@venizia/ignis-kernel 0.4.3 → 0.4.5

package/dist/cjs/base/auth/authorize/middlewares/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./authorize.middleware"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/middlewares/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/middlewares/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC","sourcesContent":["export * from './authorize.middleware';\n"]}

package/dist/cjs/base/auth/authorize/models/authorization-role.model.d.ts

@@ -1,30 +0,0 @@
-import type { IAuthorizationRole } from '../common';
-export declare class AuthorizationRole implements IAuthorizationRole {
-    readonly name: string;
-    readonly priority: number;
-    readonly delimiter: string;
-    static build(opts: {
-        name: string;
-        priority: number;
-        delimiter?: string;
-    }): AuthorizationRole;
-    constructor(opts: {
-        name: string;
-        priority: number;
-        delimiter?: string;
-    });
-    get identifier(): string;
-    compare(opts: {
-        target: IAuthorizationRole;
-    }): number;
-    isHigherThan(opts: {
-        target: IAuthorizationRole;
-    }): boolean;
-    isLowerThan(opts: {
-        target: IAuthorizationRole;
-    }): boolean;
-    isEqualTo(opts: {
-        target: IAuthorizationRole;
-    }): boolean;
-}
-//# sourceMappingURL=authorization-role.model.d.ts.map

package/dist/cjs/base/auth/authorize/models/authorization-role.model.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-role.model.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;gBAIjF,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,OAAO,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,MAAM;IAIrD,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI3D,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;IAI1D,SAAS,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO;CAGzD"}

package/dist/cjs/base/auth/authorize/models/authorization-role.model.js

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationRole = void 0;
-class AuthorizationRole {
-    static build(opts) {
-        return new AuthorizationRole(opts);
-    }
-    constructor(opts) {
-        this.name = opts.name;
-        this.priority = opts.priority;
-        this.delimiter = opts.delimiter ?? '_';
-    }
-    get identifier() {
-        return [String(this.priority).padStart(3, '0'), this.name].join(this.delimiter);
-    }
-    compare(opts) {
-        return this.priority - opts.target.priority;
-    }
-    isHigherThan(opts) {
-        return this.compare(opts) > 0;
-    }
-    isLowerThan(opts) {
-        return this.compare(opts) < 0;
-    }
-    isEqualTo(opts) {
-        return this.compare(opts) === 0;
-    }
-}
-exports.AuthorizationRole = AuthorizationRole;
-//# sourceMappingURL=authorization-role.model.js.map

package/dist/cjs/base/auth/authorize/models/authorization-role.model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-role.model.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/authorization-role.model.ts"],"names":[],"mappings":";;;AAEA,MAAa,iBAAiB;IAK5B,MAAM,CAAC,KAAK,CAAC,IAA4D;QACvE,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,IAA4D;QACtE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IACzC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,IAAoC;QAC1C,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,IAAoC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,IAAoC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,IAAoC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAlCD,8CAkCC","sourcesContent":["import type { IAuthorizationRole } from '../common';\n\nexport class AuthorizationRole implements IAuthorizationRole {\n  readonly name: string;\n  readonly priority: number;\n  readonly delimiter: string;\n\n  static build(opts: { name: string; priority: number; delimiter?: string }): AuthorizationRole {\n    return new AuthorizationRole(opts);\n  }\n\n  constructor(opts: { name: string; priority: number; delimiter?: string }) {\n    this.name = opts.name;\n    this.priority = opts.priority;\n    this.delimiter = opts.delimiter ?? '_';\n  }\n\n  get identifier(): string {\n    return [String(this.priority).padStart(3, '0'), this.name].join(this.delimiter);\n  }\n\n  compare(opts: { target: IAuthorizationRole }): number {\n    return this.priority - opts.target.priority;\n  }\n\n  isHigherThan(opts: { target: IAuthorizationRole }): boolean {\n    return this.compare(opts) > 0;\n  }\n\n  isLowerThan(opts: { target: IAuthorizationRole }): boolean {\n    return this.compare(opts) < 0;\n  }\n\n  isEqualTo(opts: { target: IAuthorizationRole }): boolean {\n    return this.compare(opts) === 0;\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/models/index.d.ts

@@ -1,2 +0,0 @@
-export * from './authorization-role.model';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/models/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/dist/cjs/base/auth/authorize/models/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./authorization-role.model"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/models/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C","sourcesContent":["export * from './authorization-role.model';\n"]}

package/dist/cjs/base/auth/authorize/providers/authorization.provider.d.ts

@@ -1,10 +0,0 @@
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import type { IProvider } from '@venizia/ignis-inversion';
-import type { TAuthorizeFn } from '../common';
-export declare class AuthorizationProvider extends BaseHelper implements IProvider<TAuthorizeFn> {
-    constructor();
-    value(): TAuthorizeFn;
-    private createAuthorizeMiddleware;
-    private extractUserRoles;
-}
-//# sourceMappingURL=authorization.provider.d.ts.map

package/dist/cjs/base/auth/authorize/providers/authorization.provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.provider.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/authorization.provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,OAAO,KAAK,EAAsB,YAAY,EAAE,MAAM,WAAW,CAAC;AAKlE,qBAAa,qBAAsB,SAAQ,UAAW,YAAW,SAAS,CAAC,YAAY,CAAC;;IAKtF,KAAK,IAAI,YAAY;IAMrB,OAAO,CAAC,yBAAyB;IAkKjC,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/cjs/base/auth/authorize/providers/authorization.provider.js

