@stonecrop/casl-middleware 0.30.0 → 0.32.0

package/dist/src/middleware/introspection.js

@@ -1,169 +0,0 @@
-import { GraphQLError } from 'graphql';
-/**
- * Middleware to restrict GraphQL introspection based on user permissions
- */
-export const createIntrospectionMiddleware = (config = {}) => {
-    const { enabled = process.env.NODE_ENV !== 'production', allowedRoles, allowAnonymous = false, customCheck, typePermissions = {}, fieldPermissions = {}, } = config;
-    return async (resolve, root, args, context, info) => {
-        // Check if this is an introspection query
-        const isIntrospection = info.fieldName === '__schema' ||
-            info.fieldName === '__type' ||
-            info.parentType?.name === '__Schema' ||
-            info.parentType?.name === '__Type';
-        if (!isIntrospection) {
-            // Not an introspection query, continue normally
-            return resolve(root, args, context, info);
-        }
-        // Check if introspection is enabled
-        if (!enabled) {
-            throw new GraphQLError('Introspection is disabled');
-        }
-        // Custom check function
-        if (customCheck) {
-            const allowed = await customCheck(context);
-            if (!allowed) {
-                throw new GraphQLError('Introspection not allowed');
-            }
-        }
-        // Check authentication
-        if (!context.user && !allowAnonymous) {
-            throw new GraphQLError('Authentication required for introspection');
-        }
-        // Check role-based access
-        if (allowedRoles && allowedRoles.length > 0) {
-            const userRoles = context.user?.roles || [];
-            const hasAllowedRole = allowedRoles.some(role => userRoles.includes(role));
-            if (!hasAllowedRole) {
-                throw new GraphQLError('Insufficient permissions for introspection');
-            }
-        }
-        // Check CASL-based permissions
-        if (context.ability) {
-            // Check if user can read schema
-            if (!context.ability.can('read', '__Schema')) {
-                throw new GraphQLError('Permission denied for schema introspection');
-            }
-        }
-        // Get the result
-        let result = await resolve(root, args, context, info);
-        // Filter the result based on permissions
-        if (result && (typePermissions || fieldPermissions)) {
-            result = filterIntrospectionResult(result, context, {
-                typePermissions,
-                fieldPermissions,
-            });
-        }
-        return result;
-    };
-};
-/**
- * Filter introspection results based on user permissions
- */
-function filterIntrospectionResult(result, context, config) {
-    if (!context.ability)
-        return result;
-    // Filter __schema result
-    if (result && result.types) {
-        result.types = result.types.filter((type) => {
-            // Check if user has permission to see this type
-            const permission = config.typePermissions?.[type.name];
-            if (permission) {
-                return context.ability.can(permission.action, permission.subject);
-            }
-            return true; // Show types without specific permissions
-        });
-        // Filter fields within types
-        result.types.forEach((type) => {
-            if (type.fields) {
-                type.fields = type.fields.filter((field) => {
-                    const fieldKey = `${type.name}.${field.name}`;
-                    const permission = config.fieldPermissions?.[fieldKey];
-                    if (permission) {
-                        return context.ability.can(permission.action, permission.subject);
-                    }
-                    return true;
-                });
-            }
-        });
-    }
-    // Filter __type result
-    if (result && result.fields) {
-        const typeName = result.name;
-        result.fields = result.fields.filter((field) => {
-            const fieldKey = `${typeName}.${field.name}`;
-            const permission = config.fieldPermissions?.[fieldKey];
-            if (permission) {
-                return context.ability.can(permission.action, permission.subject);
-            }
-            return true;
-        });
-    }
-    return result;
-}
-/**
- * Postgraphile plugin for introspection control
- */
-export const createPostgraphileIntrospectionPlugin = (config) => {
-    return {
-        name: 'IntrospectionControlPlugin',
-        version: '1.0.0',
-        // Disable introspection in GraphiQL based on config
-        grafast: {
-            hooks: {
-                GraphQLSchema(schema) {
-                    if (!config.enabled) {
-                        // Remove introspection from schema
-                        // This is a simplified approach - real implementation would be more complex
-                        console.warn('Introspection control in Postgraphile requires custom implementation');
-                    }
-                    return schema;
-                },
-            },
-        },
-    };
-};
-/**
- * Utility to create ability rules for introspection
- */
-export const createIntrospectionAbilityRules = (user) => {
-    const rules = [];
-    if (!user) {
-        // Anonymous users cannot introspect
-        return rules;
-    }
-    const roles = user.roles || [];
-    // Admins can introspect everything
-    if (roles.includes('admin')) {
-        rules.push({ action: 'read', subject: '__Schema' });
-        rules.push({ action: 'read', subject: '__Type' });
-        return rules;
-    }
-    // Developers can introspect
-    if (roles.includes('developer')) {
-        rules.push({ action: 'read', subject: '__Schema' });
-        rules.push({ action: 'read', subject: '__Type' });
-        return rules;
-    }
-    // Regular users get limited introspection
-    if (roles.includes('user')) {
-        // They can see the schema but not all types
-        rules.push({ action: 'read', subject: '__Schema' });
-        // Specific types they can see would be added here
-    }
-    return rules;
-};
-/**
- * Example: Combine introspection with CASL middleware
- */
-export const createSecureGraphQLMiddleware = (options) => {
-    const middlewares = [];
-    // Add introspection control
-    if (options.introspection) {
-        middlewares.push(createIntrospectionMiddleware(options.introspection));
-    }
-    // Combine all middlewares
-    return (resolve, root, args, context, info) => {
-        const chain = middlewares.reduceRight((next, middleware) => () => middleware(next, root, args, context, info), () => resolve(root, args, context, info));
-        return chain();
-    };
-};

