@venizia/ignis-kernel 0.2.0-0

package/dist/cjs/base/auth/authorize/common/errors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationErrors = void 0;
+const core_1 = require("@venizia/ignis-helpers/core");
+const common_1 = require("@venizia/ignis-helpers/common");
+/** Codes a client branches on for a refused authorization. A throw site may override `message` for detail; the code and status come from here. */
+exports.AuthorizationErrors = {
+    UNAUTHENTICATED: {
+        message: {
+            text: 'Authorization requires an authenticated user',
+            code: 'core.authorization.unauthenticated',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    DENIED: {
+        message: { text: 'Authorization denied', code: 'core.authorization.denied' },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Forbidden,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    /** Distinct from {@link DENIED}: a voter refused before the enforcer ever ran. */
+    DENIED_BY_VOTER: {
+        message: { text: 'Authorization denied by voter', code: 'core.authorization.denied_by_voter' },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Forbidden,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    PRINCIPAL_TYPE_MISSING: {
+        message: {
+            text: 'user.principalType is required for enforcer-based authorization',
+            code: 'core.authorization.principal_type_missing',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.BadRequest,
+        category: core_1.ErrorScopes.VALIDATION,
+    },
+    CACHE_KEY_INVALID: {
+        message: {
+            text: 'Authorization cache key resolver returned an empty key',
+            code: 'core.authorization.cache_key_invalid',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.BadRequest,
+        category: core_1.ErrorScopes.VALIDATION,
+    },
+};
+//# sourceMappingURL=errors.js.map

package/dist/cjs/base/auth/authorize/common/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/errors.ts"],"names":[],"mappings":";;;AACA,sDAA0D;AAC1D,0DAAqD;AAErD,kJAAkJ;AACrI,QAAA,mBAAmB,GAAG;IACjC,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,8CAA8C;YACpD,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAE;QAC5E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS;QAC3C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kFAAkF;IAClF,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,oCAAoC,EAAE;QAC9F,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS;QAC3C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,sBAAsB,EAAE;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,iEAAiE;YACvE,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC5C,QAAQ,EAAE,kBAAW,CAAC,UAAU;KACjC;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,wDAAwD;YAC9D,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU;QAC5C,QAAQ,EAAE,kBAAW,CAAC,UAAU;KACjC;CACkD,CAAC"}

package/dist/cjs/base/auth/authorize/common/index.d.ts

@@ -0,0 +1,4 @@
+export * from './errors';
+export * from './constants';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/common/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}

package/dist/cjs/base/auth/authorize/common/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./errors"), exports);
+__exportStar(require("./constants"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,8CAA4B;AAC5B,0CAAwB"}

