tuple source. */
+    readonly rowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
     /** The declarations to evaluate; the built-in model unless a test says otherwise. */
     readonly model?: Model;
 }

package/dist/authorization/authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAI9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA6E5E"}
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAQ9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,sHAAsH;IACtH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mHAAmH;IACnH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA8E5E"}

package/dist/authorization/authorizer.js

@@ -63,15 +63,18 @@ import { formatObjectRef } from "./tuples.js";
 /**
  * Kinds whose missing row is a denial, never `not-found` (arm 4): the
  * cloud's `PROBE_EXEMPT_KINDS` (stigmer-cloud
- * src/authorizer/fga-authorizer.ts) restricted to the kinds this edition
- * serves — `platform`, `identity_provider` and `invitation` are refused by
- * arm 2 before any row is asked about. The cloud exempts them because
- * their rows live in its own tables, out of its probe's reach; matching
- * the set here keeps the wire identical across editions (an unknown
- * platform client's id is PERMISSION_DENIED with the annotation's copy in
- * both). The cloud pins every kind here inside its own
- * `PROBE_EXEMPT_KINDS`, which is why this set is exported; a kind that
- * moves into open source joins this set in the same change.
+ * src/authorizer/fga-authorizer.ts), the same set. The cloud exempts them
+ * because their rows live in its own tables, out of its probe's reach;
+ * matching the set here keeps the wire identical across editions (an
+ * unknown platform client's id is PERMISSION_DENIED with the annotation's
+ * copy in both), so a member cannot learn which provider, invitation or
+ * team ids exist in an organization they may not read. In open source,
+ * `platform`, `identity_provider`, `invitation` and `team` are refused by
+ * arm 2 before any row is asked about, so their entries matter only to an
+ * edition that serves them. `platform` also has no row at all
+ * (model/bindings.ts, ROWLESS): outside this set every check on it would
+ * answer not-found without evaluating. The cloud pins every kind here
+ * inside its own `PROBE_EXEMPT_KINDS`, which is why this set is exported.
  *
  * `iam_policy` is reachable as a target through the IamPolicy RPCs' own
  * `resource.kind` (a caller may name it); the grant scope refuses such a
@@ -79,9 +82,13 @@ import { formatObjectRef } from "./tuples.js";
  * keeps the wire the same on the way there.
  */
 export const NOT_FOUND_EXEMPT_KINDS = new Set([
+    ApiResourceKind.platform,
     ApiResourceKind.identity_account,
+    ApiResourceKind.identity_provider,
     ApiResourceKind.iam_policy,
     ApiResourceKind.platform_client,
+    ApiResourceKind.invitation,
+    ApiResourceKind.team,
 ]);
 /** The Java RequestAuthorizationService's pre-check copy, byte for byte (the cloud renders the same). */
 export const UNKNOWN_PERMISSION_DENY_REASON = "authorization cannot be performed with unknown permission";
@@ -120,6 +127,7 @@ export function newBuiltInAuthorizer(deps) {
                     store: deps.store,
                     policies: deps.policies,
                     accounts: deps.accounts,
+                    rowReaders: deps.rowReaders,
                     model,
                 }, person);
                 const row = await source.loader.load(object);

package/dist/authorization/authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,eAAe;CAChC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAY1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,iBAAiB;IACjC,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,eAAe;IAC/B,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,IAAI;CACrB,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAiB5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/authorization/derived-tuples.d.ts

@@ -1,10 +1,11 @@
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
 import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
 import type { Store } from "../store/interface.js";
 import type { RowFacts } from "./facts.js";
 import type { Model } from "./model/index.js";
-import type { Person, RowLoader, Tuple, TupleSource } from "./tuples.js";
+import type { Principal, RowLoader, Tuple, TupleSource } from "./tuples.js";
 /**
  * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
  * by this edition (the module header): the derivation writes no owner
@@ -20,6 +21,8 @@ export interface DerivedTupleSourceDeps {
     readonly policies: IamPolicyStore;
     /** The account port — an `identity_account` object is read through it, never the generic Store (the module header). */
     readonly accounts: Pick<IdentityAccountStore, "findById">;
+    /** The readers of the kinds units keep themselves (`drivers.resourceRowReaders`); absent, every other row is the generic Store's. */
+    readonly rowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
     /** The declarations to derive with; the built-in model unless a test says otherwise. */
     readonly model?: Model;
 }
@@ -27,7 +30,8 @@ export interface DerivedTupleSource extends TupleSource {
     /** The memoised row reads, exposed for a declaration's `derived` rules and for tests. */
     readonly loader: RowLoader;
     /**
-     * The person's own IamPolicy rows as tuples — the ONE read of them this
+     * The person's own IamPolicy rows as tuples, each organization role with
+     * the organization's `affiliated` tuple it stands for — the ONE read of them this
      * source makes, shared with `tuplesOf`. A list-shaped consumer (the
      * organization directory; the list scope) reads its candidate objects
      * from here instead of scanning the port a second time. The rows granted
@@ -40,5 +44,5 @@ export interface DerivedTupleSourceSeed {
     /** Objects whose facts the caller already holds; their rows are not read for derivation. */
     readonly facts: ReadonlyArray<RowFacts>;
 }
-export declare function newDerivedTupleSource(deps: DerivedTupleSourceDeps, person: Person, seed?: DerivedTupleSourceSeed): DerivedTupleSource;
+export declare function newDerivedTupleSource(deps: DerivedTupleSourceDeps, principal: Principal, seed?: DerivedTupleSourceSeed): DerivedTupleSource;
 //# sourceMappingURL=derived-tuples.d.ts.map

