@venizia/ignis-kernel 0.2.0-0

package/dist/esm/base/auth/authorize/enforcers/enforcer-registry.js

@@ -0,0 +1,97 @@
+import { SingletonRealm } from '../../../../helpers/singleton-realm.js';
+import { getError } from '@venizia/ignis-helpers/core';
+import { AbstractAuthRegistry } from '../../base/index.js';
+import { Authorization, AuthorizeBindingKeys } from '../common/index.js';
+export class AuthorizationEnforcerRegistry extends AbstractAuthRegistry {
+    static { this.SINGLETON_REAL_KEY = 'authorization-enforcer-registry'; }
+    constructor() {
+        super({ scope: AuthorizationEnforcerRegistry.name });
+        this.configuredEnforcers = new Set();
+    }
+    static getInstance() {
+        return SingletonRealm.resolve({
+            key: AuthorizationEnforcerRegistry.SINGLETON_REAL_KEY,
+            create: () => new AuthorizationEnforcerRegistry(),
+        });
+    }
+    reset() {
+        super.reset();
+        this.configuredEnforcers.clear();
+    }
+    getBindingPrefix() {
+        return Authorization.ENFORCER;
+    }
+    register(opts) {
+        const { container, enforcers } = opts;
+        const names = enforcers.map(e => e.name);
+        const duplicateNames = names.filter((n, i) => names.indexOf(n) !== i);
+        if (duplicateNames.length) {
+            throw getError({
+                message: `[AuthorizationEnforcerRegistry] Duplicate enforcer name(s): ${[...new Set(duplicateNames)].join(', ')}`,
+            });
+        }
+        for (const { enforcer, name, options } of enforcers) {
+            if (this.descriptors.has(name)) {
+                throw getError({
+                    message: `[AuthorizationEnforcerRegistry] Enforcer already registered: ${name}`,
+                });
+            }
+            this.registerDescriptor({ container, target: enforcer, name });
+            if (options) {
+                container.bind({ key: AuthorizeBindingKeys.enforcerOptions(name) }).toValue(options);
+            }
+        }
+        return this;
+    }
+    hasEnforcers() {
+        return this.descriptors.size > 0;
+    }
+    getDefaultEnforcerName() {
+        return this.getDefaultName();
+    }
+    async resolveEnforcer(opts) {
+        const enforcer = this.resolveDescriptor(opts);
+        if (!this.configuredEnforcers.has(opts.name)) {
+            await enforcer.configure();
+            this.configuredEnforcers.add(opts.name);
+        }
+        return enforcer;
+    }
+    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
+    async invalidateUserCache(opts) {
+        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
+        const enforcer = await this.resolveEnforcer({ name });
+        // Cache management is an optional IAuthorizationEnforcer capability - feature-detect it.
+        if (typeof enforcer.invalidateUserCache !== 'function') {
+            throw getError({
+                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
+            });
+        }
+        return enforcer.invalidateUserCache({ user: opts.user });
+    }
+    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
+    async rebuildUserCache(opts) {
+        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
+        const enforcer = await this.resolveEnforcer({ name });
+        if (typeof enforcer.rebuildUserCache !== 'function') {
+            throw getError({
+                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
+            });
+        }
+        return enforcer.rebuildUserCache({ user: opts.user });
+    }
+    resolveOptions() {
+        for (const [, metadata] of this.descriptors) {
+            const { container } = metadata;
+            const options = container.get({
+                key: AuthorizeBindingKeys.OPTIONS,
+                isOptional: true,
+            });
+            if (options) {
+                return options;
+            }
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=enforcer-registry.js.map

package/dist/esm/base/auth/authorize/enforcers/enforcer-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/enforcer-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQlD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhE,MAAM,OAAO,6BAA8B,SAAQ,oBAA4C;aAC7E,uBAAkB,GAAG,iCAAiC,CAAC;IAIvE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,cAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,6BAA6B,CAAC,kBAAkB;YACrD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,6BAA6B,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAES,gBAAgB;QACxB,OAAO,aAAa,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,IAgBR;QACC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,+DAA+D,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,gEAAgE,IAAI,EAAE;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAE/D,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAsB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,mBAAmB,CAAC,IAGzB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,yFAAyF;QACzF,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,gBAAgB,CAAC,IAGtB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,cAAc;QACZ,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;YAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAoB;gBAC/C,GAAG,EAAE,oBAAoB,CAAC,OAAO;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC"}

package/dist/esm/base/auth/authorize/enforcers/index.d.ts

@@ -0,0 +1,2 @@
+export * from './enforcer-registry.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/enforcers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/esm/base/auth/authorize/enforcers/index.js