@@ -1,163 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationProvider = void 0;
-const context_1 = require("../../../controllers/context");
-const core_1 = require("@venizia/ignis-helpers/core");
-const factory_1 = require("hono/factory");
-// Deep import (not the authenticate barrel): the barrel re-exports ./controllers, whose factory extends BaseRestController - a value import here forms the base/controllers <-> auth init cycle.
-const constants_1 = require("../../authenticate/common/constants");
-const common_1 = require("../common");
-const enforcer_registry_1 = require("../enforcers/enforcer-registry");
-const request_domain_1 = require("./request-domain");
-class AuthorizationProvider extends core_1.BaseHelper {
-    constructor() {
-        super({ scope: AuthorizationProvider.name });
-    }
-    value() {
-        return (opts) => {
-            return this.createAuthorizeMiddleware(opts);
-        };
-    }
-    createAuthorizeMiddleware(opts) {
-        const { spec, enforcerName } = opts;
-        const logger = this.logger.for(this.createAuthorizeMiddleware.name);
-        return (0, factory_1.createMiddleware)(async (context, next) => {
-            const registry = enforcer_registry_1.AuthorizationEnforcerRegistry.getInstance();
-            const options = registry.resolveOptions();
-            const isSkipAuthorize = context.get(common_1.Authorization.SKIP_AUTHORIZATION);
-            if (isSkipAuthorize) {
-                logger.warn('SKIP checking authorization | path: %s', context.req.path);
-                return next();
-            }
-            const user = context.get(constants_1.Authentication.CURRENT_USER);
-            if (!user) {
-                throw (0, core_1.getError)({
-                    error: common_1.AuthorizationErrors.UNAUTHENTICATED,
-                    message: 'Authorization failed: No authenticated user found',
-                });
-            }
-            const needsRoleCheck = Boolean(options?.alwaysAllowRoles?.length) || Boolean(spec.allowedRoles?.length);
-            if (needsRoleCheck) {
-                const userRoles = this.extractUserRoles({ user });
-                if (options?.alwaysAllowRoles?.length &&
-                    userRoles.some((r) => options.alwaysAllowRoles.includes(r))) {
-                    logger.warn('SKIP checking authorization | User has always-allow role | userRoles: %s', userRoles);
-                    return next();
-                }
-                if (spec.allowedRoles?.length && userRoles.some((r) => spec.allowedRoles.includes(r))) {
-                    logger.warn('GRANT access | User has allowed role for route | userRoles: %s', userRoles);
-                    return next();
-                }
-            }
-            const votersList = spec.voters ?? [];
-            for (const voter of votersList) {
-                const decision = await voter({
-                    user,
-                    action: spec.action,
-                    resource: spec.resource,
-                    context: (0, context_1.asTypedContext)(context),
-                });
-                if (decision === common_1.AuthorizationDecisions.DENY) {
-                    throw (0, core_1.getError)({
-                        error: common_1.AuthorizationErrors.DENIED_BY_VOTER,
-                        message: `Authorization denied by voter | action: ${spec.action} | resource: ${spec.resource}`,
-                        messageArgs: { action: spec.action, resource: spec.resource },
-                    });
-                }
-                if (decision === common_1.AuthorizationDecisions.ALLOW) {
-                    await next();
-                    return;
-                }
-                // ABSTAIN → continue to enforcer
-            }
-            if (!registry.hasEnforcers()) {
-                const noEnforcerDecision = options?.defaultDecision ?? common_1.AuthorizationDecisions.DENY;
-                if (noEnforcerDecision === common_1.AuthorizationDecisions.ALLOW) {
-                    logger.warn('ALLOW checking authorization | No enforcers registered | path: %s', context.req.path);
-                    return next();
-                }
-                throw (0, core_1.getError)({
-                    error: common_1.AuthorizationErrors.ENFORCER_NOT_REGISTERED,
