@venizia/ignis-kernel 0.2.0-0

package/dist/esm/base/auth/authorize/builders/policy.builder.d.ts

@@ -0,0 +1,195 @@
+import type { IdType } from '../../../../base/index.js';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants.js';
+/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
+export type TPolicyDomainInput = string | {
+    type: string;
+    id: IdType;
+};
+export declare class AuthorizationPolicyBuilder {
+    static readonly ACTION_PRINCIPAL = "Action";
+    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
+    private static serializeDomain;
+    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
+    static grant(opts: {
+        subject: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            id: IdType;
+        };
+        action: string;
+        domain?: TNullable<TPolicyDomainInput>;
+        effect: TAuthorizationDecision;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+    };
+    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
+    static customGrant(opts: {
+        subject: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            id: IdType;
+        };
+        ops: string[];
+        domain?: TNullable<TPolicyDomainInput>;
+        effect: TAuthorizationDecision;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+        metadata: {
+            ops: string[];
+        };
+    };
+    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
+    static assignRole(opts: {
+        user: {
+            type: string;
+            id: IdType;
+        };
+        role: {
+            type: string;
+            id: IdType;
+        };
+        domain?: TNullable<TPolicyDomainInput>;
+    }): {
+        variant: "assign_role";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        domain: TNullable<string>;
+    };
+    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
+    static joinDomain(opts: {
+        user: {
+            type: string;
+            id: IdType;
+        };
+        domain: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "join_domain";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
+    static roleInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "role_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
+    static resourceInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "resource_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
+    static actionInherits(opts: {
+        child: TAuthorizationAction;
+        parent: TAuthorizationAction;
+    }): {
+        variant: "action_inherits";
+        subjectType: string;
+        subjectId: string;
+        targetType: string;
+        targetId: string;
+    };
+    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
+    static actionLattice(): {
+        variant: "action_inherits";
+        subjectType: string;
+        subjectId: string;
+        targetType: string;
+        targetId: string;
+    }[];
+    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
+    static domainInherits(opts: {
+        child: {
+            type: string;
+            id: IdType;
+        };
+        parent: {
+            type: string;
+            id: IdType;
+        };
+    }): {
+        variant: "domain_inherits";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+    };
+    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
+    static roleGrants(opts: {
+        role: {
+            type: string;
+            id: IdType;
+        };
+        permission: {
+            type: string;
+            idByCode: ReadonlyMap<string, string>;
+        };
+        grants: ReadonlyArray<{
+            resourceCode: string;
+            action: string;
+            domain?: TNullable<TPolicyDomainInput>;
+            effect: TAuthorizationDecision;
+        }>;
+    }): {
+        variant: "grant";
+        subjectType: string;
+        subjectId: IdType;
+        targetType: string;
+        targetId: IdType;
+        action: string;
+        effect: string;
+        domain: TNullable<string>;
+    }[];
+}
+//# sourceMappingURL=policy.builder.d.ts.map

package/dist/esm/base/auth/authorize/builders/policy.builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,yNAAyN;IACzN,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;IAaD,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;;;;IAcD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;;;;;;;;IAWD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;;;;;;;;;;CAsBF"}