@@ -0,0 +1,2 @@
+export * from './enforcer-registry.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/enforcers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/esm/base/auth/authorize/index.d.ts

@@ -0,0 +1,7 @@
+export * from './builders/index.js';
+export * from './common/index.js';
+export * from './enforcers/index.js';
+export * from './middlewares/index.js';
+export * from './models/index.js';
+export * from './providers/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/esm/base/auth/authorize/index.js

@@ -0,0 +1,7 @@
+export * from './builders/index.js';
+export * from './common/index.js';
+export * from './enforcers/index.js';
+export * from './middlewares/index.js';
+export * from './models/index.js';
+export * from './providers/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/esm/base/auth/authorize/middlewares/authorize.middleware.d.ts

@@ -0,0 +1,6 @@
+import type { IAuthorizationSpec } from '../common/index.js';
+export declare const authorize: (opts: {
+    spec: IAuthorizationSpec;
+    enforcerName?: string;
+}) => import("hono").MiddlewareHandler;
+//# sourceMappingURL=authorize.middleware.d.ts.map

package/dist/esm/base/auth/authorize/middlewares/authorize.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.middleware.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAMpD,eAAO,MAAM,SAAS,GAAI,MAAM;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,qCAElF,CAAC"}

package/dist/esm/base/auth/authorize/middlewares/authorize.middleware.js

@@ -0,0 +1,7 @@
+import { AuthorizationProvider } from '../providers/index.js';
+const authorizationProvider = new AuthorizationProvider();
+const authorizeFn = authorizationProvider.value();
+export const authorize = (opts) => {
+    return authorizeFn(opts);
+};
+//# sourceMappingURL=authorize.middleware.js.map

package/dist/esm/base/auth/authorize/middlewares/authorize.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.middleware.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC;AAC1D,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAyD,EAAE,EAAE;IACrF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC"}

package/dist/esm/base/auth/authorize/middlewares/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorize.middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/middlewares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/esm/base/auth/authorize/middlewares/index.js

@@ -0,0 +1,2 @@
+export * from './authorize.middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/esm/base/auth/authorize/models/authorization-role.model.d.ts

@@ -0,0 +1,30 @@
+import type { IAuthorizationRole } from '../common/index.js';
+export declare class AuthorizationRole implements IAuthorizationRole {
+    readonly name: string;
+    readonly priority: number;
+    readonly delimiter: string;
+    static build(opts: {
+        name: string;
+        priority: number;
+        delimiter?: string;
+    }): AuthorizationRole;
+    constructor(opts: {
+        name: string;
+        priority: number;
+        delimiter?: string;
+    });
+    get identifier(): string;
+    compare(opts: {
+        target: IAuthorizationRole;
+    }): number;
+    isHigherThan(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+    isLowerThan(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+    isEqualTo(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+}
+//# sourceMappingURL=authorization-role.model.d.ts.map

package/dist/esm/base/auth/authorize/models/authorization-role.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-role.model.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;gBAIjF,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM;IAIrD,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI3D,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI1D,SAAS,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;CAGzD"}

package/dist/esm/base/auth/authorize/models/authorization-role.model.js

@@ -0,0 +1,26 @@
+export class AuthorizationRole {
+    static build(opts) {
+        return new AuthorizationRole(opts);
+    }
+    constructor(opts) {
+        this.name = opts.name;
+        this.priority = opts.priority;
+        this.delimiter = opts.delimiter ?? '_';
+    }
+    get identifier() {
+        return [String(this.priority).padStart(3, '0'), this.name].join(this.delimiter);
+    }
+    compare(opts) {
+        return this.priority - opts.target.priority;
+    }
+    isHigherThan(opts) {
+        return this.compare(opts) > 0;
+    }
+    isLowerThan(opts) {
+        return this.compare(opts) < 0;
+    }
+    isEqualTo(opts) {
+        return this.compare(opts) === 0;
+    }
+}
+//# sourceMappingURL=authorization-role.model.js.map

package/dist/esm/base/auth/authorize/models/authorization-role.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-role.model.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,iBAAiB;IAK5B,MAAM,CAAC,KAAK,CAAC,IAA4D;QACvE,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,IAA4D;QACtE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IACzC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,IAAoC;QAC1C,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,IAAoC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,IAAoC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,IAAoC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/esm/base/auth/authorize/models/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorization-role.model.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/dist/esm/base/auth/authorize/models/index.js

