npm - @venizia/ignis-kernel - Versions diffs - 0.4.1 → 0.4.3 - Mend

@venizia/ignis-kernel 0.4.1 → 0.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (183) hide show

package/dist/cjs/base/auth/authenticate/common/constants/jose.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jose.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":";;;AAEA,MAAa,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,sCASC;AAID,MAAa,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,8BASC;AAID,MAAa,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID,MAAa,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\n\nexport class JOSEStandards {\n static readonly JWS = 'JWS';\n static readonly JWKS = 'JWKS';\n\n static readonly SCHEME_SET = new Set([this.JWS, this.JWKS]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJOSEStandard = TConstValue<typeof JOSEStandards>;\n\nexport class JWKSModes {\n static readonly ISSUER = 'issuer';\n static readonly VERIFIER = 'verifier';\n\n static readonly SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSMode = TConstValue<typeof JWKSModes>;\n\nexport class JWKSKeyDrivers {\n static readonly TEXT = 'text';\n static readonly FILE = 'file';\n\n static readonly SCHEME_SET = new Set([this.TEXT, this.FILE]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;\n\nexport class JWKSKeyFormats {\n static readonly PEM = 'pem';\n static readonly JWK = 'jwk';\n\n static readonly SCHEME_SET = new Set([this.PEM, this.JWK]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;\n"]}
1	+ {"version":3,"file":"jose.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":";;;AAEA,MAAa,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,sCASC;AAID,MAAa,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,8BASC;AAID,MAAa,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID,MAAa,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID,qDAAqD;AACrD,MAAa,cAAc;aACT,UAAK,GAAG,OAAO,CAAC;aAChB,UAAK,GAAG,OAAO,CAAC;aAChB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AATH,wCAUC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\n\nexport class JOSEStandards {\n static readonly JWS = 'JWS';\n static readonly JWKS = 'JWKS';\n\n static readonly SCHEME_SET = new Set([this.JWS, this.JWKS]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJOSEStandard = TConstValue<typeof JOSEStandards>;\n\nexport class JWKSModes {\n static readonly ISSUER = 'issuer';\n static readonly VERIFIER = 'verifier';\n\n static readonly SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSMode = TConstValue<typeof JWKSModes>;\n\nexport class JWKSKeyDrivers {\n static readonly TEXT = 'text';\n static readonly FILE = 'file';\n\n static readonly SCHEME_SET = new Set([this.TEXT, this.FILE]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;\n\nexport class JWKSKeyFormats {\n static readonly PEM = 'pem';\n static readonly JWK = 'jwk';\n\n static readonly SCHEME_SET = new Set([this.PEM, this.JWK]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;\n\n/** The signing algorithms a JWKS issuer supports. /\nexport class JWKSAlgorithms {\n static readonly ES256 = 'ES256';\n static readonly RS256 = 'RS256';\n static readonly EDDSA = 'EdDSA';\n\n static readonly SCHEME_SET = new Set<string>([this.ES256, this.RS256, this.EDDSA]);\n\n static isValid(value: string): boolean {\n return this.SCHEME_SET.has(value);\n }\n}\n\n/* Valid JWKS algorithm values. */\nexport type TJWKSAlgorithm = TConstValue<typeof JWKSAlgorithms>;\n"]}

package/dist/cjs/base/auth/authenticate/common/types/jwt.d.ts CHANGED Viewed

@@ -2,7 +2,7 @@ import type { IdType } from '../../../../models/common';
 import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
 import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
 import type { JWTPayload } from 'jose';
-import type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';
+import type { JOSEStandards, JWKSModes, TJWKSAlgorithm, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';
 import type { IAuthUser } from './strategy';
 /**
  * Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`
@@ -65,7 +65,6 @@ export interface IJWSTokenServiceOptions {
     /** Claims stamped on every issued token. A configured value WINS over one supplied in the payload. */
     sign?: IJWTSignOptions;
 }
-export type TJWKSAlgorithm = 'ES256' | 'RS256' | 'EdDSA';
 export interface IJWKSIssuerOptions {
     mode: typeof JWKSModes.ISSUER;
     algorithm: TJWKSAlgorithm;

package/dist/cjs/base/auth/authenticate/common/types/jwt.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,~~EAAE~~,aAAa,~~EAAE~~,SAAS,~~EAAE~~,cAAc,~~EAAE~~,cAAc,~~EAAE~~,MAAM,cAAc,CAAC;~~AAC7F~~,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,~~MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,~~WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC"}
1	+ {"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC"}

package/dist/cjs/base/auth/authenticate/common/types/jwt.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base/models/common';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';\nimport type { JWTPayload } from 'jose';\nimport type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants';\nimport type { IAuthUser } from './strategy';\n\n/*\n Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`\n * exactly, so this is a pass-through with no translation layer.\n \n Every field is optional and unset by default, which is today's behaviour: nothing is checked\n * beyond the signature and the time claims. In a fleet where every verifier points at the same\n * issuer JWKS, that means a token minted for one service is accepted verbatim by every other -\n * `audience` is what makes \"this token was meant for me\" a cryptographic statement rather than a\n * convention.\n /\nexport interface IJWTVerifyOptions {\n /* Expected `aud`. Setting it makes the claim required. Matching is jose's OVERLAP semantics, not equality: a token carrying `['a','b']` satisfies `audience: 'a'`. Enforce single-valued audiences at issue time if that matters. /\n audience?: string \| string[];\n\n /* Expected `iss`. Setting it makes the claim required. /\n issuer?: string \| string[];\n\n /* Expected `sub`. Setting it makes the claim required. /\n subject?: string;\n\n /* Clock skew tolerance: seconds, or a jose duration string such as `'30 seconds'`. /\n clockTolerance?: string \| number;\n\n /* Accepted JWS `alg` header values. Unset means the accepted algorithm is decided entirely by what the JWKS serves. /\n algorithms?: string[];\n\n /* Caps elapsed time since `iat`. The real replay window for a short-lived assertion, independent of whatever `exp` the caller chose to stamp. /\n maxTokenAge?: string \| number;\n\n /* Expected JWS `typ` header. The standard defence against cross-token-type confusion when one JWKS serves more than one kind of token. /\n typ?: string;\n\n /* Claims that must be present, beyond those implied by the checks above. /\n requiredClaims?: string[];\n}\n\n/* Default `iss` / `aud` stamped on every issued token. Configured values are AUTHORITATIVE - see {@link IJWTIssueClaims}. /\nexport interface IJWTSignOptions {\n issuer?: string;\n audience?: string \| string[];\n}\n\n/\n Per-token registered claims, passed to `generate()`.\n \n This is the supported way to vary `aud` or `sub` per token. Putting them on the payload used to\n * work by accident - `iss`, `aud`, `sub` and `jti` ride through the AES envelope in the clear\n * because they are standard JWT fields - but a claim the payload can set is a claim any caller who\n * shapes the payload can forge. These win over {@link IJWTSignOptions}; the payload never does.\n /\nexport interface IJWTIssueClaims {\n issuer?: string;\n audience?: string \| string[];\n subject?: string;\n jwtId?: string;\n}\n\nexport interface IJWSTokenServiceOptions {\n headerAlgorithm?: string;\n jwtSecret: string;\n getTokenExpiresFn: TGetTokenExpiresFn;\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. /\n verify?: IJWTVerifyOptions;\n\n /* Claims stamped on every issued token. A configured value WINS over one supplied in the payload. /\n sign?: IJWTSignOptions;\n}\n\nexport ~~type TJWKSAlgorithm = 'ES256' \| 'RS256' \| 'EdDSA';\n\nexport~~ interface IJWKSIssuerOptions {\n mode: typeof JWKSModes.ISSUER;\n algorithm: TJWKSAlgorithm;\n rest?: { path: string };\n keys: {\n driver: TJWKSKeyDriver;\n format: TJWKSKeyFormat;\n private: string; // Key content (text) or file path (file) — PEM or JWK based on format\n public: string; // Key content (text) or file path (file) — PEM or JWK based on format\n };\n kid: string;\n getTokenExpiresFn: TGetTokenExpiresFn;\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. /\n verify?: IJWTVerifyOptions;\n\n /* Claims stamped on every issued token. A configured value WINS over one supplied in the payload. /\n sign?: IJWTSignOptions;\n}\n\nexport interface IJWKSVerifierOptions {\n mode: typeof JWKSModes.VERIFIER;\n jwksUrl: string;\n cacheTtlMs?: number; // Default: 43_200_000 (12h)\n cooldownMs?: number; // Default: 30_000 (30s)\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. */\n verify?: IJWTVerifyOptions;\n}\n\nexport type TJWKSTokenServiceOptions = IJWKSIssuerOptions \| IJWKSVerifierOptions;\n\nexport type TJWTTokenServiceOptions =\n \| { standard: typeof JOSEStandards.JWS; options: IJWSTokenServiceOptions }\n \| { standard: typeof JOSEStandards.JWKS; options: TJWKSTokenServiceOptions };\n\nexport interface IJWTTokenPayload extends JWTPayload, IAuthUser {\n userId: IdType;\n roles: { id: IdType; identifier: string; priority: number }[];\n\n clientId?: string;\n provider?: string;\n email?: string;\n name?: string;\n\n [extra: string \| symbol]: any;\n}\n\nexport interface IPayloadFieldCodec<T = unknown> {\n key: string;\n serialize(opts: { value: T }): string;\n deserialize(opts: { raw: string }): T;\n}\n\nexport type TGetTokenExpiresFn = () => ValueOrPromise<number>;\n"]}
1	+ {"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base/models/common';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';\nimport type { JWTPayload } from 'jose';\nimport type {\n JOSEStandards,\n JWKSModes,\n TJWKSAlgorithm,\n TJWKSKeyDriver,\n TJWKSKeyFormat,\n} from '../constants';\nimport type { IAuthUser } from './strategy';\n\n/*\n Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`\n * exactly, so this is a pass-through with no translation layer.\n \n Every field is optional and unset by default, which is today's behaviour: nothing is checked\n * beyond the signature and the time claims. In a fleet where every verifier points at the same\n * issuer JWKS, that means a token minted for one service is accepted verbatim by every other -\n * `audience` is what makes \"this token was meant for me\" a cryptographic statement rather than a\n * convention.\n /\nexport interface IJWTVerifyOptions {\n /* Expected `aud`. Setting it makes the claim required. Matching is jose's OVERLAP semantics, not equality: a token carrying `['a','b']` satisfies `audience: 'a'`. Enforce single-valued audiences at issue time if that matters. /\n audience?: string \| string[];\n\n /* Expected `iss`. Setting it makes the claim required. /\n issuer?: string \| string[];\n\n /* Expected `sub`. Setting it makes the claim required. /\n subject?: string;\n\n /* Clock skew tolerance: seconds, or a jose duration string such as `'30 seconds'`. /\n clockTolerance?: string \| number;\n\n /* Accepted JWS `alg` header values. Unset means the accepted algorithm is decided entirely by what the JWKS serves. /\n algorithms?: string[];\n\n /* Caps elapsed time since `iat`. The real replay window for a short-lived assertion, independent of whatever `exp` the caller chose to stamp. /\n maxTokenAge?: string \| number;\n\n /* Expected JWS `typ` header. The standard defence against cross-token-type confusion when one JWKS serves more than one kind of token. /\n typ?: string;\n\n /* Claims that must be present, beyond those implied by the checks above. /\n requiredClaims?: string[];\n}\n\n/* Default `iss` / `aud` stamped on every issued token. Configured values are AUTHORITATIVE - see {@link IJWTIssueClaims}. /\nexport interface IJWTSignOptions {\n issuer?: string;\n audience?: string \| string[];\n}\n\n/\n Per-token registered claims, passed to `generate()`.\n \n This is the supported way to vary `aud` or `sub` per token. Putting them on the payload used to\n * work by accident - `iss`, `aud`, `sub` and `jti` ride through the AES envelope in the clear\n * because they are standard JWT fields - but a claim the payload can set is a claim any caller who\n * shapes the payload can forge. These win over {@link IJWTSignOptions}; the payload never does.\n /\nexport interface IJWTIssueClaims {\n issuer?: string;\n audience?: string \| string[];\n subject?: string;\n jwtId?: string;\n}\n\nexport interface IJWSTokenServiceOptions {\n headerAlgorithm?: string;\n jwtSecret: string;\n getTokenExpiresFn: TGetTokenExpiresFn;\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. /\n verify?: IJWTVerifyOptions;\n\n /* Claims stamped on every issued token. A configured value WINS over one supplied in the payload. /\n sign?: IJWTSignOptions;\n}\n\nexport interface IJWKSIssuerOptions {\n mode: typeof JWKSModes.ISSUER;\n algorithm: TJWKSAlgorithm;\n rest?: { path: string };\n keys: {\n driver: TJWKSKeyDriver;\n format: TJWKSKeyFormat;\n private: string; // Key content (text) or file path (file) — PEM or JWK based on format\n public: string; // Key content (text) or file path (file) — PEM or JWK based on format\n };\n kid: string;\n getTokenExpiresFn: TGetTokenExpiresFn;\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. /\n verify?: IJWTVerifyOptions;\n\n /* Claims stamped on every issued token. A configured value WINS over one supplied in the payload. /\n sign?: IJWTSignOptions;\n}\n\nexport interface IJWKSVerifierOptions {\n mode: typeof JWKSModes.VERIFIER;\n jwksUrl: string;\n cacheTtlMs?: number; // Default: 43_200_000 (12h)\n cooldownMs?: number; // Default: 30_000 (30s)\n aesAlgorithm?: AESAlgorithmType;\n applicationSecret?: string;\n fieldCodecs?: IPayloadFieldCodec[];\n /* Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. /\n cipher?: IPayloadCipher;\n\n /* Claim checks applied on verify. Unset means signature and time claims only. */\n verify?: IJWTVerifyOptions;\n}\n\nexport type TJWKSTokenServiceOptions = IJWKSIssuerOptions \| IJWKSVerifierOptions;\n\nexport type TJWTTokenServiceOptions =\n \| { standard: typeof JOSEStandards.JWS; options: IJWSTokenServiceOptions }\n \| { standard: typeof JOSEStandards.JWKS; options: TJWKSTokenServiceOptions };\n\nexport interface IJWTTokenPayload extends JWTPayload, IAuthUser {\n userId: IdType;\n roles: { id: IdType; identifier: string; priority: number }[];\n\n clientId?: string;\n provider?: string;\n email?: string;\n name?: string;\n\n [extra: string \| symbol]: any;\n}\n\nexport interface IPayloadFieldCodec<T = unknown> {\n key: string;\n serialize(opts: { value: T }): string;\n deserialize(opts: { raw: string }): T;\n}\n\nexport type TGetTokenExpiresFn = () => ValueOrPromise<number>;\n"]}