package/dist/authorization/derived-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAqFA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAUH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AA8BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;;;OAOG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAwHpB"}
+{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AA6FA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAO9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,SAAS,EACT,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAcH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AA8BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,qIAAqI;IACrI,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,SAAS,EAAE,SAAS,EACpB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CA+HpB"}

package/dist/authorization/derived-tuples.js

@@ -6,7 +6,7 @@ import { visibilityShapesFor } from "../pipeline/steps/authorization-tuples.js";
 import { ResourceNotFoundError } from "../store/interface.js";
 import { rowFactsOf } from "./facts.js";
 import { builtInModel } from "./model/index.js";
-import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
+import { ACCOUNT_TYPE, formatObjectRef, isPerson } from "./tuples.js";
 /**
  * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
  * by this edition (the module header): the derivation writes no owner
@@ -16,6 +16,9 @@ import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
 export const ROW_RECORDED_OWNER_KINDS = new Set([
     ApiResourceKind.organization,
 ]);
+/** The organization type, and the relation that stands while a person holds a role on it (tenancy/organization.fga). */
+const ORGANIZATION_TYPE = kindEnumName(ApiResourceKind.organization);
+const AFFILIATED_RELATION = "affiliated";
 /** The FGA type a team grant names, and the relation that makes a person one of its members (the model's `team#member`). */
 const TEAM_TYPE = kindEnumName(ApiResourceKind.team);
 const TEAM_MEMBER_RELATION = "member";
@@ -99,7 +102,7 @@ function visibilitySubject(shape, org) {
         }
     }
 }
-export function newDerivedTupleSource(deps, person, seed) {
+export function newDerivedTupleSource(deps, principal, seed) {
     const model = deps.model ?? builtInModel;
     const rows = new Map();
     const derived = new Map();
@@ -148,9 +151,13 @@ export function newDerivedTupleSource(deps, person, seed) {
     }
     function rowTuples() {
         if (personRows === undefined) {
-            personRows = deps.policies
-                .findByPrincipal(ACCOUNT_TYPE, person.accountId)
-                .then((found) => found.map(tupleOfRow));
+            personRows = isPerson(principal)
+                ? deps.policies
+                    .findByPrincipal(ACCOUNT_TYPE, principal.accountId)
+                    .then((found) => found.flatMap(tuplesOfPersonRow))
+                : deps.policies
+                    .findByPrincipal(principal.object.type, principal.object.id)
+                    .then((found) => found.filter(isDirectGrant).map(tupleOfRow));
         }
         return personRows;
     }
@@ -186,7 +193,10 @@ export function newDerivedTupleSource(deps, person, seed) {
                 tuple.object.id === object.id;
             const fromRows = (await reachableTuples()).get(pairKey(object, relation)) ?? [];
             const declaration = model.byType(object.type);
-            if (declaration === undefined) {
+            if (declaration === undefined || isAffiliation(object, relation)) {
+                // An organization's `affiliated` tuples are the person's rows'
+                // (tuplesOfPersonRow); the organization's own row derives none, so
+                // it is not read for them.
                 return fromRows;
             }
             const fromRow = (await derivedTuplesOf(object)).filter(onPair);
@@ -217,6 +227,10 @@ async function loadRow(deps, model, object) {
     if (kind === ApiResourceKind.identity_account) {
         return deps.accounts.findById(object.id);
     }
+    const reader = deps.rowReaders?.get(kind);
+    if (reader !== undefined) {
+        return reader.findById(object.id);
+    }
     try {
         return await deps.store.getResource(kind, object.id, declaration.schema);
     }
@@ -227,6 +241,14 @@ async function loadRow(deps, model, object) {
         throw error;
     }
 }
+/**
+ * Whether a row names its principal directly (`organization:o`), not as a
+ * userset (`organization:o#member`): the rows an object principal itself
+ * holds. A userset row grants the object's members, never the object.
+ */
+function isDirectGrant(row) {
+    return (row.spec?.principal?.relation ?? "") === "";
+}
 /** The key a tuple is served under: its object and relation. */
 function pairKey(object, relation) {
     return `${formatObjectRef(object)}#${relation}`;
@@ -245,6 +267,40 @@ function indexByPair(tuples) {
     }
     return index;
 }
+/** Whether the pair is an organization's `affiliated`, which only the person's rows carry. */
+function isAffiliation(object, relation) {
+    return object.type === ORGANIZATION_TYPE && relation === AFFILIATED_RELATION;
+}
+/**
+ * A row of the person's as the tuples it stands for: the tuple it records,
+ * and, for a role on an organization, the organization's `affiliated`
+ * tuple. `affiliated` is stored in the model so its bound costs one read
+ * (fga/model/tenancy/organization.fga); it stands exactly while the person
+ * holds a row on the organization, and this edition derives it from those
+ * rows here, in the same one read, where an edition that stores tuples
+ * writes it from the grant path's affiliation announcements. A row that
+ * names a userset (a team's members) is not the person's role and stands
+ * for no affiliation.
+ */
+function tuplesOfPersonRow(row) {
+    const recorded = tupleOfRow(row);
+    const principal = row.spec?.principal;
+    if (recorded.object.type !== ORGANIZATION_TYPE ||
+        recorded.object.id === "" ||
+        principal === undefined ||
+        principal.kind !== ACCOUNT_TYPE ||
+        principal.relation !== "") {
+        return [recorded];
+    }
+    return [
+        recorded,
+        {
+            object: recorded.object,
+            relation: AFFILIATED_RELATION,
+            subject: account(principal.id),
+        },
+    ];
+}
 /** An IamPolicy row as the tuple it records: `resource#relation@principal`. */
 function tupleOfRow(row) {
     const spec = row.spec;

