@venizia/ignis-kernel 0.4.3 → 0.4.4

package/dist/cjs/base/auth/authorize/common/types/enforcer.d.ts

@@ -1,113 +0,0 @@
-import type { TContext } from '../../../../controllers/common/types';
-import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
-import { type IRedisHelper } from '@venizia/ignis-helpers/core';
-import type { Adapter } from 'casbin';
-import type { Env } from 'hono';
-import { type MiddlewareHandler } from 'hono';
-import type { IAuthUser } from '../../../authenticate/common/types';
-import type { CasbinEnforcerCachedDrivers, CasbinEnforcerModelDrivers, TAuthorizationDecision, TCasbinDomainMatchingFunction } from '../constants';
-import type { IAuthorizationDomainSource, IAuthorizationRequest, IAuthorizationUser, TAuthorizationConditions, TAuthorizationDomainResolver } from './request';
-/** What CasbinAuthorizationEnforcer.buildRules returns and evaluate consumes. */
-export interface ICasbinRules {
-    user: IAuthorizationUser;
-    lines: string[];
-}
-/** Builds rules and evaluates requests. Cache management (`invalidateUserCache`/`rebuildUserCache`) is OPTIONAL - only on per-user-caching enforcers; the registry feature-detects it at runtime. */
-export interface IAuthorizationEnforcer<E extends Env = Env, TAction = string, TResource = string, TRules = unknown, TBuildRulesReturn = ValueOrPromise<TRules>, TEvaluateReturn = ValueOrPromise<TAuthorizationDecision>> {
-    name: string;
-    configure(): ValueOrPromise<void>;
-    buildRules(opts: {
-        user: IAuthorizationUser;
-        context: TContext<E, string>;
-    }): TBuildRulesReturn;
-    evaluate(opts: {
-        rules: TRules;
-        request: IAuthorizationRequest<TAction, TResource>;
-        context: TContext<E, string>;
-    }): TEvaluateReturn;
-    /** Drop a user's cached policies. Implemented only by caching enforcers. */
-    invalidateUserCache?(opts: {
-        user: IAuthorizationUser;
-    }): Promise<{
-        invalidatedKeys: number;
-    }>;
-    /** Drop + rebuild a user's cached policies. Implemented only by caching enforcers. */
-    rebuildUserCache?(opts: {
-        user: IAuthorizationUser;
-    }): Promise<{
-        cacheKey: string;
-        lineCount: number;
-    }>;
-}
-export type TAuthorizationVoter<E extends Env = Env, TAction = string, TResource = string> = (opts: {
-    user: IAuthUser;
-    action: TAction;
-    resource: TResource;
-    context: TContext<E, string>;
-}) => ValueOrPromise<TAuthorizationDecision>;
-export interface IAuthorizationSpec<E extends Env = Env, TAction = string, TResource = string> {
-    action: TAction;
-    resource: TResource;
-    conditions?: TAuthorizationConditions;
-    allowedRoles?: string[];
-    voters?: TAuthorizationVoter<E, TAction, TResource>[];
-    /** Optional per-route domain: declarative source OR a resolver method. Omitted → global resolver. */
-    domain?: IAuthorizationDomainSource | TAuthorizationDomainResolver<E>;
-}
-export type TAuthorizeFn<E extends Env = Env, TAction = string, TResource = string> = (opts: {
-    spec: IAuthorizationSpec<E, TAction, TResource>;
-    enforcerName?: string;
-}) => MiddlewareHandler;
-export interface ICasbinEnforcerCachedRedis {
-    driver: typeof CasbinEnforcerCachedDrivers.REDIS;
-    options: {
-        connection: IRedisHelper;
-        expiresIn: number;
-        keyFn: (opts: {
-            user: IAuthorizationUser;
-        }) => ValueOrPromise<string>;
-    };
-}
-export interface ICasbinEnforcerOptions<E extends Env = Env, TAction = string, TResource = string, TAdapter = Adapter> {
-    model: {
-        driver: typeof CasbinEnforcerModelDrivers.FILE;
-        definition: string;
-    } | {
-        driver: typeof CasbinEnforcerModelDrivers.TEXT;
-        definition: string;
-    };
-    cached: {
-        use: false;
-    } | (ICasbinEnforcerCachedRedis & {
-        use: true;
-    });
-    adapter?: TAdapter;
-    domainMatching?: {
-        roleDefinition: string;
-        fn: TCasbinDomainMatchingFunction;
-    };
-    normalizePayloadFn?(opts: {
-        user: IAuthUser;
-        action: TAction;
-        resource: TResource;
-        context: TContext<E, string>;
-    }): {
-        subject: string;
-        resource: string;
-        action: string;
-        domain?: string;
-    };
-    /** Domain-scoped RBAC model: requests become 4-token `(subject, domain, object, action)` and the enforcer registers the domain matcher (`keyMatch` on `g`) + resource matcher (`objectMatch`). A role assignment or grant declared at a parent domain (via a `g3` policy line, e.g. `Merchant_7 -> Organizer_3`) applies to every child domain - the adapter is what decides whether those edges exist. */
-    isScoped?: boolean;
-    /** Number of pooled enforcers (each request enforces on its own). Default 16. */
-    poolSize?: number;
-    /** Max ms to wait for a free pooled enforcer before failing closed. Default 5000. */
-    poolAcquireTimeoutMs?: number;
-}
-export interface IAuthorizeOptions {
-    defaultDecision: TAuthorizationDecision;
-    alwaysAllowRoles?: string[];
-    /** Fallback domain resolver used when a route's spec has no `domain`. */
-    domainResolver?: TAuthorizationDomainResolver;
-}
-//# sourceMappingURL=enforcer.d.ts.map