@@ -0,0 +1,2 @@
+export * from './authorization-role.model.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/dist/esm/base/auth/authorize/providers/authorization.provider.d.ts

@@ -0,0 +1,10 @@
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import type { IProvider } from '@venizia/ignis-inversion';
+import type { TAuthorizeFn } from '../common/index.js';
+export declare class AuthorizationProvider extends BaseHelper implements IProvider<TAuthorizeFn> {
+    constructor();
+    value(): TAuthorizeFn;
+    private createAuthorizeMiddleware;
+    private extractUserRoles;
+}
+//# sourceMappingURL=authorization.provider.d.ts.map

package/dist/esm/base/auth/authorize/providers/authorization.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.provider.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/authorization.provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAsB,YAAY,EAAE,MAAM,WAAW,CAAC;AAKlE,qBAAa,qBAAsB,SAAQ,UAAW,YAAW,SAAS,CAAC,YAAY,CAAC;;IAKtF,KAAK,IAAI,YAAY;IAMrB,OAAO,CAAC,yBAAyB;IAqIjC,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/esm/base/auth/authorize/providers/authorization.provider.js

@@ -0,0 +1,135 @@
+import { asTypedContext } from '../../../../base/controllers/common/types.js';
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+import { createMiddleware } from 'hono/factory';
+// Deep import (not the authenticate barrel): the barrel re-exports ./controllers, whose factory extends BaseRestController - a value import here forms the base/controllers <-> auth init cycle.
+import { Authentication } from '../../authenticate/common/constants.js';
+import { Authorization, AuthorizationDecisions, AuthorizationErrors } from '../common/index.js';
+import { AuthorizationEnforcerRegistry } from '../enforcers/enforcer-registry.js';
+import { resolveRequestDomain } from './request-domain.js';
+export class AuthorizationProvider extends BaseHelper {
+    constructor() {
+        super({ scope: AuthorizationProvider.name });
+    }
+    value() {
+        return opts => {
+            return this.createAuthorizeMiddleware(opts);
+        };
+    }
+    createAuthorizeMiddleware(opts) {
+        const { spec, enforcerName } = opts;
+        const logger = this.logger.for(this.createAuthorizeMiddleware.name);
+        return createMiddleware(async (context, next) => {
+            const registry = AuthorizationEnforcerRegistry.getInstance();
+            const options = registry.resolveOptions();
+            const isSkipAuthorize = context.get(Authorization.SKIP_AUTHORIZATION);
+            if (isSkipAuthorize) {
+                logger.warn('SKIP checking authorization | path: %s', context.req.path);
+                return next();
+            }
+            const user = context.get(Authentication.CURRENT_USER);
+            if (!user) {
+                throw getError({
+                    error: AuthorizationErrors.UNAUTHENTICATED,
+                    message: 'Authorization failed: No authenticated user found',
+                });
+            }
+            const needsRoleCheck = Boolean(options?.alwaysAllowRoles?.length) || Boolean(spec.allowedRoles?.length);
+            if (needsRoleCheck) {
+                const userRoles = this.extractUserRoles({ user });
+                if (options?.alwaysAllowRoles?.length &&
+                    userRoles.some(r => options.alwaysAllowRoles.includes(r))) {
+                    logger.warn('SKIP checking authorization | User has always-allow role | userRoles: %s', userRoles);
+                    return next();
+                }
+                if (spec.allowedRoles?.length && userRoles.some(r => spec.allowedRoles.includes(r))) {
+                    logger.warn('GRANT access | User has allowed role for route | userRoles: %s', userRoles);
+                    return next();
+                }
+            }
+            for (const voter of spec.voters ?? []) {
+                const decision = await voter({
+                    user,
+                    action: spec.action,
+                    resource: spec.resource,
+                    context: asTypedContext(context),
+                });
+                if (decision === AuthorizationDecisions.DENY) {
+                    throw getError({
+                        error: AuthorizationErrors.DENIED_BY_VOTER,
+                        message: `Authorization denied by voter | action: ${spec.action} | resource: ${spec.resource}`,
+                        messageArgs: { action: spec.action, resource: spec.resource },
+                    });
+                }
+                if (decision === AuthorizationDecisions.ALLOW) {
+                    await next();
+                    return;
+                }
+                // ABSTAIN → continue to enforcer
+            }
+            if (!registry.hasEnforcers()) {
+                logger.debug('SKIP checking authorization | No enforcers registered | path: %s', context.req.path);
+                return next();
+            }
+            const resolvedName = enforcerName ?? registry.getDefaultEnforcerName();
+            const enforcer = await registry.resolveEnforcer({ name: resolvedName });
+            // Only resolve domain scope when it is actually in play (per-route domain OR a configured global resolver) - avoids a resolver call (possible DB hit) for legacy enforcers.
+            if (spec.domain || options?.domainResolver) {
+                const domainScope = await resolveRequestDomain({
+                    spec,
+                    context: asTypedContext(context),
+                    options,
+                });
+                context.set(Authorization.DOMAIN, domainScope);
+            }
+            let rules = context.get(Authorization.RULES);
+            if (!rules) {
+                if (!user.principalType) {
+                    throw getError({
+                        error: AuthorizationErrors.PRINCIPAL_TYPE_MISSING,
+                        message: 'Authorization failed: user.principalType is required for enforcer-based authorization',
+                    });
+                }
+                rules = await enforcer.buildRules({
+                    user: user,
+                    context: asTypedContext(context),
+                });
+                context.set(Authorization.RULES, rules);
+            }
+            let decision = await enforcer.evaluate({
+                rules,
+                request: {
+                    action: spec.action,
+                    resource: spec.resource,
+                    conditions: spec.conditions,
+                    domain: context.get(Authorization.DOMAIN),
+                },
+                context: asTypedContext(context),
+            });
+            if (decision === AuthorizationDecisions.ABSTAIN) {
+                decision = options?.defaultDecision ?? AuthorizationDecisions.DENY;
+            }
+            if (decision !== AuthorizationDecisions.ALLOW) {
+                throw getError({
+                    error: AuthorizationErrors.DENIED,
+                    message: `Authorization denied | action: ${spec.action} | resource: ${spec.resource}`,
+                    messageArgs: { action: spec.action, resource: spec.resource },
+                });
+            }
+            await next();
+        });
+    }
+    extractUserRoles(opts) {
+        const { user } = opts;
+        const roles = user.roles;
+        if (!Array.isArray(roles)) {
+            return [];
+        }
+        return roles.map((r) => {
+            if (typeof r === 'string') {
+                return r;
+            }
+            return r.identifier ?? r.name ?? String(r.id ?? '');
+        });
+    }
+}
+//# sourceMappingURL=authorization.provider.js.map

