@venizia/ignis-kernel 0.4.3 → 0.4.5

package/dist/cjs/base/auth/authorize/builders/permission.builder.js

@@ -1,95 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationPermissionBuilder = void 0;
-const constants_1 = require("../common/constants");
-/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
-class AuthorizationPermissionBuilder {
-    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
-    static { this.RESOURCE_NODE_METHOD = '*'; }
-    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
-    static { this.METHOD_ACTIONS = {
-        find: constants_1.AuthorizationActions.READ,
-        findById: constants_1.AuthorizationActions.READ,
-        findOne: constants_1.AuthorizationActions.READ,
-        count: constants_1.AuthorizationActions.READ,
-        create: constants_1.AuthorizationActions.CREATE,
-        updateById: constants_1.AuthorizationActions.UPDATE,
-        updateBy: constants_1.AuthorizationActions.UPDATE,
-        deleteById: constants_1.AuthorizationActions.DELETE,
-        deleteBy: constants_1.AuthorizationActions.DELETE,
-    }; }
-    /** The CRUD methods {@link crud} generates by default. */
-    static { this.DEFAULT_CRUD_METHODS = [
-        'find',
-        'findById',
-        'findOne',
-        'count',
-        'create',
-        'updateById',
-        'updateBy',
-        'deleteById',
-        'deleteBy',
-    ]; }
-    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
-    static actionForMethod(method) {
-        return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? constants_1.AuthorizationActions.EXECUTE;
-    }
-    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
-    static operation(opts) {
-        return {
-            code: [opts.subject, opts.method].join('.'),
-            subject: opts.subject,
-            method: opts.method,
-            action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),
-            scope: opts.scope,
-            description: opts.description ?? null,
-            parentId: opts.parentId ?? null,
-            name: opts.name,
-        };
-    }
-    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
-    static resourceNode(opts) {
-        return {
-            code: opts.code,
-            subject: opts.subject ?? opts.code,
-            method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,
-            action: opts.action ?? constants_1.AuthorizationActions.MANAGE,
-            scope: opts.scope,
-            description: opts.description ?? null,
-            parentId: opts.parentId ?? null,
-            name: opts.name,
-        };
-    }
-    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
-    static crud(opts) {
-        const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;
-        return methods.map((method) => {
-            const action = AuthorizationPermissionBuilder.actionForMethod(method);
-            const ctx = {
-                subject: opts.subject,
-                method,
-                action,
-            };
-            return AuthorizationPermissionBuilder.operation({
-                subject: opts.subject,
-                method,
-                scope: opts.scope,
-                action,
-                name: opts.name(ctx),
-                description: opts.description ? opts.description(ctx) : undefined,
-            });
-        });
-    }
-    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
-    static objectMatch(requested, granted) {
-        if (granted === '*') {
-            return true;
-        }
-        if (requested === granted) {
-            return true;
-        }
-        return requested.startsWith(`${granted}.`);
-    }
-}
-exports.AuthorizationPermissionBuilder = AuthorizationPermissionBuilder;
-//# sourceMappingURL=permission.builder.js.map

package/dist/cjs/base/auth/authorize/builders/permission.builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":";;;AAGA,mDAA2D;AAE3D,+RAA+R;AAC/R,MAAa,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,gCAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,gCAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,gCAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,gCAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,gCAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,gCAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,gCAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,gCAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gCAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;;AA3HH,wEA4HC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { TAuthorizationAction } from '../common/constants';\nimport { AuthorizationActions } from '../common/constants';\n\n/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */\nexport class AuthorizationPermissionBuilder {\n  /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */\n  static readonly RESOURCE_NODE_METHOD = '*';\n\n  /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */\n  static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>> = {\n    find: AuthorizationActions.READ,\n    findById: AuthorizationActions.READ,\n    findOne: AuthorizationActions.READ,\n    count: AuthorizationActions.READ,\n    create: AuthorizationActions.CREATE,\n    updateById: AuthorizationActions.UPDATE,\n    updateBy: AuthorizationActions.UPDATE,\n    deleteById: AuthorizationActions.DELETE,\n    deleteBy: AuthorizationActions.DELETE,\n  };\n\n  /** The CRUD methods {@link crud} generates by default. */\n  static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string> = [\n    'find',\n    'findById',\n    'findOne',\n    'count',\n    'create',\n    'updateById',\n    'updateBy',\n    'deleteById',\n    'deleteBy',\n  ];\n\n  /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */\n  static actionForMethod(method: string): TAuthorizationAction {\n    return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? AuthorizationActions.EXECUTE;\n  }\n\n  /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */\n  static operation<TName>(opts: {\n    subject: string;\n    method: string;\n    scope: string;\n    name: TName;\n    description?: TNullable<TName>;\n    action?: TAuthorizationAction;\n    parentId?: TNullable<IdType>;\n  }) {\n    return {\n      code: [opts.subject, opts.method].join('.'),\n      subject: opts.subject,\n      method: opts.method,\n      action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),\n      scope: opts.scope,\n      description: opts.description ?? null,\n      parentId: opts.parentId ?? null,\n      name: opts.name,\n    };\n  }\n\n  /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */\n  static resourceNode<TName>(opts: {\n    code: string;\n    subject?: string;\n    scope: string;\n    name: TName;\n    description?: TNullable<TName>;\n    action?: TAuthorizationAction;\n    parentId?: TNullable<IdType>;\n  }) {\n    return {\n      code: opts.code,\n      subject: opts.subject ?? opts.code,\n      method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,\n      action: opts.action ?? AuthorizationActions.MANAGE,\n      scope: opts.scope,\n      description: opts.description ?? null,\n      parentId: opts.parentId ?? null,\n      name: opts.name,\n    };\n  }\n\n  /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */\n  static crud<TName>(opts: {\n    subject: string;\n    scope: string;\n    name: (ctx: { subject: string; method: string; action: TAuthorizationAction }) => TName;\n    description?: (ctx: {\n      subject: string;\n      method: string;\n      action: TAuthorizationAction;\n    }) => TNullable<TName>;\n    methods?: ReadonlyArray<string>;\n  }) {\n    const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;\n\n    return methods.map((method) => {\n      const action = AuthorizationPermissionBuilder.actionForMethod(method);\n      const ctx: { subject: string; method: string; action: TAuthorizationAction } = {\n        subject: opts.subject,\n        method,\n        action,\n      };\n\n      return AuthorizationPermissionBuilder.operation<TName>({\n        subject: opts.subject,\n        method,\n        scope: opts.scope,\n        action,\n        name: opts.name(ctx),\n        description: opts.description ? opts.description(ctx) : undefined,\n      });\n    });\n  }\n\n  /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */\n  static objectMatch(requested: string, granted: string): boolean {\n    if (granted === '*') {\n      return true;\n    }\n\n    if (requested === granted) {\n      return true;\n    }\n\n    return requested.startsWith(`${granted}.`);\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts

@@ -1,201 +0,0 @@
-import type { IdType } from '../../..';
-import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';
-import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants';
-/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
-export type TPolicyDomainInput = string | {
-    type: string;
-    id: IdType;
-};
-/**
- * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its
- * literal members widen to `string` when a method's return type is inferred rather than declared.
- * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.
- * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes
- * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.
- */
-type TBuilderGrantRow = {
-    variant: typeof AuthorizationPolicyVariants.GRANT.action;
-    subjectType: string;
-    subjectId: IdType;
-    targetType: string;
-    targetId: IdType;
-    action: string;
-    effect: TAuthorizationDecision;
-    domainType: TNullable<string>;
-    domainId: TNullable<IdType>;
-};
-/**
- * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read
- * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own
- * metadata has a different shape points the adapter at a different column
- * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.