package/dist/authorization/derived-tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAqFA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,4HAA4H;AAC5H,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AACrD,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAmCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAC1D,IAAI,aAES,CAAC;IAEd,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,SAAS,eAAe;QAGtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBACxB,IACE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;wBAC/B,KAAK,CAAC,QAAQ,KAAK,oBAAoB;wBACvC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EACtB,CAAC;wBACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAC/C,CACF,CAAC;gBACF,OAAO,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,OAAO,CAAC,MAAiB,EAAE,QAAgB;IAClD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,MAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;QAClD,CAAC,CAAC;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AA6FA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAKlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,wHAAwH;AACxH,MAAM,iBAAiB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AACrE,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEzC,4HAA4H;AAC5H,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AACrD,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAsCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,SAAoB,EACpB,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAC1D,IAAI,aAES,CAAC;IAEd,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAC9B,CAAC,CAAC,IAAI,CAAC,QAAQ;qBACV,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC;qBAClD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,QAAQ;qBACV,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;qBAC3D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,SAAS,eAAe;QAGtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBACxB,IACE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;wBAC/B,KAAK,CAAC,QAAQ,KAAK,oBAAoB;wBACvC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EACtB,CAAC;wBACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAC/C,CACF,CAAC;gBACF,OAAO,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjE,+DAA+D;gBAC/D,mEAAmE;gBACnE,2BAA2B;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,IAAuE,EACvE,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAc;IACnC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,gEAAgE;AAChE,SAAS,OAAO,CAAC,MAAiB,EAAE,QAAgB;IAClD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,MAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,MAAiB,EAAE,QAAgB;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,QAAQ,KAAK,mBAAmB,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,GAAc;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;IACtC,IACE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QACzB,SAAS,KAAK,SAAS;QACvB,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,QAAQ,KAAK,EAAE,EACzB,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IACD,OAAO;QACL,QAAQ;QACR;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;QAClD,CAAC,CAAC;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}