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts CHANGED Viewed

@@ -120,4 +120,15 @@ export declare class AuthorizationPolicyVariants {
 }
 /** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
 export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
+/** Where an `IAuthorizationDomainSource` reads the request domain from. */
+export declare class AuthorizationDomainSources {
+    static readonly PARAM = "param";
+    static readonly HEADER = "header";
+    static readonly QUERY = "query";
+    static readonly CONTEXT = "context";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(value: string): boolean;
+}
+/** Valid authorization domain source values. */
+export type TAuthorizationDomainSource = TConstValue<typeof AuthorizationDomainSources>;
 //# sourceMappingURL=authorization.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAAiE;IAElG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA+D;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC"}
1	+ {"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAAiE;IAElG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA+D;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE7D,2EAA2E;AAC3E,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAwE;IAElG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,gDAAgD;AAChD,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/cjs/base/auth/authorize/common/constants/authorization.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationPolicyVariants = exports.AuthorizationDomainScopes = exports.AuthorizationRoles = exports.AuthorizationDecisions = exports.AuthorizationActions = exports.Authorization = void 0;
+exports.AuthorizationDomainSources = exports.AuthorizationPolicyVariants = exports.AuthorizationDomainScopes = exports.AuthorizationRoles = exports.AuthorizationDecisions = exports.AuthorizationActions = exports.Authorization = void 0;
 const authorization_role_model_1 = require("../../models/authorization-role.model");
 const enforcer_1 = require("./enforcer");
 class Authorization {
@@ -160,4 +160,16 @@ class AuthorizationPolicyVariants {
     }
 }
 exports.AuthorizationPolicyVariants = AuthorizationPolicyVariants;
+/** Where an `IAuthorizationDomainSource` reads the request domain from. */
+class AuthorizationDomainSources {
+    static { this.PARAM = 'param'; }
+    static { this.HEADER = 'header'; }
+    static { this.QUERY = 'query'; }
+    static { this.CONTEXT = 'context'; }
+    static { this.SCHEME_SET = new Set([this.PARAM, this.HEADER, this.QUERY, this.CONTEXT]); }
+    static isValid(value) {
+        return this.SCHEME_SET.has(value);
+    }
+}
+exports.AuthorizationDomainSources = AuthorizationDomainSources;
 //# sourceMappingURL=authorization.js.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":";;;AACA,oFAA0E;AAC1E,yCAAgD;AAEhD,MAAa,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAJlD,sCAKC;AAED,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAxCH,oDAyCC;AAGD,MAAa,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AA9BH,wDA+BC;AAGD,MAAa,kBAAkB;aACb,gBAAW,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAhCH,gDAiCC;AAED,MAAa,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAXH,8DAYC;AAGD,sRAAsR;AACtR,MAAa,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAElF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;;AApDH,kEAqDC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { AuthorizationRole } from '../../models/authorization-role.model';\nimport { CasbinRuleVariants } from './enforcer';\n\nexport class Authorization {\n static readonly RULES = 'authorization.rules';\n static readonly SKIP_AUTHORIZATION = 'authorization.skip';\n static readonly ENFORCER = 'authorization.enforcer';\n static readonly DOMAIN = 'authorization.domain';\n}\n\nexport class AuthorizationActions {\n static readonly CREATE = 'create';\n static readonly UPDATE = 'update';\n static readonly DELETE = 'delete';\n static readonly EXECUTE = 'execute';\n\n static readonly READ = 'read';\n static readonly WRITE = 'write';\n static readonly MANAGE = 'manage';\n\n /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. /\n static readonly CUSTOM = 'custom';\n\n static readonly SCHEME_SET = new Set([\n this.CREATE,\n this.UPDATE,\n this.DELETE,\n this.EXECUTE,\n\n this.READ,\n this.WRITE,\n this.MANAGE,\n\n this.CUSTOM,\n ]);\n\n static readonly LATTICE: ReadonlyArray<{\n child: TAuthorizationAction;\n parent: TAuthorizationAction;\n }> = [\n { child: this.READ, parent: this.MANAGE },\n { child: this.WRITE, parent: this.MANAGE },\n { child: this.EXECUTE, parent: this.MANAGE },\n { child: this.CREATE, parent: this.WRITE },\n { child: this.UPDATE, parent: this.WRITE },\n { child: this.DELETE, parent: this.WRITE },\n ];\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\nexport type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;\n\nexport class AuthorizationDecisions {\n static readonly ALLOW = 'allow';\n static readonly DENY = 'deny';\n static readonly ABSTAIN = 'abstain';\n\n static readonly SCHEME_SET = new Set([this.ALLOW, this.DENY, this.ABSTAIN]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n\n static isAllow(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input > 0;\n }\n return input.toLowerCase() === this.ALLOW;\n }\n\n static isDeny(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input < 0;\n }\n return input.toLowerCase() === this.DENY;\n }\n\n static isAbstain(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input === 0;\n }\n return input.toLowerCase() === this.ABSTAIN;\n }\n}\nexport type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;\n\nexport class AuthorizationRoles {\n static readonly SUPER_ADMIN = AuthorizationRole.build({\n name: 'super-admin',\n priority: 999,\n });\n static readonly ADMIN = AuthorizationRole.build({\n name: 'admin',\n priority: 900,\n });\n static readonly USER = AuthorizationRole.build({\n name: 'user',\n priority: 10,\n });\n static readonly GUEST = AuthorizationRole.build({\n name: 'guest',\n priority: 1,\n });\n static readonly UNKNOWN_USER = AuthorizationRole.build({\n name: 'unknown-user',\n priority: 0,\n });\n\n static readonly SCHEME_SET = new Set<string>([\n this.SUPER_ADMIN.identifier,\n this.ADMIN.identifier,\n this.USER.identifier,\n this.GUEST.identifier,\n this.UNKNOWN_USER.identifier,\n ]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport class AuthorizationDomainScopes {\n /* Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). /\n static readonly ANY_MEMBER = 'ANY_MEMBER';\n\n /* Grant applies system-wide, bypassing membership - super-admin only. /\n static readonly SYSTEM_WIDE = 'SYSTEM_WIDE';\n\n static readonly SCHEME_SET = new Set([this.ANY_MEMBER, this.SYSTEM_WIDE]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\nexport type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;\n\n/* Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the _INHERITS ones. /\nexport class AuthorizationPolicyVariants {\n /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role\|User>_<id>, <domain>, <permissionCode>, <action>, <allow\|deny>` /\n static readonly GRANT = { action: 'grant', rule: CasbinRuleVariants.P } as const;\n\n /* Give a User a Role (optionally domain-scoped; no domain -> `` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain\|>` /\n static readonly ASSIGN_ROLE = { action: 'assign_role', rule: CasbinRuleVariants.G } as const;\n\n /* A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain ``: `g, Role_<child>, Role_<parent>, ` /\n static readonly ROLE_INHERITS = { action: 'role_inherits', rule: CasbinRuleVariants.G } as const;\n\n /* User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` /\n static readonly JOIN_DOMAIN = { action: 'join_domain', rule: CasbinRuleVariants.G2 } as const;\n\n /* DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` /\n static readonly DOMAIN_INHERITS = {\n action: 'domain_inherits',\n rule: CasbinRuleVariants.G3,\n } as const;\n\n /* RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) \|\| g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` /\n static readonly RESOURCE_INHERITS = {\n action: 'resource_inherits',\n rule: CasbinRuleVariants.G4,\n } as const;\n\n /* ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. /\n static readonly ACTION_INHERITS = {\n action: 'action_inherits',\n rule: CasbinRuleVariants.G5,\n } as const;\n\n /* Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. /\n static readonly ALL = [\n this.GRANT,\n this.ASSIGN_ROLE,\n this.ROLE_INHERITS,\n this.JOIN_DOMAIN,\n this.DOMAIN_INHERITS,\n this.RESOURCE_INHERITS,\n this.ACTION_INHERITS,\n ] as const;\n\n static readonly ACTION_SCHEME_SET = new Set(this.ALL.map((variant) => variant.action.toString()));\n\n static readonly RULE_SCHEME_SET = new Set(this.ALL.map((variant) => variant.rule.toString()));\n\n static isValidAction(input: string): boolean {\n return this.ACTION_SCHEME_SET.has(input);\n }\n\n static isValidRule(input: string): boolean {\n return this.RULE_SCHEME_SET.has(input);\n }\n}\n\n/* The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */\nexport type TAuthorizationPolicyVariant =\n (typeof AuthorizationPolicyVariants.ALL)[number]['action'];\n"]}