- *
- * Declared here, beside the only writer, so the column type and the row type cannot drift.
- */
-export type TSubsetGrantMetadata = {
-    ops: string[];
-};
-type TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {
-    action: typeof AuthorizationActions.CUSTOM;
-    metadata: TSubsetGrantMetadata;
-};
-export declare class AuthorizationPolicyBuilder {
-    static readonly ACTION_PRINCIPAL = "Action";
-    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
-    private static splitDomain;
-    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
-    static grant(opts: {
-        subject: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            id: IdType;
-        };
-        action: string;
-        domain?: TNullable<TPolicyDomainInput>;
-        effect: TAuthorizationDecision;
-    }): TBuilderGrantRow;
-    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
-    static customGrant(opts: {
-        subject: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            id: IdType;
-        };
-        ops: string[];
-        domain?: TNullable<TPolicyDomainInput>;
-        effect: TAuthorizationDecision;
-    }): TBuilderCustomGrantRow;
-    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
-    static assignRole(opts: {
-        user: {
-            type: string;
-            id: IdType;
-        };
-        role: {
-            type: string;
-            id: IdType;
-        };
-        domain?: TNullable<TPolicyDomainInput>;
-    }): {
-        domainType: TNullable<string>;
-        domainId: TNullable<IdType>;
-        variant: "assign_role";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
-    static joinDomain(opts: {
-        user: {
-            type: string;
-            id: IdType;
-        };
-        domain: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "join_domain";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
-    static roleInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "role_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
-    static resourceInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "resource_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
-    static actionInherits(opts: {
-        child: TAuthorizationAction;
-        parent: TAuthorizationAction;
-    }): {
-        variant: "action_inherits";
-        subjectType: string;
-        subjectId: TAuthorizationAction;
-        targetType: string;
-        targetId: TAuthorizationAction;
-    };
-    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
-    static actionLattice(): {
-        variant: "action_inherits";
-        subjectType: string;
-        subjectId: TAuthorizationAction;
-        targetType: string;
-        targetId: TAuthorizationAction;
-    }[];
-    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
-    static domainInherits(opts: {
-        child: {
-            type: string;
-            id: IdType;
-        };
-        parent: {
-            type: string;
-            id: IdType;
-        };
-    }): {
-        variant: "domain_inherits";
-        subjectType: string;
-        subjectId: IdType;
-        targetType: string;
-        targetId: IdType;
-    };
-    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
-    static roleGrants(opts: {
-        role: {
-            type: string;
-            id: IdType;
-        };
-        permission: {
-            type: string;
-            idByCode: ReadonlyMap<string, string>;
-        };
-        grants: ReadonlyArray<{
-            resourceCode: string;
-            action: string;
-            domain?: TNullable<TPolicyDomainInput>;
-            effect: TAuthorizationDecision;
-        }>;
-    }): TBuilderGrantRow[];
-}
-export {};
-//# sourceMappingURL=policy.builder.d.ts.map

package/dist/cjs/base/auth/authorize/builders/policy.builder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,oBAAoB,EAEpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErD,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IAC/D,MAAM,EAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY;IAE5C,sJAAsJ;IACtJ,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,gBAAgB;IAapB,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,sBAAsB;IAc1B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;KACxC;oBA5Da,SAAS,CAAC,MAAM,CAAC;kBACnB,SAAS,CAAC,MAAM,CAAC;;;;;;;IAsE7B,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE;;;;;;;IAUzF,iHAAiH;IACjH,MAAM,CAAC,aAAa;;;;;;;IAIpB,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACtC;;;;;;;IAUD,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,CAAC;QAEF,MAAM,EAAE,aAAa,CAAC;YACpB,YAAY,EAAE,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,EAAE,sBAAsB,CAAC;SAChC,CAAC,CAAC;KACJ;CAsBF"}