package/dist/cjs/base/auth/authorize/common/types/enforcer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,6BAA6B,EAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,WAAW,CAAC;AAEnB,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,qMAAqM;AACrM,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,MAAM,GAAG,OAAO,EAChB,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,EAC1C,eAAe,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAExD,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,UAAU,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,iBAAiB,CAAC;IAEhG,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,eAAe,CAAC;IAEpB,4EAA4E;IAC5E,mBAAmB,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE/F,sFAAsF;IACtF,gBAAgB,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,mBAAmB,CAC7B,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,IAChB,CAAC,IAAI,EAAE;IACT,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,sBAAsB,CAAC,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACtD,qGAAqG;IACrG,MAAM,CAAC,EAAE,0BAA0B,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE;IAC3F,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,KAAK,iBAAiB,CAAC;AAExB,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC;IACjD,OAAO,EAAE;QACP,UAAU,EAAE,YAAY,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,kBAAkB,CAAA;SAAE,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB,CACrC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,QAAQ,GAAG,OAAO;IAElB,KAAK,EACD;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACtE;QAAE,MAAM,EAAE,OAAO,0BAA0B,CAAC,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,MAAM,EAAE;QAAE,GAAG,EAAE,KAAK,CAAA;KAAE,GAAG,CAAC,0BAA0B,GAAG;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAEnB,cAAc,CAAC,EAAE;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,EAAE,EAAE,6BAA6B,CAAC;KACnC,CAAC;IAEF,kBAAkB,CAAC,CAAC,IAAI,EAAE;QACxB,IAAI,EAAE,SAAS,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,SAAS,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF,2YAA2Y;IAC3Y,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,4BAA4B,CAAC;CAC/C"}

package/dist/cjs/base/auth/authorize/common/types/enforcer.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=enforcer.js.map

