@venizia/ignis 0.3.0 → 0.3.1

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,wDAAqD;AACrD,wDAK+B;AAC/B,oDAAuD;AACvD,oEAAqF;AAErF,iDAAgF;AAChF,qCAMkB;AAElB;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,mCAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,2CAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,mCAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,uBAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,IAAA,iBAAG,EAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,IAAA,iBAAG,EAAA,sBAAsB,iBAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,6BAA6B,CAAC,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,iBAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,UAAU,EAAE,CAAC,EACjD,IAAA,iBAAG,EAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,IAAA,iBAAG,EAAA;;;eAGL,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,mCAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,mCAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,mCAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,0CAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,mCAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,wCAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,qCAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,2BAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,mCAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,IAAA,iBAAG,EAAA;;UAEV,0CAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,0CAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,0CAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;CACF;AAvdD,kDAudC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,wDAAqD;AACrD,wDAK+B;AAC/B,oDAAuD;AACvD,oEAAqF;AAErF,iDAAgF;AAChF,qCAMkB;AAElB;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,mCAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,2CAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,mCAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,uBAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,IAAA,iBAAG,EAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,IAAA,iBAAG,EAAA,sBAAsB,iBAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,6BAA6B,CAAC,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,iBAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,UAAU,EAAE,CAAC,EACjD,IAAA,iBAAG,EAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,IAAA,iBAAG,EAAA;;;eAGL,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,mCAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,mCAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,mCAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,0CAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,mCAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,wCAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,qCAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,2BAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,mCAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,IAAA,iBAAG,EAAA;;UAEV,0CAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,0CAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,0CAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;CACF;AAvdD,kDAudC","sourcesContent":["import type { IdType } from '@/base';\nimport { type Model } from 'casbin';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { GrantBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '@venizia/ignis-kernel';\nimport { BaseFilteredAdapter } from '../base-filtered';\nimport { CustomGrantExpander, type TCustomGrantRow } from '../custom-grant-expander';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';\nimport { PrincipalPolicyEdges, type TPrincipalPolicyRow } from './policy-edges';\nimport {\n  DEFAULT_SCHEMA,\n  type IScopedCasbinPolicyFilter,\n  type TDomainHierarchyEdge,\n  type TGrantRow,\n  type TResolveDomainEdgesFn,\n} from './common';\n\n/**\n * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,\n * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.\n *\n * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.\n * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications\n * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion\n * filter would sweep those unknown rows into a branch that has no idea what they mean. The current\n * shape makes an undeclared variant inert, which is what makes sharing the table safe.\n */\nexport class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {\n  protected readonly entities: IScopedCasbinEntities;\n  protected readonly customGrantExpander: CustomGrantExpander;\n  protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: IScopedCasbinEntities;\n    resolveDomainEdges?: TResolveDomainEdgesFn;\n  }) {\n    super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });\n    this.entities = opts.entities;\n    this.resolveDomainEdges = opts.resolveDomainEdges;\n    this.customGrantExpander = new CustomGrantExpander({\n      dataSource: opts.dataSource,\n      entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },\n    });\n  }\n\n  /**\n   * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -\n   * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot\n   * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does\n   * not wait for the structural-edges query either: both run concurrently once the closure is known.\n   */\n  async loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void> {\n    const { principal } = filter;\n    const { principals } = this.entities;\n\n    const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });\n    const structuralEdgesPromise = this.queryEdgePolicies();\n    const principalRows = await principalPoliciesPromise;\n\n    const lines: string[] = [];\n    const directGrants: TGrantRow[] = [];\n    const roleGrants: TGrantRow[] = [];\n    const domainClosure = new Set<string>();\n\n    for (const row of principalRows) {\n      switch (row.kind) {\n        case PrincipalPolicyEdges.ROLE_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`,\n          );\n          break;\n        }\n\n        case PrincipalPolicyEdges.ROLE_GRANT: {\n          roleGrants.push(row);\n          break;\n        }\n\n        case PrincipalPolicyEdges.DOMAIN_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`,\n          );\n          // Both ends are, by construction, members of the principal's domain_closure CTE.\n          domainClosure.add(String(row.subjectId));\n          domainClosure.add(String(row.targetId));\n          break;\n        }\n\n        default: {\n          if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {\n            domainClosure.add(`${row.targetType}_${row.targetId}`);\n          }\n          this.collectDirectRow({ row, principal, lines, directGrants });\n          break;\n        }\n      }\n    }\n\n    const hookLinesPromise = this.resolveDomainEdgeLines({\n      principal,\n      domains: [...domainClosure],\n    });\n\n    lines.push(\n      ...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })),\n    );\n    lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));\n\n    const [structuralEdges, hookLines] = await Promise.all([\n      structuralEdgesPromise,\n      hookLinesPromise,\n    ]);\n    lines.push(...structuralEdges);\n    lines.push(...hookLines);\n\n    await this.loadLines({ model, lines });\n  }\n\n  /** Route one `direct` row to its casbin line, or to the grant batch. */\n  protected collectDirectRow(opts: {\n    row: TPrincipalPolicyRow;\n    principal: { type: string; id: IdType };\n    lines: string[];\n    directGrants: TGrantRow[];\n  }): void {\n    const { row, principal, lines, directGrants } = opts;\n    const { principals } = this.entities;\n\n    switch (row.variant) {\n      case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.GRANT.action: {\n        directGrants.push(row);\n        break;\n      }\n\n      default: {\n        this.logger\n          .for(this.collectDirectRow.name)\n          .error('Unexpected variant in the direct branch | variant: %s', row.variant);\n        break;\n      }\n    }\n  }\n\n  /**\n   * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using\n   * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no\n   * edges - the rows already gathered for this principal still load. This is the safe direction:\n   * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the\n   * failure degrades to less access rather than either an outage or excess access.\n   */\n  protected async resolveDomainEdgeLines(opts: {\n    principal: { type: string; id: IdType };\n    domains: string[];\n  }): Promise<string[]> {\n    if (!this.resolveDomainEdges) {\n      return [];\n    }\n\n    let edges: TDomainHierarchyEdge[];\n    try {\n      edges = await this.resolveDomainEdges(opts);\n    } catch (error) {\n      this.logger\n        .for(this.resolveDomainEdgeLines.name)\n        .error(\n          'resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s',\n          opts.principal.type,\n          opts.principal.id,\n          error,\n        );\n      return [];\n    }\n\n    return edges.map(\n      edge => `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`,\n    );\n  }\n\n  /** Schema for a table, defaulting to `public`. */\n  protected schemaOf(table: { schemaName?: string }): string {\n    return table.schemaName ?? DEFAULT_SCHEMA;\n  }\n\n  /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */\n  protected domainTokenSelection(opts: { alias: string }): SQL {\n    const column = (name: string) => sql`${sql.raw(opts.alias)}.${sql.identifier(name)}`;\n    const domainType = column('domain_type');\n    const domainId = column('domain_id');\n\n    return sql`CASE\n      WHEN ${domainType} IS NULL THEN NULL\n      WHEN ${domainId} IS NULL THEN ${domainType}\n      ELSE ${domainType} || '_' || ${domainId}::text\n    END AS \"domain\"`;\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  protected qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    return sql`${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  protected softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.entities.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */\n  protected async queryPrincipalPolicies(opts: {\n    principal: { type: string; id: IdType };\n  }): Promise<TPrincipalPolicyRow[]> {\n    const { policyDefinition, permission, principals, domainTypes } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n    const { principal } = opts;\n\n    const metadataColumnName = policyDefinition.metadata?.columnName;\n    const metadataSelection = metadataColumnName\n      ? sql`, policyDefinition.${sql.identifier(metadataColumnName)} AS \"metadata\"`\n      : sql.empty();\n    const metadataNull = metadataColumnName ? sql`, NULL::jsonb AS \"metadata\"` : sql.empty();\n\n    const domainTypeList = sql.join(\n      domainTypes.map(domainType => sql`${domainType}`),\n      sql`, `,\n    );\n\n    const rows = await this.query<TPrincipalPolicyRow>({\n      statement: sql`\n      WITH RECURSIVE role_closure AS (\n        SELECT policyDefinition.target_id AS role_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      ),\n\n      domain_closure AS (\n        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_type, policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                             AND policyDefinition.subject_id = domain_closure.dom_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      )\n\n      SELECT\n        ${PrincipalPolicyEdges.DIRECT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.subject_type = ${principal.type}\n        AND policyDefinition.subject_id = ${principal.id}\n        AND policyDefinition.variant IN (\n          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},\n          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},\n          ${AuthorizationPolicyVariants.GRANT.action}\n        )\n        AND (\n          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          OR policyDefinition.target_type IN (${domainTypeList})\n        )${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}\n        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS \"subjectId\",\n        NULL AS \"targetType\",\n        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                           AND policyDefinition.subject_id = domain_closure.dom_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows;\n  }\n\n  /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */\n  protected async buildGrantLines(opts: {\n    subjectType: string;\n    rows: TGrantRow[];\n  }): Promise<string[]> {\n    const { subjectType, rows } = opts;\n    const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;\n\n    const lines: string[] = [];\n    const customRows: TCustomGrantRow[] = [];\n\n    for (const row of rows) {\n      if (!row.objectCode) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s',\n            subjectType,\n            row.subjectId,\n          );\n        continue;\n      }\n\n      const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;\n      const effect = row.effect ?? AuthorizationDecisions.ALLOW;\n      const parsed = metadataColumnName\n        ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })\n        : null;\n      const isCustomAction = row.action === AuthorizationActions.CUSTOM;\n      const isCustomRow = isCustomAction || Boolean(parsed);\n\n      if (!isCustomRow && !row.action) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      if (!isCustomRow) {\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`,\n        );\n        continue;\n      }\n\n      if (!row.objectSubject || !row.objectMethod) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      const rejection = this.customGrantExpander.rejectCustomRow({\n        row: {\n          subjectId: row.subjectId,\n          objectCode: row.objectCode,\n          objectMethod: row.objectMethod,\n        },\n        parsed,\n        isCustomAction,\n        metadataColumnName,\n      });\n\n      if (rejection) {\n        this.logger.for(this.buildGrantLines.name).error(rejection);\n        continue;\n      }\n\n      customRows.push({\n        subjectId: row.subjectId,\n        objectSubject: row.objectSubject,\n        ops: parsed!.ops,\n        domain,\n        effect,\n      });\n    }\n\n    const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });\n    for (const rejection of expanded.rejections) {\n      this.logger.for(this.buildGrantLines.name).error(rejection);\n    }\n    lines.push(...expanded.lines);\n\n    return lines;\n  }\n\n  /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */\n  protected async queryEdgePolicies(): Promise<string[]> {\n    const { policyDefinition, permission } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n\n    const rows = await this.query<{ rel: string; child: string; parent: string }>({\n      statement: sql`\n      SELECT\n        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS \"rel\",\n        child_permission.code AS \"child\",\n        parent_permission.code AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id\n        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS \"rel\",\n        policyDefinition.subject_id::text AS \"child\",\n        policyDefinition.target_id::text AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows.map(row => `${row.rel}, ${row.child}, ${row.parent}`);\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.d.ts