package/dist/cjs/base/auth/authorize/common/types.d.ts

@@ -0,0 +1,159 @@
+import type { IdType } from '../../../../base';
+import type { TContext } from '../../../../base/controllers/common/types';
+import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { type IRedisHelper } from '@venizia/ignis-helpers/core';
+import type { Adapter } from 'casbin';
+import type { Env } from 'hono';
+import { type MiddlewareHandler } from 'hono';
+import type { IAuthUser } from '../../authenticate/common/types';
+import type { CasbinEnforcerCachedDrivers, CasbinEnforcerModelDrivers, TAuthorizationAction, TAuthorizationDecision, TCasbinDomainMatchingFunction } from './constants';
+import type { AuthorizationPolicyBuilder } from '../builders/policy.builder';
+export interface IAuthorizationRole {
+    readonly name: string;
+    readonly priority: number;
+    readonly identifier: string;
+}
+/** Key-value conditions for attribute-based access control. Values compared with strict equality. */
+export type TAuthorizationConditions<KeyType extends string | symbol = string | symbol, ValueType = string | number | boolean | null> = Record<KeyType, ValueType>;
+export interface IAuthorizationRequest<TAction = string, TResource = string> {
+    action: TAction;
+    resource: TResource;
+    conditions?: TAuthorizationConditions;
+    /** Resolved domain scope for this request as a casbin domain string `"<DomainType>_<id>"` (e.g. `"Merchant_7"`), or the `"SYSTEM_WIDE"` sentinel to enforce across all domains. */
+    domain?: string;
+}
+export interface IAuthorizationUser extends IAuthUser {
+    principalType: string;
+}
+/** What CasbinAuthorizationEnforcer.buildRules returns and evaluate consumes. */
+export interface ICasbinRules {
+    user: IAuthorizationUser;
+    lines: string[];
+}
+/** Declarative description of where to read the request domain from. */
+export interface IAuthorizationDomainSource {
+    from: 'param' | 'header' | 'query' | 'context';
+    key: string;
+    type: string;
+}
+/** Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */
+export type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {
+    context: TContext<E, string>;
+}) => ValueOrPromise<TNullable<{
+    type: string;
+    id: IdType;
+}>>;
+/** Builds rules and evaluates requests. Cache management (`invalidateUserCache`/`rebuildUserCache`) is OPTIONAL - only on per-user-caching enforcers; the registry feature-detects it at runtime. */
+export interface IAuthorizationEnforcer<E extends Env = Env, TAction = string, TResource = string, TRules = unknown, TBuildRulesReturn = ValueOrPromise<TRules>, TEvaluateReturn = ValueOrPromise<TAuthorizationDecision>> {
+    name: string;
+    configure(): ValueOrPromise<void>;
+    buildRules(opts: {
+        user: IAuthorizationUser;
+        context: TContext<E, string>;
+    }): TBuildRulesReturn;
+    evaluate(opts: {
+        rules: TRules;
+        request: IAuthorizationRequest<TAction, TResource>;
+        context: TContext<E, string>;
+    }): TEvaluateReturn;
+    /** Drop a user's cached policies. Implemented only by caching enforcers. */
+    invalidateUserCache?(opts: {
+        user: IAuthorizationUser;
+    }): Promise<{
+        invalidatedKeys: number;
+    }>;
+    /** Drop + rebuild a user's cached policies. Implemented only by caching enforcers. */
+    rebuildUserCache?(opts: {
+        user: IAuthorizationUser;
+    }): Promise<{
+        cacheKey: string;
+        lineCount: number;
+    }>;
+}
+export type TAuthorizationVoter<E extends Env = Env, TAction = string, TResource = string> = (opts: {
+    user: IAuthUser;
+    action: TAction;
+    resource: TResource;
+    context: TContext<E, string>;
+}) => ValueOrPromise<TAuthorizationDecision>;
+export interface IAuthorizationSpec<E extends Env = Env, TAction = string, TResource = string> {
+    action: TAction;
+    resource: TResource;
+    conditions?: TAuthorizationConditions;
+    allowedRoles?: string[];
+    voters?: TAuthorizationVoter<E, TAction, TResource>[];
+    /** Optional per-route domain: declarative source OR a resolver method. Omitted → global resolver. */
+    domain?: IAuthorizationDomainSource | TAuthorizationDomainResolver<E>;
+}
+export type TAuthorizeFn<E extends Env = Env, TAction = string, TResource = string> = (opts: {
+    spec: IAuthorizationSpec<E, TAction, TResource>;
+    enforcerName?: string;
+}) => MiddlewareHandler;
+export interface ICasbinEnforcerCachedRedis {
+    driver: typeof CasbinEnforcerCachedDrivers.REDIS;
+    options: {
+        connection: IRedisHelper;
+        expiresIn: number;