package/dist/cjs/base/auth/authorize/builders/policy.builder.js

@@ -1,130 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationPolicyBuilder = void 0;
-const constants_1 = require("../common/constants");
-class AuthorizationPolicyBuilder {
-    static { this.ACTION_PRINCIPAL = 'Action'; }
-    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
-    static splitDomain(domain) {
-        if (domain == null || domain === constants_1.AuthorizationDomainScopes.ANY_MEMBER) {
-            return { domainType: null, domainId: null };
-        }
-        if (typeof domain === 'string') {
-            return { domainType: domain, domainId: null };
-        }
-        return { domainType: domain.type, domainId: domain.id };
-    }
-    /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
-    static grant(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.GRANT.action,
-            subjectType: opts.subject.type,
-            subjectId: opts.subject.id,
-            targetType: opts.permission.type,
-            targetId: opts.permission.id,
-            action: opts.action,
-            effect: opts.effect,
-            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
-        };
-    }
-    /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */
-    static customGrant(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.GRANT.action,
-            subjectType: opts.subject.type,
-            subjectId: opts.subject.id,
-            targetType: opts.permission.type,
-            targetId: opts.permission.id,
-            action: constants_1.AuthorizationActions.CUSTOM,
-            effect: opts.effect,
-            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
-            metadata: { ops: opts.ops },
-        };
-    }
-    /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */
-    static assignRole(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.ASSIGN_ROLE.action,
-            subjectType: opts.user.type,
-            subjectId: opts.user.id,
-            targetType: opts.role.type,
-            targetId: opts.role.id,
-            ...AuthorizationPolicyBuilder.splitDomain(opts.domain),
-        };
-    }
-    /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
-    static joinDomain(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.JOIN_DOMAIN.action,
-            subjectType: opts.user.type,
-            subjectId: opts.user.id,
-            targetType: opts.domain.type,
-            targetId: opts.domain.id,
-        };
-    }
-    /** A role inherits another role (casbin `g`, shared relation with assign_role). */
-    static roleInherits(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.ROLE_INHERITS.action,
-            subjectType: opts.child.type,
-            subjectId: opts.child.id,
-            targetType: opts.parent.type,
-            targetId: opts.parent.id,
-        };
-    }
-    /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */
-    static resourceInherits(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.RESOURCE_INHERITS.action,
-            subjectType: opts.child.type,
-            subjectId: opts.child.id,
-            targetType: opts.parent.type,
-            targetId: opts.parent.id,
-        };
-    }
-    /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */
-    static actionInherits(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.ACTION_INHERITS.action,
-            subjectType: this.ACTION_PRINCIPAL,
-            subjectId: opts.child,
-            targetType: this.ACTION_PRINCIPAL,
-            targetId: opts.parent,
-        };
-    }
-    /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */
-    static actionLattice() {
-        return constants_1.AuthorizationActions.LATTICE.map((action) => this.actionInherits(action));
-    }
-    /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */
-    static domainInherits(opts) {
-        return {
-            variant: constants_1.AuthorizationPolicyVariants.DOMAIN_INHERITS.action,
-            subjectType: opts.child.type,
-            subjectId: opts.child.id,
-            targetType: opts.parent.type,
-            targetId: opts.parent.id,
-        };
-    }
-    /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */
-    static roleGrants(opts) {
-        const rows = [];
-        for (const grant of opts.grants) {
-            const permissionId = opts.permission.idByCode.get(grant.resourceCode);
-            if (!permissionId) {
-                continue;
-            }
-            const policy = AuthorizationPolicyBuilder.grant({
-                subject: { type: opts.role.type, id: opts.role.id },
-                permission: { type: opts.permission.type, id: permissionId },
-                action: grant.action,
-                domain: grant.domain,
-                effect: grant.effect,
-            });
-            rows.push(policy);
-        }
-        return rows;
-    }
-}
-exports.AuthorizationPolicyBuilder = AuthorizationPolicyBuilder;
-//# sourceMappingURL=policy.builder.js.map

package/dist/cjs/base/auth/authorize/builders/policy.builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/policy.builder.ts"],"names":[],"mappings":";;;AAGA,mDAI6B;AAuC7B,MAAa,0BAA0B;aACrB,qBAAgB,GAAG,QAAQ,CAAC;IAE5C,sJAAsJ;IAC9I,MAAM,CAAC,WAAW,CAAC,MAAsC;QAI/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,qCAAyB,CAAC,UAAU,EAAE,CAAC;YACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,qMAAqM;IACrM,MAAM,CAAC,KAAK,CAAC,IAMZ;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,6LAA6L;IAC7L,MAAM,CAAC,WAAW,CAAC,IAMlB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,KAAK,CAAC,MAAM;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,gCAAoB,CAAC,MAAM;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAIjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,UAAU,CAAC,IAGjB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,WAAW,CAAC,MAAM;YACvD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,YAAY,CAAC,IAGnB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,aAAa,CAAC,MAAM;YACzD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,qKAAqK;IACrK,MAAM,CAAC,gBAAgB,CAAC,IAGvB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,iBAAiB,CAAC,MAAM;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,cAAc,CAAC,IAAmE;QACvF,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,aAAa;QAClB,OAAO,gCAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,8HAA8H;IAC9H,MAAM,CAAC,cAAc,CAAC,IAGrB;QACC,OAAO;YACL,OAAO,EAAE,uCAA2B,CAAC,eAAe,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,uMAAuM;IACvM,MAAM,CAAC,UAAU,CAAC,IAajB;QACC,MAAM,IAAI,GAA+D,EAAE,CAAC;QAE5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACnD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;;AAvLH,gEAwLC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants';\nimport {\n  AuthorizationActions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '../common/constants';\n\n/** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */\nexport type TPolicyDomainInput = string | { type: string; id: IdType };\n\n/**\n * Explicit on purpose: `TAuthorizationDecision` is `Extract<ValueOf<T>, string | number>`, and its\n * literal members widen to `string` when a method's return type is inferred rather than declared.\n * Without this annotation `grant()`'s `effect` stops satisfying `PolicyDefinition`'s narrowed column.\n * Not exported - `TGrantRow`/`TCustomGrantRow` already name unrelated adapter-side row shapes\n * downstream; consumers derive this shape via `ReturnType<typeof AuthorizationPolicyBuilder.grant>`.\n */\ntype TBuilderGrantRow = {\n  variant: typeof AuthorizationPolicyVariants.GRANT.action;\n  subjectType: string;\n  subjectId: IdType;\n  targetType: string;\n  targetId: IdType;\n  action: string;\n  effect: TAuthorizationDecision;\n  domainType: TNullable<string>;\n  domainId: TNullable<IdType>;\n};\n\n/**\n * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read\n * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own\n * metadata has a different shape points the adapter at a different column\n * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.\n *\n * Declared here, beside the only writer, so the column type and the row type cannot drift.