@@ -1,2 +1 @@
 export declare const DEFAULT_SCHEMA = "public";
-//# sourceMappingURL=constants.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,QAAQ,CAAC","sourcesContent":["export const DEFAULT_SCHEMA = 'public';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts

@@ -1,3 +1,2 @@
 export * from './types';
 export * from './constants';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8CAA4B","sourcesContent":["export * from './types';\nexport * from './constants';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts

@@ -47,4 +47,3 @@ export type TResolveDomainEdgesFn = (opts: {
     };
     domains: string[];
 }) => Promise<TDomainHierarchyEdge[]>;
-//# sourceMappingURL=types.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\n\nexport type TDomainHierarchyEdge = { child: string; parent: string };\n\nexport interface IScopedCasbinPolicyFilter {\n  principal: { type: string; id: IdType };\n}\n\n/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */\nexport type TGrantRow = {\n  subjectId: IdType;\n  objectCode: TNullable<string>;\n  objectSubject: TNullable<string>;\n  objectMethod: TNullable<string>;\n  action: TNullable<string>;\n  effect: TNullable<string>;\n  domain: TNullable<string>;\n  metadata?: unknown;\n};\n\n/**\n * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant\n * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app\n * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the\n * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own\n * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side\n * re-formats them.\n *\n * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both\n * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via\n * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported\n * from a mechanism that derived its domains from `assign_role` will silently lose access for\n * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.\n *\n * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one\n * function per axis and concatenate their results here - this hook deliberately takes a single\n * function, so composition stays visible in the application, not hidden inside the framework:\n * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.\n */\nexport type TResolveDomainEdgesFn = (opts: {\n  principal: { type: string; id: IdType };\n  domains: string[];\n}) => Promise<TDomainHierarchyEdge[]>;\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/index.d.ts