package/dist/cjs/base/auth/authorize/common/types/enforcer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/enforcer.ts"],"names":[],"mappings":"","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport { type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { type IRedisHelper } from '@venizia/ignis-helpers/core';\nimport type { Adapter } from 'casbin';\nimport type { Env } from 'hono';\nimport { type MiddlewareHandler } from 'hono';\nimport type { IAuthUser } from '../../../authenticate/common/types';\nimport type {\n  CasbinEnforcerCachedDrivers,\n  CasbinEnforcerModelDrivers,\n  TAuthorizationDecision,\n  TCasbinDomainMatchingFunction,\n} from '../constants';\nimport type {\n  IAuthorizationDomainSource,\n  IAuthorizationRequest,\n  IAuthorizationUser,\n  TAuthorizationConditions,\n  TAuthorizationDomainResolver,\n} from './request';\n\n/** What CasbinAuthorizationEnforcer.buildRules returns and evaluate consumes. */\nexport interface ICasbinRules {\n  user: IAuthorizationUser;\n  lines: string[];\n}\n\n/** Builds rules and evaluates requests. Cache management (`invalidateUserCache`/`rebuildUserCache`) is OPTIONAL - only on per-user-caching enforcers; the registry feature-detects it at runtime. */\nexport interface IAuthorizationEnforcer<\n  E extends Env = Env,\n  TAction = string,\n  TResource = string,\n  TRules = unknown,\n  TBuildRulesReturn = ValueOrPromise<TRules>,\n  TEvaluateReturn = ValueOrPromise<TAuthorizationDecision>,\n> {\n  name: string;\n\n  configure(): ValueOrPromise<void>;\n\n  buildRules(opts: { user: IAuthorizationUser; context: TContext<E, string> }): TBuildRulesReturn;\n\n  evaluate(opts: {\n    rules: TRules;\n    request: IAuthorizationRequest<TAction, TResource>;\n    context: TContext<E, string>;\n  }): TEvaluateReturn;\n\n  /** Drop a user's cached policies. Implemented only by caching enforcers. */\n  invalidateUserCache?(opts: { user: IAuthorizationUser }): Promise<{ invalidatedKeys: number }>;\n\n  /** Drop + rebuild a user's cached policies. Implemented only by caching enforcers. */\n  rebuildUserCache?(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lineCount: number }>;\n}\n\nexport type TAuthorizationVoter<\n  E extends Env = Env,\n  TAction = string,\n  TResource = string,\n> = (opts: {\n  user: IAuthUser;\n  action: TAction;\n  resource: TResource;\n  context: TContext<E, string>;\n}) => ValueOrPromise<TAuthorizationDecision>;\n\nexport interface IAuthorizationSpec<E extends Env = Env, TAction = string, TResource = string> {\n  action: TAction;\n  resource: TResource;\n  conditions?: TAuthorizationConditions;\n  allowedRoles?: string[];\n  voters?: TAuthorizationVoter<E, TAction, TResource>[];\n  /** Optional per-route domain: declarative source OR a resolver method. Omitted → global resolver. */\n  domain?: IAuthorizationDomainSource | TAuthorizationDomainResolver<E>;\n}\n\nexport type TAuthorizeFn<E extends Env = Env, TAction = string, TResource = string> = (opts: {\n  spec: IAuthorizationSpec<E, TAction, TResource>;\n  enforcerName?: string;\n}) => MiddlewareHandler;\n\nexport interface ICasbinEnforcerCachedRedis {\n  driver: typeof CasbinEnforcerCachedDrivers.REDIS;\n  options: {\n    connection: IRedisHelper;\n    expiresIn: number;\n    keyFn: (opts: { user: IAuthorizationUser }) => ValueOrPromise<string>;\n  };\n}\n\nexport interface ICasbinEnforcerOptions<\n  E extends Env = Env,\n  TAction = string,\n  TResource = string,\n  TAdapter = Adapter,\n> {\n  model:\n    | { driver: typeof CasbinEnforcerModelDrivers.FILE; definition: string }\n    | { driver: typeof CasbinEnforcerModelDrivers.TEXT; definition: string };\n  cached: { use: false } | (ICasbinEnforcerCachedRedis & { use: true });\n  adapter?: TAdapter;\n\n  domainMatching?: {\n    roleDefinition: string;\n    fn: TCasbinDomainMatchingFunction;\n  };\n\n  normalizePayloadFn?(opts: {\n    user: IAuthUser;\n    action: TAction;\n    resource: TResource;\n    context: TContext<E, string>;\n  }): {\n    subject: string;\n    resource: string;\n    action: string;\n    domain?: string;\n  };\n\n  /** Domain-scoped RBAC model: requests become 4-token `(subject, domain, object, action)` and the enforcer registers the domain matcher (`keyMatch` on `g`) + resource matcher (`objectMatch`). A role assignment or grant declared at a parent domain (via a `g3` policy line, e.g. `Merchant_7 -> Organizer_3`) applies to every child domain - the adapter is what decides whether those edges exist. */\n  isScoped?: boolean;\n\n  /** Number of pooled enforcers (each request enforces on its own). Default 16. */\n  poolSize?: number;\n\n  /** Max ms to wait for a free pooled enforcer before failing closed. Default 5000. */\n  poolAcquireTimeoutMs?: number;\n}\n\nexport interface IAuthorizeOptions {\n  defaultDecision: TAuthorizationDecision;\n  alwaysAllowRoles?: string[];\n  /** Fallback domain resolver used when a route's spec has no `domain`. */\n  domainResolver?: TAuthorizationDomainResolver;\n}\n"]}

package/dist/cjs/base/auth/authorize/common/types/grant.d.ts

@@ -1,18 +0,0 @@
-import type { AuthorizationPolicyBuilder } from '../../builders/policy.builder';
-import type { TAuthorizationAction } from '../constants';
-/** Shape of `PolicyDefinition.metadata` on a subset ("custom") grant. `ops` holds bare method names (e.g. `"find"`), not full permission codes. */
-export type TCustomGrantMetadata = {
-    ops: string[];
-};
-export type TGrantIntent = {
-    tier: TAuthorizationAction;
-} | {
-    ops: string[];
-};
-/** Per-operation rows carry `targetId` = the operation's code, not a database id; the consumer resolves codes to ids when persisting. */
-export type TPlannedGrantRow = ReturnType<typeof AuthorizationPolicyBuilder.grant> & {
-    metadata?: {
-        ops: string[];
-    };
-};
-//# sourceMappingURL=grant.d.ts.map

package/dist/cjs/base/auth/authorize/common/types/grant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,mJAAmJ;AACnJ,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE9E,yIAAyI;AACzI,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,KAAK,CAAC,GAAG;IACnF,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9B,CAAC"}

package/dist/cjs/base/auth/authorize/common/types/grant.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=grant.js.map

package/dist/cjs/base/auth/authorize/common/types/grant.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/grant.ts"],"names":[],"mappings":"","sourcesContent":["import type { AuthorizationPolicyBuilder } from '../../builders/policy.builder';\nimport type { TAuthorizationAction } from '../constants';\n\n/** Shape of `PolicyDefinition.metadata` on a subset (\"custom\") grant. `ops` holds bare method names (e.g. `\"find\"`), not full permission codes. */\nexport type TCustomGrantMetadata = { ops: string[] };\n\nexport type TGrantIntent = { tier: TAuthorizationAction } | { ops: string[] };\n\n/** Per-operation rows carry `targetId` = the operation's code, not a database id; the consumer resolves codes to ids when persisting. */\nexport type TPlannedGrantRow = ReturnType<typeof AuthorizationPolicyBuilder.grant> & {\n  metadata?: { ops: string[] };\n};\n"]}