1	+ {"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":";;;AACA,oFAA0E;AAC1E,yCAAgD;AAEhD,MAAa,aAAa;aACR,UAAK,GAAG,qBAAqB,CAAC;aAC9B,uBAAkB,GAAG,oBAAoB,CAAC;aAC1C,aAAQ,GAAG,wBAAwB,CAAC;aACpC,WAAM,GAAG,sBAAsB,CAAC;;AAJlD,sCAKC;AAED,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,YAAO,GAAG,SAAS,CAAC;aAEpB,SAAI,GAAG,MAAM,CAAC;aACd,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;IAElC,+FAA+F;aAC/E,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAC;QACnC,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,OAAO;QAEZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,MAAM;QAEX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;aAEa,YAAO,GAGlB;QACH,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACzC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;QAC1C,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;KAC3C,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAxCH,oDAyCC;AAGD,MAAa,sBAAsB;aACjB,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAsB;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAsB;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC;IAC9C,CAAC;;AA9BH,wDA+BC;AAGD,MAAa,kBAAkB;aACb,gBAAW,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACpD,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;aACa,SAAI,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;aACa,UAAK,GAAG,4CAAiB,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aACa,iBAAY,GAAG,4CAAiB,CAAC,KAAK,CAAC;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;aAEa,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,WAAW,CAAC,UAAU;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAhCH,gDAiCC;AAED,MAAa,yBAAyB;IACpC,+FAA+F;aAC/E,eAAU,GAAG,YAAY,CAAC;IAE1C,0EAA0E;aAC1D,gBAAW,GAAG,aAAa,CAAC;aAE5B,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAXH,8DAYC;AAGD,sRAAsR;AACtR,MAAa,2BAA2B;IACtC,0KAA0K;aAC1J,UAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjF,wIAAwI;aACxH,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAE7F,0LAA0L;aAC1K,kBAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,6BAAkB,CAAC,CAAC,EAAW,CAAC;IAEjG,gJAAgJ;aAChI,gBAAW,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,6BAAkB,CAAC,EAAE,EAAW,CAAC;IAE9F,oLAAoL;aACpK,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,uPAAuP;aACvO,sBAAiB,GAAG;QAClC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,0RAA0R;aAC1Q,oBAAe,GAAG;QAChC,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,6BAAkB,CAAC,EAAE;KACnB,CAAC;IAEX,sIAAsI;aACtH,QAAG,GAAG;QACpB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,eAAe;KACZ,CAAC;aAEK,sBAAiB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;aAElF,oBAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;;AApDH,kEAqDC;AAMD,2EAA2E;AAC3E,MAAa,0BAA0B;aACrB,UAAK,GAAG,OAAO,CAAC;aAChB,WAAM,GAAG,QAAQ,CAAC;aAClB,UAAK,GAAG,OAAO,CAAC;aAChB,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAElG,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAVH,gEAWC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { AuthorizationRole } from '../../models/authorization-role.model';\nimport { CasbinRuleVariants } from './enforcer';\n\nexport class Authorization {\n static readonly RULES = 'authorization.rules';\n static readonly SKIP_AUTHORIZATION = 'authorization.skip';\n static readonly ENFORCER = 'authorization.enforcer';\n static readonly DOMAIN = 'authorization.domain';\n}\n\nexport class AuthorizationActions {\n static readonly CREATE = 'create';\n static readonly UPDATE = 'update';\n static readonly DELETE = 'delete';\n static readonly EXECUTE = 'execute';\n\n static readonly READ = 'read';\n static readonly WRITE = 'write';\n static readonly MANAGE = 'manage';\n\n /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. /\n static readonly CUSTOM = 'custom';\n\n static readonly SCHEME_SET = new Set([\n this.CREATE,\n this.UPDATE,\n this.DELETE,\n this.EXECUTE,\n\n this.READ,\n this.WRITE,\n this.MANAGE,\n\n this.CUSTOM,\n ]);\n\n static readonly LATTICE: ReadonlyArray<{\n child: TAuthorizationAction;\n parent: TAuthorizationAction;\n }> = [\n { child: this.READ, parent: this.MANAGE },\n { child: this.WRITE, parent: this.MANAGE },\n { child: this.EXECUTE, parent: this.MANAGE },\n { child: this.CREATE, parent: this.WRITE },\n { child: this.UPDATE, parent: this.WRITE },\n { child: this.DELETE, parent: this.WRITE },\n ];\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\nexport type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;\n\nexport class AuthorizationDecisions {\n static readonly ALLOW = 'allow';\n static readonly DENY = 'deny';\n static readonly ABSTAIN = 'abstain';\n\n static readonly SCHEME_SET = new Set([this.ALLOW, this.DENY, this.ABSTAIN]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n\n static isAllow(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input > 0;\n }\n return input.toLowerCase() === this.ALLOW;\n }\n\n static isDeny(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input < 0;\n }\n return input.toLowerCase() === this.DENY;\n }\n\n static isAbstain(input: string \| number): boolean {\n if (typeof input === 'number') {\n return input === 0;\n }\n return input.toLowerCase() === this.ABSTAIN;\n }\n}\nexport type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;\n\nexport class AuthorizationRoles {\n static readonly SUPER_ADMIN = AuthorizationRole.build({\n name: 'super-admin',\n priority: 999,\n });\n static readonly ADMIN = AuthorizationRole.build({\n name: 'admin',\n priority: 900,\n });\n static readonly USER = AuthorizationRole.build({\n name: 'user',\n priority: 10,\n });\n static readonly GUEST = AuthorizationRole.build({\n name: 'guest',\n priority: 1,\n });\n static readonly UNKNOWN_USER = AuthorizationRole.build({\n name: 'unknown-user',\n priority: 0,\n });\n\n static readonly SCHEME_SET = new Set<string>([\n this.SUPER_ADMIN.identifier,\n this.ADMIN.identifier,\n this.USER.identifier,\n this.GUEST.identifier,\n this.UNKNOWN_USER.identifier,\n ]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\n\nexport class AuthorizationDomainScopes {\n /* Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). /\n static readonly ANY_MEMBER = 'ANY_MEMBER';\n\n /* Grant applies system-wide, bypassing membership - super-admin only. /\n static readonly SYSTEM_WIDE = 'SYSTEM_WIDE';\n\n static readonly SCHEME_SET = new Set([this.ANY_MEMBER, this.SYSTEM_WIDE]);\n\n static isValid(input: string): boolean {\n return this.SCHEME_SET.has(input);\n }\n}\nexport type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;\n\n/* Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the _INHERITS ones. /\nexport class AuthorizationPolicyVariants {\n /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role\|User>_<id>, <domain>, <permissionCode>, <action>, <allow\|deny>` /\n static readonly GRANT = { action: 'grant', rule: CasbinRuleVariants.P } as const;\n\n /* Give a User a Role (optionally domain-scoped; no domain -> `` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain\|>` /\n static readonly ASSIGN_ROLE = { action: 'assign_role', rule: CasbinRuleVariants.G } as const;\n\n /* A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain ``: `g, Role_<child>, Role_<parent>, ` /\n static readonly ROLE_INHERITS = { action: 'role_inherits', rule: CasbinRuleVariants.G } as const;\n\n /* User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` /\n static readonly JOIN_DOMAIN = { action: 'join_domain', rule: CasbinRuleVariants.G2 } as const;\n\n /* DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` /\n static readonly DOMAIN_INHERITS = {\n action: 'domain_inherits',\n rule: CasbinRuleVariants.G3,\n } as const;\n\n /* RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) \|\| g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` /\n static readonly RESOURCE_INHERITS = {\n action: 'resource_inherits',\n rule: CasbinRuleVariants.G4,\n } as const;\n\n /* ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. /\n static readonly ACTION_INHERITS = {\n action: 'action_inherits',\n rule: CasbinRuleVariants.G5,\n } as const;\n\n /* Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. /\n static readonly ALL = [\n this.GRANT,\n this.ASSIGN_ROLE,\n this.ROLE_INHERITS,\n this.JOIN_DOMAIN,\n this.DOMAIN_INHERITS,\n this.RESOURCE_INHERITS,\n this.ACTION_INHERITS,\n ] as const;\n\n static readonly ACTION_SCHEME_SET = new Set(this.ALL.map((variant) => variant.action.toString()));\n\n static readonly RULE_SCHEME_SET = new Set(this.ALL.map((variant) => variant.rule.toString()));\n\n static isValidAction(input: string): boolean {\n return this.ACTION_SCHEME_SET.has(input);\n }\n\n static isValidRule(input: string): boolean {\n return this.RULE_SCHEME_SET.has(input);\n }\n}\n\n/* The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. /\nexport type TAuthorizationPolicyVariant =\n (typeof AuthorizationPolicyVariants.ALL)[number]['action'];\n\n/* Where an `IAuthorizationDomainSource` reads the request domain from. /\nexport class AuthorizationDomainSources {\n static readonly PARAM = 'param';\n static readonly HEADER = 'header';\n static readonly QUERY = 'query';\n static readonly CONTEXT = 'context';\n\n static readonly SCHEME_SET = new Set<string>([this.PARAM, this.HEADER, this.QUERY, this.CONTEXT]);\n\n static isValid(value: string): boolean {\n return this.SCHEME_SET.has(value);\n }\n}\n\n/* Valid authorization domain source values. */\nexport type TAuthorizationDomainSource = TConstValue<typeof AuthorizationDomainSources>;\n"]}