@@ -1,4 +1,3 @@
 export type { IScopedCasbinPolicyFilter, TDomainHierarchyEdge, TGrantRow, TResolveDomainEdgesFn, } from './common';
 export * from './policy-edges';
 export * from './adapter';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAQA,iDAA+B;AAC/B,4CAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAQA,iDAA+B;AAC/B,4CAA0B","sourcesContent":["// DEFAULT_SCHEMA (common/constants.ts) was module-private in the pre-split file - re-export only\n// the types, never the whole './common' barrel, or it leaks into the public surface.\nexport type {\n  IScopedCasbinPolicyFilter,\n  TDomainHierarchyEdge,\n  TGrantRow,\n  TResolveDomainEdgesFn,\n} from './common';\nexport * from './policy-edges';\nexport * from './adapter';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts

@@ -14,4 +14,3 @@ export type TPrincipalPolicyRow = TGrantRow & {
     targetType: TNullable<string>;
     targetId: IdType;
 };
-//# sourceMappingURL=policy-edges.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-edges.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":";;;AAIA,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,UAAU,CAAC;aACvB,eAAU,GAAG,WAAW,CAAC;aACzB,gBAAW,GAAG,YAAY,CAAC;;AAJ7C,oDAKC"}
+{"version":3,"file":"policy-edges.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":";;;AAIA,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,UAAU,CAAC;aACvB,eAAU,GAAG,WAAW,CAAC;aACzB,gBAAW,GAAG,YAAY,CAAC;;AAJ7C,oDAKC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';\nimport type { TGrantRow } from './common';\n\nexport class PrincipalPolicyEdges {\n  static readonly DIRECT = 'direct';\n  static readonly ROLE_EDGE = 'roleEdge';\n  static readonly ROLE_GRANT = 'roleGrant';\n  static readonly DOMAIN_EDGE = 'domainEdge';\n}\n\n/** A row from the single principal-policy statement; `kind` says which branch produced it. */\nexport type TPrincipalPolicyRow = TGrantRow & {\n  kind: TConstValue<typeof PrincipalPolicyEdges>;\n  variant: string;\n  targetType: TNullable<string>;\n  targetId: IdType;\n};\n"]}

package/dist/components/auth/authorize/component.d.ts

@@ -7,4 +7,3 @@ export declare class AuthorizeComponent extends BaseComponent {
     binding(): ValueOrPromise<void>;
     private bindAlwaysAllowRoles;
 }
-//# sourceMappingURL=component.d.ts.map

package/dist/components/auth/authorize/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,wDAA+C;AAC/C,wDAAqD;AACrD,sDAAuD;AAEvD,wDAI+B;AAE/B,IAAa,kBAAkB,0BAA/B,MAAa,kBAAmB,SAAQ,4BAAa;IACnD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,oBAAkB,CAAC,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;SACtD,CAAC,CAAC;QALyD,gBAAW,GAAX,WAAW,CAAiB;IAM1F,CAAC;IAEQ,OAAO;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAoB;YACtD,GAAG,EAAE,mCAAoB,CAAC,OAAO;YACjC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,iIAAiI;aACpI,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvC,0FAA0F;QAC1F,4FAA4F;QAC5F,4CAA6B,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAEO,oBAAoB,CAAC,IAAoC;QAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAAW,EAAE,GAAG,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC;aAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAzCY,gDAAkB;6BAAlB,kBAAkB;IAE1B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,kBAAkB,CAyC9B"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,wDAA+C;AAC/C,wDAAqD;AACrD,sDAAuD;AAEvD,wDAI+B;AAE/B,IAAa,kBAAkB,0BAA/B,MAAa,kBAAmB,SAAQ,4BAAa;IACnD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,oBAAkB,CAAC,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;SACtD,CAAC,CAAC;QALyD,gBAAW,GAAX,WAAW,CAAiB;IAM1F,CAAC;IAEQ,OAAO;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAoB;YACtD,GAAG,EAAE,mCAAoB,CAAC,OAAO;YACjC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,iIAAiI;aACpI,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvC,0FAA0F;QAC1F,4FAA4F;QAC5F,4CAA6B,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAEO,oBAAoB,CAAC,IAAoC;QAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAAW,EAAE,GAAG,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC;aAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAzCY,gDAAkB;6BAAlB,kBAAkB;IAE1B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,kBAAkB,CAyC9B","sourcesContent":["import type { BaseApplication } from '@/base/applications/base';\nimport { BaseComponent } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { CoreBindings } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationEnforcerRegistry,\n  AuthorizeBindingKeys,\n  type IAuthorizeOptions,\n} from '@venizia/ignis-kernel';\n\nexport class AuthorizeComponent extends BaseComponent {\n  constructor(\n    @inject({ key: CoreBindings.APPLICATION_INSTANCE }) private application: BaseApplication,\n  ) {\n    super({\n      scope: AuthorizeComponent.name,\n      initDefault: { enable: true, container: application },\n    });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    const options = this.application.get<IAuthorizeOptions>({\n      key: AuthorizeBindingKeys.OPTIONS,\n      isOptional: true,\n    });\n\n    if (!options) {\n      throw getError({\n        message:\n          '[AuthorizeComponent] No authorize options found. Bind options to AuthorizeBindingKeys.OPTIONS before registering the component.',\n      });\n    }\n\n    this.bindAlwaysAllowRoles({ options });\n\n    // The registry otherwise finds options only through a registered enforcer's container, so\n    // `defaultDecision` would be unreadable in the one case it decides: no enforcer registered.\n    AuthorizationEnforcerRegistry.getInstance().setOptions({ options });\n\n    this.logger.for(this.binding.name).info('Authorization configured');\n  }\n\n  private bindAlwaysAllowRoles(opts: { options: IAuthorizeOptions }): void {\n    if (!opts.options.alwaysAllowRoles?.length) {\n      return;\n    }\n\n    this.application\n      .bind<string[]>({ key: AuthorizeBindingKeys.ALWAYS_ALLOW_ROLES })\n      .toValue(opts.options.alwaysAllowRoles);\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/casbin-module.d.ts

