@venizia/ignis-kernel 0.2.0-4 → 0.2.0-40

package/dist/cjs/base/auth/authenticate/common/types/service.d.ts

@@ -0,0 +1,95 @@
+import type { TContext } from '../../../../controllers/common/types';
+import type { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { Env } from 'hono';
+import type { JWTPayload } from 'jose';
+import type { TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';
+import type { IAuthUser } from './strategy';
+/**
+ * The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed
+ * against a different method or path.
+ *
+ * `htu` is the percent-ENCODED pathname on both ends. Compare it against
+ * `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,
+ * so any route carrying a space or a non-ASCII slug would never match what the caller signed.
+ */
+export interface IServiceAssertionClaims extends JWTPayload {
+    htm: string;
+    htu: string;
+}
+/**
+ * One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.
+ */
+export type TServiceCallerEntry = string | {
+    jwksUrl: string;
+    /** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */
+    acceptMaxAgeSeconds?: number;
+};
+/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */
+export interface IServiceAuthOptions<E extends Env = Env> {
+    /** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */
+    name: string;
+    /**
+     * Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is
+     * mounted - which is the common case, since most services are called and never call.
+     */
+    keys?: {
+        driver: TJWKSKeyDriver;
+        format: TJWKSKeyFormat;
+        /** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */
+        private: string;
+        public: string;
+        kid?: string;
+    };
+    /**
+     * Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot
+     * call, and an empty map correctly allows nobody.
+     *
+     * The bare-string form is the common case. The object form exists to widen the accepted age for
+     * ONE caller: a nightly batch may legitimately need more slack than an interactive service, and
+     * granting it per caller keeps the concession named and visible in config.
+     */
+    callers?: Record<string, TServiceCallerEntry>;
+    /** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */
+    rest?: {
+        path: string;
+    };
+    /**
+     * How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.
+     */
+    signLifetimeSeconds?: number;
+    /**
+     * The oldest assertion this service ACCEPTS, measured from `iat`.
+     *
+     * Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the
+     * caller. The caller already controls `exp` - it signs the token - so this is the only bound that
+     * survives a compromised caller. A per-caller override belongs in {@link callers}, never in the
+     * assertion.
+     *
+     * Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.
+     */
+    acceptMaxAgeSeconds?: number;
+    /**
+     * Clock skew allowance. A SECURITY knob, not an operational one.
+     *
+     * Its job is the future case: two machines never agree to the second, and without it a caller one
+     * second ahead is refused outright. But it also widens the REPLAY window second for second - a
+     * callee accepting an `iat` 5s in its own future keeps accepting that token for the rest of the
+     * window too. Measured at the defaults: 65s accepted on our clock, 70s of wall-clock life for a
+     * capture minted by a caller running the full tolerance fast.
+     */
+    clockToleranceSeconds?: number;
+    jwks?: {
+        cacheMaxAgeMs?: number;
+        cooldownMs?: number;
+    };
+    /**
+     * WHO a verified assertion acts as. The framework has already proven the caller; this only maps a
+     * caller name onto an application principal. Return `null` to refuse a caller the allowlist
+     * admits but the application does not recognise.
+     */
+    resolvePrincipal: (opts: {
+        issuer: string;
+        context: TContext<E, string>;
+    }) => ValueOrPromise<TNullable<IAuthUser>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACtD,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;CAC5C"}

package/dist/cjs/base/auth/authenticate/common/types/service.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=service.js.map

package/dist/cjs/base/auth/authenticate/common/types/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/strategy.d.ts

@@ -0,0 +1,26 @@
+import type { TContext } from '../../../../controllers/common/types';
+import type { IdType } from '../../../../models/common';
+import type { AnyObject } from '@venizia/ignis-helpers/common';
+import type { Env, MiddlewareHandler } from 'hono';
+import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../../models/requests';
+import type { TAuthMode } from '../constants';
+export interface IAuthUser {
+    userId: IdType;
+    [extra: string | symbol]: any;
+}
+export interface IAuthenticationStrategy<E extends Env = Env> {
+    name: string;
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
+    strategies: string[];
+    mode?: TAuthMode;
+}) => MiddlewareHandler<RouteEnv>;
+export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
+    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
+    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
+    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
+    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
+    refreshToken?(context: TContext<E>): Promise<RTRS>;
+}
+//# sourceMappingURL=strategy.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/cjs/base/auth/authenticate/common/types/strategy.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=strategy.js.map

package/dist/cjs/base/auth/authenticate/common/types/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authorize/builders/grant.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { type TNullable } from '@venizia/ignis-helpers/common';
 import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common';

package/dist/cjs/base/auth/authorize/builders/permission.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import type { TNullable } from '@venizia/ignis-helpers/common';
 import type { TAuthorizationAction } from '../common/constants';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts

@@ -1,15 +1,49 @@
-import type { IdType } from '../../../../base';
+import type { IdType } from '../../..';
 import type { TNullable } from '@venizia/ignis-helpers/common';
 import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';
+import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants';
 /** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
 export type TPolicyDomainInput = string | {
     type: string;
     id: IdType;
 };
+/**
+ * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its
+ * literal members widen to `string` when a method's return type is inferred rather than declared.
+ * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.
+ * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes
+ * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.
+ */
+type TBuilderGrantRow = {
+    variant: typeof AuthorizationPolicyVariants.GRANT.action;
+    subjectType: string;
+    subjectId: IdType;
+    targetType: string;
+    targetId: IdType;
+    action: string;
+    effect: TAuthorizationDecision;
+    domainType: TNullable<string>;
+    domainId: TNullable<IdType>;
+};
+/**
+ * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read
+ * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own
+ * metadata has a different shape points the adapter at a different column
+ * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.
+ *
+ * Declared here, beside the only writer, so the column type and the row type cannot drift.
+ */
+export type TSubsetGrantMetadata = {
+    ops: string[];
+};
+type TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {
+    action: typeof AuthorizationActions.CUSTOM;
+    metadata: TSubsetGrantMetadata;
+};
 export declare class AuthorizationPolicyBuilder {
     static readonly ACTION_PRINCIPAL = "Action";
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    private static serializeDomain;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    private static splitDomain;
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts: {
         subject: {
@@ -23,16 +57,7 @@ export declare class AuthorizationPolicyBuilder {
         action: string;
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    };
+    }): TBuilderGrantRow;
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
     static customGrant(opts: {
         subject: {
@@ -46,19 +71,7 @@ export declare class AuthorizationPolicyBuilder {
         ops: string[];
         domain?: TNullable<TPolicyDomainInput>;
         effect: TAuthorizationDecision;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-        metadata: {
-            ops: string[];
-        };
-    };
+    }): TBuilderCustomGrantRow;
     /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
     static assignRole(opts: {
         user: {
@@ -71,12 +84,13 @@ export declare class AuthorizationPolicyBuilder {
         };
         domain?: TNullable<TPolicyDomainInput>;
     }): {
+        domainType: TNullable<string>;
+        domainId: TNullable<IdType>;
         variant: "assign_role";
         subjectType: string;
         subjectId: IdType;
         targetType: string;
         targetId: IdType;
-        domain: TNullable<string>;
     };
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
     static joinDomain(opts: {
@@ -181,15 +195,7 @@ export declare class AuthorizationPolicyBuilder {
             domain?: TNullable<TPolicyDomainInput>;
             effect: TAuthorizationDecision;
         }>;
-    }): {
-        variant: "grant";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-        action: string;
-        effect: string;
-        domain: TNullable<string>;
-    }[];
+    }): TBuilderGrantRow[];
 }
+export {};
 //# sourceMappingURL=policy.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,yNAAyN;IACzN,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;IAaD,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC;;;;;;;;;;;;;IAcD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;;;;;;;;IAWD,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;;;;;;;;;;CAsBF"}
+{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,oBAAoB,EAEpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IAC/D,MAAM,EAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,sJAAsJ;IACtJ,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,gBAAgB;IAapB,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,sBAAsB;IAc1B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;oBA5Da,SAAS,CAAC,MAAM,CAAC;kBACnB,SAAS,CAAC,MAAM,CAAC;;;;;;;IAsE7B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;CAsBF"}

package/dist/cjs/base/auth/authorize/builders/policy.builder.js

@@ -4,15 +4,15 @@ exports.AuthorizationPolicyBuilder = void 0;
 const constants_1 = require("../common/constants");
 class AuthorizationPolicyBuilder {
     static { this.ACTION_PRINCIPAL = 'Action'; }
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    static serializeDomain(domain) {
-        if (domain == null) {
-            return null;
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
+    static splitDomain(domain) {
+        if (domain == null || domain === constants_1.AuthorizationDomainScopes.ANY_MEMBER) {
+            return { domainType: null, domainId: null };
         }
         if (typeof domain === 'string') {
-            return domain;
+            return { domainType: domain, domainId: null };
         }
-        return [domain.type, domain.id].join('_');
+        return { domainType: domain.type, domainId: domain.id };
     }
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts) {
@@ -24,7 +24,7 @@ class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: opts.action,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
@@ -37,7 +37,7 @@ class AuthorizationPolicyBuilder {
             targetId: opts.permission.id,
             action: constants_1.AuthorizationActions.CUSTOM,
             effect: opts.effect,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
             metadata: { ops: opts.ops },
         };
     }
@@ -49,7 +49,7 @@ class AuthorizationPolicyBuilder {
             subjectId: opts.user.id,
             targetType: opts.role.type,
             targetId: opts.role.id,
-            domain: AuthorizationPolicyBuilder.serializeDomain(opts.domain),
+            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
         };
     }
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */

package/dist/cjs/base/auth/authorize/builders/policy.builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAAwF;AAKxF,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,yNAAyN;IACjN,MAAM,CAAC,eAAe,CAAC,MAAsC;QACnE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AApLH,gEAqLC"}
+{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAI6B;AAuC7B,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,qCAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AAvLH,gEAwLC"}

package/dist/cjs/base/auth/authorize/common/{constants.d.ts → constants/authorization.d.ts}