package/dist/cjs/base/auth/authorize/common/types/request.d.ts CHANGED Viewed

@@ -3,6 +3,7 @@ import type { TContext } from '../../../../controllers/common/types';
 import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
 import type { Env } from 'hono';
 import type { IAuthUser } from '../../../authenticate/common/types';
+import type { TAuthorizationDomainSource } from '../constants';
 export interface IAuthorizationRole {
     readonly name: string;
     readonly priority: number;
@@ -22,7 +23,7 @@ export interface IAuthorizationUser extends IAuthUser {
 }
 /** Declarative description of where to read the request domain from. */
 export interface IAuthorizationDomainSource {
-    from: 'param' | 'header' | 'query' | 'context';
+    from: TAuthorizationDomainSource;
     key: string;
     type: string;
 }

package/dist/cjs/base/auth/authorize/common/types/request.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;~~AAEpE~~,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EACjD,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE/B,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,mLAAmL;IACnL,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,~~OAAO~~,~~GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,~~CAAC;~~IAC/C~~,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EACjD,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE/B,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,mLAAmL;IACnL,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC"}

package/dist/cjs/base/auth/authorize/common/types/request.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TContext } from '@/base/controllers/common/types';\nimport { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport type { IAuthUser } from '../../../authenticate/common/types';\n\nexport interface IAuthorizationRole {\n readonly name: string;\n readonly priority: number;\n readonly identifier: string;\n}\n\n/** Key-value conditions for attribute-based access control. Values compared with strict equality. /\nexport type TAuthorizationConditions<\n KeyType extends string \| symbol = string \| symbol,\n ValueType = string \| number \| boolean \| null,\n> = Record<KeyType, ValueType>;\n\nexport interface IAuthorizationRequest<TAction = string, TResource = string> {\n action: TAction;\n resource: TResource;\n conditions?: TAuthorizationConditions;\n /* Resolved domain scope for this request as a casbin domain string `\"<DomainType>_<id>\"` (e.g. `\"Merchant_7\"`), or the `\"SYSTEM_WIDE\"` sentinel to enforce across all domains. /\n domain?: string;\n}\n\nexport interface IAuthorizationUser extends IAuthUser {\n principalType: string;\n}\n\n/* Declarative description of where to read the request domain from. /\nexport interface IAuthorizationDomainSource {\n from: ~~'param' \| 'header' \| 'query' \| 'context'~~;\n key: string;\n type: string; // domain type, e.g. 'Merchant' \| 'Organizer'\n}\n\n/* Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */\nexport type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {\n context: TContext<E, string>;\n}) => ValueOrPromise<TNullable<{ type: string; id: IdType }>>;\n"]}
1	+ {"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TContext } from '@/base/controllers/common/types';\nimport { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport type { IAuthUser } from '../../../authenticate/common/types';\nimport type { TAuthorizationDomainSource } from '../constants';\n\nexport interface IAuthorizationRole {\n readonly name: string;\n readonly priority: number;\n readonly identifier: string;\n}\n\n/** Key-value conditions for attribute-based access control. Values compared with strict equality. /\nexport type TAuthorizationConditions<\n KeyType extends string \| symbol = string \| symbol,\n ValueType = string \| number \| boolean \| null,\n> = Record<KeyType, ValueType>;\n\nexport interface IAuthorizationRequest<TAction = string, TResource = string> {\n action: TAction;\n resource: TResource;\n conditions?: TAuthorizationConditions;\n /* Resolved domain scope for this request as a casbin domain string `\"<DomainType>_<id>\"` (e.g. `\"Merchant_7\"`), or the `\"SYSTEM_WIDE\"` sentinel to enforce across all domains. /\n domain?: string;\n}\n\nexport interface IAuthorizationUser extends IAuthUser {\n principalType: string;\n}\n\n/* Declarative description of where to read the request domain from. /\nexport interface IAuthorizationDomainSource {\n from: TAuthorizationDomainSource;\n key: string;\n type: string; // domain type, e.g. 'Merchant' \| 'Organizer'\n}\n\n/* Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */\nexport type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {\n context: TContext<E, string>;\n}) => ValueOrPromise<TNullable<{ type: string; id: IdType }>>;\n"]}

package/dist/cjs/base/auth/authorize/providers/request-domain.js CHANGED Viewed

@@ -6,16 +6,16 @@ const constants_1 = require("../common/constants");
 const readDeclarative = (opts) => {
     const { source, context } = opts;
     switch (source.from) {
-        case 'param': {
+        case constants_1.AuthorizationDomainSources.PARAM: {
             return context.req.param(source.key) ?? null;
         }
-        case 'header': {
+        case constants_1.AuthorizationDomainSources.HEADER: {
             return context.req.header(source.key) ?? null;
         }
-        case 'query': {
+        case constants_1.AuthorizationDomainSources.QUERY: {
             return context.req.query(source.key) ?? null;
         }
-        case 'context': {
+        case constants_1.AuthorizationDomainSources.CONTEXT: {
             const value = context.get(source.key);
             return value == null ? null : String(value);
         }

package/dist/cjs/base/auth/authorize/providers/request-domain.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request-domain.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":";;;AAGA,~~mDAAgE~~;~~AAOhE~~,yEAAyE;AAClE,MAAM,eAAe,GAAG,CAAC,IAG/B,EAAqB,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,~~OAAO~~,CAAC,CAAC,CAAC;~~YACb~~,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,~~QAAQ~~,CAAC,CAAC,CAAC;~~YACd~~,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,KAAK,~~OAAO~~,CAAC,CAAC,CAAC;~~YACb~~,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,~~SAAS~~,CAAC,CAAC,CAAC;~~YACf~~,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAU,CAAC,CAAC;YAC7C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAvBW,QAAA,eAAe,mBAuB1B;AAEF,iMAAiM;AAC1L,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAI1C,EAAmB,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAExC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,IAAA,uBAAe,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;IACvD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,qCAAyB,CAAC,WAAW,CAAC;AAC/C,CAAC,CAAC;AA5BW,QAAA,oBAAoB,wBA4B/B","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport { AuthorizationDomainScopes } from '../common/constants';\nimport type {\n IAuthorizationDomainSource,\n IAuthorizationSpec,\n IAuthorizeOptions,\n} from '../common/types';\n\n/** Read a domain value from a declarative source on the Hono context. /\nexport const readDeclarative = (opts: {\n source: IAuthorizationDomainSource;\n context: TContext<Env, string>;\n}): TNullable<string> => {\n const { source, context } = opts;\n switch (source.from) {\n case ~~'param'~~: {\n return context.req.param(source.key) ?? null;\n }\n case ~~'header'~~: {\n return context.req.header(source.key) ?? null;\n }\n case ~~'query'~~: {\n return context.req.query(source.key) ?? null;\n }\n case ~~'context'~~: {\n const value = context.get(source.key as any);\n return value == null ? null : String(value);\n }\n default: {\n return null;\n }\n }\n};\n\n/* Resolve the request domain, precedence spec.domain (method \| declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string (\"<type>_<id>\") or the SYSTEM_WIDE sentinel. */\nexport const resolveRequestDomain = async (opts: {\n spec: IAuthorizationSpec;\n context: TContext<Env, string>;\n options: TNullable<IAuthorizeOptions>;\n}): Promise<string> => {\n const { spec, context, options } = opts;\n\n if (typeof spec.domain === 'function') {\n const resolved = await spec.domain({ context });\n return resolved\n ? [resolved.type, resolved.id].join('_')\n : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n if (spec.domain) {\n const id = readDeclarative({ source: spec.domain, context });\n return id ? [spec.domain.type, id].join('_') : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n const globalResolver = options?.domainResolver ?? null;\n if (globalResolver) {\n const resolved = await globalResolver({ context });\n return resolved\n ? [resolved.type, resolved.id].join('_')\n : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n return AuthorizationDomainScopes.SYSTEM_WIDE;\n};\n"]}
1	+ {"version":3,"file":"request-domain.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":";;;AAGA,mDAA4F;AAO5F,yEAAyE;AAClE,MAAM,eAAe,GAAG,CAAC,IAG/B,EAAqB,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,sCAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,sCAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,KAAK,sCAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,sCAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAU,CAAC,CAAC;YAC7C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAvBW,QAAA,eAAe,mBAuB1B;AAEF,iMAAiM;AAC1L,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAI1C,EAAmB,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAExC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,IAAA,uBAAe,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;IACvD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,qCAAyB,CAAC,WAAW,CAAC;AAC/C,CAAC,CAAC;AA5BW,QAAA,oBAAoB,wBA4B/B","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport { AuthorizationDomainScopes, AuthorizationDomainSources } from '../common/constants';\nimport type {\n IAuthorizationDomainSource,\n IAuthorizationSpec,\n IAuthorizeOptions,\n} from '../common/types';\n\n/** Read a domain value from a declarative source on the Hono context. /\nexport const readDeclarative = (opts: {\n source: IAuthorizationDomainSource;\n context: TContext<Env, string>;\n}): TNullable<string> => {\n const { source, context } = opts;\n switch (source.from) {\n case AuthorizationDomainSources.PARAM: {\n return context.req.param(source.key) ?? null;\n }\n case AuthorizationDomainSources.HEADER: {\n return context.req.header(source.key) ?? null;\n }\n case AuthorizationDomainSources.QUERY: {\n return context.req.query(source.key) ?? null;\n }\n case AuthorizationDomainSources.CONTEXT: {\n const value = context.get(source.key as any);\n return value == null ? null : String(value);\n }\n default: {\n return null;\n }\n }\n};\n\n/* Resolve the request domain, precedence spec.domain (method \| declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string (\"<type>_<id>\") or the SYSTEM_WIDE sentinel. */\nexport const resolveRequestDomain = async (opts: {\n spec: IAuthorizationSpec;\n context: TContext<Env, string>;\n options: TNullable<IAuthorizeOptions>;\n}): Promise<string> => {\n const { spec, context, options } = opts;\n\n if (typeof spec.domain === 'function') {\n const resolved = await spec.domain({ context });\n return resolved\n ? [resolved.type, resolved.id].join('_')\n : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n if (spec.domain) {\n const id = readDeclarative({ source: spec.domain, context });\n return id ? [spec.domain.type, id].join('_') : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n const globalResolver = options?.domainResolver ?? null;\n if (globalResolver) {\n const resolved = await globalResolver({ context });\n return resolved\n ? [resolved.type, resolved.id].join('_')\n : AuthorizationDomainScopes.SYSTEM_WIDE;\n }\n\n return AuthorizationDomainScopes.SYSTEM_WIDE;\n};\n"]}