package/dist/src/middleware/jwt.d.ts

@@ -1,114 +0,0 @@
-import jwt from 'jsonwebtoken';
-import type { Context, User } from '../types';
-export interface JWTConfig {
-    enabled?: boolean;
-    secret?: string;
-    publicKey?: string;
-    algorithms?: jwt.Algorithm[];
-    issuer?: string;
-    audience?: string;
-    extractUser?: (payload: any) => User | undefined;
-    headerName?: string;
-    tokenPrefix?: string;
-    optional?: boolean;
-    maxAge?: string;
-}
-export interface JWTPayload extends jwt.JwtPayload {
-    sub?: string;
-    roles?: string[];
-    permissions?: Array<{
-        action: string;
-        subject: string;
-        conditions?: any;
-    }>;
-    [key: string]: any;
-}
-/**
- * JWT middleware factory for GraphQL servers
- *
- * @example
- * ```typescript
- * // In Nuxt Yoga
- * export default defineNuxtConfig({
- *   yoga: {
- *     middleware: [
- *       createJWTMiddleware({
- *         enabled: true,
- *         secret: process.env.JWT_SECRET,
- *         optional: true // Don't fail if no token
- *       })
- *     ]
- *   }
- * })
- *
- * // In Postgraphile
- * const jwtPlugin = createPostgraphileJWTPlugin({
- *   secret: process.env.JWT_SECRET,
- *   extractUser: (payload) => ({
- *     id: payload.user_id,
- *     roles: payload.user_roles
- *   })
- * })
- * ```
- */
-export declare const createJWTMiddleware: (config?: JWTConfig) => (context: Context, next: () => Promise<any>) => Promise<any>;
-/**
- * Create a JWT token with user data
- */
-export declare const createJWT: (user: User, config: {
-    secret: string;
-    expiresIn?: jwt.SignOptions["expiresIn"];
-    issuer?: string;
-    audience?: string;
-    additionalClaims?: Record<string, any>;
-}) => string;
-/**
- * Integration with CASL ability builder
- */
-export declare const createJWTAbilityBuilder: (_config?: JWTConfig) => (user?: User) => Promise<import("./ability").AppAbility>;
-/**
- * Postgraphile-specific JWT plugin
- */
-export declare const createPostgraphileJWTPlugin: (config: JWTConfig) => {
-    name: string;
-    version: string;
-    grafast: {
-        hooks: {
-            context(ctx: any, _build: any): Promise<any>;
-        };
-    };
-};
-/**
- * Express/Koa middleware for REST endpoints
- */
-export declare const createHTTPJWTMiddleware: (config: JWTConfig) => (req: any, res: any, next: any) => Promise<void>;
-/**
- * Refresh token utilities
- */
-export declare const refreshTokenUtils: {
-    /**
-     * Create access and refresh tokens
-     */
-    createTokenPair: (user: User, config: {
-        accessSecret: string;
-        refreshSecret: string;
-        accessExpiresIn?: jwt.SignOptions["expiresIn"];
-        refreshExpiresIn?: jwt.SignOptions["expiresIn"];
-    }) => {
-        accessToken: string;
-        refreshToken: string;
-    };
-    /**
-     * Verify refresh token and create new access token
-     */
-    refreshAccessToken: (refreshToken: string, config: {
-        accessSecret: string;
-        refreshSecret: string;
-        getUserById: (id: string) => Promise<User | null>;
-        accessExpiresIn?: jwt.SignOptions["expiresIn"];
-    }) => Promise<{
-        accessToken: string;
-        user: User;
-    }>;
-};
-//# sourceMappingURL=jwt.d.ts.map