+        keyFn: (opts: {
+            user: IAuthorizationUser;
+        }) => ValueOrPromise<string>;
+    };
+}
+export interface ICasbinEnforcerOptions<E extends Env = Env, TAction = string, TResource = string, TAdapter = Adapter> {
+    model: {
+        driver: typeof CasbinEnforcerModelDrivers.FILE;
+        definition: string;
+    } | {
+        driver: typeof CasbinEnforcerModelDrivers.TEXT;
+        definition: string;
+    };
+    cached: {
+        use: false;
+    } | (ICasbinEnforcerCachedRedis & {
+        use: true;
+    });
+    adapter?: TAdapter;
+    domainMatching?: {
+        roleDefinition: string;
+        fn: TCasbinDomainMatchingFunction;
+    };
+    normalizePayloadFn?(opts: {
+        user: IAuthUser;
+        action: TAction;
+        resource: TResource;
+        context: TContext<E, string>;
+    }): {
+        subject: string;
+        resource: string;
+        action: string;
+        domain?: string;
+    };
+    /** Domain-scoped RBAC model: requests become 4-token `(subject, domain, object, action)` and the enforcer registers the domain matcher (`keyMatch` on `g`) + resource matcher (`objectMatch`). */
+    isScoped?: boolean;
+    /** Number of pooled enforcers (each request enforces on its own). Default 16. */
+    poolSize?: number;
+    /** Max ms to wait for a free pooled enforcer before failing closed. Default 5000. */
+    poolAcquireTimeoutMs?: number;
+}
+export interface IAuthorizeOptions {
+    defaultDecision: TAuthorizationDecision;
+    alwaysAllowRoles?: string[];
+    /** Fallback domain resolver used when a route's spec has no `domain`. */
+    domainResolver?: TAuthorizationDomainResolver;
+}
+/** Shape of `PolicyDefinition.metadata` on a subset ("custom") grant. `ops` holds bare method names (e.g. `"find"`), not full permission codes. */
+export type TCustomGrantMetadata = {
+    ops: string[];
+};
+export type TGrantIntent = {
+    tier: TAuthorizationAction;
+} | {
+    ops: string[];
+};
+/** Per-operation rows carry `targetId` = the operation's code, not a database id; the consumer resolves codes to ids when persisting. */
+export type TPlannedGrantRow = ReturnType<typeof AuthorizationPolicyBuilder.grant> & {
+    metadata?: {
+        ops: string[];
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/cjs/base/auth/authorize/common/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EACjD,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE/B,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,mLAAmL;IACnL,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAE9D,qMAAqM;AACrM,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,MAAM,GAAG,OAAO,EAChB,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,EAC1C,eAAe,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAExD,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,UAAU,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,iBAAiB,CAAC;IAEhG,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,eAAe,CAAC;IAEpB,4EAA4E;IAC5E,mBAAmB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE/F,sFAAsF;IACtF,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,mBAAmB,CAC7B,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,IAChB,CAAC,IAAI,EAAE;IACT,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,sBAAsB,CAAC,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACtD,qGAAqG;IACrG,MAAM,CAAC,EAAE,0BAA0B,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE;IAC3F,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,KAAK,iBAAiB,CAAC;AAExB,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC;IACjD,OAAO,EAAE;QACP,UAAU,EAAE,YAAY,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,kBAAkB,CAAA;SAAE,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,QAAQ,GAAG,OAAO;IAElB,KAAK,EACD;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACtE;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,MAAM,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG,CAAC,0BAA0B,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB,cAAc,CAAC,EAAE;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,EAAE,EAAE,6BAA6B,CAAC;KACnC,CAAC;IAEF,kBAAkB,CAAC,CAAC,IAAI,EAAE;QACxB,IAAI,EAAE,SAAS,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,SAAS,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF,kMAAkM;IAClM,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,4BAA4B,CAAC;CAC/C;AAED,mJAAmJ;AACnJ,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE9E,yIAAyI;AACzI,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,KAAK,CAAC,GAAG;IACnF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9B,CAAC"}

