@venizia/ignis-kernel 0.2.0-4 → 0.2.0-40

package/dist/esm/base/auth/authenticate/common/types/strategy.d.ts

@@ -0,0 +1,26 @@
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import type { IdType } from '../../../../models/common/index.js';
+import type { AnyObject } from '@venizia/ignis-helpers/common';
+import type { Env, MiddlewareHandler } from 'hono';
+import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../../models/requests/index.js';
+import type { TAuthMode } from '../constants/index.js';
+export interface IAuthUser {
+    userId: IdType;
+    [extra: string | symbol]: any;
+}
+export interface IAuthenticationStrategy<E extends Env = Env> {
+    name: string;
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
+    strategies: string[];
+    mode?: TAuthMode;
+}) => MiddlewareHandler<RouteEnv>;
+export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
+    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
+    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
+    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
+    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
+    refreshToken?(context: TContext<E>): Promise<RTRS>;
+}
+//# sourceMappingURL=strategy.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/esm/base/auth/authenticate/common/types/strategy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=strategy.js.map

package/dist/esm/base/auth/authenticate/common/types/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authorize/builders/grant.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { type TNullable } from '@venizia/ignis-helpers/common';
 import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common/index.js';

package/dist/esm/base/auth/authorize/builders/permission.builder.d.ts

@@ -1,6 +1,6 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction } from '../common/constants.js';
+import type { TAuthorizationAction } from '../common/constants/index.js';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
 export declare class AuthorizationPermissionBuilder {
     /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */

package/dist/esm/base/auth/authorize/builders/permission.builder.js

@@ -1,4 +1,4 @@
-import { AuthorizationActions } from '../common/constants.js';
+import { AuthorizationActions } from '../common/constants/index.js';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
 export class AuthorizationPermissionBuilder {
     /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */

package/dist/esm/base/auth/authorize/builders/policy.builder.d.ts

@@ -1,15 +1,49 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants.js';
+import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants/index.js';
+import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants/index.js';
 /** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
 export type TPolicyDomainInput = string | {
     type: string;
     id: IdType;
 };
+/**
+ * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its
+ * literal members widen to `string` when a method's return type is inferred rather than declared.
+ * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.
+ * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes
+ * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.
+ */
+type TBuilderGrantRow = {
+    variant: typeof AuthorizationPolicyVariants.GRANT.action;
+    subjectType: string;
+    subjectId: IdType;
+    targetType: string;
+    targetId: IdType;
+    action: string;
+    effect: TAuthorizationDecision;
+    domainType: TNullable<string>;
+    domainId: TNullable<IdType>;
+};
+/**
+ * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read
+ * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own
+ * metadata has a different shape points the adapter at a different column
+ * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.
+ *
+ * Declared here, beside the only writer, so the column type and the row type cannot drift.
+ */
+export type TSubsetGrantMetadata = {
+    ops: string[];
+};
+type TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {
+    action: typeof AuthorizationActions.CUSTOM;
+    metadata: TSubsetGrantMetadata;
+};
 export declare class AuthorizationPolicyBuilder {
     static readonly ACTION_PRINCIPAL = "Action";
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    private static serializeDomain;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    private static splitDomain;
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts: {
         subject: {
@@ -23,16 +57,7 @@ export declare class AuthorizationPolicyBuilder {
         action: string;
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    };
+    }): TBuilderGrantRow;
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
     static customGrant(opts: {
         subject: {
@@ -46,19 +71,7 @@ export declare class AuthorizationPolicyBuilder {
         ops: string[];
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-        metadata: {
-            ops: string[];
-        };
-    };
+    }): TBuilderCustomGrantRow;
     /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
     static assignRole(opts: {
         user: {
@@ -71,12 +84,13 @@ export declare class AuthorizationPolicyBuilder {
         };
         domain?: TNullable<TPolicyDomainInput>;
     }): {
+        domainType: TNullable<string>;
+        domainId: TNullable<IdType>;
         variant: "assign_role";
         subjectType: string;
         subjectId: IdType;
         targetType: string;
         targetId: IdType;
-        domain: TNullable<string>;
     };
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
     static joinDomain(opts: {
@@ -181,15 +195,7 @@ export declare class AuthorizationPolicyBuilder {
             domain?: TNullable<TPolicyDomainInput>;
             effect: TAuthorizationDecision;
         }>;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    }[];
+    }): TBuilderGrantRow[];
 }
+export {};
 //# sourceMappingURL=policy.builder.d.ts.map