package/dist/cjs/base/auth/authorize/common/types/index.d.ts

@@ -1,4 +0,0 @@
-export * from './enforcer';
-export * from './grant';
-export * from './request';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/common/types/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC"}

package/dist/cjs/base/auth/authorize/common/types/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./enforcer"), exports);
-__exportStar(require("./grant"), exports);
-__exportStar(require("./request"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/common/types/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,0CAAwB;AACxB,4CAA0B","sourcesContent":["export * from './enforcer';\nexport * from './grant';\nexport * from './request';\n"]}

package/dist/cjs/base/auth/authorize/common/types/request.d.ts

@@ -1,37 +0,0 @@
-import type { IdType } from '../../../..';
-import type { TContext } from '../../../../controllers/common/types';
-import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
-import type { Env } from 'hono';
-import type { IAuthUser } from '../../../authenticate/common/types';
-import type { TAuthorizationDomainSource } from '../constants';
-export interface IAuthorizationRole {
-    readonly name: string;
-    readonly priority: number;
-    readonly identifier: string;
-}
-/** Key-value conditions for attribute-based access control. Values compared with strict equality. */
-export type TAuthorizationConditions<KeyType extends string | symbol = string | symbol, ValueType = string | number | boolean | null> = Record<KeyType, ValueType>;
-export interface IAuthorizationRequest<TAction = string, TResource = string> {
-    action: TAction;
-    resource: TResource;
-    conditions?: TAuthorizationConditions;
-    /** Resolved domain scope for this request as a casbin domain string `"<DomainType>_<id>"` (e.g. `"Merchant_7"`), or the `"SYSTEM_WIDE"` sentinel to enforce across all domains. */
-    domain?: string;
-}
-export interface IAuthorizationUser extends IAuthUser {
-    principalType: string;
-}
-/** Declarative description of where to read the request domain from. */
-export interface IAuthorizationDomainSource {
-    from: TAuthorizationDomainSource;
-    key: string;
-    type: string;
-}
-/** Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */
-export type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {
-    context: TContext<E, string>;
-}) => ValueOrPromise<TNullable<{
-    type: string;
-    id: IdType;
-}>>;
-//# sourceMappingURL=request.d.ts.map

package/dist/cjs/base/auth/authorize/common/types/request.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EACjD,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE/B,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,mLAAmL;IACnL,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACrE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK,cAAc,CAAC,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC"}

package/dist/cjs/base/auth/authorize/common/types/request.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=request.js.map

package/dist/cjs/base/auth/authorize/common/types/request.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/types/request.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TContext } from '@/base/controllers/common/types';\nimport { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport type { IAuthUser } from '../../../authenticate/common/types';\nimport type { TAuthorizationDomainSource } from '../constants';\n\nexport interface IAuthorizationRole {\n  readonly name: string;\n  readonly priority: number;\n  readonly identifier: string;\n}\n\n/** Key-value conditions for attribute-based access control. Values compared with strict equality. */\nexport type TAuthorizationConditions<\n  KeyType extends string | symbol = string | symbol,\n  ValueType = string | number | boolean | null,\n> = Record<KeyType, ValueType>;\n\nexport interface IAuthorizationRequest<TAction = string, TResource = string> {\n  action: TAction;\n  resource: TResource;\n  conditions?: TAuthorizationConditions;\n  /** Resolved domain scope for this request as a casbin domain string `\"<DomainType>_<id>\"` (e.g. `\"Merchant_7\"`), or the `\"SYSTEM_WIDE\"` sentinel to enforce across all domains. */\n  domain?: string;\n}\n\nexport interface IAuthorizationUser extends IAuthUser {\n  principalType: string;\n}\n\n/** Declarative description of where to read the request domain from. */\nexport interface IAuthorizationDomainSource {\n  from: TAuthorizationDomainSource;\n  key: string;\n  type: string; // domain type, e.g. 'Merchant' | 'Organizer'\n}\n\n/** Returns the current request domain; null = no domain (→ SYSTEM_WIDE). */\nexport type TAuthorizationDomainResolver<E extends Env = Env> = (opts: {\n  context: TContext<E, string>;\n}) => ValueOrPromise<TNullable<{ type: string; id: IdType }>>;\n"]}