package/dist/cjs/base/controllers/common/constants.d.ts CHANGED Viewed

@@ -27,4 +27,14 @@ export declare class RestPaths {
 }
 export declare const commonResponseHeaders: TResponseHeaders;
 export declare const findResponseHeaders: TResponseHeaders;
+/** Which decorator-defined routes `registerRoutesFromRegistry` registers: STATIC (no path parameter), PARAM (a path parameter) or ALL. */
+export declare class RoutePathScopes {
+    static readonly STATIC = "static";
+    static readonly PARAM = "param";
+    static readonly ALL = "all";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(value: string): boolean;
+}
+/** Valid route path scope values. */
+export type TRoutePathScope = TConstValue<typeof RoutePathScopes>;
 //# sourceMappingURL=constants.d.ts.map

package/dist/cjs/base/controllers/common/constants.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/base/controllers/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;GAIG;AAEH,oDAAoD;AACpD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;CAC/B;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,iGAAiG;AACjG,qBAAa,eAAe;IAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAA8C;IAExE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,YAAY;IACjC,MAAM,CAAC,QAAQ,CAAC,QAAQ,eAAe;CACxC;AAED,eAAO,MAAM,qBAAqB,EAAE,gBAanC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,gBAMjC,CAAC"}
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/base/controllers/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;GAIG;AAEH,oDAAoD;AACpD,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;CAC/B;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,iGAAiG;AACjG,qBAAa,eAAe;IAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAA8C;IAExE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,YAAY;IACjC,MAAM,CAAC,QAAQ,CAAC,QAAQ,eAAe;CACxC;AAED,eAAO,MAAM,qBAAqB,EAAE,gBAanC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,gBAMjC,CAAC;AAEF,0IAA0I;AAC1I,qBAAa,eAAe;IAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAwD;IAElF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/cjs/base/controllers/common/constants.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findResponseHeaders = exports.commonResponseHeaders = exports.RestPaths = exports.ResponseFormats = exports.ControllerTransports = void 0;
+exports.RoutePathScopes = exports.findResponseHeaders = exports.commonResponseHeaders = exports.RestPaths = exports.ResponseFormats = exports.ControllerTransports = void 0;
 const common_1 = require("@venizia/ignis-helpers/common");
 /**
  * Constants with NO zod import, deliberately. The container's controller mixin imports
@@ -51,4 +51,15 @@ exports.findResponseHeaders = {
         schema: { type: 'string', examples: ['records 0-24/100', 'records 25-49/100'] },
     },
 };
+/** Which decorator-defined routes `registerRoutesFromRegistry` registers: STATIC (no path parameter), PARAM (a path parameter) or ALL. */
+class RoutePathScopes {
+    static { this.STATIC = 'static'; }
+    static { this.PARAM = 'param'; }
+    static { this.ALL = 'all'; }
+    static { this.SCHEME_SET = new Set([this.STATIC, this.PARAM, this.ALL]); }
+    static isValid(value) {
+        return this.SCHEME_SET.has(value);
+    }
+}
+exports.RoutePathScopes = RoutePathScopes;
 //# sourceMappingURL=constants.js.map

package/dist/cjs/base/controllers/common/constants.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../src/base/controllers/common/constants.ts"],"names":[],"mappings":";;;AACA,0DAAqD;AAGrD;;;;GAIG;AAEH,oDAAoD;AACpD,MAAa,oBAAoB;aACf,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;;AAFhC,oDAGC;AAID,iGAAiG;AACjG,MAAa,eAAe;aACV,WAAM,GAAG,QAAQ,CAAC;aAClB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAExE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,0CASC;AAID,6DAA6D;AAC7D,MAAa,SAAS;aACJ,SAAI,GAAG,GAAG,CAAC;aACX,UAAK,GAAG,QAAQ,CAAC;aACjB,aAAQ,GAAG,WAAW,CAAC;;AAHzC,8BAIC;AAEY,QAAA,qBAAqB,GAAqB;IACrD,CAAC,aAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;QACjC,WAAW,EAAE,gCAAgC;QAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC3B;IACD,CAAC,aAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;QAClC,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;KACzD;IACD,CAAC,aAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;QAC9B,WAAW,EAAE,2BAA2B;QACxC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;KAC1D;CACF,CAAC;AAEW,QAAA,mBAAmB,GAAqB;IACnD,GAAG,6BAAqB;IACxB,CAAC,aAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAC5B,WAAW,EAAE,yDAAyD;QACtE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,EAAE;KAChF;CACF,CAAC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { TResponseHeaders } from './types';\n\n/*\n Constants with NO zod import, deliberately. The container's controller mixin imports\n * `ControllerTransports` from here, so anything this file pulls in reaches every consumer of\n * `Container` - the request schemas live in `schemas.ts` for exactly that reason.\n /\n\n/* Transport protocol constants for controllers. /\nexport class ControllerTransports {\n static readonly REST = 'rest';\n static readonly GRPC = 'grpc';\n}\n\nexport type TControllerTransport = TConstValue<typeof ControllerTransports>;\n\n/* Shape of `data` in a `{ count, data }` response, echoed in the `X-Response-Format` header. /\nexport class ResponseFormats {\n static readonly OBJECT = 'object';\n static readonly ARRAY = 'array';\n\n static readonly SCHEME_SET = new Set<string>([this.OBJECT, this.ARRAY]);\n\n static isValid(value: string): boolean {\n return this.SCHEME_SET.has(value);\n }\n}\n\nexport type TResponseFormat = TConstValue<typeof ResponseFormats>;\n\n/* Standard REST API path constants for CRUD controllers. */\nexport class RestPaths {\n static readonly ROOT = '/';\n static readonly COUNT = '/count';\n static readonly FIND_ONE = '/find-one';\n}\n\nexport const commonResponseHeaders: TResponseHeaders = {\n [HTTP.Headers.REQUEST_TRACING_ID]: {\n description: 'Echo of the request tracing ID',\n schema: { type: 'string' },\n },\n [HTTP.Headers.RESPONSE_COUNT_DATA]: {\n description: 'Number of records in response',\n schema: { type: 'string', examples: ['1', '10', '100'] },\n },\n [HTTP.Headers.RESPONSE_FORMAT]: {\n description: 'Response format indicator',\n schema: { type: 'string', examples: ['array', 'object'] },\n },\n};\n\nexport const findResponseHeaders: TResponseHeaders = {\n ...commonResponseHeaders,\n [HTTP.Headers.CONTENT_RANGE]: {\n description: 'Content range for pagination (e.g., \"records 0-24/100\")',\n schema: { type: 'string', examples: ['records 0-24/100', 'records 25-49/100'] },\n },\n};\n"]}
1	+ {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../src/base/controllers/common/constants.ts"],"names":[],"mappings":";;;AACA,0DAAqD;AAGrD;;;;GAIG;AAEH,oDAAoD;AACpD,MAAa,oBAAoB;aACf,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;;AAFhC,oDAGC;AAID,iGAAiG;AACjG,MAAa,eAAe;aACV,WAAM,GAAG,QAAQ,CAAC;aAClB,UAAK,GAAG,OAAO,CAAC;aAEhB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAExE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,0CASC;AAID,6DAA6D;AAC7D,MAAa,SAAS;aACJ,SAAI,GAAG,GAAG,CAAC;aACX,UAAK,GAAG,QAAQ,CAAC;aACjB,aAAQ,GAAG,WAAW,CAAC;;AAHzC,8BAIC;AAEY,QAAA,qBAAqB,GAAqB;IACrD,CAAC,aAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;QACjC,WAAW,EAAE,gCAAgC;QAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC3B;IACD,CAAC,aAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;QAClC,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;KACzD;IACD,CAAC,aAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;QAC9B,WAAW,EAAE,2BAA2B;QACxC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;KAC1D;CACF,CAAC;AAEW,QAAA,mBAAmB,GAAqB;IACnD,GAAG,6BAAqB;IACxB,CAAC,aAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAC5B,WAAW,EAAE,yDAAyD;QACtE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,EAAE;KAChF;CACF,CAAC;AAEF,0IAA0I;AAC1I,MAAa,eAAe;aACV,WAAM,GAAG,QAAQ,CAAC;aAClB,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AATH,0CAUC","sourcesContent":["import type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { TResponseHeaders } from './types';\n\n/*\n Constants with NO zod import, deliberately. The container's controller mixin imports\n * `ControllerTransports` from here, so anything this file pulls in reaches every consumer of\n * `Container` - the request schemas live in `schemas.ts` for exactly that reason.\n /\n\n/* Transport protocol constants for controllers. /\nexport class ControllerTransports {\n static readonly REST = 'rest';\n static readonly GRPC = 'grpc';\n}\n\nexport type TControllerTransport = TConstValue<typeof ControllerTransports>;\n\n/* Shape of `data` in a `{ count, data }` response, echoed in the `X-Response-Format` header. /\nexport class ResponseFormats {\n static readonly OBJECT = 'object';\n static readonly ARRAY = 'array';\n\n static readonly SCHEME_SET = new Set<string>([this.OBJECT, this.ARRAY]);\n\n static isValid(value: string): boolean {\n return this.SCHEME_SET.has(value);\n }\n}\n\nexport type TResponseFormat = TConstValue<typeof ResponseFormats>;\n\n/* Standard REST API path constants for CRUD controllers. /\nexport class RestPaths {\n static readonly ROOT = '/';\n static readonly COUNT = '/count';\n static readonly FIND_ONE = '/find-one';\n}\n\nexport const commonResponseHeaders: TResponseHeaders = {\n [HTTP.Headers.REQUEST_TRACING_ID]: {\n description: 'Echo of the request tracing ID',\n schema: { type: 'string' },\n },\n [HTTP.Headers.RESPONSE_COUNT_DATA]: {\n description: 'Number of records in response',\n schema: { type: 'string', examples: ['1', '10', '100'] },\n },\n [HTTP.Headers.RESPONSE_FORMAT]: {\n description: 'Response format indicator',\n schema: { type: 'string', examples: ['array', 'object'] },\n },\n};\n\nexport const findResponseHeaders: TResponseHeaders = {\n ...commonResponseHeaders,\n [HTTP.Headers.CONTENT_RANGE]: {\n description: 'Content range for pagination (e.g., \"records 0-24/100\")',\n schema: { type: 'string', examples: ['records 0-24/100', 'records 25-49/100'] },\n },\n};\n\n/* Which decorator-defined routes `registerRoutesFromRegistry` registers: STATIC (no path parameter), PARAM (a path parameter) or ALL. /\nexport class RoutePathScopes {\n static readonly STATIC = 'static';\n static readonly PARAM = 'param';\n static readonly ALL = 'all';\n\n static readonly SCHEME_SET = new Set<string>([this.STATIC, this.PARAM, this.ALL]);\n\n static isValid(value: string): boolean {\n return this.SCHEME_SET.has(value);\n }\n}\n\n/* Valid route path scope values. */\nexport type TRoutePathScope = TConstValue<typeof RoutePathScopes>;\n"]}