@@ -2,4 +2,3 @@
 export declare class CasbinModule {
     static load(): Promise<typeof import('casbin')>;
 }
-//# sourceMappingURL=casbin-module.d.ts.map

package/dist/components/auth/authorize/enforcers/casbin-module.js.map

@@ -1 +1 @@
-{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAEvD,iOAAiO;AACjO,MAAa,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAXD,oCAWC"}
+{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAEvD,iOAAiO;AACjO,MAAa,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAXD,oCAWC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\n\n/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */\nexport class CasbinModule {\n  static async load(): Promise<typeof import('casbin')> {\n    try {\n      return await import('casbin');\n    } catch {\n      throw getError({\n        message:\n          '[CasbinModule] \"casbin\" is not installed | Install the optional peer casbin to use the casbin enforcer',\n      });\n    }\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/casbin.enforcer.d.ts

@@ -87,4 +87,3 @@ export declare class CasbinAuthorizationEnforcer<E extends Env = Env, TAction ex
     }): Promise<void>;
 }
 export {};
-//# sourceMappingURL=casbin.enforcer.d.ts.map

package/dist/components/auth/authorize/enforcers/casbin.enforcer.js.map

@@ -1 +1 @@
-{"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,sDAAmF;AAQnF,wDAAuE;AACvE,wDAgB+B;AAC/B,wEAA+E;AAC/E,mDAA+C;AAC/C,4DAAoE;AACpE,wDAAgE;AAChE,2DAAsD;AACtD,qEAA+D;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,iBAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,qBAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;gBAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wCAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,4CAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,iCAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,6CAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,0CAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,8BAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,kCAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,6CAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,iCAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,6CAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,4CAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,4CAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,kDAAkD,yCAA0B,CAAC,IAAI,KAAK,yCAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,mCAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mCAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtaY,kEAA2B;sCAA3B,2BAA2B;IAoBnC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,mCAAoB,CAAC,eAAe,CAAC,yCAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CAsavC"}
+{"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,sDAAmF;AAQnF,wDAAuE;AACvE,wDAgB+B;AAC/B,wEAA+E;AAC/E,mDAA+C;AAC/C,4DAAoE;AACpE,wDAAgE;AAChE,2DAAsD;AACtD,qEAA+D;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,iBAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,qBAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;gBAC1B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wCAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,4CAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,iCAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,6CAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,0CAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,8BAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,kCAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,6CAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,iCAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,6CAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,4CAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,4CAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,kDAAkD,yCAA0B,CAAC,IAAI,KAAK,yCAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,mCAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mCAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtaY,kEAA2B;sCAA3B,2BAA2B;IAoBnC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,mCAAoB,CAAC,eAAe,CAAC,yCAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CAsavC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  RoleManager as CasbinRoleManagerType,\n} from 'casbin';\nimport { type Env } from 'hono';\nimport { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationEnforcerTypes,\n  AuthorizationPolicyVariants,\n  AuthorizeBindingKeys,\n  CasbinDomainMatchingFunctions,\n  CasbinEnforcerModelDrivers,\n  CasbinRuleVariants,\n  type IAuthorizationEnforcer,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n  type ICasbinRules,\n  type IAuthorizationRequest,\n  type TAuthorizationDecision,\n  type TCasbinDomainMatchingFunction,\n} from '@venizia/ignis-kernel';\nimport { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy';\nimport { CasbinModule } from './casbin-module';\nimport { MembershipRoleManager } from '../role-managers/membership';\nimport { ResourceRoleManager } from '../role-managers/resource';\nimport { PolicyLineCodec } from './policy-line-codec';\nimport { UserPolicyLineCache } from './user-policy-line-cache';\n\n/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */\ntype TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {\n  user: IAuthorizationUser;\n  action: TAction;\n  resource: TResource;\n  context: TContext<E, string>;\n}) => { subject: string; resource: string; action: string; domain?: string };\n\n/** `addDomainHierarchy` lives on casbin's `DefaultRoleManager`, not on the `RoleManager` interface or the `Enforcer` facade - feature-detect it on whatever `getNamedRoleManager` returns. */\ninterface ICasbinRoleManagerWithDomainHierarchy {\n  addDomainHierarchy?(rm: CasbinRoleManagerType): Promise<void>;\n}\n\n// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.\n\nexport class CasbinAuthorizationEnforcer<\n  E extends Env = Env,\n  TAction extends string = string,\n  TResource extends string = string,\n>\n  extends BaseHelper\n  implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules>\n{\n  name = CasbinAuthorizationEnforcer.name;\n  private readonly MIN_EXPIRES_IN = 10_000;\n\n  private pool: TNullable<BasePoolHelper<CasbinEnforcerType>> = null;\n  private helper: TNullable<typeof CasbinHelperType> = null;\n  // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.\n  private userPolicyLineCache: TNullable<UserPolicyLineCache> = null;\n\n  // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).\n  private resolvedPayloadFn: TNullable<TNormalizePayloadFn<E, TAction, TResource>> = null;\n\n  constructor(\n    @inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })\n    private options: ICasbinEnforcerOptions<E, TAction, TResource>,\n  ) {\n    super({ scope: CasbinAuthorizationEnforcer.name });\n  }\n\n  // Lifecycle\n\n  async configure(): Promise<void> {\n    const casbin = await CasbinModule.load();\n\n    if (!this.options.model) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] options.model is required.',\n      });\n    }\n\n    this.helper = casbin.Helper;\n\n    this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();\n\n    const { cached } = this.options;\n    if (cached.use) {\n      this.validateExpiresIn({ expiresIn: cached.options.expiresIn });\n    }\n\n    this.pool = new BasePoolHelper<CasbinEnforcerType>({\n      scope: `${CasbinAuthorizationEnforcer.name}.Pool`,\n      size: this.options.poolSize ?? 16,\n      acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,\n      create: async () => {\n        const model = this.resolveModel({ casbin, model: this.options.model });\n\n        const enforcer = await casbin.newEnforcer(model);\n        await this.registerMatchers({ enforcer, casbin });\n        this.assertMatcherCompilesSync({ enforcer });\n\n        return enforcer;\n      },\n    });\n    await this.pool.warmup();\n\n    this.logger\n      .for(this.configure.name)\n      .info(\n        'Casbin enforcer pool ready (size: %s, cached: %s)',\n        this.options.poolSize ?? 16,\n        cached.use ? cached.driver : 'none',\n      );\n  }\n\n  destroy(): void {\n    this.pool?.destroy().catch(error => {\n      this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);\n    });\n  }\n\n  /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */\n  protected assertMatcherCompilesSync(opts: { enforcer: CasbinEnforcerType }) {\n    try {\n      if (this.options.isScoped || this.options.normalizePayloadFn) {\n        opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');\n        return;\n      }\n\n      opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');\n    } catch (error) {\n      throw getError({\n        message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,\n      });\n    }\n  }\n\n  // IAuthorizationEnforcer - public API\n\n  async buildRules(opts: {\n    user: IAuthorizationUser;\n    context: TContext<E, string>;\n  }): Promise<ICasbinRules> {\n    const { user } = opts;\n    const cached = this.options.cached;\n\n    const lines = cached.use\n      ? await this.requireRedisCache().fetch({ user })\n      : await this.extractUserLines({ user });\n\n    return { user, lines };\n  }\n\n  async evaluate(opts: {\n    rules: ICasbinRules;\n    request: IAuthorizationRequest<TAction, TResource>;\n    context: TContext<E, string>;\n  }): Promise<TAuthorizationDecision> {\n    if (!this.pool) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',\n      });\n    }\n\n    if (!opts.request?.action || !opts.request?.resource) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',\n      });\n    }\n\n    const { rules, request, context } = opts;\n    const { user, lines } = rules;\n\n    return this.pool.use({\n      execution: async enforcer => {\n        await this.loadPolicyLinesIntoModel({ enforcer, lines });\n\n        const normalizePayloadFn = this.resolvedPayloadFn;\n\n        if (!normalizePayloadFn) {\n          const subject = `${user.principalType}_${user.userId}`;\n          const isAllowed = this.enforceWithExplain({\n            enforcer,\n            vals: [subject, String(request.resource), String(request.action)],\n          });\n          return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n        }\n\n        const normalized = normalizePayloadFn({\n          user,\n          action: request.action,\n          resource: request.resource,\n          context,\n        });\n\n        // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.