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.d.ts

@@ -1,68 +0,0 @@
-import type { Container } from '../../../../helpers/inversion/container';
-import type { TClass } from '@venizia/ignis-helpers/common';
-import type { IAuthUser } from '../../authenticate/common/types';
-import { AbstractAuthRegistry } from '../../base';
-import type { AuthorizationEnforcerTypes, IAuthorizationEnforcer, IAuthorizationUser, IAuthorizeOptions, ICasbinEnforcerOptions } from '../common';
-export declare class AuthorizationEnforcerRegistry extends AbstractAuthRegistry<IAuthorizationEnforcer> {
-    static readonly SINGLETON_REAL_KEY = "authorization-enforcer-registry";
-    private configuredEnforcers;
-    /** In-flight `configure()` calls, so concurrent first requests share one warmup instead of racing. */
-    private pendingConfigurations;
-    /** Set by AuthorizeComponent from the application container. Held here because the descriptor scan
-     * below sees only registered enforcers, and `defaultDecision` has to be readable when there are none. */
-    private applicationOptions;
-    constructor();
-    static getInstance(): AuthorizationEnforcerRegistry;
-    reset(): void;
-    protected getBindingPrefix(): string;
-    register(opts: {
-        container: Container;
-        enforcers: Array<{
-            enforcer: TClass<IAuthorizationEnforcer>;
-            name: string;
-            type: typeof AuthorizationEnforcerTypes.CASBIN;
-            options?: ICasbinEnforcerOptions;
-        } | {
-            enforcer: TClass<IAuthorizationEnforcer>;
-            name: string;
-            type: typeof AuthorizationEnforcerTypes.CUSTOM;
-            options?: unknown;
-        }>;
-    }): this;
-    hasEnforcers(): boolean;
-    getDefaultEnforcerName(): string;
-    /**
-     * The PROMISE is memoised, not just the completed flag.
-     *
-     * `configure()` yields (it dynamic-imports casbin), and the flag was only set after the await -
-     * so a burst of first requests each saw an unconfigured enforcer and each built a full pool.
-     * Measured: 40 concurrent first requests produced 40 configure() calls and 640 enforcers.
-     * The entry is dropped on rejection so a failed warmup does not poison every later request.
-     */
-    resolveEnforcer(opts: {
-        name: string;
-    }): Promise<IAuthorizationEnforcer>;
-    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
-    invalidateUserCache(opts: {
-        user: IAuthorizationUser;
-        enforcerName?: string;
-    }): Promise<{
-        invalidatedKeys: number;
-    }>;
-    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
-    rebuildUserCache(opts: {
-        user: {
-            principalType: string;
-        } & IAuthUser;
-        enforcerName?: string;
-    }): Promise<{
-        cacheKey: string;
-        lineCount: number;
-    }>;
-    /** Options bound on the application, independent of any enforcer. */
-    setOptions(opts: {
-        options: IAuthorizeOptions;
-    }): void;
-    resolveOptions(): IAuthorizeOptions | undefined;
-}
-//# sourceMappingURL=enforcer-registry.d.ts.map

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer-registry.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/enforcer-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,+BAA+B,CAAC;AAEvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,WAAW,CAAC;AAGnB,qBAAa,6BAA8B,SAAQ,oBAAoB,CAAC,sBAAsB,CAAC;IAC7F,MAAM,CAAC,QAAQ,CAAC,kBAAkB,qCAAqC;IAEvE,OAAO,CAAC,mBAAmB,CAAc;IAEzC,sGAAsG;IACtG,OAAO,CAAC,qBAAqB,CAA6B;IAE1D;6GACyG;IACzG,OAAO,CAAC,kBAAkB,CAAsC;;IAQhE,MAAM,CAAC,WAAW;IAOT,KAAK,IAAI,IAAI;IAOtB,SAAS,CAAC,gBAAgB,IAAI,MAAM;IAIpC,QAAQ,CAAC,IAAI,EAAE;QACb,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,KAAK,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACzC,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,EAAE,sBAAsB,CAAC;SAClC,GACD;YACE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACzC,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CACJ,CAAC;KACH;IA4BD,YAAY,IAAI,OAAO;IAIvB,sBAAsB,IAAI,MAAM;IAIhC;;;;;;;OAOG;IACG,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6B9E,4FAA4F;IACtF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxC,2FAA2F;IACrF,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE;YAAE,aAAa,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;QAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAapD,qEAAqE;IACrE,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI;IAItD,cAAc,IAAI,iBAAiB,GAAG,SAAS;CAiBhD"}

