@veap/auth 0.0.0-stage → 0.1.1

package/dist/rbac/contracts.d.ts

@@ -0,0 +1,75 @@
+import type { UserPermission, UserRole } from "../common/index.js";
+export type { UserPermission, UserRole };
+/** A role as persisted (already mapped to a plain object). */
+export interface RoleRecord {
+    id: string;
+    name: string;
+    description?: string | null;
+    [key: string]: any;
+}
+/** Minimal `{ id, name }` reference used by RBAC read models. */
+export interface AccessGrant {
+    id: string;
+    name: string;
+}
+/**
+ * The roles and permissions graph of a single user, as loaded from the
+ * persistence layer.
+ */
+export interface UserAccess {
+    roles: Array<AccessGrant & {
+        permissions: AccessGrant[];
+    }>;
+    directPermissions: AccessGrant[];
+}
+export interface CreateRoleRecord {
+    name: string;
+    description?: string;
+}
+/**
+ * Role persistence port.
+ */
+export interface IRoleRepository {
+    findAll(): Promise<RoleRecord[]>;
+    findById(id: string): Promise<RoleRecord | undefined>;
+    findByName(name: string): Promise<RoleRecord | null>;
+    create(record: CreateRoleRecord): Promise<RoleRecord>;
+    remove(id: string): Promise<void>;
+    /** Permissions granted to a role. */
+    getPermissions(roleId: string): Promise<AccessGrant[]>;
+    /**
+     * Loads the full role/permission graph for a user.
+     * Returns `null` when the user does not exist.
+     */
+    loadUserAccess(userId: string): Promise<UserAccess | null>;
+    assignToUser(userId: string, roleId: string): Promise<void>;
+    revokeFromUser(userId: string, roleId: string): Promise<void>;
+}
+/** Injection token for the role repository port. */
+export declare const ROLE_REPOSITORY: unique symbol;
+/** A permission as persisted (already mapped to a plain object). */
+export interface PermissionRecord {
+    id: string;
+    name: string;
+    description?: string | null;
+    [key: string]: any;
+}
+export interface CreatePermissionRecord {
+    name: string;
+    description?: string;
+}
+/**
+ * Permission persistence port.
+ */
+export interface IPermissionRepository {
+    findAll(): Promise<PermissionRecord[]>;
+    findById(id: string): Promise<PermissionRecord | undefined>;
+    create(record: CreatePermissionRecord): Promise<PermissionRecord>;
+    remove(id: string): Promise<void>;
+    assignToRole(roleId: string, permissionId: string): Promise<void>;
+    revokeFromRole(roleId: string, permissionId: string): Promise<void>;
+    assignToUser(userId: string, permissionId: string): Promise<void>;
+    revokeFromUser(userId: string, permissionId: string): Promise<void>;
+}
+/** Injection token for the permission repository port. */
+export declare const PERMISSION_REPOSITORY: unique symbol;

package/dist/rbac/contracts.js

@@ -0,0 +1,4 @@
+/** Injection token for the role repository port. */
+export const ROLE_REPOSITORY = Symbol.for("veap:auth:role-repository");
+/** Injection token for the permission repository port. */
+export const PERMISSION_REPOSITORY = Symbol.for("veap:auth:permission-repository");

package/dist/rbac/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./contracts.js";
+export * from "./rbac.facade.js";
+export * from "./rbac.repository.js";
+export * from "./rbac.service.js";

package/dist/rbac/index.js

@@ -0,0 +1,4 @@
+export * from "./contracts.js";
+export * from "./rbac.facade.js";
+export * from "./rbac.repository.js";
+export * from "./rbac.service.js";