package/dist/esm/base/auth/authorize/providers/authorization.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.provider.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/authorization.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,iMAAiM;AACjM,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,EAAE;YACZ,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC;IACJ,CAAC;IAEO,yBAAyB,CAAC,IAAyD;QACzF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAEpE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;YAE1C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;YACtE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAA0B,CAAC;YAC/E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,QAAQ,CAAC;oBACb,KAAK,EAAE,mBAAmB,CAAC,eAAe;oBAC1C,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAClB,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAElD,IACE,OAAO,EAAE,gBAAgB,EAAE,MAAM;oBACjC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC1D,CAAC;oBACD,MAAM,CAAC,IAAI,CACT,0EAA0E,EAC1E,SAAS,CACV,CAAC;oBACF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrF,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE,SAAS,CAAC,CAAC;oBACzF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;oBAC3B,IAAI;oBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;iBACjC,CAAC,CAAC;gBAEH,IAAI,QAAQ,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;oBAC7C,MAAM,QAAQ,CAAC;wBACb,KAAK,EAAE,mBAAmB,CAAC,eAAe;wBAC1C,OAAO,EAAE,2CAA2C,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,QAAQ,EAAE;wBAC9F,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,QAAQ,KAAK,sBAAsB,CAAC,KAAK,EAAE,CAAC;oBAC9C,MAAM,IAAI,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,iCAAiC;YACnC,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,KAAK,CACV,kEAAkE,EAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CACjB,CAAC;gBACF,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,YAAY,GAAG,YAAY,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAExE,4KAA4K;YAC5K,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;gBAC3C,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC;oBAC7C,IAAI;oBACJ,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;oBAChC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxB,MAAM,QAAQ,CAAC;wBACb,KAAK,EAAE,mBAAmB,CAAC,sBAAsB;wBACjD,OAAO,EACL,uFAAuF;qBAC1F,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;oBAChC,IAAI,EAAE,IAA6C;oBACnD,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;iBACjC,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACrC,KAAK;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC;iBAC1C;gBACD,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;aACjC,CAAC,CAAC;YAEH,IAAI,QAAQ,KAAK,sBAAsB,CAAC,OAAO,EAAE,CAAC;gBAChD,QAAQ,GAAG,OAAO,EAAE,eAAe,IAAI,sBAAsB,CAAC,IAAI,CAAC;YACrE,CAAC;YAED,IAAI,QAAQ,KAAK,sBAAsB,CAAC,KAAK,EAAE,CAAC;gBAC9C,MAAM,QAAQ,CAAC;oBACb,KAAK,EAAE,mBAAmB,CAAC,MAAM;oBACjC,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,QAAQ,EAAE;oBACrF,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAyB;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgE,EAAE,EAAE;YACpF,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/base/auth/authorize/providers/index.d.ts