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.js

@@ -1,137 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationEnforcerRegistry = void 0;
-const singleton_realm_1 = require("../../../../helpers/singleton-realm");
-const core_1 = require("@venizia/ignis-helpers/core");
-const base_1 = require("../../base");
-const common_1 = require("../common");
-class AuthorizationEnforcerRegistry extends base_1.AbstractAuthRegistry {
-    static { this.SINGLETON_REAL_KEY = 'authorization-enforcer-registry'; }
-    constructor() {
-        super({ scope: AuthorizationEnforcerRegistry.name });
-        /** Set by AuthorizeComponent from the application container. Held here because the descriptor scan
-         * below sees only registered enforcers, and `defaultDecision` has to be readable when there are none. */
-        this.applicationOptions = null;
-        this.configuredEnforcers = new Set();
-        this.pendingConfigurations = new Map();
-    }
-    static getInstance() {
-        return singleton_realm_1.SingletonRealm.resolve({
-            key: AuthorizationEnforcerRegistry.SINGLETON_REAL_KEY,
-            create: () => new AuthorizationEnforcerRegistry(),
-        });
-    }
-    reset() {
-        super.reset();
-        this.configuredEnforcers.clear();
-        this.pendingConfigurations.clear();
-        this.applicationOptions = null;
-    }
-    getBindingPrefix() {
-        return common_1.Authorization.ENFORCER;
-    }
-    register(opts) {
-        const { container, enforcers } = opts;
-        const names = enforcers.map((e) => e.name);
-        const duplicateNames = names.filter((n, i) => names.indexOf(n) !== i);
-        if (duplicateNames.length) {
-            throw (0, core_1.getError)({
-                message: `[AuthorizationEnforcerRegistry] Duplicate enforcer name(s): ${[...new Set(duplicateNames)].join(', ')}`,
-            });
-        }
-        for (const { enforcer, name, options } of enforcers) {
-            if (this.descriptors.has(name)) {
-                throw (0, core_1.getError)({
-                    message: `[AuthorizationEnforcerRegistry] Enforcer already registered: ${name}`,
-                });
-            }
-            this.registerDescriptor({ container, target: enforcer, name });
-            if (options) {
-                container.bind({ key: common_1.AuthorizeBindingKeys.enforcerOptions(name) }).toValue(options);
-            }
-        }
-        return this;
-    }
-    hasEnforcers() {
-        return this.descriptors.size > 0;
-    }
-    getDefaultEnforcerName() {
-        return this.getDefaultName();
-    }
-    /**
-     * The PROMISE is memoised, not just the completed flag.
-     *
-     * `configure()` yields (it dynamic-imports casbin), and the flag was only set after the await -
-     * so a burst of first requests each saw an unconfigured enforcer and each built a full pool.
-     * Measured: 40 concurrent first requests produced 40 configure() calls and 640 enforcers.
-     * The entry is dropped on rejection so a failed warmup does not poison every later request.
-     */
-    async resolveEnforcer(opts) {
-        const enforcer = this.resolveDescriptor(opts);
-        if (this.configuredEnforcers.has(opts.name)) {
-            return enforcer;
-        }
-        const inFlight = this.pendingConfigurations.get(opts.name);
-        if (inFlight) {
-            await inFlight;
-            return enforcer;
-        }
-        // `Promise.resolve` because `configure()` is declared `ValueOrPromise<void>` - a synchronous
-        // implementation returns plain `void`, which has no `.then`.
-        const pending = Promise.resolve(enforcer.configure())
-            .then(() => {
-            this.configuredEnforcers.add(opts.name);
-        })
-            .finally(() => {
-            this.pendingConfigurations.delete(opts.name);
-        });
-        this.pendingConfigurations.set(opts.name, pending);
-        await pending;
-        return enforcer;
-    }
-    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
-    async invalidateUserCache(opts) {
-        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
-        const enforcer = await this.resolveEnforcer({ name });
-        // Cache management is an optional IAuthorizationEnforcer capability - feature-detect it.
-        if (typeof enforcer.invalidateUserCache !== 'function') {
-            throw (0, core_1.getError)({
-                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
-            });
-        }
-        return enforcer.invalidateUserCache({ user: opts.user });
-    }
-    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
-    async rebuildUserCache(opts) {
-        const name = opts.enforcerName ?? this.getDefaultEnforcerName();
-        const enforcer = await this.resolveEnforcer({ name });
-        if (typeof enforcer.rebuildUserCache !== 'function') {
-            throw (0, core_1.getError)({
-                message: `[AuthorizationEnforcerRegistry] Enforcer "${name}" does not support cache invalidation`,
-            });
-        }
-        return enforcer.rebuildUserCache({ user: opts.user });
-    }
-    /** Options bound on the application, independent of any enforcer. */
-    setOptions(opts) {
-        this.applicationOptions = opts.options;
-    }
-    resolveOptions() {
-        if (this.applicationOptions) {
-            return this.applicationOptions;
-        }
-        for (const [, metadata] of this.descriptors) {
-            const { container } = metadata;
-            const options = container.get({
-                key: common_1.AuthorizeBindingKeys.OPTIONS,
-                isOptional: true,
-            });
-            if (options) {
-                return options;
-            }
-        }
-        return undefined;
-    }
-}
-exports.AuthorizationEnforcerRegistry = AuthorizationEnforcerRegistry;
-//# sourceMappingURL=enforcer-registry.js.map