-                    message: `Authorization failed: authorize() was declared for this route but no enforcer is registered | path: ${context.req.path}`,
-                });
-            }
-            const resolvedName = enforcerName ?? registry.getDefaultEnforcerName();
-            const enforcer = await registry.resolveEnforcer({ name: resolvedName });
-            // Only resolve domain scope when it is actually in play (per-route domain OR a configured global resolver) - avoids a resolver call (possible DB hit) for legacy enforcers.
-            //
-            // Held in a LOCAL, not read back out of the context. One middleware is pushed per spec onto
-            // the same Hono context, so reading `Authorization.DOMAIN` at decision time meant a
-            // domain-less spec inherited the tenant domain a PREVIOUS spec had written - silently
-            // widening a check that should have run at SYSTEM_WIDE. The context is still set, for
-            // observability, but nothing decides on it.
-            const domainScope = spec.domain || options?.domainResolver
-                ? await (0, request_domain_1.resolveRequestDomain)({
-                    spec,
-                    context: (0, context_1.asTypedContext)(context),
-                    options,
-                })
-                : undefined;
-            context.set(common_1.Authorization.DOMAIN, domainScope);
-            // Keyed by enforcer. The slot used to hold one rule set for the whole request, so a second
-            // `authorize()` naming a DIFFERENT enforcer evaluated against the first enforcer's rules -
-            // granting where its own policy set denies.
-            //
-            // `instanceof Map`, not a truthiness test: the slot previously held a bare rule set, so
-            // anything that pre-populates it with the old shape would otherwise reach `.get` on a value
-            // that has no such method and take the request down with a TypeError.
-            const existingRules = context.get(common_1.Authorization.RULES);
-            const rulesByEnforcer = existingRules instanceof Map ? existingRules : new Map();
-            let rules = rulesByEnforcer.get(resolvedName);
-            if (!rules) {
-                if (!user.principalType) {
-                    throw (0, core_1.getError)({
-                        error: common_1.AuthorizationErrors.PRINCIPAL_TYPE_MISSING,
-                        message: 'Authorization failed: user.principalType is required for enforcer-based authorization',
-                    });
-                }
-                rules = await enforcer.buildRules({
-                    user: user,
-                    context: (0, context_1.asTypedContext)(context),
-                });
-                rulesByEnforcer.set(resolvedName, rules);
-                context.set(common_1.Authorization.RULES, rulesByEnforcer);
-            }
-            let decision = await enforcer.evaluate({
-                rules,
-                request: {
-                    action: spec.action,
-                    resource: spec.resource,
-                    conditions: spec.conditions,
-                    domain: domainScope,
-                },
-                context: (0, context_1.asTypedContext)(context),
-            });
-            if (decision === common_1.AuthorizationDecisions.ABSTAIN) {
-                decision = options?.defaultDecision ?? common_1.AuthorizationDecisions.DENY;
-            }
-            if (decision !== common_1.AuthorizationDecisions.ALLOW) {
-                throw (0, core_1.getError)({
-                    error: common_1.AuthorizationErrors.DENIED,
-                    message: `Authorization denied | action: ${spec.action} | resource: ${spec.resource}`,
-                    messageArgs: { action: spec.action, resource: spec.resource },
-                });
-            }
-            await next();
-        });
-    }
-    extractUserRoles(opts) {
-        const { user } = opts;
-        const roles = user.roles;
-        if (!Array.isArray(roles)) {
-            return [];
-        }
-        return roles.map((r) => {
-            if (typeof r === 'string') {
-                return r;
-            }
-            return r.identifier ?? r.name ?? String(r.id ?? '');
-        });
-    }
-}
-exports.AuthorizationProvider = AuthorizationProvider;
-//# sourceMappingURL=authorization.provider.js.map