package/dist/authorization/evaluator.d.ts

@@ -1,10 +1,13 @@
 /**
  * The evaluator — OpenFGA's check, over the built-in model and a tuple
  * source, small because the model uses five rewrite forms and nothing
- * else (model/rewrite.ts). `checkRelation(object, relation, person)`
- * answers "does this person hold this relation on this object" the way
- * the cloud's engine answers it over stored tuples, so the two editions
- * share one meaning of authorization. There is no context parameter: the
+ * else (model/rewrite.ts). `checkRelation(object, relation, principal)`
+ * answers "does this person (or this object) hold this relation on this
+ * object" the way the cloud's engine answers it over stored tuples, so the
+ * two editions share one meaning of authorization. The principal is
+ * almost always a person; an object principal (an organization) is how a
+ * unit asks the structural questions the cloud asks its engine, such as
+ * whether a resource belongs to an organization. There is no context parameter: the
  * model declares no condition, so a check has no posture to state.
  *
  * The walk, in the order a `.fga` line reads:
@@ -12,7 +15,8 @@
  *     its subject's TYPE is in the line's restriction list — the check
  *     OpenFGA makes at write time, made here at read time, so a derived
  *     tuple the model no longer admits denies instead of allowing. An
- *     object subject matches when it names one of the person's aliases;
+ *     object subject matches a person when it is an account naming one of
+ *     their aliases, and an object principal when it is that very object;
  *     a userset subject is resolved on its own object.
  *   - `computed`: the same object, another relation.
  *   - `from`: every object the tupleset relation links to (again within
@@ -45,7 +49,7 @@
  * denial.
  */
 import type { Model } from "./model/index.js";
-import type { ObjectRef, Person, TupleSource } from "./tuples.js";
+import type { ObjectRef, Principal, TupleSource } from "./tuples.js";
 /**
  * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
  * the bound here is the oracle's own and not a number chosen locally. The
@@ -69,5 +73,5 @@ export interface EvaluationDeps {
     readonly model: Model;
     readonly source: TupleSource;
 }
-export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person): Promise<boolean>;
+export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, principal: Principal): Promise<boolean>;
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/authorization/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAG9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/authorization/evaluator.js

@@ -1,4 +1,4 @@
-import { ACCOUNT_TYPE, formatObjectRef, pairKey } from "./tuples.js";
+import { ACCOUNT_TYPE, formatObjectRef, isPerson, pairKey } from "./tuples.js";
 /**
  * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
  * the bound here is the oracle's own and not a number chosen locally. The
@@ -16,21 +16,21 @@ export class AuthorizationEvaluationError extends Error {
         this.reason = reason;
     }
 }
-export async function checkRelation(deps, object, relation, person) {
+export async function checkRelation(deps, object, relation, principal) {
     if (deps.model.byType(object.type) === undefined) {
         throw new AuthorizationEvaluationError("undeclared-target-kind", `no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);
     }
-    return new Walk(deps, person).resolve(object, relation, 0);
+    return new Walk(deps, principal).resolve(object, relation, 0);
 }
 /** One check's state: the memo and the in-progress set, over one source. */
 class Walk {
     deps;
-    person;
+    principal;
     memo = new Map();
     inProgress = new Set();
-    constructor(deps, person) {
+    constructor(deps, principal) {
         this.deps = deps;
-        this.person = person;
+        this.principal = principal;
     }
     resolve(object, relation, depth) {
         const key = pairKey(object, relation);
@@ -101,13 +101,11 @@ class Walk {
             }
         }
     }
-    /** Whether one direct tuple's subject reaches the person, within the line's type restriction. */
+    /** Whether one direct tuple's subject reaches the principal, within the line's type restriction. */
     async subjectHolds(subject, restriction, depth) {
         switch (subject.form) {
             case "object":
-                return (subject.object.type === ACCOUNT_TYPE &&
-                    restriction.some((allowed) => allowed.form === "object" && allowed.type === ACCOUNT_TYPE) &&
-                    this.person.aliases.has(subject.object.id));
+                return (restriction.some((allowed) => allowed.form === "object" && allowed.type === subject.object.type) && this.isPrincipal(subject.object));
             case "userset":
                 return (restriction.some((allowed) => allowed.form === "userset" &&
                     allowed.type === subject.object.type &&
@@ -118,6 +116,14 @@ class Walk {
             }
         }
     }
+    /** Whether an object subject names the principal: one of a person's aliases on an account, or the object principal itself. */
+    isPrincipal(object) {
+        if (isPerson(this.principal)) {
+            return (object.type === ACCOUNT_TYPE && this.principal.aliases.has(object.id));
+        }
+        return (object.type === this.principal.object.type &&
+            object.id === this.principal.object.id);
+    }
     /** The object types the tupleset line admits — `[organization]`, `[session]` — from its `this` nodes. */
     objectTypesOf(object, tupleset) {
         const rewrite = this.deps.model