\n        const domain =\n          normalized.domain ??\n          request.domain ??\n          (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);\n\n        const vals = domain\n          ? [normalized.subject, domain, normalized.resource, normalized.action]\n          : [normalized.subject, normalized.resource, normalized.action];\n        const isAllowed = this.enforceWithExplain({ enforcer, vals });\n\n        return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n      },\n    });\n  }\n\n  /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */\n  protected enforceWithExplain(opts: { enforcer: CasbinEnforcerType; vals: string[] }): boolean {\n    const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);\n\n    if (!isAllowed) {\n      this.logger\n        .for(this.evaluate.name)\n        .info(\n          'DENY | request: [%s] | matchedPolicy: %s',\n          opts.vals.join(', '),\n          matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>',\n        );\n    }\n\n    return isAllowed;\n  }\n\n  // Cache management - optional IAuthorizationEnforcer members (on-demand)\n  async invalidateUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ invalidatedKeys: number }> {\n    const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({\n      user: opts.user,\n    });\n\n    this.logger\n      .for(this.invalidateUserCache.name)\n      .info(\n        'Invalidated authz cache | user: %s | key: %s | deleted: %s',\n        opts.user.userId,\n        cacheKey,\n        invalidatedKeys,\n      );\n\n    return { invalidatedKeys };\n  }\n\n  async rebuildUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lineCount: number }> {\n    // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.\n    const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });\n\n    this.logger\n      .for(this.rebuildUserCache.name)\n      .info(\n        'Rebuilt authz cache | user: %s | key: %s | lines: %s',\n        opts.user.userId,\n        cacheKey,\n        lines.length,\n      );\n\n    return { cacheKey, lineCount: lines.length };\n  }\n\n  /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */\n  protected requireRedisCache(): UserPolicyLineCache {\n    const { cached } = this.options;\n\n    if (!cached.use) {\n      throw getError({\n        message:\n          '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',\n      });\n    }\n\n    return (this.userPolicyLineCache ??= new UserPolicyLineCache({\n      cached,\n      loadLines: opts => this.extractUserLines(opts),\n    }));\n  }\n\n  // Matchers & model resolvers\n\n  protected async registerMatchers(opts: {\n    enforcer: CasbinEnforcerType;\n    casbin: typeof import('casbin');\n  }): Promise<void> {\n    const { enforcer, casbin } = opts;\n    const { domainMatching, isScoped } = this.options;\n\n    if (domainMatching) {\n      if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {\n        throw getError({\n          message: `[registerMatchers] Role definition \"${domainMatching.roleDefinition}\" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \\`g = _, _, _\\`) before enabling domainMatching.`,\n        });\n      }\n\n      const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });\n      await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);\n    }\n\n    if (isScoped) {\n      await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);\n      await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);\n\n      // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.\n      enforcer.setNamedRoleManager(\n        AuthorizationPolicyVariants.RESOURCE_INHERITS.rule,\n        new ResourceRoleManager(),\n      );\n\n      // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the\n      // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss\n      // per-request g3 edges - g2 needs the same freshness for a just-created child domain.\n      // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is\n      // repopulated from whatever `g3` lines this principal's own policy line set carries.\n      const domainHierarchyOverlay = new Map<string, Set<string>>();\n\n      // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G2,\n        new MembershipRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G3,\n        new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs\n      // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.\n      const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G) as\n        | (CasbinRoleManagerType & ICasbinRoleManagerWithDomainHierarchy)\n        | undefined;\n\n      if (!gRoleManager?.addDomainHierarchy) {\n        throw getError({\n          message:\n            '[registerMatchers] The \"g\" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for \"g\".',\n        });\n      }\n\n      await gRoleManager.addDomainHierarchy(\n        new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }),\n      );\n    }\n\n    await enforcer.buildRoleLinks();\n  }\n\n  /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */\n  protected resolveDomainMatchingFn(opts: {\n    casbin: typeof import('casbin');\n    name: TCasbinDomainMatchingFunction;\n  }): (arg1: string, arg2: string) => boolean {\n    // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.\n    const { Util } = opts.casbin;\n    switch (opts.name) {\n      case CasbinDomainMatchingFunctions.KEY_MATCH: {\n        return Util.keyMatchFunc;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_2: {\n        return Util.keyMatch2Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_3: {\n        return Util.keyMatch3Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_4: {\n        return Util.keyMatch4Func;\n      }\n      case CasbinDomainMatchingFunctions.REGEX_MATCH: {\n        return Util.regexMatchFunc;\n      }\n      default: {\n        throw getError({\n          message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,\n        });\n      }\n    }\n  }\n\n  /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */\n  protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined {\n    if (!this.options.isScoped) {\n      return undefined;\n    }\n\n    return (opts: {\n      user: IAuthorizationUser;\n      action: TAction;\n      resource: TResource;\n    }): { subject: string; resource: string; action: string; domain?: string } => {\n      // No domain here - evaluate() fills it from request.domain (set by the provider).\n      return {\n        subject: `${opts.user.principalType}_${opts.user.userId}`,\n        resource: String(opts.resource),\n        action: String(opts.action),\n      };\n    };\n  }\n\n  protected resolveModel(opts: {\n    casbin: typeof import('casbin');\n    model: ICasbinEnforcerOptions['model'];\n  }) {\n    const { casbin, model } = opts;\n\n    switch (model.driver) {\n      case CasbinEnforcerModelDrivers.FILE: {\n        return casbin.newModelFromFile(model.definition);\n      }\n      case CasbinEnforcerModelDrivers.TEXT: {\n        return casbin.newModelFromString(model.definition);\n      }\n      default: {\n        throw getError({\n          message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,\n        });\n      }\n    }\n  }\n\n  protected validateExpiresIn(opts: { expiresIn: number }): void {\n    if (opts.expiresIn >= this.MIN_EXPIRES_IN) {\n      return;\n    }\n\n    throw getError({\n      message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,\n    });\n  }\n\n  // Policy loading internals\n\n  /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */\n  protected async extractUserLines(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const casbin = await CasbinModule.load();\n    const model = this.resolveModel({ casbin, model: this.options.model });\n\n    return PolicyLineCodec.extractUserLines({\n      casbin,\n      model,\n      adapter: this.options.adapter,\n      user: opts.user,\n    });\n  }\n\n  /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */\n  protected async loadPolicyLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n  }): Promise<void> {\n    if (!this.helper) {\n      throw getError({\n        message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',\n      });\n    }\n\n    await PolicyLineCodec.loadLinesIntoModel({\n      enforcer: opts.enforcer,\n      lines: opts.lines,\n      helper: this.helper,\n    });\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/index.d.ts