@@ -0,0 +1,3 @@
+export * from './authorization.provider.js';
+export * from './request-domain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/esm/base/auth/authorize/providers/index.js

@@ -0,0 +1,3 @@
+export * from './authorization.provider.js';
+export * from './request-domain.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/esm/base/auth/authorize/providers/request-domain.d.ts

@@ -0,0 +1,16 @@
+import type { TContext } from '../../../../base/controllers/common/types.js';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+import type { Env } from 'hono';
+import type { IAuthorizationDomainSource, IAuthorizationSpec, IAuthorizeOptions } from '../common/types.js';
+/** Read a domain value from a declarative source on the Hono context. */
+export declare const readDeclarative: (opts: {
+    source: IAuthorizationDomainSource;
+    context: TContext<Env, string>;
+}) => TNullable<string>;
+/** Resolve the request domain, precedence spec.domain (method | declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string ("<type>_<id>") or the SYSTEM_WIDE sentinel. */
+export declare const resolveRequestDomain: (opts: {
+    spec: IAuthorizationSpec;
+    context: TContext<Env, string>;
+    options: TNullable<IAuthorizeOptions>;
+}) => Promise<string>;
+//# sourceMappingURL=request-domain.d.ts.map

package/dist/esm/base/auth/authorize/providers/request-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-domain.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,yEAAyE;AACzE,eAAO,MAAM,eAAe,GAAI,MAAM;IACpC,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;CAChC,KAAG,SAAS,CAAC,MAAM,CAoBnB,CAAC;AAEF,iMAAiM;AACjM,eAAO,MAAM,oBAAoB,GAAU,MAAM;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;CACvC,KAAG,OAAO,CAAC,MAAM,CAwBjB,CAAC"}

package/dist/esm/base/auth/authorize/providers/request-domain.js

@@ -0,0 +1,46 @@
+import { AuthorizationDomainScopes } from '../common/constants.js';
+/** Read a domain value from a declarative source on the Hono context. */
+export const readDeclarative = (opts) => {
+    const { source, context } = opts;
+    switch (source.from) {
+        case 'param': {
+            return context.req.param(source.key) ?? null;
+        }
+        case 'header': {
+            return context.req.header(source.key) ?? null;
+        }
+        case 'query': {
+            return context.req.query(source.key) ?? null;
+        }
+        case 'context': {
+            const value = context.get(source.key);
+            return value == null ? null : String(value);
+        }
+        default: {
+            return null;
+        }
+    }
+};
+/** Resolve the request domain, precedence spec.domain (method | declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string ("<type>_<id>") or the SYSTEM_WIDE sentinel. */
+export const resolveRequestDomain = async (opts) => {
+    const { spec, context, options } = opts;
+    if (typeof spec.domain === 'function') {
+        const resolved = await spec.domain({ context });
+        return resolved
+            ? [resolved.type, resolved.id].join('_')
+            : AuthorizationDomainScopes.SYSTEM_WIDE;
+    }
+    if (spec.domain) {
+        const id = readDeclarative({ source: spec.domain, context });
+        return id ? [spec.domain.type, id].join('_') : AuthorizationDomainScopes.SYSTEM_WIDE;
+    }
+    const globalResolver = options?.domainResolver ?? null;
+    if (globalResolver) {
+        const resolved = await globalResolver({ context });
+        return resolved
+            ? [resolved.type, resolved.id].join('_')
+            : AuthorizationDomainScopes.SYSTEM_WIDE;
+    }
+    return AuthorizationDomainScopes.SYSTEM_WIDE;
+};
+//# sourceMappingURL=request-domain.js.map

package/dist/esm/base/auth/authorize/providers/request-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-domain.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAG/B,EAAqB,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAU,CAAC,CAAC;YAC7C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,iMAAiM;AACjM,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAI1C,EAAmB,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAExC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;IACvD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,yBAAyB,CAAC,WAAW,CAAC;AAC/C,CAAC,CAAC"}