package/dist/cjs/base/controllers/factory/authorize-guard.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { IAuthorizationSpec } from '../../auth/authorize/common/types';
+import type { ICustomizableRoutes } from '../common';
+/**
+ * Refuses a CRUD controller whose enabled write verb would inherit a controller-level `authorize`
+ * that is only a `read` permission: the verb would then answer to anyone who may read.
+ *
+ * A write verb is fine when it declares its own `authorize` (a spec, an array, or `{ skip: true }`),
+ * skips authentication, is not enabled, or the controller is `readonly`. Only the literal action
+ * `read` is detected; a custom action name is the application's own vocabulary. An array counts when
+ * every spec in it is `read`, since the specs of one route must all pass.
+ */
+export declare const assertWriteVerbsDeclareAuthorize: (opts: {
+    controllerName: string;
+    authorize: IAuthorizationSpec | IAuthorizationSpec[] | undefined;
+    routes: ICustomizableRoutes | undefined;
+    readonly: boolean | undefined;
+    enabledRoutes: Array<keyof ICustomizableRoutes> | undefined;
+}) => void;
+//# sourceMappingURL=authorize-guard.d.ts.map

package/dist/cjs/base/controllers/factory/authorize-guard.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"authorize-guard.d.ts","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/authorize-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AASrD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAAI,MAAM;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,GAAG,SAAS,CAAC;IACjE,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,KAAK,CAAC,MAAM,mBAAmB,CAAC,GAAG,SAAS,CAAC;CAC7D,KAAG,IA+CH,CAAC"}

package/dist/cjs/base/controllers/factory/authorize-guard.js ADDED Viewed

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertWriteVerbsDeclareAuthorize = void 0;
+const constants_1 = require("../../auth/authorize/common/constants");
+const core_1 = require("@venizia/ignis-helpers/core");
+/** The generated routes that change data: the ones that must never be answered by a `read` permission. */
+const WRITE_VERBS = ['create', 'updateById', 'updateBy', 'deleteById', 'deleteBy'];
+const describeSpec = (spec) => {
+    return `{ action: ${String(spec.action)}, resource: ${String(spec.resource)} }`;
+};
+/**
+ * Refuses a CRUD controller whose enabled write verb would inherit a controller-level `authorize`
+ * that is only a `read` permission: the verb would then answer to anyone who may read.
+ *
+ * A write verb is fine when it declares its own `authorize` (a spec, an array, or `{ skip: true }`),
+ * skips authentication, is not enabled, or the controller is `readonly`. Only the literal action
+ * `read` is detected; a custom action name is the application's own vocabulary. An array counts when
+ * every spec in it is `read`, since the specs of one route must all pass.
+ */
+const assertWriteVerbsDeclareAuthorize = (opts) => {
+    const { controllerName, authorize, routes, readonly, enabledRoutes } = opts;
+    if (readonly || authorize == null) {
+        return;
+    }
+    const specs = Array.isArray(authorize) ? authorize : [authorize];
+    const isReadOnlyPermission = specs.length > 0 && specs.every((spec) => spec.action === constants_1.AuthorizationActions.READ);
+    if (!isReadOnlyPermission) {
+        return;
+    }
+    const offending = WRITE_VERBS.filter((verb) => {
+        const isEnabled = enabledRoutes
+            ? enabledRoutes.includes(verb)
+            : routes?.[verb]?.enabled !== false;
+        if (!isEnabled) {
+            return false;
+        }
+        const route = routes?.[verb];
+        return route?.authenticate?.skip !== true && route?.authorize == null;
+    });
+    if (offending.length === 0) {
+        return;
+    }
+    const inherited = specs.map(describeSpec).join(', ');
+    const verbs = offending.map((verb) => `${controllerName}.${verb}`).join(', ');
+    const hasBulkVerb = offending.some((verb) => verb === 'updateBy' || verb === 'deleteBy');
+    throw (0, core_1.getError)({
+        message: [
+            `[defineCrudController] Write routes would inherit a read-only authorize | controller: ${controllerName} | routes: ${verbs} | inherited: ${inherited}`,
+            'Anyone allowed to read could then create, update or delete.',
+            `Fix: declare routes.<verb>.authorize for each of them (a spec, an array or { skip: true }), or set controller.readonly, or leave them out of controller.enabledRoutes.`,
+            ...(hasBulkVerb
+                ? [
+                    'updateBy and deleteBy are bulk routes on the collection and are generated unless controller.enabledRoutes lists the routes you want, so dropping them there closes this too.',
+                ]
+                : []),
+        ].join(' | '),
+    });
+};
+exports.assertWriteVerbsDeclareAuthorize = assertWriteVerbsDeclareAuthorize;
+//# sourceMappingURL=authorize-guard.js.map

package/dist/cjs/base/controllers/factory/authorize-guard.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"authorize-guard.js","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/authorize-guard.ts"],"names":[],"mappings":";;;AAAA,sEAA8E;AAE9E,sDAAuD;AAGvD,0GAA0G;AAC1G,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAE5F,MAAM,YAAY,GAAG,CAAC,IAAwB,EAAU,EAAE;IACxD,OAAO,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;AAClF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACI,MAAM,gCAAgC,GAAG,CAAC,IAMhD,EAAQ,EAAE;IACT,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE5E,IAAI,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,oBAAoB,GACxB,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,gCAAoB,CAAC,IAAI,CAAC,CAAC;IAEvF,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,aAAa;YAC7B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC,CAAC;IAEzF,MAAM,IAAA,eAAQ,EAAC;QACb,OAAO,EAAE;YACP,yFAAyF,cAAc,cAAc,KAAK,iBAAiB,SAAS,EAAE;YACtJ,6DAA6D;YAC7D,wKAAwK;YACxK,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC;oBACE,8KAA8K;iBAC/K;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,IAAI,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;AACL,CAAC,CAAC;AArDW,QAAA,gCAAgC,oCAqD3C","sourcesContent":["import { AuthorizationActions } from '@/base/auth/authorize/common/constants';\nimport type { IAuthorizationSpec } from '@/base/auth/authorize/common/types';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type { ICustomizableRoutes } from '../common';\n\n/** The generated routes that change data: the ones that must never be answered by a `read` permission. */\nconst WRITE_VERBS = ['create', 'updateById', 'updateBy', 'deleteById', 'deleteBy'] as const;\n\nconst describeSpec = (spec: IAuthorizationSpec): string => {\n return `{ action: ${String(spec.action)}, resource: ${String(spec.resource)} }`;\n};\n\n/**\n * Refuses a CRUD controller whose enabled write verb would inherit a controller-level `authorize`\n * that is only a `read` permission: the verb would then answer to anyone who may read.\n *\n * A write verb is fine when it declares its own `authorize` (a spec, an array, or `{ skip: true }`),\n * skips authentication, is not enabled, or the controller is `readonly`. Only the literal action\n * `read` is detected; a custom action name is the application's own vocabulary. An array counts when\n * every spec in it is `read`, since the specs of one route must all pass.\n */\nexport const assertWriteVerbsDeclareAuthorize = (opts: {\n controllerName: string;\n authorize: IAuthorizationSpec | IAuthorizationSpec[] | undefined;\n routes: ICustomizableRoutes | undefined;\n readonly: boolean | undefined;\n enabledRoutes: Array<keyof ICustomizableRoutes> | undefined;\n}): void => {\n const { controllerName, authorize, routes, readonly, enabledRoutes } = opts;\n\n if (readonly || authorize == null) {\n return;\n }\n\n const specs = Array.isArray(authorize) ? authorize : [authorize];\n const isReadOnlyPermission =\n specs.length > 0 && specs.every((spec) => spec.action === AuthorizationActions.READ);\n\n if (!isReadOnlyPermission) {\n return;\n }\n\n const offending = WRITE_VERBS.filter((verb) => {\n const isEnabled = enabledRoutes\n ? enabledRoutes.includes(verb)\n : routes?.[verb]?.enabled !== false;\n if (!isEnabled) {\n return false;\n }\n\n const route = routes?.[verb];\n return route?.authenticate?.skip !== true && route?.authorize == null;\n });\n\n if (offending.length === 0) {\n return;\n }\n\n const inherited = specs.map(describeSpec).join(', ');\n const verbs = offending.map((verb) => `${controllerName}.${verb}`).join(', ');\n const hasBulkVerb = offending.some((verb) => verb === 'updateBy' || verb === 'deleteBy');\n\n throw getError({\n message: [\n `[defineCrudController] Write routes would inherit a read-only authorize | controller: ${controllerName} | routes: ${verbs} | inherited: ${inherited}`,\n 'Anyone allowed to read could then create, update or delete.',\n `Fix: declare routes.<verb>.authorize for each of them (a spec, an array or { skip: true }), or set controller.readonly, or leave them out of controller.enabledRoutes.`,\n ...(hasBulkVerb\n ? [\n 'updateBy and deleteBy are bulk routes on the collection and are generated unless controller.enabledRoutes lists the routes you want, so dropping them there closes this too.',\n ]\n : []),\n ].join(' | '),\n });\n};\n"]}