@@ -3,4 +3,3 @@ export * from './casbin.enforcer';
 export * from './models';
 export * from './policy-line-codec';
 export * from './user-policy-line-cache';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/enforcers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8FAA8F;AAC9F,wDAAsC;AAEtC,oDAAkC;AAClC,2CAAyB;AACzB,sDAAoC;AACpC,2DAAyC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8FAA8F;AAC9F,wDAAsC;AAEtC,oDAAkC;AAClC,2CAAyB;AACzB,sDAAoC;AACpC,2DAAyC","sourcesContent":["// `enforcer-registry.ts` moved to the kernel - `casbin.enforcer.ts` registers itself into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './casbin.enforcer';\nexport * from './models';\nexport * from './policy-line-codec';\nexport * from './user-policy-line-cache';\n"]}

package/dist/components/auth/authorize/enforcers/models/index.d.ts

@@ -1,2 +1 @@
 export * from './rbac-domain.model';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/enforcers/models/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC","sourcesContent":["export * from './rbac-domain.model';\n"]}

package/dist/components/auth/authorize/enforcers/models/rbac-domain.model.d.ts

@@ -1,3 +1,2 @@
 /** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */
 export declare const CASBIN_RBAC_DOMAIN_SCOPED_MODEL = "\n[request_definition]\nr = sub, dom, obj, act\n\n[policy_definition]\np = sub, dom, obj, act, eft\n\n[role_definition]\ng = _, _, _\ng2 = _, _\ng3 = _, _\ng4 = _, _\ng5 = _, _\n\n[policy_effect]\ne = some(where (p.eft == allow)) && !some(where (p.eft == deny))\n\n[matchers]\nm = g(r.sub, p.sub, r.dom) && (p.dom == \"SYSTEM_WIDE\" || (p.dom == \"ANY_MEMBER\" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)\n";
-//# sourceMappingURL=rbac-domain.model.d.ts.map

package/dist/components/auth/authorize/enforcers/models/rbac-domain.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-domain.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":";;;AAAA,0NAA0N;AAC1N,mHAAmH;AACnH,iKAAiK;AACpJ,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;CAmB9C,CAAC"}
+{"version":3,"file":"rbac-domain.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":";;;AAAA,0NAA0N;AAC1N,mHAAmH;AACnH,iKAAiK;AACpJ,QAAA,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;CAmB9C,CAAC","sourcesContent":["// Relation semantics live on AuthorizationPolicyVariants; g's KEY_MATCH domain fn makes `*`-domain links match any request domain; `objectMatch` appears directly in the matcher because hasLink only walks stored nodes.\n// g3/g4/g5 rely on DefaultRoleManager self-links (hasLink(name, name)) - a custom role manager must preserve them.\n/** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */\nexport const CASBIN_RBAC_DOMAIN_SCOPED_MODEL = `\n[request_definition]\nr = sub, dom, obj, act\n\n[policy_definition]\np = sub, dom, obj, act, eft\n\n[role_definition]\ng = _, _, _\ng2 = _, _\ng3 = _, _\ng4 = _, _\ng5 = _, _\n\n[policy_effect]\ne = some(where (p.eft == allow)) && !some(where (p.eft == deny))\n\n[matchers]\nm = g(r.sub, p.sub, r.dom) && (p.dom == \"SYSTEM_WIDE\" || (p.dom == \"ANY_MEMBER\" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)\n`;\n"]}