\n */\nexport type TSubsetGrantMetadata = { ops: string[] };\n\ntype TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {\n  action: typeof AuthorizationActions.CUSTOM;\n  metadata: TSubsetGrantMetadata;\n};\n\nexport class AuthorizationPolicyBuilder {\n  static readonly ACTION_PRINCIPAL = 'Action';\n\n  /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */\n  private static splitDomain(domain?: TNullable<TPolicyDomainInput>): {\n    domainType: TNullable<string>;\n    domainId: TNullable<IdType>;\n  } {\n    if (domain == null || domain === AuthorizationDomainScopes.ANY_MEMBER) {\n      return { domainType: null, domainId: null };\n    }\n\n    if (typeof domain === 'string') {\n      return { domainType: domain, domainId: null };\n    }\n\n    return { domainType: domain.type, domainId: domain.id };\n  }\n\n  /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */\n  static grant(opts: {\n    subject: { type: string; id: IdType };\n    permission: { type: string; id: IdType };\n    action: string;\n    domain?: TNullable<TPolicyDomainInput>;\n    effect: TAuthorizationDecision;\n  }): TBuilderGrantRow {\n    return {\n      variant: AuthorizationPolicyVariants.GRANT.action,\n      subjectType: opts.subject.type,\n      subjectId: opts.subject.id,\n      targetType: opts.permission.type,\n      targetId: opts.permission.id,\n      action: opts.action,\n      effect: opts.effect,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n    };\n  }\n\n  /** A subset grant (casbin `p` x N): role/user -> resource node with the granted operations in metadata. `action` is fixed to the CUSTOM sentinel; the adapter expands `ops` at read time. */\n  static customGrant(opts: {\n    subject: { type: string; id: IdType };\n    permission: { type: string; id: IdType };\n    ops: string[];\n    domain?: TNullable<TPolicyDomainInput>;\n    effect: TAuthorizationDecision;\n  }): TBuilderCustomGrantRow {\n    return {\n      variant: AuthorizationPolicyVariants.GRANT.action,\n      subjectType: opts.subject.type,\n      subjectId: opts.subject.id,\n      targetType: opts.permission.type,\n      targetId: opts.permission.id,\n      action: AuthorizationActions.CUSTOM,\n      effect: opts.effect,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n      metadata: { ops: opts.ops },\n    };\n  }\n\n  /** Assign a role to a user (casbin `g`). `domain` null ⇒ `*` (every domain). */\n  static assignRole(opts: {\n    user: { type: string; id: IdType };\n    role: { type: string; id: IdType };\n    domain?: TNullable<TPolicyDomainInput>;\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.ASSIGN_ROLE.action,\n      subjectType: opts.user.type,\n      subjectId: opts.user.id,\n      targetType: opts.role.type,\n      targetId: opts.role.id,\n      ...AuthorizationPolicyBuilder.splitDomain(opts.domain),\n    };\n  }\n\n  /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */\n  static joinDomain(opts: {\n    user: { type: string; id: IdType };\n    domain: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.JOIN_DOMAIN.action,\n      subjectType: opts.user.type,\n      subjectId: opts.user.id,\n      targetType: opts.domain.type,\n      targetId: opts.domain.id,\n    };\n  }\n\n  /** A role inherits another role (casbin `g`, shared relation with assign_role). */\n  static roleInherits(opts: {\n    child: { type: string; id: IdType };\n    parent: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.ROLE_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** A resource inherits another (casbin `g4`): a grant on the PARENT covers the CHILD. Many-to-many - a subject may inherit several module parents, one edge each. */\n  static resourceInherits(opts: {\n    child: { type: string; id: IdType }; // Permission\n    parent: { type: string; id: IdType }; // Permission\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.RESOURCE_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** An action inherits another (casbin `g5`): the child action is implied by the parent, e.g. read ⊂ manage. */\n  static actionInherits(opts: { child: TAuthorizationAction; parent: TAuthorizationAction }) {\n    return {\n      variant: AuthorizationPolicyVariants.ACTION_INHERITS.action,\n      subjectType: this.ACTION_PRINCIPAL,\n      subjectId: opts.child,\n      targetType: this.ACTION_PRINCIPAL,\n      targetId: opts.parent,\n    };\n  }\n\n  /** All `action_inherits` rows for the standard {@link AuthorizationActions.LATTICE}. Seed once, idempotently. */\n  static actionLattice() {\n    return AuthorizationActions.LATTICE.map((action) => this.actionInherits(action));\n  }\n\n  /** A domain inherits another (casbin `g3`): a grant in the parent domain cascades to the child. e.g. Merchant ⊂ Organizer. */\n  static domainInherits(opts: {\n    child: { type: string; id: IdType };\n    parent: { type: string; id: IdType };\n  }) {\n    return {\n      variant: AuthorizationPolicyVariants.DOMAIN_INHERITS.action,\n      