package/dist/cjs/base/auth/authorize/providers/authorization.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.provider.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/authorization.provider.ts"],"names":[],"mappings":";;;AAAA,wDAA4D;AAC5D,sDAAmE;AAEnE,0CAAgD;AAEhD,iMAAiM;AACjM,mEAAqE;AAErE,sCAAuF;AACvF,sEAA+E;AAC/E,qDAAwD;AAExD,MAAa,qBAAsB,SAAQ,iBAAU;IACnD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,OAAO,CAAC,IAAI,EAAE,EAAE;YACd,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC;IACJ,CAAC;IAEO,yBAAyB,CAAC,IAAyD;QACzF,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAEpE,OAAO,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,QAAQ,GAAG,iDAA6B,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;YAE1C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAa,CAAC,kBAAkB,CAAC,CAAC;YACtE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxE,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,0BAAc,CAAC,YAAY,CAA0B,CAAC;YAC/E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAA,eAAQ,EAAC;oBACb,KAAK,EAAE,4BAAmB,CAAC,eAAe;oBAC1C,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAClB,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAElD,IACE,OAAO,EAAE,gBAAgB,EAAE,MAAM;oBACjC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC5D,CAAC;oBACD,MAAM,CAAC,IAAI,CACT,0EAA0E,EAC1E,SAAS,CACV,CAAC;oBACF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvF,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE,SAAS,CAAC,CAAC;oBACzF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;oBAC3B,IAAI;oBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAA,wBAAc,EAAC,OAAO,CAAC;iBACjC,CAAC,CAAC;gBAEH,IAAI,QAAQ,KAAK,+BAAsB,CAAC,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAA,eAAQ,EAAC;wBACb,KAAK,EAAE,4BAAmB,CAAC,eAAe;wBAC1C,OAAO,EAAE,2CAA2C,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,QAAQ,EAAE;wBAC9F,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,QAAQ,KAAK,+BAAsB,CAAC,KAAK,EAAE,CAAC;oBAC9C,MAAM,IAAI,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,iCAAiC;YACnC,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC7B,MAAM,kBAAkB,GAAG,OAAO,EAAE,eAAe,IAAI,+BAAsB,CAAC,IAAI,CAAC;gBAEnF,IAAI,kBAAkB,KAAK,+BAAsB,CAAC,KAAK,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,CACT,mEAAmE,EACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CACjB,CAAC;oBACF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,IAAA,eAAQ,EAAC;oBACb,KAAK,EAAE,4BAAmB,CAAC,uBAAuB;oBAClD,OAAO,EAAE,uGAAuG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;iBACnI,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,GAAG,YAAY,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAExE,4KAA4K;YAC5K,EAAE;YACF,4FAA4F;YAC5F,oFAAoF;YACpF,sFAAsF;YACtF,sFAAsF;YACtF,4CAA4C;YAC5C,MAAM,WAAW,GACf,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,cAAc;gBACpC,CAAC,CAAC,MAAM,IAAA,qCAAoB,EAAC;oBACzB,IAAI;oBACJ,OAAO,EAAE,IAAA,wBAAc,EAAC,OAAO,CAAC;oBAChC,OAAO;iBACR,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,sBAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE/C,2FAA2F;YAC3F,2FAA2F;YAC3F,4CAA4C;YAC5C,EAAE;YACF,wFAAwF;YACxF,4FAA4F;YAC5F,sEAAsE;YACtE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAa,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,eAAe,GACnB,aAAa,YAAY,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;YAC5E,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxB,MAAM,IAAA,eAAQ,EAAC;wBACb,KAAK,EAAE,4BAAmB,CAAC,sBAAsB;wBACjD,OAAO,EACL,uFAAuF;qBAC1F,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;oBAChC,IAAI,EAAE,IAA6C;oBACnD,OAAO,EAAE,IAAA,wBAAc,EAAC,OAAO,CAAC;iBACjC,CAAC,CAAC;gBACH,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,sBAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACrC,KAAK;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,WAAW;iBACpB;gBACD,OAAO,EAAE,IAAA,wBAAc,EAAC,OAAO,CAAC;aACjC,CAAC,CAAC;YAEH,IAAI,QAAQ,KAAK,+BAAsB,CAAC,OAAO,EAAE,CAAC;gBAChD,QAAQ,GAAG,OAAO,EAAE,eAAe,IAAI,+BAAsB,CAAC,IAAI,CAAC;YACrE,CAAC;YAED,IAAI,QAAQ,KAAK,+BAAsB,CAAC,KAAK,EAAE,CAAC;gBAC9C,MAAM,IAAA,eAAQ,EAAC;oBACb,KAAK,EAAE,4BAAmB,CAAC,MAAM;oBACjC,OAAO,EAAE,kCAAkC,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,QAAQ,EAAE;oBACrF,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAyB;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgE,EAAE,EAAE;YACpF,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5LD,sDA4LC","sourcesContent":["import { asTypedContext } from '@/base/controllers/context';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport type { IProvider } from '@venizia/ignis-inversion';\nimport { createMiddleware } from 'hono/factory';\nimport type { IAuthUser } from '../../authenticate/common/types';\n// Deep import (not the authenticate barrel): the barrel re-exports ./controllers, whose factory extends BaseRestController - a value import here forms the base/controllers <-> auth init cycle.\nimport { Authentication } from '../../authenticate/common/constants';\nimport type { IAuthorizationSpec, TAuthorizeFn } from '../common';\nimport { Authorization, AuthorizationDecisions, AuthorizationErrors } from '../common';\nimport { AuthorizationEnforcerRegistry } from '../enforcers/enforcer-registry';\nimport { resolveRequestDomain } from './request-domain';\n\nexport class AuthorizationProvider extends BaseHelper implements IProvider<TAuthorizeFn> {\n  constructor() {\n    super({ scope: AuthorizationProvider.name });\n  }\n\n  value(): TAuthorizeFn {\n    return (opts) => {\n      return this.createAuthorizeMiddleware(opts);\n    };\n  }\n\n  private createAuthorizeMiddleware(opts: { spec: IAuthorizationSpec; enforcerName?: string }) {\n    const { spec, enforcerName } = opts;\n    const logger = this.logger.for(this.createAuthorizeMiddleware.name);\n\n    return createMiddleware(async (context, next) => {\n      const registry = AuthorizationEnforcerRegistry.getInstance();\n      const options = registry.resolveOptions();\n\n      const isSkipAuthorize = context.get(Authorization.SKIP_AUTHORIZATION);\n      if (isSkipAuthorize) {\n        logger.warn('SKIP checking authorization | path: %s', context.req.path);\n        return next();\n      }\n\n      const user = context.get(Authentication.CURRENT_USER) as IAuthUser | undefined;\n      if (!user) {\n        throw getError({\n          error: AuthorizationErrors.UNAUTHENTICATED,\n          message: 'Authorization failed: No authenticated user found',\n        });\n      }\n\n      const needsRoleCheck =\n        Boolean(options?.alwaysAllowRoles?.length) || Boolean(spec.allowedRoles?.length);\n      if (needsRoleCheck) {\n        const userRoles = this.extractUserRoles({ user });\n\n        if (\n          options?.alwaysAllowRoles?.length &&\n          userRoles.some((r) => options.alwaysAllowRoles!.includes(r))\n        ) {\n          logger.warn(\n            'SKIP checking authorization | User has always-allow role | userRoles: %s',\n            userRoles,\n          );\n          return next();\n        }\n\n        if (spec.allowedRoles?.length && userRoles.some((r) => spec.allowedRoles!.includes(r))) {\n          logger.warn('GRANT access | User has allowed role for route | userRoles: %s', userRoles);\n          return next();\n        }\n      }\n\n      const votersList = spec.voters ?? [];\n      for (const voter of votersList) {\n        const decision = await voter({\n          user,\n          action: spec.action,\n          resource: spec.resource,\n          context: asTypedContext(context),\n        });\n\n        if (decision === AuthorizationDecisions.DENY) {\n          throw getError({\n            error: AuthorizationErrors.DENIED_BY_VOTER,\n            message: `Authorization denied by voter | action: ${spec.action} | resource: ${spec.resource}`,\n            messageArgs: { action: spec.action, resource: spec.resource },\n          });\n        }\n\n        if (decision === AuthorizationDecisions.ALLOW) {\n          await next();\n          return;\n        }\n\n        // ABSTAIN → continue to enforcer\n      }\n\n      if (!registry.hasEnforcers()) {\n        const noEnforcerDecision = options?.defaultDecision ?? AuthorizationDecisions.DENY;\n\n        if (noEnforcerDecision === AuthorizationDecisions.ALLOW) {\n          logger.warn(\n            'ALLOW checking authorization | No enforcers registered | path: %s',\n            context.req.path,\n          );\n          return next();\n        }\n\n        throw getError({\n          error: AuthorizationErrors.ENFORCER_NOT_REGISTERED,\n          message: `Authorization failed: authorize() was declared for this route but no enforcer is registered | path: ${context.req.path}`,\n        });\n      }\n\n      const resolvedName = enforcerName ?? registry.getDefaultEnforcerName();\n      const enforcer = await registry.resolveEnforcer({ name: resolvedName });\n\n      // Only resolve domain scope when it is actually in play (per-route domain OR a configured global resolver) - avoids a resolver call (possible DB hit) for legacy enforcers.\n      //\n      // Held in a LOCAL, not read back out of the context. One middleware is pushed per spec onto\n      // the same Hono context, so reading `Authorization.DOMAIN` at decision time meant a\n      // domain-less spec inherited the tenant domain a PREVIOUS spec had written - silently\n      // widening a check that should have run at SYSTEM_WIDE. The context is still set, for\n      // observability, but nothing decides on it.\n      const domainScope =\n        spec.domain || options?.domainResolver\n          ? await resolveRequestDomain({\n              spec,\n              context: asTypedContext(context),\n              options,\n            })\n          : undefined;\n      context.set(Authorization.DOMAIN, domainScope);\n\n      // Keyed by enforcer. The slot used to hold one rule set for the whole request, so a second\n      // `authorize()` naming a DIFFERENT enforcer evaluated against the first enforcer's rules -\n      // granting where its own policy set denies.\n      //\n      // `instanceof Map`, not a truthiness test: the slot previously held a bare rule set, so\n      // anything that pre-populates it with the old shape would otherwise reach `.get` on a value\n      // that has no such method and take the request down with a TypeError.\n      const existingRules = context.get(Authorization.RULES);\n      const rulesByEnforcer =\n        existingRules instanceof Map ? existingRules : new Map<string, unknown>();\n      let rules = rulesByEnforcer.get(resolvedName);\n\n      if (!rules) {\n        if (!user.principalType) {\n          throw getError({\n            error: AuthorizationErrors.PRINCIPAL_TYPE_MISSING,\n            message:\n              'Authorization failed: user.principalType is required for enforcer-based authorization',\n          });\n        }\n\n        rules = await enforcer.buildRules({\n          user: user as { principalType: string } & IAuthUser,\n          context: asTypedContext(context),\n        });\n        rulesByEnforcer.set(resolvedName, rules);\n        context.set(Authorization.RULES, rulesByEnforcer);\n      }\n\n      let decision = await enforcer.evaluate({\n        rules,\n        request: {\n          action: spec.action,\n          resource: spec.resource,\n          conditions: spec.conditions,\n          domain: domainScope,\n        },\n        context: asTypedContext(context),\n      });\n\n      if (decision === AuthorizationDecisions.ABSTAIN) {\n        decision = options?.defaultDecision ?? AuthorizationDecisions.DENY;\n      }\n\n      if (decision !== AuthorizationDecisions.ALLOW) {\n        throw getError({\n          error: AuthorizationErrors.DENIED,\n          message: `Authorization denied | action: ${spec.action} | resource: ${spec.resource}`,\n          messageArgs: { action: spec.action, resource: spec.resource },\n        });\n      }\n\n      await next();\n    });\n  }\n\n  private extractUserRoles(opts: { user: IAuthUser }): string[] {\n    const { user } = opts;\n    const roles = user.roles;\n\n    if (!Array.isArray(roles)) {\n      return [];\n    }\n\n    return roles.map((r: string | { identifier?: string; name?: string; id?: unknown }) => {\n      if (typeof r === 'string') {\n        return r;\n      }\n      return r.identifier ?? r.name ?? String(r.id ?? '');\n    });\n  }\n}\n"]}