package/dist/esm/base/auth/base/abstract-auth-registry.d.ts

@@ -0,0 +1,28 @@
+import type { Container } from '../../../helpers/inversion/container.js';
+import type { TClass } from '@venizia/ignis-helpers/common';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+export type TRegistryDescriptor<TItem> = {
+    container: Container;
+    targetClass: TClass<TItem>;
+};
+export declare abstract class AbstractAuthRegistry<TItem> extends BaseHelper {
+    protected descriptors: Map<string, TRegistryDescriptor<TItem>>;
+    constructor(opts: {
+        scope: string;
+    });
+    protected abstract getBindingPrefix(): string;
+    getKey(opts: {
+        name: string;
+    }): string;
+    getDefaultName(): string;
+    protected registerDescriptor(opts: {
+        container: Container;
+        target: TClass<TItem>;
+        name: string;
+    }): void;
+    reset(): void;
+    protected resolveDescriptor(opts: {
+        name: string;
+    }): TItem;
+}
+//# sourceMappingURL=abstract-auth-registry.d.ts.map

package/dist/esm/base/auth/base/abstract-auth-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstract-auth-registry.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/base/abstract-auth-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAGnE,MAAM,MAAM,mBAAmB,CAAC,KAAK,IAAI;IACvC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;CAC5B,CAAC;AAEF,8BAAsB,oBAAoB,CAAC,KAAK,CAAE,SAAQ,UAAU;IAClE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEnD,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAKnC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,MAAM;IAE7C,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAQtC,cAAc,IAAI,MAAM;IAUxB,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI;IAUR,KAAK,IAAI,IAAI;IAIb,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK;CAuB3D"}

package/dist/esm/base/auth/base/abstract-auth-registry.js

@@ -0,0 +1,55 @@
+import { BindingScopes } from '@venizia/ignis-inversion';
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+import isEmpty from 'lodash/isEmpty';
+export class AbstractAuthRegistry extends BaseHelper {
+    constructor(opts) {
+        super(opts);
+        this.descriptors = new Map();
+    }
+    getKey(opts) {
+        if (!opts?.name || isEmpty(opts.name)) {
+            throw getError({ message: `[getKey] Invalid name | name: ${opts.name}` });
+        }
+        return [this.getBindingPrefix(), opts.name].join('.');
+    }
+    getDefaultName() {
+        const firstName = this.descriptors.keys().next().value;
+        if (!firstName) {
+            throw getError({
+                message: `[${this.constructor.name}] No items registered`,
+            });
+        }
+        return firstName;
+    }
+    registerDescriptor(opts) {
+        const { container, target, name } = opts;
+        this.descriptors.set(name, { container, targetClass: target });
+        container
+            .bind({ key: this.getKey({ name }) })
+            .toClass(target)
+            .setScope(BindingScopes.SINGLETON);
+    }
+    reset() {
+        this.descriptors.clear();
+    }
+    resolveDescriptor(opts) {
+        const { name } = opts;
+        const metadata = this.descriptors.get(name);
+        if (!metadata) {
+            throw getError({
+                message: `[${this.constructor.name}] Descriptor not found: ${name}`,
+            });
+        }
+        const { container } = metadata;
+        const instance = container.get({
+            key: this.getKey({ name }),
+        });
+        if (!instance) {
+            throw getError({
+                message: `[${this.constructor.name}] Failed to resolve: ${name}`,
+            });
+        }
+        return instance;
+    }
+}
+//# sourceMappingURL=abstract-auth-registry.js.map

package/dist/esm/base/auth/base/abstract-auth-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstract-auth-registry.js","sourceRoot":"","sources":["../../../../../src/base/auth/base/abstract-auth-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,OAAO,MAAM,gBAAgB,CAAC;AAOrC,MAAM,OAAgB,oBAA4B,SAAQ,UAAU;IAGlE,YAAY,IAAuB;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAID,MAAM,CAAC,IAAsB;QAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,iCAAiC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,cAAc;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,uBAAuB;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,kBAAkB,CAAC,IAI5B;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,SAAS;aACN,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aACpC,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAES,iBAAiB,CAAC,IAAsB;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,2BAA2B,IAAI,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAQ;YACpC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,wBAAwB,IAAI,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/esm/base/auth/base/index.d.ts

@@ -0,0 +1,2 @@
+export * from './abstract-auth-registry.js';
+//# sourceMappingURL=index.d.ts.map