package/dist/cjs/base/auth/authorize/enforcers/enforcer-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer-registry.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/enforcer-registry.ts"],"names":[],"mappings":";;;AAAA,+DAA2D;AAG3D,sDAAuD;AAEvD,qCAAkD;AAQlD,sCAAgE;AAEhE,MAAa,6BAA8B,SAAQ,2BAA4C;aAC7E,uBAAkB,GAAG,iCAAiC,AAApC,CAAqC;IAWvE;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QALvD;iHACyG;QACjG,uBAAkB,GAAiC,IAAI,CAAC;QAI9D,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,gCAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,6BAA6B,CAAC,kBAAkB;YACrD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,6BAA6B,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;IACjC,CAAC;IAES,gBAAgB;QACxB,OAAO,sBAAa,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,IAgBR;QACC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+DAA+D,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,gEAAgE,IAAI,EAAE;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAE/D,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,6BAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,IAAsB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC;YACf,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;aAClD,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnD,MAAM,OAAO,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,mBAAmB,CAAC,IAGzB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,yFAAyF;QACzF,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,gBAAgB,CAAC,IAGtB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACpD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,uCAAuC;aAClG,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,UAAU,CAAC,IAAoC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC;IACzC,CAAC;IAED,cAAc;QACZ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;YAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAoB;gBAC/C,GAAG,EAAE,6BAAoB,CAAC,OAAO;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;;AArLH,sEAsLC","sourcesContent":["import { SingletonRealm } from '@/helpers/singleton-realm';\nimport type { Container } from '@/helpers/inversion/container';\nimport type { TClass, TNullable } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type { IAuthUser } from '../../authenticate/common/types';\nimport { AbstractAuthRegistry } from '../../base';\nimport type {\n  AuthorizationEnforcerTypes,\n  IAuthorizationEnforcer,\n  IAuthorizationUser,\n  IAuthorizeOptions,\n  ICasbinEnforcerOptions,\n} from '../common';\nimport { Authorization, AuthorizeBindingKeys } from '../common';\n\nexport class AuthorizationEnforcerRegistry extends AbstractAuthRegistry<IAuthorizationEnforcer> {\n  static readonly SINGLETON_REAL_KEY = 'authorization-enforcer-registry';\n\n  private configuredEnforcers: Set<string>;\n\n  /** In-flight `configure()` calls, so concurrent first requests share one warmup instead of racing. */\n  private pendingConfigurations: Map<string, Promise<void>>;\n\n  /** Set by AuthorizeComponent from the application container. Held here because the descriptor scan\n   * below sees only registered enforcers, and `defaultDecision` has to be readable when there are none. */\n  private applicationOptions: TNullable<IAuthorizeOptions> = null;\n\n  constructor() {\n    super({ scope: AuthorizationEnforcerRegistry.name });\n    this.configuredEnforcers = new Set();\n    this.pendingConfigurations = new Map();\n  }\n\n  static getInstance() {\n    return SingletonRealm.resolve({\n      key: AuthorizationEnforcerRegistry.SINGLETON_REAL_KEY,\n      create: () => new AuthorizationEnforcerRegistry(),\n    });\n  }\n\n  override reset(): void {\n    super.reset();\n    this.configuredEnforcers.clear();\n    this.pendingConfigurations.clear();\n    this.applicationOptions = null;\n  }\n\n  protected getBindingPrefix(): string {\n    return Authorization.ENFORCER;\n  }\n\n  register(opts: {\n    container: Container;\n    enforcers: Array<\n      | {\n          enforcer: TClass<IAuthorizationEnforcer>;\n          name: string;\n          type: typeof AuthorizationEnforcerTypes.CASBIN;\n          options?: ICasbinEnforcerOptions;\n        }\n      | {\n          enforcer: TClass<IAuthorizationEnforcer>;\n          name: string;\n          type: typeof AuthorizationEnforcerTypes.CUSTOM;\n          options?: unknown;\n        }\n    >;\n  }) {\n    const { container, enforcers } = opts;\n\n    const names = enforcers.map((e) => e.name);\n    const duplicateNames = names.filter((n, i) => names.indexOf(n) !== i);\n    if (duplicateNames.length) {\n      throw getError({\n        message: `[AuthorizationEnforcerRegistry] Duplicate enforcer name(s): ${[...new Set(duplicateNames)].join(', ')}`,\n      });\n    }\n\n    for (const { enforcer, name, options } of enforcers) {\n      if (this.descriptors.has(name)) {\n        throw getError({\n          message: `[AuthorizationEnforcerRegistry] Enforcer already registered: ${name}`,\n        });\n      }\n\n      this.registerDescriptor({ container, target: enforcer, name });\n\n      if (options) {\n        container.bind({ key: AuthorizeBindingKeys.enforcerOptions(name) }).toValue(options);\n      }\n    }\n\n    return this;\n  }\n\n  hasEnforcers(): boolean {\n    return this.descriptors.size > 0;\n  }\n\n  getDefaultEnforcerName(): string {\n    return this.getDefaultName();\n  }\n\n  /**\n   * The PROMISE is memoised, not just the completed flag.\n   *\n   * `configure()` yields (it dynamic-imports casbin), and the flag was only set after the await -\n   * so a burst of first requests each saw an unconfigured enforcer and each built a full pool.\n   * Measured: 40 concurrent first requests produced 40 configure() calls and 640 enforcers.\n   * The entry is dropped on rejection so a failed warmup does not poison every later request.\n   */\n  async resolveEnforcer(opts: { name: string }): Promise<IAuthorizationEnforcer> {\n    const enforcer = this.resolveDescriptor(opts);\n\n    if (this.configuredEnforcers.has(opts.name)) {\n      return enforcer;\n    }\n\n    const inFlight = this.pendingConfigurations.get(opts.name);\n    if (inFlight) {\n      await inFlight;\n      return enforcer;\n    }\n\n    // `Promise.resolve` because `configure()` is declared `ValueOrPromise<void>` - a synchronous\n    // implementation returns plain `void`, which has no `.then`.\n    const pending = Promise.resolve(enforcer.configure())\n      .then(() => {\n        this.configuredEnforcers.add(opts.name);\n      })\n      .finally(() => {\n        this.pendingConfigurations.delete(opts.name);\n      });\n\n    this.pendingConfigurations.set(opts.name, pending);\n\n    await pending;\n    return enforcer;\n  }\n\n  /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */\n  async invalidateUserCache(opts: {\n    user: IAuthorizationUser;\n    enforcerName?: string;\n  }): Promise<{ invalidatedKeys: number }> {\n    const name = opts.enforcerName ?? this.getDefaultEnforcerName();\n    const enforcer = await this.resolveEnforcer({ name });\n\n    // Cache management is an optional IAuthorizationEnforcer capability - feature-detect it.\n    if (typeof enforcer.invalidateUserCache !== 'function') {\n      throw getError({\n        message: `[AuthorizationEnforcerRegistry] Enforcer \"${name}\" does not support cache invalidation`,\n      });\n    }\n\n    return enforcer.invalidateUserCache({ user: opts.user });\n  }\n\n  /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */\n  async rebuildUserCache(opts: {\n    user: { principalType: string } & IAuthUser;\n    enforcerName?: string;\n  }): Promise<{ cacheKey: string; lineCount: number }> {\n    const name = opts.enforcerName ?? this.getDefaultEnforcerName();\n    const enforcer = await this.resolveEnforcer({ name });\n\n    if (typeof enforcer.rebuildUserCache !== 'function') {\n      throw getError({\n        message: `[AuthorizationEnforcerRegistry] Enforcer \"${name}\" does not support cache invalidation`,\n      });\n    }\n\n    return enforcer.rebuildUserCache({ user: opts.user });\n  }\n\n  /** Options bound on the application, independent of any enforcer. */\n  setOptions(opts: { options: IAuthorizeOptions }): void {\n    this.applicationOptions = opts.options;\n  }\n\n  resolveOptions(): IAuthorizeOptions | undefined {\n    if (this.applicationOptions) {\n      return this.applicationOptions;\n    }\n\n    for (const [, metadata] of this.descriptors) {\n      const { container } = metadata;\n      const options = container.get<IAuthorizeOptions>({\n        key: AuthorizeBindingKeys.OPTIONS,\n        isOptional: true,\n      });\n      if (options) {\n        return options;\n      }\n    }\n    return undefined;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/enforcers/index.d.ts