package/dist/components/auth/authorize/enforcers/policy-line-codec.d.ts

@@ -23,4 +23,3 @@ export declare class PolicyLineCodec {
         helper: typeof CasbinHelperType;
     }): Promise<void>;
 }
-//# sourceMappingURL=policy-line-codec.d.ts.map

package/dist/components/auth/authorize/enforcers/policy-line-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,wDAI+B;AAO/B;;;GAGG;AACH,MAAa,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF;AAlED,0CAkEC"}
+{"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AACvD,wDAI+B;AAO/B;;;GAGG;AACH,MAAa,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF;AAlED,0CAkEC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport {\n  CasbinRuleVariants,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n} from '@venizia/ignis-kernel';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  Model as CasbinModelType,\n} from 'casbin';\n\n/**\n * Serializes casbin policy state to/from plain string lines. Pure - no pool, no cache, no\n * lifecycle; every method takes exactly what it needs from the caller instead of holding state.\n */\nexport class PolicyLineCodec {\n  /** Extract a user's lines from an ISOLATED throwaway enforcer (own model + adapter), never a pooled serving one, so concurrent requests cannot change what we cache. */\n  static async extractUserLines(opts: {\n    casbin: typeof import('casbin');\n    model: CasbinModelType;\n    adapter: ICasbinEnforcerOptions['adapter'];\n    user: IAuthorizationUser;\n  }): Promise<string[]> {\n    const { casbin, model, adapter, user } = opts;\n    const loader = await casbin.newEnforcer(model, adapter);\n\n    if (!loader.loadFilteredPolicy) {\n      throw getError({\n        message: '[PolicyLineCodec] Adapter does not support loadFilteredPolicy.',\n      });\n    }\n\n    await loader.loadFilteredPolicy({\n      principal: { type: user.principalType, id: user.userId },\n    });\n\n    return PolicyLineCodec.extractLinesFrom({ enforcer: loader });\n  }\n\n  /** Serialize ALL p-types and g-types (not just `p`/`g`) back into casbin lines so the cached payload is complete for the scoped model; it reads stored rules, so the loader needs no matching funcs registered. */\n  static async extractLinesFrom(opts: { enforcer: CasbinEnforcerType }): Promise<string[]> {\n    const { enforcer } = opts;\n    const model = enforcer.getModel();\n    const lines: string[] = [];\n\n    const policyTypes = model.model.get(CasbinRuleVariants.P);\n    const policyTypesKeys = policyTypes?.keys() ?? [];\n    for (const ptype of policyTypesKeys) {\n      const rules = await enforcer.getNamedPolicy(ptype);\n      for (const rule of rules) {\n        lines.push([ptype, ...rule].join(', '));\n      }\n    }\n\n    const groupingTypes = model.model.get(CasbinRuleVariants.G);\n    const groupingTypesKeys = groupingTypes?.keys() ?? [];\n    for (const gtype of groupingTypesKeys) {\n      const rules = await enforcer.getNamedGroupingPolicy(gtype);\n      for (const rule of rules) {\n        lines.push([gtype, ...rule].join(', '));\n      }\n    }\n\n    return lines;\n  }\n\n  /** Atomically reset a borrowed enforcer's model to exactly `lines` + rebuild role links. */\n  static async loadLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n    helper: typeof CasbinHelperType;\n  }): Promise<void> {\n    const model = opts.enforcer.getModel();\n    model.clearPolicy();\n\n    for (const line of opts.lines) {\n      opts.helper.loadPolicyLine(line, model);\n    }\n\n    await opts.enforcer.buildRoleLinks();\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/user-policy-line-cache.d.ts

@@ -43,4 +43,3 @@ export declare class UserPolicyLineCache extends BaseHelper {
     /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */
     private parseLines;
 }
-//# sourceMappingURL=user-policy-line-cache.d.ts.map