package/dist/cjs/base/auth/authorize/common/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/base/auth/authorize/common/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/common/types.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.d.ts

@@ -0,0 +1,51 @@
+import type { Container } from '../../../../helpers/inversion/container';
+import type { TClass } from '@venizia/ignis-helpers/common';
+import type { IAuthUser } from '../../authenticate/common/types';
+import { AbstractAuthRegistry } from '../../base';
+import type { AuthorizationEnforcerTypes, IAuthorizationEnforcer, IAuthorizationUser, IAuthorizeOptions, ICasbinEnforcerOptions } from '../common';
+export declare class AuthorizationEnforcerRegistry extends AbstractAuthRegistry<IAuthorizationEnforcer> {
+    static readonly SINGLETON_REAL_KEY = "authorization-enforcer-registry";
+    private configuredEnforcers;
+    constructor();
+    static getInstance(): AuthorizationEnforcerRegistry;
+    reset(): void;
+    protected getBindingPrefix(): string;
+    register(opts: {
+        container: Container;
+        enforcers: Array<{
+            enforcer: TClass<IAuthorizationEnforcer>;
+            name: string;
+            type: typeof AuthorizationEnforcerTypes.CASBIN;
+            options?: ICasbinEnforcerOptions;
+        } | {
+            enforcer: TClass<IAuthorizationEnforcer>;
+            name: string;
+            type: typeof AuthorizationEnforcerTypes.CUSTOM;
+            options?: unknown;
+        }>;
+    }): this;
+    hasEnforcers(): boolean;
+    getDefaultEnforcerName(): string;
+    resolveEnforcer(opts: {
+        name: string;
+    }): Promise<IAuthorizationEnforcer>;
+    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
+    invalidateUserCache(opts: {
+        user: IAuthorizationUser;
+        enforcerName?: string;
+    }): Promise<{
+        invalidatedKeys: number;
+    }>;
+    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
+    rebuildUserCache(opts: {
+        user: {
+            principalType: string;
+        } & IAuthUser;
+        enforcerName?: string;
+    }): Promise<{
+        cacheKey: string;
+        lineCount: number;
+    }>;
+    resolveOptions(): IAuthorizeOptions | undefined;
+}
+//# sourceMappingURL=enforcer-registry.d.ts.map

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer-registry.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/enforcer-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,WAAW,CAAC;AAGnB,qBAAa,6BAA8B,SAAQ,oBAAoB,CAAC,sBAAsB,CAAC;IAC7F,MAAM,CAAC,QAAQ,CAAC,kBAAkB,qCAAqC;IAEvE,OAAO,CAAC,mBAAmB,CAAc;;IAOzC,MAAM,CAAC,WAAW;IAOT,KAAK,IAAI,IAAI;IAKtB,SAAS,CAAC,gBAAgB,IAAI,MAAM;IAIpC,QAAQ,CAAC,IAAI,EAAE;QACb,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,KAAK,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACzC,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,EAAE,sBAAsB,CAAC;SAClC,GACD;YACE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACzC,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CACJ,CAAC;KACH;IA4BD,YAAY,IAAI,OAAO;IAIvB,sBAAsB,IAAI,MAAM;IAI1B,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAW9E,4FAA4F;IACtF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxC,2FAA2F;IACrF,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE;YAAE,aAAa,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;QAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAapD,cAAc,IAAI,iBAAiB,GAAG,SAAS;CAahD"}