package/dist/src/middleware/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG7C,MAAM,WAAW,SAAS;IACzB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,SAAS,CAAA;IAChD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG,CAAC,UAAU;IACjD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,CAAC,EAAE,KAAK,CAAC;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,GAAG,CAAA;KAChB,CAAC,CAAA;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAQ,SAAc,MAoB3C,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,iBAwExD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,GACrB,MAAM,IAAI,EACV,QAAQ;IACP,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACtC,KACC,MAiBF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAS,SAAc,MAChD,OAAO,IAAI,4CAsBzB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,SAAS;;;;;yBAQtC,GAAG,UAAU,GAAG;;;CAwBtC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,SAAS,MAI1C,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,kBA4B3C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;4BAEI,IAAI,UACF;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAC9C,gBAAgB,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;KAC/C;;;;IAkCF;;OAEG;uCAEY,MAAM,UACZ;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;QACjD,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;KAC9C;;;;CAgDF,CAAA"}

package/dist/src/middleware/jwt.js

@@ -1,302 +0,0 @@
-import jwt from 'jsonwebtoken';
-import { AbilityBuilder, PureAbility } from '@casl/ability';
-import { defaultAbilityBuilder } from './ability';
-/**
- * Default user extractor from JWT payload
- */
-const defaultUserExtractor = (payload) => {
-    if (!payload.sub)
-        return undefined;
-    return {
-        id: payload.sub,
-        roles: payload.roles || [],
-        ...payload, // Include any additional claims
-    };
-};
-/**
- * JWT middleware factory for GraphQL servers
- *
- * @example
- * ```typescript
- * // In Nuxt Yoga
- * export default defineNuxtConfig({
- *   yoga: {
- *     middleware: [
- *       createJWTMiddleware({
- *         enabled: true,
- *         secret: process.env.JWT_SECRET,
- *         optional: true // Don't fail if no token
- *       })
- *     ]
- *   }
- * })
- *
- * // In Postgraphile
- * const jwtPlugin = createPostgraphileJWTPlugin({
- *   secret: process.env.JWT_SECRET,
- *   extractUser: (payload) => ({
- *     id: payload.user_id,
- *     roles: payload.user_roles
- *   })
- * })
- * ```
- */
-export const createJWTMiddleware = (config = {}) => {
-    const { enabled = true, secret, publicKey, algorithms = ['HS256'], issuer, audience, headerName = 'authorization', tokenPrefix = 'Bearer ', optional = false, extractUser = defaultUserExtractor, maxAge, } = config;
-    // Validate configuration
-    if (enabled && !secret && !publicKey) {
-        throw new Error('JWT middleware requires either secret or publicKey');
-    }
-    return async (context, next) => {
-        // Skip if JWT is disabled
-        if (!enabled) {
-            return next();
-        }
-        try {
-            // Extract token from request headers
-            const authHeader = context.req?.headers?.get?.(headerName) ||
-                context.request?.headers?.get?.(headerName) ||
-                context.headers?.[headerName];
-            if (!authHeader) {
-                if (optional) {
-                    return next();
-                }
-                throw new Error('No authorization header found');
-            }
-            // Remove token prefix
-            const token = authHeader.startsWith(tokenPrefix) ? authHeader.slice(tokenPrefix.length) : authHeader;
-            // Prepare verification options
-            const verifyOptions = {
-                algorithms,
-                ...(issuer && { issuer }),
-                ...(audience && { audience }),
-                ...(maxAge && { maxAge }),
-            };
-            // Verify and decode token
-            const secretOrPublicKey = publicKey || secret;
-            const decoded = jwt.verify(token, secretOrPublicKey, verifyOptions);
-            if (typeof decoded === 'string' || decoded == null) {
-                throw new Error('Invalid JWT payload: expected object');
-            }
-            const payload = decoded;
-            // Extract user from payload
-            const user = extractUser(payload);
-            if (user) {
-                context.user = user;
-                // Store the raw payload for potential use
-                context.jwtPayload = payload;
-            }
-            // Continue to next middleware
-            return next();
-        }
-        catch (error) {
-            if (optional) {
-                // Log error in development
-                if (process.env.NODE_ENV === 'development') {
-                    console.warn('JWT verification failed (optional):', error.message);
-                }
-                // Continue without user if optional
-                return next();
-            }
-            // Re-throw with more specific error messages
-            if (error.name === 'TokenExpiredError') {
-                throw new Error('Token has expired', { cause: error });
-            }
-            else if (error.name === 'JsonWebTokenError') {
-                throw new Error('Invalid token', { cause: error });
-            }
-            else if (error.name === 'NotBeforeError') {
-                throw new Error('Token not active yet', { cause: error });
-            }
-            throw error;
-        }
-    };
-};
-/**
- * Create a JWT token with user data
- */
-export const createJWT = (user, config) => {
-    const { secret, expiresIn = '1h', issuer, audience, additionalClaims = {} } = config;
-    const payload = {
-        sub: user.id,
-        roles: user.roles || [],
-        ...additionalClaims,
-    };
-    const signOptions = {};
-    // Add optional fields only if they exist
-    if (issuer !== undefined)
-        signOptions.issuer = issuer;
-    if (audience !== undefined)
-        signOptions.audience = audience;