package/dist/authorization/evaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAYvC,oGAAoG;AACpG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAAkB;IAEjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAoB,EACpB,MAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,MAAM,CAAC,IAAI,aAAa,eAAe,CAAC,MAAM,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI;IAKW;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,YACmB,IAAoB,EACpB,MAAc;QADd,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,OAAO,CACL,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,EAClB,IAAI,GAAG,4DAA4D,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,EAC3B,cAAc,GAAG,cAAc,oBAAoB,OAAO,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAgB,EAChB,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;wBAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACvC,CAAC,MAAM,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,EAChB,KAAK,GAAG,CAAC,CACV,CAAC,EACF,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACzD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC5D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,YAAY,CACxB,OAAgB,EAChB,WAAuC,EACvC,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,CACL,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACpC,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAC7D;oBACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;oBACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CACvE,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,yGAAyG;IACjG,aAAa,CACnB,MAAiB,EACjB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACpB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAYvC,oGAAoG;AACpG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAAkB;IAEjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAoB,EACpB,MAAiB,EACjB,QAAgB,EAChB,SAAoB;IAEpB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,MAAM,CAAC,IAAI,aAAa,eAAe,CAAC,MAAM,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI;IAKW;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,YACmB,IAAoB,EACpB,SAAoB;QADpB,SAAI,GAAJ,IAAI,CAAgB;QACpB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,OAAO,CACL,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,EAClB,IAAI,GAAG,4DAA4D,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,EAC3B,cAAc,GAAG,cAAc,oBAAoB,OAAO,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAgB,EAChB,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;wBAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACvC,CAAC,MAAM,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,EAChB,KAAK,GAAG,CAAC,CACV,CAAC,EACF,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACzD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC5D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,YAAY,CACxB,OAAgB,EAChB,WAAuC,EACvC,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CACpE,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CACtC,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;oBACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CACvE,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,8HAA8H;IACtH,WAAW,CAAC,MAAiB;QACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;YAC1C,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,aAAa,CACnB,MAAiB,EACjB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACpB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/authorization/list-read-scope.d.ts

@@ -1,5 +1,7 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { Logger } from "../boot/logger.js";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
 import type { ListReadScope } from "../extensions/list-read-scope.js";
 import type { Store } from "../store/interface.js";
 import type { Model } from "./model/index.js";
@@ -11,6 +13,8 @@ export interface BuiltInListReadScopeDeps {
     /** The account port: the caller's account, and the parent hops that land on one. */
     readonly accounts: AccountsByCaller;
     readonly logger: Logger;
+    /** The readers of the kinds units keep themselves (`drivers.resourceRowReaders`), handed to every tuple source. */
+    readonly rowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
     /** The declarations to evaluate; the built-in model unless a test says otherwise. */
     readonly model?: Model;
 }

package/dist/authorization/list-read-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAqEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAKnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAUpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,aAAa,CA8Hf"}
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAmEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAKnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAUpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mHAAmH;IACnH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,aAAa,CA+Hf"}

package/dist/authorization/list-read-scope.js

@@ -85,6 +85,7 @@ export function newBuiltInListReadScope(deps) {
             store: deps.store,
             policies: deps.policies,
             accounts: deps.accounts,
+            rowReaders: deps.rowReaders,
             model,
         }, person, { facts: candidates });
         const type = kindEnumName(kind);

package/dist/authorization/list-read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAYhD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,UAAU,CAAC;AAgBjC,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,gGAAgG;IAChG,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAqB,EACrB,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAW,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;SACN,EACD,MAAM,EACN,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,aAAa,EACb,MAAM,CACP,CAAC;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACnD,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,eAAe,CAAC,IAAqB;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACxH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,SAAS,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACrG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,UAAU,CAAC,WAAgC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,MAAsB,EACtB,IAAqB,EACrB,OAAqC;YAErC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,MAAsB,EACtB,IAAqB;YAErB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAahD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,UAAU,CAAC;AAkBjC,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,gGAAgG;IAChG,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAqB,EACrB,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAW,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK;SACN,EACD,MAAM,EACN,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,aAAa,EACb,MAAM,CACP,CAAC;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACnD,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,eAAe,CAAC,IAAqB;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACxH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,SAAS,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACrG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,UAAU,CAAC,WAAgC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,MAAsB,EACtB,IAAqB,EACrB,OAAqC;YAErC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,MAAsB,EACtB,IAAqB;YAErB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}