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationEnforcerRegistry = void 0;
+const singleton_realm_1 = require("../../../../helpers/singleton-realm");
+const core_1 = require("@venizia/ignis-helpers/core");
+const base_1 = require("../../base");
+const common_1 = require("../common");
+class AuthorizationEnforcerRegistry extends base_1.AbstractAuthRegistry {
+    static { this.SINGLETON_REAL_KEY = 'authorization-enforcer-registry'; }
+    constructor() {
+        super({ scope: AuthorizationEnforcerRegistry.name });
+        this.configuredEnforcers = new Set();
+    }
+    static getInstance() {
+        return singleton_realm_1.SingletonRealm.resolve({
+            key: AuthorizationEnforcerRegistry.SINGLETON_REAL_KEY,
+            create: () => new AuthorizationEnforcerRegistry(),
+        });
+    }
+    reset() {
+        super.reset();
+        this.configuredEnforcers.clear();
+    }
+    getBindingPrefix() {
+        return common_1.Authorization.ENFORCER;
+    }
+    register(opts) {
+        const { container, enforcers } = opts;
+        const names = enforcers.map(e => e.name);
+        const duplicateNames = names.filter((n, i) => names.indexOf(n) !== i);
+        if (duplicateNames.length) {
+            throw (0, core_1.getError)({
+                message: `[AuthorizationEnforcerRegistry] Duplicate enforcer name(s): ${[...new Set(duplicateNames)].join(', ')}`,
+            });
+        }
+        for (const { enforcer, name, options } of enforcers) {
+            if (this.descriptors.has(name)) {
+                throw (0, core_1.getError)({
+                    message: `[AuthorizationEnforcerRegistry] Enforcer already registered: ${name}`,
+                });
+            }
+            this.registerDescriptor({ container, target: enforcer, name });
+            if (options) {
+                container.bind({ key: common_1.AuthorizeBindingKeys.enforcerOptions(name) }).toValue(options);
+            }
+        }
+        return this;
+    }
+    hasEnforcers() {
+        return this.descriptors.size > 0;
+    }
+    getDefaultEnforcerName() {
+        return this.getDefaultName();
+    }
+    async resolveEnforcer(opts) {
+        const enforcer = this.resolveDescriptor(opts);
+        if (!this.configuredEnforcers.has(opts.name)) {
+            await enforcer.configure();
+            this.configuredEnforcers.add(opts.name);
+        }
+        return enforcer;
+    }
+    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
+    async invalidateUserCache(opts) {
+        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
+        const enforcer = await this.resolveEnforcer({ name });
+        // Cache management is an optional IAuthorizationEnforcer capability - feature-detect it.
+        if (typeof enforcer.invalidateUserCache !== 'function') {
+            throw (0, core_1.getError)({
+                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
+            });
+        }
+        return enforcer.invalidateUserCache({ user: opts.user });
+    }
+    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
+    async rebuildUserCache(opts) {
+        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
+        const enforcer = await this.resolveEnforcer({ name });
+        if (typeof enforcer.rebuildUserCache !== 'function') {
+            throw (0, core_1.getError)({
+                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
+            });
+        }
+        return enforcer.rebuildUserCache({ user: opts.user });
+    }
+    resolveOptions() {
+        for (const [, metadata] of this.descriptors) {
+            const { container } = metadata;
+            const options = container.get({
+                key: common_1.AuthorizeBindingKeys.OPTIONS,
+                isOptional: true,
+            });
+            if (options) {
+                return options;
+            }
+        }
+        return undefined;
+    }
+}
+exports.AuthorizationEnforcerRegistry = AuthorizationEnforcerRegistry;
+//# sourceMappingURL=enforcer-registry.js.map

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcer-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/enforcer-registry.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAG3D,sDAAuD;AAEvD,qCAAkD;AAQlD,sCAAgE;AAEhE,MAAa,6BAA8B,SAAQ,2BAA4C;aAC7E,uBAAkB,GAAG,iCAAiC,CAAC;IAIvE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,6BAA6B,CAAC,kBAAkB;YACrD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,6BAA6B,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAES,gBAAgB;QACxB,OAAO,sBAAa,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,IAgBR;QACC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+DAA+D,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,gEAAgE,IAAI,EAAE;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAE/D,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAsB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,mBAAmB,CAAC,IAGzB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,yFAAyF;QACzF,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,gBAAgB,CAAC,IAGtB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACpD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,cAAc;QACZ,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;YAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAoB;gBAC/C,GAAG,EAAE,6BAAoB,CAAC,OAAO;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;;AAxIH,sEAyIC"}

package/dist/cjs/base/auth/authorize/enforcers/index.d.ts

@@ -0,0 +1,2 @@
+export * from './enforcer-registry';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/enforcers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/cjs/base/auth/authorize/enforcers/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./enforcer-registry"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/enforcers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}

package/dist/cjs/base/auth/authorize/index.d.ts

@@ -0,0 +1,7 @@
+export * from './builders';
+export * from './common';
+export * from './enforcers';
+export * from './middlewares';
+export * from './models';
+export * from './providers';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/cjs/base/auth/authorize/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./builders"), exports);
+__exportStar(require("./common"), exports);
+__exportStar(require("./enforcers"), exports);
+__exportStar(require("./middlewares"), exports);
+__exportStar(require("./models"), exports);
+__exportStar(require("./providers"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,2CAAyB;AACzB,8CAA4B;AAC5B,gDAA8B;AAC9B,2CAAyB;AACzB,8CAA4B"}