package/dist/rbac/rbac.facade.d.ts

@@ -0,0 +1,23 @@
+export declare function getRoles(): Promise<import("./contracts.js").RoleRecord[]>;
+export declare function getRoleById(roleId: string): Promise<import("./contracts.js").RoleRecord | undefined>;
+export declare function createRole(name: string, description?: string): Promise<import("./contracts.js").RoleRecord[]>;
+export declare function deleteRole(roleId: string): Promise<void>;
+export declare function getPermissions(): Promise<import("./contracts.js").PermissionRecord[]>;
+export declare function getPermissionById(permissionId: string): Promise<import("./contracts.js").PermissionRecord | undefined>;
+export declare function createPermission(name: string, description?: string): Promise<import("./contracts.js").PermissionRecord[]>;
+export declare function deletePermission(permissionId: string): Promise<void>;
+export declare function getRolePermissions(roleId: string): Promise<import("./contracts.js").AccessGrant[]>;
+export declare function assignPermissionToRole(roleId: string, permissionId: string): Promise<void>;
+export declare function revokePermissionFromRole(roleId: string, permissionId: string): Promise<void>;
+export declare function assignRoleToUser(userId: string, roleId: string): Promise<void>;
+export declare function revokeRoleFromUser(userId: string, roleId: string): Promise<void>;
+export declare function assignPermissionToUser(userId: string, permissionId: string): Promise<void>;
+export declare function revokePermissionFromUser(userId: string, permissionId: string): Promise<void>;
+export declare function getUserRbacData(userId: string): Promise<{
+    roles: {
+        id: string;
+        name: string;
+    }[];
+    directPermissions: import("./contracts.js").AccessGrant[];
+    effectivePermissions: import("./contracts.js").AccessGrant[];
+}>;

package/dist/rbac/rbac.facade.js

@@ -0,0 +1,85 @@
+"use server";
+import { app } from "@veap/kernel";
+import { authContext, isAuthContextBound } from "../common/context.js";
+import { RbacService } from "./rbac.service.js";
+async function resolveRbacService() {
+    const g = globalThis;
+    if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
+        try {
+            await g.__VEAP_BOOTSTRAPPING_PROMISE__;
+        }
+        catch { }
+    }
+    if (isAuthContextBound()) {
+        return authContext().rbac;
+    }
+    return await app(RbacService);
+}
+// --- Roles ---
+export async function getRoles() {
+    const service = await resolveRbacService();
+    return service.getRoles();
+}
+export async function getRoleById(roleId) {
+    const service = await resolveRbacService();
+    return service.getRoleById(roleId);
+}
+export async function createRole(name, description) {
+    const service = await resolveRbacService();
+    return service.createRole(name, description);
+}
+export async function deleteRole(roleId) {
+    const service = await resolveRbacService();
+    return service.deleteRole(roleId);
+}
+// --- Permissions ---
+export async function getPermissions() {
+    const service = await resolveRbacService();
+    return service.getPermissions();
+}
+export async function getPermissionById(permissionId) {
+    const service = await resolveRbacService();
+    return service.getPermissionById(permissionId);
+}
+export async function createPermission(name, description) {
+    const service = await resolveRbacService();
+    return service.createPermission(name, description);
+}
+export async function deletePermission(permissionId) {
+    const service = await resolveRbacService();
+    return service.deletePermission(permissionId);
+}
+// --- Mappings ---
+export async function getRolePermissions(roleId) {
+    const service = await resolveRbacService();
+    return service.getRolePermissions(roleId);
+}
+export async function assignPermissionToRole(roleId, permissionId) {
+    const service = await resolveRbacService();
+    return service.assignPermissionToRole(roleId, permissionId);
+}
+export async function revokePermissionFromRole(roleId, permissionId) {
+    const service = await resolveRbacService();
+    return service.revokePermissionFromRole(roleId, permissionId);
+}
+// --- User Assignment ---
+export async function assignRoleToUser(userId, roleId) {
+    const service = await resolveRbacService();
+    return service.assignRoleToUser(userId, roleId);
+}
+export async function revokeRoleFromUser(userId, roleId) {
+    const service = await resolveRbacService();
+    return service.revokeRoleFromUser(userId, roleId);
+}
+export async function assignPermissionToUser(userId, permissionId) {
+    const service = await resolveRbacService();
+    return service.assignPermissionToUser(userId, permissionId);
+}
+export async function revokePermissionFromUser(userId, permissionId) {
+    const service = await resolveRbacService();
+    return service.revokePermissionFromUser(userId, permissionId);
+}
+export async function getUserRbacData(userId) {
+    const service = await resolveRbacService();
+    return service.getUserRbacData(userId);
+}