package/dist/esm/base/auth/authorize/builders/policy.builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,yNAAyN;IACzN,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;IAaD,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;;;;IAcD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;;;;;;;;IAWD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;;;;;;;;;;CAsBF"}
+{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,oBAAoB,EAEpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IAC/D,MAAM,EAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,sJAAsJ;IACtJ,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,gBAAgB;IAapB,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,sBAAsB;IAc1B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;oBA5Da,SAAS,CAAC,MAAM,CAAC;kBACnB,SAAS,CAAC,MAAM,CAAC;;;;;;;IAsE7B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;CAsBF"}

package/dist/esm/base/auth/authorize/builders/policy.builder.js

@@ -1,15 +1,15 @@
-import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants.js';
+import { AuthorizationActions, AuthorizationDomainScopes, AuthorizationPolicyVariants, } from '../common/constants/index.js';
 export class AuthorizationPolicyBuilder {
     static { this.ACTION_PRINCIPAL = 'Action'; }
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    static serializeDomain(domain) {
-        if (domain == null) {
-            return null;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    static splitDomain(domain) {
+        if (domain == null || domain === AuthorizationDomainScopes.ANY_MEMBER) {
+            return { domainType: null, domainId: null };
         }
         if (typeof domain === 'string') {
-            return domain;
+            return { domainType: domain, domainId: null };
         }
-        return [domain.type, domain.id].join('_');
+        return { domainType: domain.type, domainId: domain.id };
     }
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts) {
@@ -21,7 +21,7 @@ export class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: opts.action,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
@@ -34,7 +34,7 @@ export class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: AuthorizationActions.CUSTOM,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
             metadata: { ops: opts.ops },
         };
     }
@@ -46,7 +46,7 @@ export class AuthorizationPolicyBuilder {
             subjectId: opts.user.id,
             targetType: opts.role.type,
             targetId: opts.role.id,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */

package/dist/esm/base/auth/authorize/builders/policy.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAKxF,MAAM,OAAO,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,yNAAyN;IACjN,MAAM,CAAC,eAAe,CAAC,MAAsC;QACnE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,oBAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC"}
+{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAuC7B,MAAM,OAAO,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,yBAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,oBAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,2BAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC"}

package/dist/esm/base/auth/authorize/common/{constants.d.ts → constants/authorization.d.ts}

@@ -1,5 +1,5 @@
 import type { TConstValue } from '@venizia/ignis-helpers/common';
-import { AuthorizationRole } from '../models/authorization-role.model.js';
+import { AuthorizationRole } from '../../models/authorization-role.model.js';
 export declare class Authorization {
     static readonly RULES = "authorization.rules";
     static readonly SKIP_AUTHORIZATION = "authorization.skip";
@@ -44,41 +44,6 @@ export declare class AuthorizationRoles {
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
-export declare class AuthorizationEnforcerTypes {
-    static readonly CASBIN = "casbin";
-    static readonly CUSTOM = "custom";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
-export declare class CasbinEnforcerCachedDrivers {
-    static readonly REDIS = "redis";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
-export declare class CasbinEnforcerModelDrivers {
-    static readonly FILE = "file";
-    static readonly TEXT = "text";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
-export declare class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static readonly KEY_MATCH = "keyMatch";
-    /** Adds URL-path `:param` segment matching. */
-    static readonly KEY_MATCH_2 = "keyMatch2";
-    /** Adds `{param}` segment matching. */
-    static readonly KEY_MATCH_3 = "keyMatch3";
-    /** `{param}` matching with repeated-name equality checks. */
-    static readonly KEY_MATCH_4 = "keyMatch4";
-    /** Treats the stored/policy value as a full regular expression. */
-    static readonly REGEX_MATCH = "regexMatch";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
 export declare class AuthorizationDomainScopes {
     /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
     static readonly ANY_MEMBER = "ANY_MEMBER";
@@ -88,23 +53,6 @@ export declare class AuthorizationDomainScopes {
     static isValid(input: string): boolean;
 }
 export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export declare class CasbinRuleVariants {
-    /** Permission policy line. */
-    static readonly P = "p";
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static readonly G = "g";
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static readonly G2 = "g2";
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static readonly G3 = "g3";
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static readonly G4 = "g4";
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static readonly G5 = "g5";
-}
-export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
 /** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
 export declare class AuthorizationPolicyVariants {
     /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
@@ -142,15 +90,34 @@ export declare class AuthorizationPolicyVariants {
         readonly action: "action_inherits";
         readonly rule: "g5";
     };
+    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
+    static readonly ALL: readonly [{
+        readonly action: "grant";
+        readonly rule: "p";
+    }, {
+        readonly action: "assign_role";
+        readonly rule: "g";
+    }, {
+        readonly action: "role_inherits";
+        readonly rule: "g";
+    }, {
+        readonly action: "join_domain";
+        readonly rule: "g2";
+    }, {
+        readonly action: "domain_inherits";
+        readonly rule: "g3";
+    }, {
+        readonly action: "resource_inherits";
+        readonly rule: "g4";
+    }, {
+        readonly action: "action_inherits";
+        readonly rule: "g5";
+    }];
     static readonly ACTION_SCHEME_SET: Set<string>;
     static readonly RULE_SCHEME_SET: Set<string>;
     static isValidAction(input: string): boolean;
     static isValidRule(input: string): boolean;
 }
-export type TAuthorizationPolicyVariant = TConstValue<typeof AuthorizationPolicyVariants>;
-export declare class AuthorizeBindingKeys {
-    static readonly OPTIONS = "@app/authorize/options";
-    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
-    static enforcerOptions(name: string): string;
-}
-//# sourceMappingURL=constants.d.ts.map
+/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
+export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
+//# sourceMappingURL=authorization.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAA+D;IAEhG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA6D;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC"}