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.d.ts

@@ -0,0 +1,6 @@
+import type { IAuthorizationSpec } from '../common';
+export declare const authorize: (opts: {
+    spec: IAuthorizationSpec;
+    enforcerName?: string;
+}) => import("hono").MiddlewareHandler;
+//# sourceMappingURL=authorize.middleware.d.ts.map

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.middleware.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAMpD,eAAO,MAAM,SAAS,GAAI,MAAM;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,qCAElF,CAAC"}

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorize = void 0;
+const providers_1 = require("../providers");
+const authorizationProvider = new providers_1.AuthorizationProvider();
+const authorizeFn = authorizationProvider.value();
+const authorize = (opts) => {
+    return authorizeFn(opts);
+};
+exports.authorize = authorize;
+//# sourceMappingURL=authorize.middleware.js.map

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.middleware.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":";;;AACA,4CAAqD;AAErD,MAAM,qBAAqB,GAAG,IAAI,iCAAqB,EAAE,CAAC;AAC1D,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAE3C,MAAM,SAAS,GAAG,CAAC,IAAyD,EAAE,EAAE;IACrF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAFW,QAAA,SAAS,aAEpB"}

package/dist/cjs/base/auth/authorize/middlewares/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorize.middleware';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/middlewares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/cjs/base/auth/authorize/middlewares/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authorize.middleware"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC"}

package/dist/cjs/base/auth/authorize/models/authorization-role.model.d.ts

@@ -0,0 +1,30 @@
+import type { IAuthorizationRole } from '../common';
+export declare class AuthorizationRole implements IAuthorizationRole {
+    readonly name: string;
+    readonly priority: number;
+    readonly delimiter: string;
+    static build(opts: {
+        name: string;
+        priority: number;
+        delimiter?: string;
+    }): AuthorizationRole;
+    constructor(opts: {
+        name: string;
+        priority: number;
+        delimiter?: string;
+    });
+    get identifier(): string;
+    compare(opts: {
+        target: IAuthorizationRole;
+    }): number;
+    isHigherThan(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+    isLowerThan(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+    isEqualTo(opts: {
+        target: IAuthorizationRole;
+    }): boolean;
+}
+//# sourceMappingURL=authorization-role.model.d.ts.map

package/dist/cjs/base/auth/authorize/models/authorization-role.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-role.model.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;gBAIjF,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM;IAIrD,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI3D,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI1D,SAAS,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;CAGzD"}

package/dist/cjs/base/auth/authorize/models/authorization-role.model.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationRole = void 0;
+class AuthorizationRole {
+    static build(opts) {
+        return new AuthorizationRole(opts);
+    }
+    constructor(opts) {
+        this.name = opts.name;
+        this.priority = opts.priority;
+        this.delimiter = opts.delimiter ?? '_';
+    }
+    get identifier() {
+        return [String(this.priority).padStart(3, '0'), this.name].join(this.delimiter);
+    }
+    compare(opts) {
+        return this.priority - opts.target.priority;
+    }
+    isHigherThan(opts) {
+        return this.compare(opts) > 0;
+    }
+    isLowerThan(opts) {
+        return this.compare(opts) < 0;
+    }
+    isEqualTo(opts) {
+        return this.compare(opts) === 0;
+    }
+}
+exports.AuthorizationRole = AuthorizationRole;
+//# sourceMappingURL=authorization-role.model.js.map

package/dist/cjs/base/auth/authorize/models/authorization-role.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-role.model.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":";;;AAEA,MAAa,iBAAiB;IAK5B,MAAM,CAAC,KAAK,CAAC,IAA4D;QACvE,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,IAA4D;QACtE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IACzC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,IAAoC;QAC1C,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,IAAoC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,IAAoC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,IAAoC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAlCD,8CAkCC"}

package/dist/cjs/base/auth/authorize/models/index.d.ts

@@ -0,0 +1,2 @@
+export * from './authorization-role.model';
+//# sourceMappingURL=index.d.ts.map