package/dist/cjs/base/auth/authorize/providers/index.d.ts

@@ -1,3 +0,0 @@
-export * from './authorization.provider';
-export * from './request-domain';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authorize/providers/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/cjs/base/auth/authorize/providers/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./authorization.provider"), exports);
-__exportStar(require("./request-domain"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authorize/providers/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,mDAAiC","sourcesContent":["export * from './authorization.provider';\nexport * from './request-domain';\n"]}

package/dist/cjs/base/auth/authorize/providers/request-domain.d.ts

@@ -1,16 +0,0 @@
-import type { TContext } from '../../../controllers/common/types';
-import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { Env } from 'hono';
-import type { IAuthorizationDomainSource, IAuthorizationSpec, IAuthorizeOptions } from '../common/types';
-/** Read a domain value from a declarative source on the Hono context. */
-export declare const readDeclarative: (opts: {
-    source: IAuthorizationDomainSource;
-    context: TContext<Env, string>;
-}) => TNullable<string>;
-/** Resolve the request domain, precedence spec.domain (method | declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string ("<type>_<id>") or the SYSTEM_WIDE sentinel. */
-export declare const resolveRequestDomain: (opts: {
-    spec: IAuthorizationSpec;
-    context: TContext<Env, string>;
-    options: TNullable<IAuthorizeOptions>;
-}) => Promise<string>;
-//# sourceMappingURL=request-domain.d.ts.map

package/dist/cjs/base/auth/authorize/providers/request-domain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-domain.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,yEAAyE;AACzE,eAAO,MAAM,eAAe,GAAI,MAAM;IACpC,MAAM,EAAE,0BAA0B,CAAC;IACnC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;CAChC,KAAG,SAAS,CAAC,MAAM,CAoBnB,CAAC;AAEF,iMAAiM;AACjM,eAAO,MAAM,oBAAoB,GAAU,MAAM;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;CACvC,KAAG,OAAO,CAAC,MAAM,CAwBjB,CAAC"}

package/dist/cjs/base/auth/authorize/providers/request-domain.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveRequestDomain = exports.readDeclarative = void 0;
-const constants_1 = require("../common/constants");
-/** Read a domain value from a declarative source on the Hono context. */
-const readDeclarative = (opts) => {
-    const { source, context } = opts;
-    switch (source.from) {
-        case constants_1.AuthorizationDomainSources.PARAM: {
-            return context.req.param(source.key) ?? null;
-        }
-        case constants_1.AuthorizationDomainSources.HEADER: {
-            return context.req.header(source.key) ?? null;
-        }
-        case constants_1.AuthorizationDomainSources.QUERY: {
-            return context.req.query(source.key) ?? null;
-        }
-        case constants_1.AuthorizationDomainSources.CONTEXT: {
-            const value = context.get(source.key);
-            return value == null ? null : String(value);
-        }
-        default: {
-            return null;
-        }
-    }
-};
-exports.readDeclarative = readDeclarative;
-/** Resolve the request domain, precedence spec.domain (method | declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string ("<type>_<id>") or the SYSTEM_WIDE sentinel. */
-const resolveRequestDomain = async (opts) => {
-    const { spec, context, options } = opts;
-    if (typeof spec.domain === 'function') {
-        const resolved = await spec.domain({ context });
-        return resolved
-            ? [resolved.type, resolved.id].join('_')
-            : constants_1.AuthorizationDomainScopes.SYSTEM_WIDE;
-    }
-    if (spec.domain) {
-        const id = (0, exports.readDeclarative)({ source: spec.domain, context });
-        return id ? [spec.domain.type, id].join('_') : constants_1.AuthorizationDomainScopes.SYSTEM_WIDE;
-    }
-    const globalResolver = options?.domainResolver ?? null;
-    if (globalResolver) {
-        const resolved = await globalResolver({ context });
-        return resolved
-            ? [resolved.type, resolved.id].join('_')
-            : constants_1.AuthorizationDomainScopes.SYSTEM_WIDE;
-    }
-    return constants_1.AuthorizationDomainScopes.SYSTEM_WIDE;
-};
-exports.resolveRequestDomain = resolveRequestDomain;
-//# sourceMappingURL=request-domain.js.map

package/dist/cjs/base/auth/authorize/providers/request-domain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-domain.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/providers/request-domain.ts"],"names":[],"mappings":";;;AAGA,mDAA4F;AAO5F,yEAAyE;AAClE,MAAM,eAAe,GAAG,CAAC,IAG/B,EAAqB,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,sCAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,sCAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,KAAK,sCAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,KAAK,sCAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAU,CAAC,CAAC;YAC7C,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAvBW,QAAA,eAAe,mBAuB1B;AAEF,iMAAiM;AAC1L,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAI1C,EAAmB,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAExC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,IAAA,uBAAe,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;IACvD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ;YACb,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,qCAAyB,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,qCAAyB,CAAC,WAAW,CAAC;AAC/C,CAAC,CAAC;AA5BW,QAAA,oBAAoB,wBA4B/B","sourcesContent":["import type { TContext } from '@/base/controllers/common/types';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport type { Env } from 'hono';\nimport { AuthorizationDomainScopes, AuthorizationDomainSources } from '../common/constants';\nimport type {\n  IAuthorizationDomainSource,\n  IAuthorizationSpec,\n  IAuthorizeOptions,\n} from '../common/types';\n\n/** Read a domain value from a declarative source on the Hono context. */\nexport const readDeclarative = (opts: {\n  source: IAuthorizationDomainSource;\n  context: TContext<Env, string>;\n}): TNullable<string> => {\n  const { source, context } = opts;\n  switch (source.from) {\n    case AuthorizationDomainSources.PARAM: {\n      return context.req.param(source.key) ?? null;\n    }\n    case AuthorizationDomainSources.HEADER: {\n      return context.req.header(source.key) ?? null;\n    }\n    case AuthorizationDomainSources.QUERY: {\n      return context.req.query(source.key) ?? null;\n    }\n    case AuthorizationDomainSources.CONTEXT: {\n      const value = context.get(source.key as any);\n      return value == null ? null : String(value);\n    }\n    default: {\n      return null;\n    }\n  }\n};\n\n/** Resolve the request domain, precedence spec.domain (method | declarative) -> options.domainResolver -> SYSTEM_WIDE, as a casbin domain string (\"<type>_<id>\") or the SYSTEM_WIDE sentinel. */\nexport const resolveRequestDomain = async (opts: {\n  spec: IAuthorizationSpec;\n  context: TContext<Env, string>;\n  options: TNullable<IAuthorizeOptions>;\n}): Promise<string> => {\n  const { spec, context, options } = opts;\n\n  if (typeof spec.domain === 'function') {\n    const resolved = await spec.domain({ context });\n    return resolved\n      ? [resolved.type, resolved.id].join('_')\n      : AuthorizationDomainScopes.SYSTEM_WIDE;\n  }\n\n  if (spec.domain) {\n    const id = readDeclarative({ source: spec.domain, context });\n    return id ? [spec.domain.type, id].join('_') : AuthorizationDomainScopes.SYSTEM_WIDE;\n  }\n\n  const globalResolver = options?.domainResolver ?? null;\n  if (globalResolver) {\n    const resolved = await globalResolver({ context });\n    return resolved\n      ? [resolved.type, resolved.id].join('_')\n      : AuthorizationDomainScopes.SYSTEM_WIDE;\n  }\n\n  return AuthorizationDomainScopes.SYSTEM_WIDE;\n};\n"]}