@@ -1,5 +1,5 @@
 import type { TConstValue } from '@venizia/ignis-helpers/common';
-import { AuthorizationRole } from '../models/authorization-role.model';
+import { AuthorizationRole } from '../../models/authorization-role.model';
 export declare class Authorization {
     static readonly RULES = "authorization.rules";
     static readonly SKIP_AUTHORIZATION = "authorization.skip";
@@ -44,41 +44,6 @@ export declare class AuthorizationRoles {
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
-export declare class AuthorizationEnforcerTypes {
-    static readonly CASBIN = "casbin";
-    static readonly CUSTOM = "custom";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationEnforcerType = TConstValue<typeof AuthorizationEnforcerTypes>;
-export declare class CasbinEnforcerCachedDrivers {
-    static readonly REDIS = "redis";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerCachedDriver = TConstValue<typeof CasbinEnforcerCachedDrivers>;
-export declare class CasbinEnforcerModelDrivers {
-    static readonly FILE = "file";
-    static readonly TEXT = "text";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinEnforcerModelDriver = TConstValue<typeof CasbinEnforcerModelDrivers>;
-export declare class CasbinDomainMatchingFunctions {
-    /** `*` is the only wildcard; exact compare otherwise. Safest for `Merchant_<uuid>` domains. */
-    static readonly KEY_MATCH = "keyMatch";
-    /** Adds URL-path `:param` segment matching. */
-    static readonly KEY_MATCH_2 = "keyMatch2";
-    /** Adds `{param}` segment matching. */
-    static readonly KEY_MATCH_3 = "keyMatch3";
-    /** `{param}` matching with repeated-name equality checks. */
-    static readonly KEY_MATCH_4 = "keyMatch4";
-    /** Treats the stored/policy value as a full regular expression. */
-    static readonly REGEX_MATCH = "regexMatch";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TCasbinDomainMatchingFunction = TConstValue<typeof CasbinDomainMatchingFunctions>;
 export declare class AuthorizationDomainScopes {
     /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
     static readonly ANY_MEMBER = "ANY_MEMBER";
@@ -88,23 +53,6 @@ export declare class AuthorizationDomainScopes {
     static isValid(input: string): boolean;
 }
 export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
-/** Relation prefixes the Casbin MODEL declares (`p` + `g`..`g5`), which {@link AuthorizationPolicyVariants} maps onto (many app edge-types -> one rule). Keep in sync with the model's `[role_definition]`. */
-export declare class CasbinRuleVariants {
-    /** Permission policy line. */
-    static readonly P = "p";
-    /** Numbered in request-tuple order (sub -> dom -> obj -> act): g (sub), g2/g3 (dom), g4 (obj), g5 (act). */
-    /** Grouping #1 - role membership + role inheritance (user→role, role→role). The `sub` axis. */
-    static readonly G = "g";
-    /** Grouping #2 - user→domain membership (join_domain). The `dom` axis (membership). */
-    static readonly G2 = "g2";
-    /** Grouping #3 - domain hierarchy. The `dom` axis (nesting). */
-    static readonly G3 = "g3";
-    /** Grouping #4 - resource hierarchy. The `obj` axis. */
-    static readonly G4 = "g4";
-    /** Grouping #5 - action hierarchy. The `act` axis. */
-    static readonly G5 = "g5";
-}
-export type TCasbinRuleVariant = TConstValue<typeof CasbinRuleVariants>;
 /** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
 export declare class AuthorizationPolicyVariants {
     /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
@@ -142,15 +90,34 @@ export declare class AuthorizationPolicyVariants {
         readonly action: "action_inherits";
         readonly rule: "g5";
     };
+    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
+    static readonly ALL: readonly [{
+        readonly action: "grant";
+        readonly rule: "p";
+    }, {
+        readonly action: "assign_role";
+        readonly rule: "g";
+    }, {
+        readonly action: "role_inherits";
+        readonly rule: "g";
+    }, {
+        readonly action: "join_domain";
+        readonly rule: "g2";
+    }, {
+        readonly action: "domain_inherits";
+        readonly rule: "g3";
+    }, {
+        readonly action: "resource_inherits";
+        readonly rule: "g4";
+    }, {
+        readonly action: "action_inherits";
+        readonly rule: "g5";
+    }];
     static readonly ACTION_SCHEME_SET: Set<string>;
     static readonly RULE_SCHEME_SET: Set<string>;
     static isValidAction(input: string): boolean;
     static isValidRule(input: string): boolean;
 }
-export type TAuthorizationPolicyVariant = TConstValue<typeof AuthorizationPolicyVariants>;
-export declare class AuthorizeBindingKeys {
-    static readonly OPTIONS = "@app/authorize/options";
-    static readonly ALWAYS_ALLOW_ROLES = "@app/authorize/always-allow-roles";
-    static enforcerOptions(name: string): string;
-}
-//# sourceMappingURL=constants.d.ts.map
+/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
+export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
+//# sourceMappingURL=authorization.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAA+D;IAEhG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA6D;IAE5F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC"}