package/dist/cjs/base/controllers/factory/controller.d.ts CHANGED Viewed

@@ -176,7 +176,7 @@ export declare class ControllerFactory extends BaseHelper {
             definitions: Record<string, import("../common").IAuthRouteConfig>;
             getRouter(): import("@hono/zod-openapi").OpenAPIHono<RouteEnv, RouteSchema, BasePath>;
             registerRoutesFromRegistry(opts?: {
-                paths?: "static" | "param" | "all";
+                paths?: import("../common").TRoutePathScope;
             }): void;
             configure(opts?: ConfigurableOptions | undefined): Promise<import("@hono/zod-openapi").OpenAPIHono<RouteEnv, RouteSchema, BasePath>>;
             buildRouteMiddlewares<RouteConfig extends import("../common").IAuthRouteConfig>(opts: {

package/dist/cjs/base/controllers/factory/controller.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,WAAW,CAAC;~~AAKnB~~,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,UAAU;;IAK/C,MAAM,CAAC,oBAAoB,CACzB,OAAO,SAAS,cAAc,CAAC,gBAAgB,CAAC,GAAG,cAAc,CAAC,gBAAgB,CAAC,EACnF,MAAM,SAAS,mBAAmB,GAAG,mBAAmB,EACxD,QAAQ,SAAS,GAAG,GAAG,GAAG,EAC1B,WAAW,SAAS,MAAM,GAAG,EAAE,EAC/B,QAAQ,SAAS,MAAM,GAAG,GAAG,EAC7B,mBAAmB,SAAS,MAAM,GAAG,EAAE,EACvC,WAAW,SAAS,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,EACvD,cAAc,SAAS,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,EAC7D,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC;~~yBAyCtB~~,kBAAkB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC;YAUhF,iGAAiG;uBAC7E,cAAc,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~qBAN3B~~,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~CA8FnB~~"}
1	+ {"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,WAAW,CAAC;AAMnB,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,UAAU;;IAK/C,MAAM,CAAC,oBAAoB,CACzB,OAAO,SAAS,cAAc,CAAC,gBAAgB,CAAC,GAAG,cAAc,CAAC,gBAAgB,CAAC,EACnF,MAAM,SAAS,mBAAmB,GAAG,mBAAmB,EACxD,QAAQ,SAAS,GAAG,GAAG,GAAG,EAC1B,WAAW,SAAS,MAAM,GAAG,EAAE,EAC/B,QAAQ,SAAS,MAAM,GAAG,GAAG,EAC7B,mBAAmB,SAAS,MAAM,GAAG,EAAE,EACvC,WAAW,SAAS,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,EACvD,cAAc,SAAS,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,EAC7D,OAAO,EAAE,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC;yBAiDtB,kBAAkB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC;YAUhF,iGAAiG;uBAC7E,cAAc,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAXG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGjD"}

package/dist/cjs/base/controllers/factory/controller.js CHANGED Viewed

@@ -5,6 +5,7 @@ const constants_1 = require("../../models/common/constants");
 const core_1 = require("@venizia/ignis-helpers/core");
 const ignis_inversion_1 = require("@venizia/ignis-inversion");
 const crud_1 = require("./crud");
+const authorize_guard_1 = require("./authorize-guard");
 const definition_1 = require("./definition");
 const repository_injection_1 = require("./repository-injection");
 /** Factory for generating typed CRUD controllers from entity definitions. */
@@ -20,6 +21,13 @@ class ControllerFactory extends core_1.BaseHelper {
                 message: `[defineCrudController] Invalid controller basePath | name: ${name} | basePath: ${basePath}`,
             });
         }
+        (0, authorize_guard_1.assertWriteVerbsDeclareAuthorize)({
+            controllerName: name,
+            authorize,
+            routes,
+            readonly: controller.readonly,
+            enabledRoutes: controller.enabledRoutes,
+        });
         const entityClass = (0, ignis_inversion_1.isClass)(entity) ? entity : entity();
         const entityInstance = new entityClass();
         const routeDefinitions = (0, definition_1.defineControllerRouteConfigs)({