package/dist/cjs/base/auth/base/abstract-auth-registry.d.ts

@@ -1,38 +0,0 @@
-import type { Container } from '../../../helpers/inversion/container';
-import type { TClass } from '@venizia/ignis-helpers/common';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-export type TRegistryDescriptor<TItem> = {
-    container: Container;
-    targetClass: TClass<TItem>;
-};
-export declare abstract class AbstractAuthRegistry<TItem> extends BaseHelper {
-    protected descriptors: Map<string, TRegistryDescriptor<TItem>>;
-    constructor(opts: {
-        scope: string;
-    });
-    protected abstract getBindingPrefix(): string;
-    getKey(opts: {
-        name: string;
-    }): string;
-    /**
-     * Whether a name resolves. The registry is the only source of truth for that: the strategy type is
-     * open (`TAuthStrategy` accepts any string), so nothing upstream can tell a registered name from a
-     * typo. `AuthenticateStrategy.isValid` knows the two built-ins only and must not be used here.
-     */
-    has(opts: {
-        name: string;
-    }): boolean;
-    /** Every registered name, for a caller building its own startup check or an error message. */
-    getNames(): string[];
-    getDefaultName(): string;
-    protected registerDescriptor(opts: {
-        container: Container;
-        target: TClass<TItem>;
-        name: string;
-    }): void;
-    reset(): void;
-    protected resolveDescriptor(opts: {
-        name: string;
-    }): TItem;
-}
-//# sourceMappingURL=abstract-auth-registry.d.ts.map

package/dist/cjs/base/auth/base/abstract-auth-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract-auth-registry.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/base/abstract-auth-registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,CAAC,KAAK,IAAI;IACvC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;CAC5B,CAAC;AAEF,8BAAsB,oBAAoB,CAAC,KAAK,CAAE,SAAQ,UAAU;IAClE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEnD,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAKnC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,MAAM;IAE7C,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAQtC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAIpC,8FAA8F;IAC9F,QAAQ,IAAI,MAAM,EAAE;IAIpB,cAAc,IAAI,MAAM;IAUxB,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI;IAUR,KAAK,IAAI,IAAI;IAIb,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK;CAuB3D"}

package/dist/cjs/base/auth/base/abstract-auth-registry.js

@@ -1,71 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AbstractAuthRegistry = void 0;
-const common_1 = require("@venizia/ignis-helpers/common");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const core_1 = require("@venizia/ignis-helpers/core");
-class AbstractAuthRegistry extends core_1.BaseHelper {
-    constructor(opts) {
-        super(opts);
-        this.descriptors = new Map();
-    }
-    getKey(opts) {
-        if (!opts?.name || (0, common_1.isEmpty)({ value: opts.name })) {
-            throw (0, core_1.getError)({ message: `[getKey] Invalid name | name: ${opts.name}` });
-        }
-        return [this.getBindingPrefix(), opts.name].join('.');
-    }
-    /**
-     * Whether a name resolves. The registry is the only source of truth for that: the strategy type is
-     * open (`TAuthStrategy` accepts any string), so nothing upstream can tell a registered name from a
-     * typo. `AuthenticateStrategy.isValid` knows the two built-ins only and must not be used here.
-     */
-    has(opts) {
-        return this.descriptors.has(opts.name);
-    }
-    /** Every registered name, for a caller building its own startup check or an error message. */
-    getNames() {
-        return [...this.descriptors.keys()];
-    }
-    getDefaultName() {
-        const firstName = this.descriptors.keys().next().value;
-        if (!firstName) {
-            throw (0, core_1.getError)({
-                message: `[${this.constructor.name}] No items registered`,
-            });
-        }
-        return firstName;
-    }
-    registerDescriptor(opts) {
-        const { container, target, name } = opts;
-        this.descriptors.set(name, { container, targetClass: target });
-        container
-            .bind({ key: this.getKey({ name }) })
-            .toClass(target)
-            .setScope(ignis_inversion_1.BindingScopes.SINGLETON);
-    }
-    reset() {
-        this.descriptors.clear();
-    }
-    resolveDescriptor(opts) {
-        const { name } = opts;
-        const metadata = this.descriptors.get(name);
-        if (!metadata) {
-            throw (0, core_1.getError)({
-                message: `[${this.constructor.name}] Descriptor not found: ${name}`,
-            });
-        }
-        const { container } = metadata;
-        const instance = container.get({
-            key: this.getKey({ name }),
-        });
-        if (!instance) {
-            throw (0, core_1.getError)({
-                message: `[${this.constructor.name}] Failed to resolve: ${name}`,
-            });
-        }
-        return instance;
-    }
-}
-exports.AbstractAuthRegistry = AbstractAuthRegistry;
-//# sourceMappingURL=abstract-auth-registry.js.map