subjectType: opts.child.type,\n      subjectId: opts.child.id,\n      targetType: opts.parent.type,\n      targetId: opts.parent.id,\n    };\n  }\n\n  /** Build a role's coarse grant rows from resolved permission ids. The caller resolves each `resourceCode` (subject/module) to a `Permission` and supplies the lookup; unresolved codes are skipped. */\n  static roleGrants(opts: {\n    role: { type: string; id: IdType };\n    permission: {\n      type: string;\n      idByCode: ReadonlyMap<string, string>;\n    };\n\n    grants: ReadonlyArray<{\n      resourceCode: string;\n      action: string;\n      domain?: TNullable<TPolicyDomainInput>;\n      effect: TAuthorizationDecision;\n    }>;\n  }) {\n    const rows: Array<ReturnType<typeof AuthorizationPolicyBuilder.grant>> = [];\n\n    for (const grant of opts.grants) {\n      const permissionId = opts.permission.idByCode.get(grant.resourceCode);\n      if (!permissionId) {\n        continue;\n      }\n\n      const policy = AuthorizationPolicyBuilder.grant({\n        subject: { type: opts.role.type, id: opts.role.id },\n        permission: { type: opts.permission.type, id: permissionId },\n        action: grant.action,\n        domain: grant.domain,\n        effect: grant.effect,\n      });\n\n      rows.push(policy);\n    }\n\n    return rows;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts

@@ -1,134 +0,0 @@
-import type { TConstValue } from '@venizia/ignis-helpers/common';
-import { AuthorizationRole } from '../../models/authorization-role.model';
-export declare class Authorization {
-    static readonly RULES = "authorization.rules";
-    static readonly SKIP_AUTHORIZATION = "authorization.skip";
-    static readonly ENFORCER = "authorization.enforcer";
-    static readonly DOMAIN = "authorization.domain";
-}
-export declare class AuthorizationActions {
-    static readonly CREATE = "create";
-    static readonly UPDATE = "update";
-    static readonly DELETE = "delete";
-    static readonly EXECUTE = "execute";
-    static readonly READ = "read";
-    static readonly WRITE = "write";
-    static readonly MANAGE = "manage";
-    /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */
-    static readonly CUSTOM = "custom";
-    static readonly SCHEME_SET: Set<string>;
-    static readonly LATTICE: ReadonlyArray<{
-        child: TAuthorizationAction;
-        parent: TAuthorizationAction;
-    }>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;
-export declare class AuthorizationDecisions {
-    static readonly ALLOW = "allow";
-    static readonly DENY = "deny";
-    static readonly ABSTAIN = "abstain";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-    static isAllow(input: string | number): boolean;
-    static isDeny(input: string | number): boolean;
-    static isAbstain(input: string | number): boolean;
-}
-export type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;
-export declare class AuthorizationRoles {
-    static readonly SUPER_ADMIN: AuthorizationRole;
-    static readonly ADMIN: AuthorizationRole;
-    static readonly USER: AuthorizationRole;
-    static readonly GUEST: AuthorizationRole;
-    static readonly UNKNOWN_USER: AuthorizationRole;
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export declare class AuthorizationDomainScopes {
-    /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
-    static readonly ANY_MEMBER = "ANY_MEMBER";
-    /** Grant applies system-wide, bypassing membership - super-admin only. */
-    static readonly SYSTEM_WIDE = "SYSTEM_WIDE";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
-/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
-export declare class AuthorizationPolicyVariants {
-    /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
-    static readonly GRANT: {
-        readonly action: "grant";
-        readonly rule: "p";
-    };
-    /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */
-    static readonly ASSIGN_ROLE: {
-        readonly action: "assign_role";
-        readonly rule: "g";
-    };
-    /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */
-    static readonly ROLE_INHERITS: {
-        readonly action: "role_inherits";
-        readonly rule: "g";
-    };
-    /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */
-    static readonly JOIN_DOMAIN: {
-        readonly action: "join_domain";
-        readonly rule: "g2";
-    };
-    /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */
-    static readonly DOMAIN_INHERITS: {
-        readonly action: "domain_inherits";
-        readonly rule: "g3";
-    };
-    /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */
-    static readonly RESOURCE_INHERITS: {
-        readonly action: "resource_inherits";
-        readonly rule: "g4";
-    };
-    /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */
-    static readonly ACTION_INHERITS: {
-        readonly action: "action_inherits";
-        readonly rule: "g5";
-    };
-    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
-    static readonly ALL: readonly [{
-        readonly action: "grant";
-        readonly rule: "p";
-    }, {
-        readonly action: "assign_role";
-        readonly rule: "g";
-    }, {
-        readonly action: "role_inherits";
-        readonly rule: "g";
-    }, {
-        readonly action: "join_domain";
-        readonly rule: "g2";
-    }, {
-        readonly action: "domain_inherits";
-        readonly rule: "g3";
-    }, {
-        readonly action: "resource_inherits";
-        readonly rule: "g4";
-    }, {
-        readonly action: "action_inherits";
-        readonly rule: "g5";
-    }];
-    static readonly ACTION_SCHEME_SET: Set<string>;
-    static readonly RULE_SCHEME_SET: Set<string>;
-    static isValidAction(input: string): boolean;
-    static isValidRule(input: string): boolean;
-}
-/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
-export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
-/** Where an `IAuthorizationDomainSource` reads the request domain from. */
-export declare class AuthorizationDomainSources {
-    static readonly PARAM = "param";
-    static readonly HEADER = "header";
-    static readonly QUERY = "query";
-    static readonly CONTEXT = "context";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(value: string): boolean;
-}
-/** Valid authorization domain source values. */
-export type TAuthorizationDomainSource = TConstValue<typeof AuthorizationDomainSources>;
-//# sourceMappingURL=authorization.d.ts.map

package/dist/cjs/base/auth/authorize/common/constants/authorization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authorize/common/constants/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,yBAAyB;IAC9C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,wBAAwB;IAC1D,MAAM,CAAC,QAAQ,CAAC,QAAQ,4BAA4B;IACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,0BAA0B;CACjD;AAED,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAWvB;IAEH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE,oBAAoB,CAAC;QAC5B,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAOA;IAEF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5E,qBAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkD;IAE5E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO/C,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAO9C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;CAMlD;AACD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEhF,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,oBAGxB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAGjB;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,oBAGlB;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,oBAGzB;IAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,qBAAa,yBAAyB;IACpC,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAE5C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAgD;IAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEtF,sRAAsR;AACtR,qBAAa,2BAA2B;IACtC,0KAA0K;IAC1K,MAAM,CAAC,QAAQ,CAAC,KAAK;;;MAA4D;IAEjF,wIAAwI;IACxI,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAkE;IAE7F,0LAA0L;IAC1L,MAAM,CAAC,QAAQ,CAAC,aAAa;;;MAAoE;IAEjG,gJAAgJ;IAChJ,MAAM,CAAC,QAAQ,CAAC,WAAW;;;MAAmE;IAE9F,oLAAoL;IACpL,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,uPAAuP;IACvP,MAAM,CAAC,QAAQ,CAAC,iBAAiB;;;MAGtB;IAEX,0RAA0R;IAC1R,MAAM,CAAC,QAAQ,CAAC,eAAe;;;MAGpB;IAEX,sIAAsI;IACtI,MAAM,CAAC,QAAQ,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;OAQR;IAEX,MAAM,CAAC,QAAQ,CAAC,iBAAiB,cAAiE;IAElG,MAAM,CAAC,QAAQ,CAAC,eAAe,cAA+D;IAE9F,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI5C,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAG3C;AAED,6IAA6I;AAC7I,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE7D,2EAA2E;AAC3E,qBAAa,0BAA0B;IACrC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAwE;IAElG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,gDAAgD;AAChD,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC"}