package/dist/cjs/base/controllers/factory/controller.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/controller.ts"],"names":[],"mappings":";;;AACA,8DAA6D;AAI7D,sDAAmE;AACnE,8DAAmD;AAQnD,iCAAmD;AACnD,6CAA4D;AAC5D,iEAA4E;AAE5E,6EAA6E;AAC7E,MAAa,iBAAkB,SAAQ,iBAAU;IAC/C;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,oBAAoB,CASzB,OAAgD;QAChD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAExE,MAAM,EACJ,IAAI,EACJ,QAAQ,GAAG,cAAc,EACzB,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAC/C,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC7C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,8DAA8D,IAAI,gBAAgB,QAAQ,EAAE;aACtG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,yBAAO,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;QAEzC,MAAM,gBAAgB,GAAG,IAAA,yCAA4B,EAAC;YACpD,QAAQ,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;YACxC,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE;YAClC,YAAY;YACZ,SAAS;YACT,MAAM;YACN,MAAM,EAAE;gBACN,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;aAC/D;YACD,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,EAAE;SACzD,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,KAAM,SAAQ,gCAQrC;YACC,uGAAuG;YACvG,YAAY,UAAoE;gBAC9E,KAAK,CAAC;oBACJ,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;oBAC/B,UAAU;oBACV,WAAW,EAAE,gBAAgB;iBAC9B,CAAC,CAAC;YACL,CAAC;YAED,iGAAiG;YACxF,OAAO;gBACd,MAAM,SAAS,GAAG,CAAC,QAAmC,EAAE,EAAE;oBACxD,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;wBAC7B,OAAO,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;gBAC/C,CAAC,CAAC;gBAEF,+DAA+D;gBAC/D,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,KAAK;wBAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;qBACpD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,IAAI;wBAC9B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;qBACnD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,QAAQ;wBAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;qBACtD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,UAAU;wBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;gBAED,uCAAuC;gBACvC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACxB,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,MAAM;wBAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;qBACrD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,YAAY;wBACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,SAAS;wBACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,YAAY;wBACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,SAAS;wBACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;QAEF,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAA,yDAAkC,EAAC;YACjC,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,sBAAsB;YACnC,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;SACxC,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AA1JD,8CA0JC","sourcesContent":["import type { AbstractEntity } from '@/base/models';\nimport { SchemaTypes } from '@/base/models/common/constants';\nimport type { AbstractRepository } from '@/base/repositories';\nimport type { TAnyObjectSchema } from '@/base/controllers/common/schema-builders';\nimport type { AnyType, ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { isClass } from '@venizia/ignis-inversion';\nimport type { Env, Schema } from 'hono';\nimport type {\n ICrudControllerOptions,\n ICustomizableRoutes,\n TEntityDataObject,\n TEntityPersistObject,\n} from '../common';\nimport { PersistableCrudController } from './crud';\nimport { defineControllerRouteConfigs } from './definition';\nimport { registerFactoryRepositoryInjection } from './repository-injection';\n\n/** Factory for generating typed CRUD controllers from entity definitions. /\nexport class ControllerFactory extends BaseHelper {\n constructor() {\n super({ scope: ControllerFactory.name });\n }\n\n static defineCrudController<\n TEntity extends AbstractEntity<TAnyObjectSchema> = AbstractEntity<TAnyObjectSchema>,\n Routes extends ICustomizableRoutes = ICustomizableRoutes,\n RouteEnv extends Env = Env,\n RouteSchema extends Schema = {},\n BasePath extends string = '/',\n ConfigurableOptions extends object = {},\n TDataObject extends object = TEntityDataObject<TEntity>,\n TPersistObject extends object = TEntityPersistObject<TEntity>,\n >(defOpts: ICrudControllerOptions<TEntity, Routes>) {\n const { controller, entity, authenticate, authorize, routes } = defOpts;\n\n const {\n name,\n basePath = 'unknown_path',\n isStrict = { path: true, requestSchema: true },\n } = controller;\n if (!basePath \|\| basePath === 'unknown_path') {\n throw getError({\n message: `[defineCrudController] Invalid controller basePath \| name: ${name} \| basePath: ${basePath}`,\n });\n }\n\n const entityClass = isClass(entity) ? entity : entity();\n const entityInstance = new entityClass();\n\n const routeDefinitions = defineControllerRouteConfigs({\n isStrict: isStrict.requestSchema ?? true,\n idType: entityInstance.getIdType(),\n authenticate,\n authorize,\n routes,\n schema: {\n select: entityInstance.getSchema({ type: SchemaTypes.SELECT }),\n create: entityInstance.getSchema({ type: SchemaTypes.CREATE }),\n update: entityInstance.getSchema({ type: SchemaTypes.UPDATE }),\n },\n serverStampedKeys: entityInstance.getServerStampedKeys(),\n });\n\n const controllerClass = class extends PersistableCrudController<\n TEntity,\n RouteEnv,\n RouteSchema,\n BasePath,\n ConfigurableOptions,\n TDataObject,\n TPersistObject\n > {\n // Any extra options: a repository whose options narrow `IExtraOptions` (a typed transaction) must fit.\n constructor(repository: AbstractRepository<TDataObject, TPersistObject, AnyType>) {\n super({\n scope: name,\n path: basePath,\n isStrict: isStrict.path ?? true,\n repository,\n definitions: routeDefinitions,\n });\n }\n\n /* Registers each CRUD route whose handler tier supplies it, honoring enabledRoutes/readonly. */\n override binding(): ValueOrPromise<void> {\n const isEnabled = (routeKey: keyof ICustomizableRoutes) => {\n if (controller.enabledRoutes) {\n return controller.enabledRoutes.includes(routeKey);\n }\n return routes?.[routeKey]?.enabled !== false;\n };\n\n // Read routes - always registered (unless explicitly disabled)\n if (isEnabled('count')) {\n this.defineRoute({\n configs: routeDefinitions.COUNT,\n handler: async (context) => this.count({ context }),\n });\n }\n\n if (isEnabled('find')) {\n this.defineRoute({\n configs: routeDefinitions.FIND,\n handler: async (context) => this.find({ context }),\n });\n }\n\n if (isEnabled('findOne')) {\n this.defineRoute({\n configs: routeDefinitions.FIND_ONE,\n handler: async (context) => this.findOne({ context }),\n });\n }\n\n if (isEnabled('findById')) {\n this.defineRoute({\n configs: routeDefinitions.FIND_BY_ID,\n handler: async (context) => this.findById({ context }),\n });\n }\n\n // Write routes - skipped when readonly\n if (controller.readonly) {\n return;\n }\n\n if (isEnabled('create')) {\n this.defineRoute({\n configs: routeDefinitions.CREATE,\n handler: async (context) => this.create({ context }),\n });\n }\n\n if (isEnabled('updateById')) {\n this.defineRoute({\n configs: routeDefinitions.UPDATE_BY_ID,\n handler: async (context) => this.updateById({ context }),\n });\n }\n\n if (isEnabled('updateBy')) {\n this.defineRoute({\n configs: routeDefinitions.UPDATE_BY,\n handler: async (context) => this.updateBy({ context }),\n });\n }\n\n if (isEnabled('deleteById')) {\n this.defineRoute({\n configs: routeDefinitions.DELETE_BY_ID,\n handler: async (context) => this.deleteById({ context }),\n });\n }\n\n if (isEnabled('deleteBy')) {\n this.defineRoute({\n configs: routeDefinitions.DELETE_BY,\n handler: async (context) => this.deleteBy({ context }),\n });\n }\n }\n };\n\n Object.defineProperty(controllerClass, 'name', { value: name, configurable: true });\n registerFactoryRepositoryInjection({\n target: controllerClass,\n factoryName: 'defineCrudController',\n controllerName: name,\n repositoryName: defOpts.repository.name,\n });\n return controllerClass;\n }\n}\n"]}
1	+ {"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../src/base/controllers/factory/controller.ts"],"names":[],"mappings":";;;AACA,8DAA6D;AAI7D,sDAAmE;AACnE,8DAAmD;AAQnD,iCAAmD;AACnD,uDAAqE;AACrE,6CAA4D;AAC5D,iEAA4E;AAE5E,6EAA6E;AAC7E,MAAa,iBAAkB,SAAQ,iBAAU;IAC/C;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,oBAAoB,CASzB,OAAgD;QAChD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAExE,MAAM,EACJ,IAAI,EACJ,QAAQ,GAAG,cAAc,EACzB,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAC/C,GAAG,UAAU,CAAC;QACf,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC7C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,8DAA8D,IAAI,gBAAgB,QAAQ,EAAE;aACtG,CAAC,CAAC;QACL,CAAC;QAED,IAAA,kDAAgC,EAAC;YAC/B,cAAc,EAAE,IAAI;YACpB,SAAS;YACT,MAAM;YACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;SACxC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAA,yBAAO,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;QAEzC,MAAM,gBAAgB,GAAG,IAAA,yCAA4B,EAAC;YACpD,QAAQ,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;YACxC,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE;YAClC,YAAY;YACZ,SAAS;YACT,MAAM;YACN,MAAM,EAAE;gBACN,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,MAAM,EAAE,CAAC;aAC/D;YACD,iBAAiB,EAAE,cAAc,CAAC,oBAAoB,EAAE;SACzD,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,KAAM,SAAQ,gCAQrC;YACC,uGAAuG;YACvG,YAAY,UAAoE;gBAC9E,KAAK,CAAC;oBACJ,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;oBAC/B,UAAU;oBACV,WAAW,EAAE,gBAAgB;iBAC9B,CAAC,CAAC;YACL,CAAC;YAED,iGAAiG;YACxF,OAAO;gBACd,MAAM,SAAS,GAAG,CAAC,QAAmC,EAAE,EAAE;oBACxD,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;wBAC7B,OAAO,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;gBAC/C,CAAC,CAAC;gBAEF,+DAA+D;gBAC/D,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,KAAK;wBAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;qBACpD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,IAAI;wBAC9B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;qBACnD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,QAAQ;wBAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;qBACtD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,UAAU;wBACpC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;gBAED,uCAAuC;gBACvC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACxB,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,MAAM;wBAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;qBACrD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,YAAY;wBACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,SAAS;wBACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,YAAY;wBACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC;wBACf,OAAO,EAAE,gBAAgB,CAAC,SAAS;wBACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;QAEF,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAA,yDAAkC,EAAC;YACjC,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,sBAAsB;YACnC,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;SACxC,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AAlKD,8CAkKC","sourcesContent":["import type { AbstractEntity } from '@/base/models';\nimport { SchemaTypes } from '@/base/models/common/constants';\nimport type { AbstractRepository } from '@/base/repositories';\nimport type { TAnyObjectSchema } from '@/base/controllers/common/schema-builders';\nimport type { AnyType, ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { isClass } from '@venizia/ignis-inversion';\nimport type { Env, Schema } from 'hono';\nimport type {\n ICrudControllerOptions,\n ICustomizableRoutes,\n TEntityDataObject,\n TEntityPersistObject,\n} from '../common';\nimport { PersistableCrudController } from './crud';\nimport { assertWriteVerbsDeclareAuthorize } from './authorize-guard';\nimport { defineControllerRouteConfigs } from './definition';\nimport { registerFactoryRepositoryInjection } from './repository-injection';\n\n/** Factory for generating typed CRUD controllers from entity definitions. /\nexport class ControllerFactory extends BaseHelper {\n constructor() {\n super({ scope: ControllerFactory.name });\n }\n\n static defineCrudController<\n TEntity extends AbstractEntity<TAnyObjectSchema> = AbstractEntity<TAnyObjectSchema>,\n Routes extends ICustomizableRoutes = ICustomizableRoutes,\n RouteEnv extends Env = Env,\n RouteSchema extends Schema = {},\n BasePath extends string = '/',\n ConfigurableOptions extends object = {},\n TDataObject extends object = TEntityDataObject<TEntity>,\n TPersistObject extends object = TEntityPersistObject<TEntity>,\n >(defOpts: ICrudControllerOptions<TEntity, Routes>) {\n const { controller, entity, authenticate, authorize, routes } = defOpts;\n\n const {\n name,\n basePath = 'unknown_path',\n isStrict = { path: true, requestSchema: true },\n } = controller;\n if (!basePath \|\| basePath === 'unknown_path') {\n throw getError({\n message: `[defineCrudController] Invalid controller basePath \| name: ${name} \| basePath: ${basePath}`,\n });\n }\n\n assertWriteVerbsDeclareAuthorize({\n controllerName: name,\n authorize,\n routes,\n readonly: controller.readonly,\n enabledRoutes: controller.enabledRoutes,\n });\n\n const entityClass = isClass(entity) ? entity : entity();\n const entityInstance = new entityClass();\n\n const routeDefinitions = defineControllerRouteConfigs({\n isStrict: isStrict.requestSchema ?? true,\n idType: entityInstance.getIdType(),\n authenticate,\n authorize,\n routes,\n schema: {\n select: entityInstance.getSchema({ type: SchemaTypes.SELECT }),\n create: entityInstance.getSchema({ type: SchemaTypes.CREATE }),\n update: entityInstance.getSchema({ type: SchemaTypes.UPDATE }),\n },\n serverStampedKeys: entityInstance.getServerStampedKeys(),\n });\n\n const controllerClass = class extends PersistableCrudController<\n TEntity,\n RouteEnv,\n RouteSchema,\n BasePath,\n ConfigurableOptions,\n TDataObject,\n TPersistObject\n > {\n // Any extra options: a repository whose options narrow `IExtraOptions` (a typed transaction) must fit.\n constructor(repository: AbstractRepository<TDataObject, TPersistObject, AnyType>) {\n super({\n scope: name,\n path: basePath,\n isStrict: isStrict.path ?? true,\n repository,\n definitions: routeDefinitions,\n });\n }\n\n /* Registers each CRUD route whose handler tier supplies it, honoring enabledRoutes/readonly. */\n override binding(): ValueOrPromise<void> {\n const isEnabled = (routeKey: keyof ICustomizableRoutes) => {\n if (controller.enabledRoutes) {\n return controller.enabledRoutes.includes(routeKey);\n }\n return routes?.[routeKey]?.enabled !== false;\n };\n\n // Read routes - always registered (unless explicitly disabled)\n if (isEnabled('count')) {\n this.defineRoute({\n configs: routeDefinitions.COUNT,\n handler: async (context) => this.count({ context }),\n });\n }\n\n if (isEnabled('find')) {\n this.defineRoute({\n configs: routeDefinitions.FIND,\n handler: async (context) => this.find({ context }),\n });\n }\n\n if (isEnabled('findOne')) {\n this.defineRoute({\n configs: routeDefinitions.FIND_ONE,\n handler: async (context) => this.findOne({ context }),\n });\n }\n\n if (isEnabled('findById')) {\n this.defineRoute({\n configs: routeDefinitions.FIND_BY_ID,\n handler: async (context) => this.findById({ context }),\n });\n }\n\n // Write routes - skipped when readonly\n if (controller.readonly) {\n return;\n }\n\n if (isEnabled('create')) {\n this.defineRoute({\n configs: routeDefinitions.CREATE,\n handler: async (context) => this.create({ context }),\n });\n }\n\n if (isEnabled('updateById')) {\n this.defineRoute({\n configs: routeDefinitions.UPDATE_BY_ID,\n handler: async (context) => this.updateById({ context }),\n });\n }\n\n if (isEnabled('updateBy')) {\n this.defineRoute({\n configs: routeDefinitions.UPDATE_BY,\n handler: async (context) => this.updateBy({ context }),\n });\n }\n\n if (isEnabled('deleteById')) {\n this.defineRoute({\n configs: routeDefinitions.DELETE_BY_ID,\n handler: async (context) => this.deleteById({ context }),\n });\n }\n\n if (isEnabled('deleteBy')) {\n this.defineRoute({\n configs: routeDefinitions.DELETE_BY,\n handler: async (context) => this.deleteBy({ context }),\n });\n }\n }\n };\n\n Object.defineProperty(controllerClass, 'name', { value: name, configurable: true });\n registerFactoryRepositoryInjection({\n target: controllerClass,\n factoryName: 'defineCrudController',\n controllerName: name,\n repositoryName: defOpts.repository.name,\n });\n return controllerClass;\n }\n}\n"]}

package/dist/cjs/base/controllers/rest/abstract.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { type TRoutePathScope } from '../common/constants';
 import type { Hook } from '@hono/zod-openapi';
 import { OpenAPIHono } from '@hono/zod-openapi';
 import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
@@ -15,7 +16,7 @@ export declare abstract class AbstractRestController<RouteEnv extends Env = Env,
     getRouter(): OpenAPIHono<RouteEnv, RouteSchema, BasePath>;
     /** Registers decorator-defined routes from the metadata registry; `paths` selects them by shape - see the two-phase call in {@link configure}. */
     registerRoutesFromRegistry(opts?: {
-        paths?: 'static' | 'param' | 'all';
+        paths?: TRoutePathScope;
     }): void;
     /** Configures the controller by binding all routes and registering decorator-based routes. Idempotent. */
     configure(opts?: ConfigurableOptions): Promise<OpenAPIHono<RouteEnv, RouteSchema, BasePath>>;