package/dist/esm/base/auth/authorize/builders/policy.builder.js

@@ -0,0 +1,126 @@
+import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants.js';
+export class AuthorizationPolicyBuilder {
+    static { this.ACTION_PRINCIPAL = 'Action'; }
+    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
+    static serializeDomain(domain) {
+        if (domain == null) {
+            return null;
+        }
+        if (typeof domain === 'string') {
+            return domain;
+        }
+        return [domain.type, domain.id].join('_');
+    }
+    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
+    static grant(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.GRANT.action,
+            subjectType: opts.subject.type,
+            subjectId: opts.subject.id,
+            targetType: opts.permission.type,
+            targetId: opts.permission.id,
+            action: opts.action,
+            effect: opts.effect,
+            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+        };
+    }
+    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
+    static customGrant(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.GRANT.action,
+            subjectType: opts.subject.type,
+            subjectId: opts.subject.id,
+            targetType: opts.permission.type,
+            targetId: opts.permission.id,
+            action: AuthorizationActions.CUSTOM,
+            effect: opts.effect,
+            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            metadata: { ops: opts.ops },
+        };
+    }
+    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
+    static assignRole(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.ASSIGN_ROLE.action,
+            subjectType: opts.user.type,
+            subjectId: opts.user.id,
+            targetType: opts.role.type,
+            targetId: opts.role.id,
+            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+        };
+    }
+    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
+    static joinDomain(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.JOIN_DOMAIN.action,
+            subjectType: opts.user.type,
+            subjectId: opts.user.id,
+            targetType: opts.domain.type,
+            targetId: opts.domain.id,
+        };
+    }
+    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
+    static roleInherits(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.ROLE_INHERITS.action,
+            subjectType: opts.child.type,
+            subjectId: opts.child.id,
+            targetType: opts.parent.type,
+            targetId: opts.parent.id,
+        };
+    }
+    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
+    static resourceInherits(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.RESOURCE_INHERITS.action,
+            subjectType: opts.child.type,
+            subjectId: opts.child.id,
+            targetType: opts.parent.type,
+            targetId: opts.parent.id,
+        };
+    }
+    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
+    static actionInherits(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.ACTION_INHERITS.action,
+            subjectType: this.ACTION_PRINCIPAL,
+            subjectId: opts.child,
+            targetType: this.ACTION_PRINCIPAL,
+            targetId: opts.parent,
+        };
+    }
+    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
+    static actionLattice() {
+        return AuthorizationActions.LATTICE.map(action => this.actionInherits(action));
+    }
+    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
+    static domainInherits(opts) {
+        return {
+            variant: AuthorizationPolicyVariants.DOMAIN_INHERITS.action,
+            subjectType: opts.child.type,
+            subjectId: opts.child.id,
+            targetType: opts.parent.type,
+            targetId: opts.parent.id,
+        };
+    }
+    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
+    static roleGrants(opts) {
+        const rows = [];
+        for (const grant of opts.grants) {
+            const permissionId = opts.permission.idByCode.get(grant.resourceCode);
+            if (!permissionId) {
+                continue;
+            }
+            const policy = AuthorizationPolicyBuilder.grant({
+                subject: { type: opts.role.type, id: opts.role.id },
+                permission: { type: opts.permission.type, id: permissionId },
+                action: grant.action,
+                domain: grant.domain,
+                effect: grant.effect,
+            });
+            rows.push(policy);
+        }
+        return rows;
+    }
+}
+//# sourceMappingURL=policy.builder.js.map

package/dist/esm/base/auth/authorize/builders/policy.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAKxF,MAAM,OAAO,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,yNAAyN;IACjN,MAAM,CAAC,eAAe,CAAC,MAAsC;QACnE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,oBAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC"}