package/dist/esm/base/auth/authorize/common/{constants.js → constants/authorization.js}

@@ -1,4 +1,5 @@
-import { AuthorizationRole } from '../models/authorization-role.model.js';
+import { AuthorizationRole } from '../../models/authorization-role.model.js';
+import { CasbinRuleVariants } from './enforcer.js';
 export class Authorization {
     static { this.RULES = 'authorization.rules'; }
     static { this.SKIP_AUTHORIZATION = 'authorization.skip'; }
@@ -96,51 +97,6 @@ export class AuthorizationRoles {
         return this.SCHEME_SET.has(input);
     }
 }
-export class AuthorizationEnforcerTypes {
-    static { this.CASBIN = 'casbin'; }
-    static { this.CUSTOM = 'custom'; }
-    static { this.SCHEME_SET = new Set([this.CASBIN, this.CUSTOM]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinEnforcerCachedDrivers {
-    static { this.REDIS = 'redis'; }
-    static { this.SCHEME_SET = new Set([this.REDIS]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinEnforcerModelDrivers {
-    static { this.FILE = 'file'; }
-    static { this.TEXT = 'text'; }
-    static { this.SCHEME_SET = new Set([this.FILE, this.TEXT]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static { this.KEY_MATCH = 'keyMatch'; }
-    /** Adds URL-path `:param` segment matching. */
-    static { this.KEY_MATCH_2 = 'keyMatch2'; }
-    /** Adds `{param}` segment matching. */
-    static { this.KEY_MATCH_3 = 'keyMatch3'; }
-    /** `{param}` matching with repeated-name equality checks. */
-    static { this.KEY_MATCH_4 = 'keyMatch4'; }
-    /** Treats the stored/policy value as a full regular expression. */
-    static { this.REGEX_MATCH = 'regexMatch'; }
-    static { this.SCHEME_SET = new Set([
-        this.KEY_MATCH,
-        this.KEY_MATCH_2,
-        this.KEY_MATCH_3,
-        this.KEY_MATCH_4,
-        this.REGEX_MATCH,
-    ]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
 export class AuthorizationDomainScopes {
     /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
     static { this.ANY_MEMBER = 'ANY_MEMBER'; }
@@ -151,22 +107,6 @@ export class AuthorizationDomainScopes {
         return this.SCHEME_SET.has(input);
     }
 }
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export class CasbinRuleVariants {
-    /** Permission policy line. */
-    static { this.P = 'p'; }
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static { this.G = 'g'; }
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static { this.G2 = 'g2'; }
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static { this.G3 = 'g3'; }
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static { this.G4 = 'g4'; }
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static { this.G5 = 'g5'; }
-}
 /** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
 export class AuthorizationPolicyVariants {
     /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
@@ -192,24 +132,18 @@ export class AuthorizationPolicyVariants {
         action: 'action_inherits',
         rule: CasbinRuleVariants.G5,
     }; }
-    static { this.ACTION_SCHEME_SET = new Set([
-        this.GRANT.action.toString(),
-        this.ASSIGN_ROLE.action.toString(),
-        this.ROLE_INHERITS.action.toString(),
-        this.JOIN_DOMAIN.action.toString(),
-        this.DOMAIN_INHERITS.action.toString(),
-        this.RESOURCE_INHERITS.action.toString(),
-        this.ACTION_INHERITS.action.toString(),
-    ]); }
-    static { this.RULE_SCHEME_SET = new Set([
-        this.GRANT.rule.toString(),
-        this.ASSIGN_ROLE.rule.toString(),
-        this.ROLE_INHERITS.rule.toString(),
-        this.JOIN_DOMAIN.rule.toString(),
-        this.DOMAIN_INHERITS.rule.toString(),
-        this.RESOURCE_INHERITS.rule.toString(),
-        this.ACTION_INHERITS.rule.toString(),
-    ]); }
+    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
+    static { this.ALL = [
+        this.GRANT,
+        this.ASSIGN_ROLE,
+        this.ROLE_INHERITS,
+        this.JOIN_DOMAIN,
+        this.DOMAIN_INHERITS,
+        this.RESOURCE_INHERITS,
+        this.ACTION_INHERITS,
+    ]; }
+    static { this.ACTION_SCHEME_SET = new Set(this.ALL.map(variant => variant.action.toString())); }
+    static { this.RULE_SCHEME_SET = new Set(this.ALL.map(variant => variant.rule.toString())); }
     static isValidAction(input) {
         return this.ACTION_SCHEME_SET.has(input);
     }
@@ -217,11 +151,4 @@ export class AuthorizationPolicyVariants {
         return this.RULE_SCHEME_SET.has(input);
     }
 }
-export class AuthorizeBindingKeys {
-    static { this.OPTIONS = '@app/authorize/options'; }
-    static { this.ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles'; }
-    static enforcerOptions(name) {
-        return `@app/authorize/enforcers/${name}/options`;
-    }
-}
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=authorization.js.map