package/dist/rbac/rbac.repository.d.ts

@@ -0,0 +1,30 @@
+import type { AccessGrant, CreatePermissionRecord, CreateRoleRecord, IPermissionRepository, IRoleRepository, PermissionRecord, RoleRecord, UserAccess } from "./contracts.js";
+/**
+ * `IRoleRepository` adapter backed by the `Role` ActiveRecord model and the
+ * `users_to_roles` pivot table.
+ */
+export declare class ActiveRecordRoleRepository implements IRoleRepository {
+    findAll(): Promise<RoleRecord[]>;
+    findById(id: string): Promise<RoleRecord | undefined>;
+    findByName(name: string): Promise<RoleRecord | null>;
+    create(record: CreateRoleRecord): Promise<RoleRecord>;
+    remove(id: string): Promise<void>;
+    getPermissions(roleId: string): Promise<AccessGrant[]>;
+    loadUserAccess(userId: string): Promise<UserAccess | null>;
+    assignToUser(userId: string, roleId: string): Promise<void>;
+    revokeFromUser(userId: string, roleId: string): Promise<void>;
+}
+/**
+ * `IPermissionRepository` adapter backed by the `Permission` ActiveRecord model
+ * and the `roles_to_permissions` / `users_to_permissions` pivot tables.
+ */
+export declare class ActiveRecordPermissionRepository implements IPermissionRepository {
+    findAll(): Promise<PermissionRecord[]>;
+    findById(id: string): Promise<PermissionRecord | undefined>;
+    create(record: CreatePermissionRecord): Promise<PermissionRecord>;
+    remove(id: string): Promise<void>;
+    assignToRole(roleId: string, permissionId: string): Promise<void>;
+    revokeFromRole(roleId: string, permissionId: string): Promise<void>;
+    assignToUser(userId: string, permissionId: string): Promise<void>;
+    revokeFromUser(userId: string, permissionId: string): Promise<void>;
+}

package/dist/rbac/rbac.repository.js

@@ -0,0 +1,137 @@
+import { getKnex } from "@veap/database";
+import { Permission } from "../models/Permission.js";
+import { Role } from "../models/Role.js";
+import { User } from "../models/User.js";
+/**
+ * `IRoleRepository` adapter backed by the `Role` ActiveRecord model and the
+ * `users_to_roles` pivot table.
+ */
+export class ActiveRecordRoleRepository {
+    async findAll() {
+        const roles = await Role.query().orderBy("name", "asc").get();
+        return roles.map((role) => role.toJSON());
+    }
+    async findById(id) {
+        const role = await Role.find(id);
+        return role ? role.toJSON() : undefined;
+    }
+    async findByName(name) {
+        const role = await Role.where("name", name).first();
+        return role ? role.toJSON() : null;
+    }
+    async create(record) {
+        const role = await Role.create({
+            name: record.name,
+            description: record.description,
+        });
+        return role.toJSON();
+    }
+    async remove(id) {
+        await Role.destroy(id);
+    }
+    async getPermissions(roleId) {
+        const role = await Role.find(roleId);
+        if (!role)
+            return [];
+        const permissions = await role.permissions().get();
+        return permissions.map((permission) => ({
+            id: permission.id,
+            name: permission.name,
+        }));
+    }
+    async loadUserAccess(userId) {
+        const user = await User.query()
+            .with("roles.permissions", "permissions")
+            .find(userId);
+        if (!user)
+            return null;
+        const roles = user.getRelation("roles") || [];
+        const direct = user.getRelation("permissions") || [];
+        return {
+            roles: roles.map((role) => ({
+                id: role.id,
+                name: role.name,
+                permissions: (role.getRelation("permissions") || []).map((permission) => ({
+                    id: permission.id,
+                    name: permission.name,
+                })),
+            })),
+            directPermissions: direct.map((permission) => ({
+                id: permission.id,
+                name: permission.name,
+            })),
+        };
+    }
+    async assignToUser(userId, roleId) {
+        const knex = getKnex();
+        await knex("users_to_roles")
+            .insert({ user_id: userId, role_id: roleId })
+            .onConflict(["user_id", "role_id"])
+            .ignore();
+    }
+    async revokeFromUser(userId, roleId) {
+        const knex = getKnex();
+        await knex("users_to_roles")
+            .where({
+            user_id: userId,
+            role_id: roleId,
+        })
+            .delete();
+    }
+}
+/**
+ * `IPermissionRepository` adapter backed by the `Permission` ActiveRecord model
+ * and the `roles_to_permissions` / `users_to_permissions` pivot tables.
+ */
+export class ActiveRecordPermissionRepository {
+    async findAll() {
+        const permissions = await Permission.query().orderBy("name", "asc").get();
+        return permissions.map((permission) => permission.toJSON());
+    }
+    async findById(id) {
+        const permission = await Permission.find(id);
+        return permission ? permission.toJSON() : undefined;
+    }
+    async create(record) {
+        const permission = await Permission.create({
+            name: record.name,
+            description: record.description,
+        });
+        return permission.toJSON();
+    }
+    async remove(id) {
+        await Permission.destroy(id);
+    }
+    async assignToRole(roleId, permissionId) {
+        const knex = getKnex();
+        await knex("roles_to_permissions")
+            .insert({ role_id: roleId, permission_id: permissionId })
+            .onConflict(["role_id", "permission_id"])
+            .ignore();
+    }
+    async revokeFromRole(roleId, permissionId) {
+        const knex = getKnex();
+        await knex("roles_to_permissions")
+            .where({
+            role_id: roleId,
+            permission_id: permissionId,
+        })
+            .delete();
+    }
+    async assignToUser(userId, permissionId) {
+        const knex = getKnex();
+        await knex("users_to_permissions")
+            .insert({ user_id: userId, permission_id: permissionId })
+            .onConflict(["user_id", "permission_id"])
+            .ignore();
+    }
+    async revokeFromUser(userId, permissionId) {
+        const knex = getKnex();
+        await knex("users_to_permissions")
+            .where({
+            user_id: userId,
+            permission_id: permissionId,
+        })
+            .delete();
+    }
+}