package/dist/esm/base/auth/authorize/common/constants.d.ts

@@ -0,0 +1,156 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+import { AuthorizationRole } from '../models/authorization-role.model.js';
+export declare class Authorization {
+    static readonly RULES = "authorization.rules";
+    static readonly SKIP_AUTHORIZATION = "authorization.skip";
+    static readonly ENFORCER = "authorization.enforcer";
+    static readonly DOMAIN = "authorization.domain";
+}
+export declare class AuthorizationActions {
+    static readonly CREATE = "create";
+    static readonly UPDATE = "update";
+    static readonly DELETE = "delete";
+    static readonly EXECUTE = "execute";
+    static readonly READ = "read";
+    static readonly WRITE = "write";
+    static readonly MANAGE = "manage";
+    /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */
+    static readonly CUSTOM = "custom";
+    static readonly SCHEME_SET: Set<string>;
+    static readonly LATTICE: ReadonlyArray<{
+        child: TAuthorizationAction;
+        parent: TAuthorizationAction;
+    }>;
+    static isValid(input: string): boolean;
+}
+export type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;
+export declare class AuthorizationDecisions {
+    static readonly ALLOW = "allow";
+    static readonly DENY = "deny";
+    static readonly ABSTAIN = "abstain";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+    static isAllow(input: string | number): boolean;
+    static isDeny(input: string | number): boolean;
+    static isAbstain(input: string | number): boolean;
+}
+export type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;
+export declare class AuthorizationRoles {
+    static readonly SUPER_ADMIN: AuthorizationRole;
+    static readonly ADMIN: AuthorizationRole;
+    static readonly USER: AuthorizationRole;
+    static readonly GUEST: AuthorizationRole;
+    static readonly UNKNOWN_USER: AuthorizationRole;
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export declare class AuthorizationEnforcerTypes {
+    static readonly CASBIN = "casbin";
+    static readonly CUSTOM = "custom";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
+export declare class CasbinEnforcerCachedDrivers {
+    static readonly REDIS = "redis";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
+export declare class CasbinEnforcerModelDrivers {
+    static readonly FILE = "file";
+    static readonly TEXT = "text";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
+export declare class CasbinDomainMatchingFunctions {
+    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
+    static readonly KEY_MATCH = "keyMatch";
+    /** Adds URL-path `:param` segment matching. */
+    static readonly KEY_MATCH_2 = "keyMatch2";
+    /** Adds `{param}` segment matching. */
+    static readonly KEY_MATCH_3 = "keyMatch3";
+    /** `{param}` matching with repeated-name equality checks. */
+    static readonly KEY_MATCH_4 = "keyMatch4";
+    /** Treats the stored/policy value as a full regular expression. */
+    static readonly REGEX_MATCH = "regexMatch";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
+export declare class AuthorizationDomainScopes {
+    /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
+    static readonly ANY_MEMBER = "ANY_MEMBER";
+    /** Grant applies system-wide, bypassing membership - super-admin only. */
+    static readonly SYSTEM_WIDE = "SYSTEM_WIDE";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
+/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
+export declare class CasbinRuleVariants {
+    /** Permission policy line. */
+    static readonly P = "p";
+    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
+    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
+    static readonly G = "g";
+    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
+    static readonly G2 = "g2";
+    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
+    static readonly G3 = "g3";
+    /** Grouping #4 - resource hierarchy. The `obj` axis. */
+    static readonly G4 = "g4";
+    /** Grouping #5 - action hierarchy. The `act` axis. */
+    static readonly G5 = "g5";
+}
+export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
+/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
+export declare class AuthorizationPolicyVariants {
+    /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
+    static readonly GRANT: {
+        readonly action: "grant";
+        readonly rule: "p";
+    };
+    /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */
+    static readonly ASSIGN_ROLE: {
+        readonly action: "assign_role";
+        readonly rule: "g";
+    };
+    /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */
+    static readonly ROLE_INHERITS: {
+        readonly action: "role_inherits";
+        readonly rule: "g";
+    };
+    /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */
+    static readonly JOIN_DOMAIN: {
+        readonly action: "join_domain";
+        readonly rule: "g2";
+    };
+    /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */
+    static readonly DOMAIN_INHERITS: {
+        readonly action: "domain_inherits";
+        readonly rule: "g3";
+    };
+    /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */
+    static readonly RESOURCE_INHERITS: {
+        readonly action: "resource_inherits";
+        readonly rule: "g4";
+    };
+    /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */
+    static readonly ACTION_INHERITS: {
+        readonly action: "action_inherits";
+        readonly rule: "g5";
+    };
+    static readonly ACTION_SCHEME_SET: Set<string>;
+    static readonly RULE_SCHEME_SET: Set<string>;
+    static isValidAction(input: string): boolean;
+    static isValidRule(input: string): boolean;
+}
+export type TAuthorizationPolicyVariant = TConstValue<typeof AuthorizationPolicyVariants>;
+export declare class AuthorizeBindingKeys {
+    static readonly OPTIONS = "@app/authorize/options";
+    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
+    static enforcerOptions(name: string): string;
+}
+//# sourceMappingURL=constants.d.ts.map

package/dist/esm/base/auth/authorize/common/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAuC;IAEjE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,2BAA2B;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyB;IAEnD,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE1F,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAExF,qBAAa,6BAA6B;IACxC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IAEvC,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,uCAAuC;IACvC,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,6DAA6D;IAC7D,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe;IAE1C,mEAAmE;IACnE,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;IAE3C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,6BAA6B,GAAG,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE9F,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,+MAA+M;AAC/M,qBAAa,kBAAkB;IAC7B,8BAA8B;IAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,4GAA4G;IAE5G,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO;IAExB,uFAAuF;IACvF,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;IAE1B,sDAAsD;IACtD,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ;CAC3B;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAQ9B;IAEH,MAAM,CAAC,QAAQ,CAAC,eAAe,cAQ5B;IAEH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AACD,MAAM,MAAM,2BAA2B,GAAG,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE1F,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,4BAA4B;IACnD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uCAAuC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7C"}