package/dist/cjs/base/auth/base/abstract-auth-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract-auth-registry.js","sourceRoot":"","sources":["../../../../../src/base/auth/base/abstract-auth-registry.ts"],"names":[],"mappings":";;;AAAA,0DAAwD;AACxD,8DAAyD;AAGzD,sDAAmE;AAOnE,MAAsB,oBAA4B,SAAQ,iBAAU;IAGlE,YAAY,IAAuB;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAID,MAAM,CAAC,IAAsB;QAC3B,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAA,gBAAO,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,iCAAiC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,IAAsB;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,cAAc;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,uBAAuB;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,kBAAkB,CAAC,IAI5B;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,SAAS;aACN,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aACpC,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CAAC,+BAAa,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAES,iBAAiB,CAAC,IAAsB;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,2BAA2B,IAAI,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAQ;YACpC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,wBAAwB,IAAI,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAnFD,oDAmFC","sourcesContent":["import { isEmpty } from '@venizia/ignis-helpers/common';\nimport { BindingScopes } from '@venizia/ignis-inversion';\nimport type { Container } from '@/helpers/inversion/container';\nimport type { TClass } from '@venizia/ignis-helpers/common';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\n\nexport type TRegistryDescriptor<TItem> = {\n  container: Container;\n  targetClass: TClass<TItem>;\n};\n\nexport abstract class AbstractAuthRegistry<TItem> extends BaseHelper {\n  protected descriptors: Map<string, TRegistryDescriptor<TItem>>;\n\n  constructor(opts: { scope: string }) {\n    super(opts);\n    this.descriptors = new Map();\n  }\n\n  protected abstract getBindingPrefix(): string;\n\n  getKey(opts: { name: string }): string {\n    if (!opts?.name || isEmpty({ value: opts.name })) {\n      throw getError({ message: `[getKey] Invalid name | name: ${opts.name}` });\n    }\n\n    return [this.getBindingPrefix(), opts.name].join('.');\n  }\n\n  /**\n   * Whether a name resolves. The registry is the only source of truth for that: the strategy type is\n   * open (`TAuthStrategy` accepts any string), so nothing upstream can tell a registered name from a\n   * typo. `AuthenticateStrategy.isValid` knows the two built-ins only and must not be used here.\n   */\n  has(opts: { name: string }): boolean {\n    return this.descriptors.has(opts.name);\n  }\n\n  /** Every registered name, for a caller building its own startup check or an error message. */\n  getNames(): string[] {\n    return [...this.descriptors.keys()];\n  }\n\n  getDefaultName(): string {\n    const firstName = this.descriptors.keys().next().value;\n    if (!firstName) {\n      throw getError({\n        message: `[${this.constructor.name}] No items registered`,\n      });\n    }\n    return firstName;\n  }\n\n  protected registerDescriptor(opts: {\n    container: Container;\n    target: TClass<TItem>;\n    name: string;\n  }): void {\n    const { container, target, name } = opts;\n\n    this.descriptors.set(name, { container, targetClass: target });\n    container\n      .bind({ key: this.getKey({ name }) })\n      .toClass(target)\n      .setScope(BindingScopes.SINGLETON);\n  }\n\n  reset(): void {\n    this.descriptors.clear();\n  }\n\n  protected resolveDescriptor(opts: { name: string }): TItem {\n    const { name } = opts;\n    const metadata = this.descriptors.get(name);\n\n    if (!metadata) {\n      throw getError({\n        message: `[${this.constructor.name}] Descriptor not found: ${name}`,\n      });\n    }\n\n    const { container } = metadata;\n    const instance = container.get<TItem>({\n      key: this.getKey({ name }),\n    });\n\n    if (!instance) {\n      throw getError({\n        message: `[${this.constructor.name}] Failed to resolve: ${name}`,\n      });\n    }\n\n    return instance;\n  }\n}\n"]}

package/dist/cjs/base/auth/base/index.d.ts

@@ -1,2 +0,0 @@
-export * from './abstract-auth-registry';
-//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/base/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/base/auth/base/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC"}

package/dist/cjs/base/auth/base/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./abstract-auth-registry"), exports);
-//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/base/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/base/auth/base/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC","sourcesContent":["export * from './abstract-auth-registry';\n"]}