@@ -1,2 +0,0 @@
-export * from './enforcer-registry';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/enforcers/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/cjs/base/auth/authorize/enforcers/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./enforcer-registry"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/enforcers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/enforcers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC","sourcesContent":["export * from './enforcer-registry';\n"]}

package/dist/cjs/base/auth/authorize/index.d.ts

@@ -1,7 +0,0 @@
-export * from './builders';
-export * from './common';
-export * from './enforcers';
-export * from './middlewares';
-export * from './models';
-export * from './providers';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/cjs/base/auth/authorize/index.js

@@ -1,23 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./builders"), exports);
-__exportStar(require("./common"), exports);
-__exportStar(require("./enforcers"), exports);
-__exportStar(require("./middlewares"), exports);
-__exportStar(require("./models"), exports);
-__exportStar(require("./providers"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/authorize/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,2CAAyB;AACzB,8CAA4B;AAC5B,gDAA8B;AAC9B,2CAAyB;AACzB,8CAA4B","sourcesContent":["export * from './builders';\nexport * from './common';\nexport * from './enforcers';\nexport * from './middlewares';\nexport * from './models';\nexport * from './providers';\n"]}

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.d.ts

@@ -1,6 +0,0 @@
-import type { IAuthorizationSpec } from '../common';
-export declare const authorize: (opts: {
-    spec: IAuthorizationSpec;
-    enforcerName?: string;
-}) => import("hono").MiddlewareHandler;
-//# sourceMappingURL=authorize.middleware.d.ts.map

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.middleware.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAMpD,eAAO,MAAM,SAAS,GAAI,MAAM;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,qCAElF,CAAC"}

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorize = void 0;
-const providers_1 = require("../providers");
-const authorizationProvider = new providers_1.AuthorizationProvider();
-const authorizeFn = authorizationProvider.value();
-const authorize = (opts) => {
-    return authorizeFn(opts);
-};
-exports.authorize = authorize;
-//# sourceMappingURL=authorize.middleware.js.map

package/dist/cjs/base/auth/authorize/middlewares/authorize.middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.middleware.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/authorize.middleware.ts"],"names":[],"mappings":";;;AACA,4CAAqD;AAErD,MAAM,qBAAqB,GAAG,IAAI,iCAAqB,EAAE,CAAC;AAC1D,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAE3C,MAAM,SAAS,GAAG,CAAC,IAAyD,EAAE,EAAE;IACrF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAFW,QAAA,SAAS,aAEpB","sourcesContent":["import type { IAuthorizationSpec } from '../common';\nimport { AuthorizationProvider } from '../providers';\n\nconst authorizationProvider = new AuthorizationProvider();\nconst authorizeFn = authorizationProvider.value();\n\nexport const authorize = (opts: { spec: IAuthorizationSpec; enforcerName?: string }) => {\n  return authorizeFn(opts);\n};\n"]}

package/dist/cjs/base/auth/authorize/middlewares/index.d.ts

@@ -1,2 +0,0 @@
-export * from './authorize.middleware';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/middlewares/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}