package/dist/esm/base/auth/authorize/common/constants/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,OAAO,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAGlD,MAAM,OAAO,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAIH,MAAM,OAAO,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AAIH,MAAM,OAAO,kBAAkB;aACb,gBAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAGH,MAAM,OAAO,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAIH,sRAAsR;AACtR,MAAM,OAAO,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,kBAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAEhF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/binding-keys.d.ts

@@ -0,0 +1,6 @@
+export declare class AuthorizeBindingKeys {
+    static readonly OPTIONS = "@app/authorize/options";
+    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
+    static enforcerOptions(name: string): string;
+}
+//# sourceMappingURL=binding-keys.d.ts.map

package/dist/esm/base/auth/authorize/common/constants/binding-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-keys.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,4BAA4B;IACnD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uCAAuC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7C"}

package/dist/esm/base/auth/authorize/common/constants/binding-keys.js

@@ -0,0 +1,8 @@
+export class AuthorizeBindingKeys {
+    static { this.OPTIONS = '@app/authorize/options'; }
+    static { this.ALWAYS_ALLOW_ROLES = '@app/authorize/always-allow-roles'; }
+    static enforcerOptions(name) {
+        return `@app/authorize/enforcers/${name}/options`;
+    }
+}
+//# sourceMappingURL=binding-keys.js.map

package/dist/esm/base/auth/authorize/common/constants/binding-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-keys.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/binding-keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,oBAAoB;aACf,YAAO,GAAG,wBAAwB,CAAC;aACnC,uBAAkB,GAAG,mCAAmC,CAAC;IAEzE,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,4BAA4B,IAAI,UAAU,CAAC;IACpD,CAAC"}

package/dist/esm/base/auth/authorize/common/constants/enforcer.d.ts

@@ -0,0 +1,54 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+export declare class AuthorizationEnforcerTypes {
+    static readonly CASBIN = "casbin";
+    static readonly CUSTOM = "custom";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
+export declare class CasbinEnforcerCachedDrivers {
+    static readonly REDIS = "redis";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
+export declare class CasbinEnforcerModelDrivers {
+    static readonly FILE = "file";
+    static readonly TEXT = "text";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
+export declare class CasbinDomainMatchingFunctions {
+    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
+    static readonly KEY_MATCH = "keyMatch";
+    /** Adds URL-path `:param` segment matching. */
+    static readonly KEY_MATCH_2 = "keyMatch2";
+    /** Adds `{param}` segment matching. */
+    static readonly KEY_MATCH_3 = "keyMatch3";
+    /** `{param}` matching with repeated-name equality checks. */
+    static readonly KEY_MATCH_4 = "keyMatch4";
+    /** Treats the stored/policy value as a full regular expression. */
+    static readonly REGEX_MATCH = "regexMatch";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
+/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
+export declare class CasbinRuleVariants {
+    /** Permission policy line. */
+    static readonly P = "p";
+    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
+    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
+    static readonly G = "g";
+    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
+    static readonly G2 = "g2";
+    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
+    static readonly G3 = "g3";
+    /** Grouping #4 - resource hierarchy. The `obj` axis. */
+    static readonly G4 = "g4";
+    /** Grouping #5 - action hierarchy. The `act` axis. */
+    static readonly G5 = "g5";
+}
+export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
+//# sourceMappingURL=enforcer.d.ts.map