package/dist/rbac/rbac.service.d.ts

@@ -0,0 +1,35 @@
+import type { User } from "../common/index.js";
+import { type AccessGrant, type IPermissionRepository, type IRoleRepository, type PermissionRecord, type RoleRecord } from "./contracts.js";
+/**
+ * Core RBAC use cases. Persistence lives behind the role/permission
+ * repositories, so this service stays framework-free and testable.
+ */
+export declare class RbacService {
+    private readonly roles;
+    private readonly permissions;
+    constructor(roles: IRoleRepository, permissions: IPermissionRepository);
+    getRoles(): Promise<RoleRecord[]>;
+    getRoleById(roleId: string): Promise<RoleRecord | undefined>;
+    createRole(name: string, description?: string): Promise<RoleRecord[]>;
+    deleteRole(roleId: string): Promise<void>;
+    getPermissions(): Promise<PermissionRecord[]>;
+    getPermissionById(permissionId: string): Promise<PermissionRecord | undefined>;
+    createPermission(name: string, description?: string): Promise<PermissionRecord[]>;
+    deletePermission(permissionId: string): Promise<void>;
+    getRolePermissions(roleId: string): Promise<AccessGrant[]>;
+    assignPermissionToRole(roleId: string, permissionId: string): Promise<void>;
+    revokePermissionFromRole(roleId: string, permissionId: string): Promise<void>;
+    assignRoleToUser(userId: string, roleId: string): Promise<void>;
+    revokeRoleFromUser(userId: string, roleId: string): Promise<void>;
+    assignPermissionToUser(userId: string, permissionId: string): Promise<void>;
+    revokePermissionFromUser(userId: string, permissionId: string): Promise<void>;
+    getUserRbacData(userId: string): Promise<{
+        roles: {
+            id: string;
+            name: string;
+        }[];
+        directPermissions: AccessGrant[];
+        effectivePermissions: AccessGrant[];
+    }>;
+    coreRbacAugmenter(user: User): Promise<Record<string, any>>;
+}