-    if (expiresIn !== undefined)
-        signOptions.expiresIn = expiresIn;
-    return jwt.sign(payload, secret, signOptions);
-};
-/**
- * Integration with CASL ability builder
- */
-export const createJWTAbilityBuilder = (_config = {}) => {
-    return async (user) => {
-        // If user has direct permissions in JWT, use those
-        const jwtPermissions = user?.permissions;
-        if (jwtPermissions && Array.isArray(jwtPermissions)) {
-            // Build ability from JWT permissions
-            const { can, cannot, build } = new AbilityBuilder(PureAbility);
-            jwtPermissions.forEach((permission) => {
-                if (permission.inverted) {
-                    cannot(permission.action, permission.subject, permission.conditions);
-                }
-                else {
-                    can(permission.action, permission.subject, permission.conditions);
-                }
-            });
-            return build();
-        }
-        // Fall back to role-based abilities
-        return defaultAbilityBuilder(user);
-    };
-};
-/**
- * Postgraphile-specific JWT plugin
- */
-export const createPostgraphileJWTPlugin = (config) => {
-    return {
-        name: 'JWTAuthPlugin',
-        version: '1.0.0',
-        // Hook into Postgraphile's context building
-        grafast: {
-            hooks: {
-                async context(ctx, _build) {
-                    const middleware = createJWTMiddleware(config);
-                    // Create a simple context object that the middleware can work with
-                    const context = {
-                        req: ctx.req,
-                        headers: ctx.req?.headers,
-                        user: undefined,
-                        jwtPayload: undefined,
-                    };
-                    // Run the JWT middleware
-                    await middleware(context, async () => { });
-                    // Add user to Postgraphile context
-                    if (context.user) {
-                        return { ...ctx, user: context.user, jwtPayload: context.jwtPayload };
-                    }
-                    return ctx;
-                },
-            },
-        },
-    };
-};
-/**
- * Express/Koa middleware for REST endpoints
- */
-export const createHTTPJWTMiddleware = (config) => {
-    const jwtMiddleware = createJWTMiddleware(config);
-    // Express middleware
-    return async (req, res, next) => {
-        const context = {
-            req: {
-                headers: {
-                    get: (name) => req.headers[name],
-                },
-            },
-            headers: req.headers,
-            user: undefined,
-            jwtPayload: undefined,
-        };
-        try {
-            await jwtMiddleware(context, async () => { });
-            req.user = context.user;
-            req.jwtPayload = context.jwtPayload;
-            next();
-        }
-        catch (error) {
-            if (config.optional) {
-                next();
-            }
-            else {
-                res.status(401).json({
-                    error: error.message,
-                    code: 'UNAUTHORIZED',
-                });
-            }
-        }
-    };
-};
-/**
- * Refresh token utilities
- */
-export const refreshTokenUtils = {
-    /**
-     * Create access and refresh tokens
-     */
-    createTokenPair: (user, config) => {
-        const { accessSecret, refreshSecret, accessExpiresIn = '15m', refreshExpiresIn = '7d' } = config;
-        const accessPayload = {
-            sub: user.id,
-            roles: user.roles,
-            type: 'access',
-        };
-        const refreshPayload = {
-            sub: user.id,
-            type: 'refresh',
-        };
-        // Create access token with proper options
-        const accessOptions = {};
-        if (accessExpiresIn) {
-            accessOptions.expiresIn = accessExpiresIn;
-        }
-        const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
-        // Create refresh token with proper options
-        const refreshOptions = {};
-        if (refreshExpiresIn) {
-            refreshOptions.expiresIn = refreshExpiresIn;
-        }
-        const refreshToken = jwt.sign(refreshPayload, refreshSecret, refreshOptions);
-        return { accessToken, refreshToken };
-    },
-    /**
-     * Verify refresh token and create new access token
-     */
-    refreshAccessToken: async (refreshToken, config) => {
-        const { accessSecret, refreshSecret, getUserById, accessExpiresIn = '15m' } = config;
-        try {
-            // Verify refresh token
-            const decoded = jwt.verify(refreshToken, refreshSecret);
-            if (typeof decoded === 'string' || decoded == null) {
-                throw new Error('Invalid refresh token payload: expected object');
-            }
-            const payload = decoded;
-            if (payload.type !== 'refresh') {
-                throw new Error('Invalid token type');
-            }
-            // Get fresh user data
-            if (!payload.sub) {
-                throw new Error('Invalid refresh token payload: missing subject');
-            }
-            const user = await getUserById(payload.sub);
-            if (!user) {
-                throw new Error('User not found');
-            }
-            // Create new access token
-            const accessPayload = {
-                sub: user.id,
-                roles: user.roles,
-                type: 'access',
-            };
-            // Create access token with proper options
-            const accessOptions = {};
-            if (accessExpiresIn) {
-                accessOptions.expiresIn = accessExpiresIn;
-            }
-            const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
-            return { accessToken, user };
-        }
-        catch (error) {
-            if (error.name === 'TokenExpiredError') {
-                throw new Error('Refresh token expired', { cause: error });
-            }
-            throw error;
-        }
-    },
-};