package/dist/rbac/rbac.service.js

@@ -0,0 +1,143 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@veap/kernel";
+import { PERMISSION_REPOSITORY, ROLE_REPOSITORY, } from "./contracts.js";
+/**
+ * Core RBAC use cases. Persistence lives behind the role/permission
+ * repositories, so this service stays framework-free and testable.
+ */
+let RbacService = class RbacService {
+    roles;
+    permissions;
+    constructor(roles, permissions) {
+        this.roles = roles;
+        this.permissions = permissions;
+    }
+    async getRoles() {
+        return await this.roles.findAll();
+    }
+    async getRoleById(roleId) {
+        return await this.roles.findById(roleId);
+    }
+    async createRole(name, description) {
+        const role = await this.roles.create({ name, description });
+        return [role];
+    }
+    async deleteRole(roleId) {
+        await this.roles.remove(roleId);
+    }
+    async getPermissions() {
+        return await this.permissions.findAll();
+    }
+    async getPermissionById(permissionId) {
+        return await this.permissions.findById(permissionId);
+    }
+    async createPermission(name, description) {
+        const permission = await this.permissions.create({ name, description });
+        return [permission];
+    }
+    async deletePermission(permissionId) {
+        await this.permissions.remove(permissionId);
+    }
+    async getRolePermissions(roleId) {
+        return await this.roles.getPermissions(roleId);
+    }
+    async assignPermissionToRole(roleId, permissionId) {
+        await this.permissions.assignToRole(roleId, permissionId);
+    }
+    async revokePermissionFromRole(roleId, permissionId) {
+        await this.permissions.revokeFromRole(roleId, permissionId);
+    }
+    async assignRoleToUser(userId, roleId) {
+        await this.roles.assignToUser(userId, roleId);
+    }
+    async revokeRoleFromUser(userId, roleId) {
+        await this.roles.revokeFromUser(userId, roleId);
+    }
+    async assignPermissionToUser(userId, permissionId) {
+        await this.permissions.assignToUser(userId, permissionId);
+    }
+    async revokePermissionFromUser(userId, permissionId) {
+        await this.permissions.revokeFromUser(userId, permissionId);
+    }
+    async getUserRbacData(userId) {
+        const access = await this.roles.loadUserAccess(userId);
+        if (!access) {
+            return {
+                roles: [],
+                directPermissions: [],
+                effectivePermissions: [],
+            };
+        }
+        const roles = access.roles.map((role) => ({
+            id: role.id,
+            name: role.name,
+        }));
+        const directPermissions = access.directPermissions;
+        const effective = new Map();
+        for (const permission of directPermissions) {
+            effective.set(permission.id, permission);
+        }
+        for (const role of access.roles) {
+            for (const permission of role.permissions) {
+                effective.set(permission.id, permission);
+            }
+        }
+        return {
+            roles,
+            directPermissions,
+            effectivePermissions: Array.from(effective.values()),
+        };
+    }
+    async coreRbacAugmenter(user) {
+        const userId = user?.id;
+        if (!userId) {
+            return { roles: [], permissions: [] };
+        }
+        try {
+            const access = await this.roles.loadUserAccess(userId);
+            if (!access) {
+                return { roles: [], permissions: [] };
+            }
+            const roles = access.roles.map((role) => role.name);
+            const permissions = new Set();
+            for (const permission of access.directPermissions) {
+                if (permission.name) {
+                    permissions.add(permission.name);
+                }
+            }
+            for (const role of access.roles) {
+                for (const permission of role.permissions) {
+                    if (permission.name) {
+                        permissions.add(permission.name);
+                    }
+                }
+            }
+            return {
+                roles,
+                permissions: Array.from(permissions),
+            };
+        }
+        catch (error) {
+            console.error("[Auth:RBAC] Failed to augment user:", error);
+            return { roles: [], permissions: [] };
+        }
+    }
+};
+RbacService = __decorate([
+    Injectable(),
+    __param(0, Inject(ROLE_REPOSITORY)),
+    __param(1, Inject(PERMISSION_REPOSITORY)),
+    __metadata("design:paramtypes", [Object, Object])
+], RbacService);
+export { RbacService };

package/dist/server.d.ts

@@ -0,0 +1,3 @@
+export * from "./actions/index.js";
+export * from "./crypto/index.js";
+export * from "./index.js";

package/dist/server.js

@@ -0,0 +1,3 @@
+export * from "./actions/index.js";
+export * from "./crypto/index.js";
+export * from "./index.js";

package/dist/session/auth.service.d.ts

@@ -0,0 +1,35 @@
+import { type ICacheProvider } from "@veap/kernel";
+import type { AuthResponse, SessionFlags } from "../common/index.js";
+import { type IPasswordHasher } from "../crypto/contracts.js";
+import { UserService } from "../users/user.service.js";
+import type { LoginInput, RegisterInput } from "../validation/index.js";
+import { EmailVerificationService } from "../verification/verification.service.js";
+import { SessionService } from "./session.service.js";
+export declare class AuthService {
+    private userService;
+    private sessionService;
+    private emailVerificationService;
+    private readonly hasher;
+    private readonly cache?;
+    private failedAttempts;
+    constructor(userService: UserService, sessionService: SessionService, emailVerificationService: EmailVerificationService, hasher: IPasswordHasher, cache?: ICacheProvider | undefined);
+    private isRateLimited;
+    private recordFailedAttempt;
+    private clearFailedAttempts;
+    /**
+     * Sign In Logic
+     */
+    signIn(data: LoginInput): Promise<AuthResponse>;
+    /**
+     * Sign Up Logic
+     */
+    signUp(data: RegisterInput): Promise<AuthResponse>;
+    /**
+     * Finalize Login Logic (used by MFA/Interceptions)
+     */
+    finalizeLogin(userId: string, flags?: SessionFlags): Promise<AuthResponse>;
+    /**
+     * Sign Out Logic
+     */
+    signOut(): Promise<void>;
+}