package/dist/src/middleware/postgraphile.d.ts

@@ -1,7 +0,0 @@
-import { GraphileConfig } from 'postgraphile/graphile-build';
-/**
- * PostGraphile plugin for CASL authorization
- * @public
- */
-export declare const pglCaslPlugin: GraphileConfig.Plugin;
-//# sourceMappingURL=postgraphile.d.ts.map

package/dist/src/middleware/postgraphile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"postgraphile.d.ts","sourceRoot":"","sources":["../../../src/middleware/postgraphile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAI5D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,cAAc,CAAC,MA8EzC,CAAA"}

package/dist/src/middleware/postgraphile.js

@@ -1,79 +0,0 @@
-import { extendSchema, gql } from 'postgraphile/utils';
-import { createAbility } from './ability';
-/**
- * PostGraphile plugin for CASL authorization
- * @public
- */
-export const pglCaslPlugin = extendSchema(build => {
-    const { grafast: { constant, object, sideEffect }, } = build;
-    return {
-        typeDefs: gql `
-			input CreateAbilityInput {
-				userId: String!
-				roles: [String!]
-			}
-
-			type AbilityResponse {
-				success: Boolean!
-				ability: JSON
-				message: String
-			}
-
-			type SecretData {
-				id: String!
-				content: String!
-			}
-
-			extend type Query {
-				getSecretData: SecretData
-			}
-
-			extend type Mutation {
-				createAbility(input: CreateAbilityInput!): AbilityResponse!
-			}
-		`,
-        objects: {
-            Query: {
-                plans: {
-                    async getSecretData() {
-                        // TODO: This should be protected by CASL
-                        // const $ability = context<Context>().get('ability')
-                        // if (!$ability.can('read', 'SecretData')) {
-                        // 	throw new Error('Access denied')
-                        // }
-                        return object({
-                            id: constant('123'),
-                            content: constant('This is protected content'),
-                        });
-                    },
-                },
-            },
-            Mutation: {
-                plans: {
-                    async createAbility(_plan, fieldArgs) {
-                        const $userId = fieldArgs.getRaw().input.userId;
-                        const $roles = fieldArgs.getRaw().input.roles;
-                        return sideEffect([$userId, $roles], async ([userId, roles]) => {
-                            // Make this async
-                            try {
-                                const ability = await createAbility({ id: userId, roles }); // Await here
-                                return {
-                                    success: true,
-                                    ability: ability.rules,
-                                    message: 'Ability created successfully',
-                                };
-                            }
-                            catch (error) {
-                                return {
-                                    success: false,
-                                    ability: null,
-                                    message: error instanceof Error ? error.message : 'Unknown error occurred',
-                                };
-                            }
-                        });
-                    },
-                },
-            },
-        },
-    };
-});

package/dist/src/middleware/yoga.d.ts

@@ -1,15 +0,0 @@
-import type { Plugin } from 'graphql-yoga';
-import type { Context, MiddlewareOptions } from '../types';
-export declare const yogaCaslPlugin: Plugin<Context>;
-/**
- * Create a GraphQL Yoga plugin for CASL authorization
- * Note: This is a placeholder for future implementation
- *
- * @param options - CASL middleware configuration options
- * @returns Yoga plugin
- * @public
- */
-export declare const createYogaPlugin: (_options?: MiddlewareOptions) => {
-    onExecute: (_: any) => Promise<void>;
-};
-//# sourceMappingURL=yoga.d.ts.map