package/dist/components/auth/authorize/enforcers/user-policy-line-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-policy-line-cache.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":";;;AAAA,sDAAmE;AAEnE,wDAI+B;AAK/B;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAOjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAP7C,4IAA4I;QAC3H,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAOzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,KAAK,CAAC,IAAkC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,+JAA+J;QAC/J,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,qLAAqL;QACrL,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,UAAU,CAAC,IAEhB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEvF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,OAAO,CAAC,IAEb;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,eAAe,CAAC,IAAkC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,kCAAmB,CAAC,iBAAiB;gBAC5C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,UAAU,CAAC,IAA2C;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvC,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,UAAU,CAAC,IAAuC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uEAAuE;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAkB,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,8DAA8D,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAlHD,kDAkHC"}
+{"version":3,"file":"user-policy-line-cache.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":";;;AAAA,sDAAmE;AAEnE,wDAI+B;AAK/B;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAOjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAP7C,4IAA4I;QAC3H,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAOzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,KAAK,CAAC,IAAkC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,+JAA+J;QAC/J,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,qLAAqL;QACrL,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,UAAU,CAAC,IAEhB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEvF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,OAAO,CAAC,IAEb;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,eAAe,CAAC,IAAkC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,kCAAmB,CAAC,iBAAiB;gBAC5C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,UAAU,CAAC,IAA2C;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvC,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,UAAU,CAAC,IAAuC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uEAAuE;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAkB,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,8DAA8D,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAlHD,kDAkHC","sourcesContent":["import { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationErrors,\n  type IAuthorizationUser,\n  type ICasbinEnforcerCachedRedis,\n} from '@venizia/ignis-kernel';\n\n/** Computes a user's policy lines on a cache miss - CasbinAuthorizationEnforcer wires this to its isolated-enforcer extraction (PolicyLineCodec.extractUserLines). */\nexport type TPolicyLineLoader = (opts: { user: IAuthorizationUser }) => Promise<string[]>;\n\n/**\n * Per-user redis cache of casbin policy lines. Owns the cache key, the TTL, and concurrent-miss\n * de-duplication so N simultaneous misses for the same user collapse onto one extraction.\n */\nexport class UserPolicyLineCache extends BaseHelper {\n  private readonly cached: ICasbinEnforcerCachedRedis & { use: true };\n  private readonly loadLines: TPolicyLineLoader;\n\n  // cacheKey -> in-progress line-fetch; concurrent misses for the same user share one extraction instead of all hitting the DB (see fetch()).\n  private readonly pendingLineFetches = new Map<string, Promise<string[]>>();\n\n  constructor(opts: {\n    cached: ICasbinEnforcerCachedRedis & { use: true };\n    loadLines: TPolicyLineLoader;\n  }) {\n    super({ scope: UserPolicyLineCache.name });\n    this.cached = opts.cached;\n    this.loadLines = opts.loadLines;\n  }\n\n  /** Fetch the user's lines, collapsing concurrent misses per key onto one extraction. Best-effort: two misses may race past the cache read and both extract (benign - per-user lines are identical). */\n  async fetch(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n\n    // Cache hit - Redis owns expiry (PX on write), so a present key is fresh; a corrupted/legacy entry must NOT 500 the request, so it is discarded and refetched.\n    const raw = await this.cached.options.connection.get({ key: cacheKey });\n    if (raw) {\n      const lines = this.parseLines({ raw, cacheKey });\n\n      if (lines) {\n        return lines;\n      }\n    }\n\n    const existing = this.pendingLineFetches.get(cacheKey);\n    if (existing) {\n      return existing;\n    }\n\n    // Cache miss (or discarded corrupt entry) - extract from an ISOLATED enforcer so a concurrent load cannot contaminate the cache, persist it, then return the lines for THIS request.\n    const task = async () => {\n      const lines = await this.loadLines({ user: opts.user });\n      await this.writeLines({ cacheKey, lines });\n      return lines;\n    };\n\n    const promise = task().finally(() => {\n      this.pendingLineFetches.delete(cacheKey);\n    });\n\n    this.pendingLineFetches.set(cacheKey, promise);\n    return promise;\n  }\n\n  /** Drop the user's cached entry. */\n  async invalidate(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; invalidatedKeys: number }> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n    const invalidatedKeys = await this.cached.options.connection.del({ keys: [cacheKey] });\n\n    return { cacheKey, invalidatedKeys };\n  }\n\n  /** Drop then recompute the user's cached entry via `loadLines` - an isolated extraction (never a pooled serving enforcer), so a concurrent request cannot make the cache hold another user's lines. */\n  async rebuild(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lines: string[] }> {\n    const cacheKey = await this.resolveCacheKey({ user: opts.user });\n    await this.cached.options.connection.del({ keys: [cacheKey] });\n\n    const lines = await this.loadLines({ user: opts.user });\n    await this.writeLines({ cacheKey, lines });\n\n    return { cacheKey, lines };\n  }\n\n  /** Compute the user's cache key and reject an empty result - consistent with the read path. */\n  private async resolveCacheKey(opts: { user: IAuthorizationUser }): Promise<string> {\n    const cacheKey = await this.cached.options.keyFn({ user: opts.user });\n    if (!cacheKey) {\n      throw getError({\n        error: AuthorizationErrors.CACHE_KEY_INVALID,\n        message: '[UserPolicyLineCache] keyFn returned an empty cache key.',\n      });\n    }\n\n    return cacheKey;\n  }\n\n  /** Single source of truth for the cache encoding. Used by the miss path and rebuild(). */\n  private async writeLines(opts: { cacheKey: string; lines: string[] }): Promise<void> {\n    await this.cached.options.connection.set({\n      key: opts.cacheKey,\n      value: opts.lines,\n      options: { expiresIn: this.cached.options.expiresIn },\n    });\n  }\n\n  /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */\n  private parseLines(opts: { raw: string; cacheKey: string }): TNullable<string[]> {\n    try {\n      const parsed = JSON.parse(opts.raw);\n\n      if (!Array.isArray(parsed) || parsed.some(line => typeof line !== 'string')) {\n        throw getError({\n          message: '[UserPolicyLineCache] Cached payload is not an array of policy lines.',\n        });\n      }\n\n      return parsed as string[];\n    } catch (error) {\n      this.logger\n        .for(this.parseLines.name)\n        .warn('Discarding corrupted authz cache entry | key: %s | error: %s', opts.cacheKey, error);\n      return null;\n    }\n  }\n}\n"]}

package/dist/components/auth/authorize/index.d.ts

@@ -3,4 +3,3 @@ export * from './adapters';
 export * from './component';
 export * from './enforcers';
 export * from './role-managers';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6FAA6F;AAC7F,oFAAoF;AACpF,wDAAsC;AAEtC,6CAA2B;AAC3B,8CAA4B;AAC5B,8CAA4B;AAC5B,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6FAA6F;AAC7F,oFAAoF;AACpF,wDAAsC;AAEtC,6CAA2B;AAC3B,8CAA4B;AAC5B,8CAA4B;AAC5B,kDAAgC","sourcesContent":["// `builders`, `common`, `middlewares`, `models` and `providers` moved to the kernel in full;\n// `enforcer-registry.ts` moved out of `enforcers` too (see `./enforcers/index.ts`).\nexport * from '@venizia/ignis-kernel';\n\nexport * from './adapters';\nexport * from './component';\nexport * from './enforcers';\nexport * from './role-managers';\n"]}

package/dist/components/auth/authorize/role-managers/base.d.ts

@@ -31,4 +31,3 @@ export declare abstract class BaseRoleManager extends BaseHelper {
         node: string;
     }): string[];
 }
-//# sourceMappingURL=base.d.ts.map

package/dist/components/auth/authorize/role-managers/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAEzD;;;;;GAKG;AACH,MAAsB,eAAgB,SAAQ,iBAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAkFlC,CAAC;IA9EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnFD,0CAmFC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":";;;AAAA,sDAAyD;AAEzD;;;;;GAKG;AACH,MAAsB,eAAgB,SAAQ,iBAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAkFlC,CAAC;IA9EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnFD,0CAmFC","sourcesContent":["import { BaseHelper } from '@venizia/ignis-helpers/core';\n\n/**\n * Shared casbin `RoleManager` scaffolding for the resource, domain-hierarchy, and membership\n * role managers: the debug-only interface members (`printRoles`, `getDomains`, `getAllDomains`),\n * the `hasLink` wrapper around the synchronous `syncedHasLink`, the once-per-`clear()`\n * overlay-initialized log line, and the shared ancestor walk both hierarchy-aware managers use.\n */\nexport abstract class BaseRoleManager extends BaseHelper {\n  protected graphReported = false;\n\n  abstract syncedHasLink(name1: string, name2: string): boolean;\n\n  async hasLink(name1: string, name2: string): Promise<boolean> {\n    return this.syncedHasLink(name1, name2);\n  }\n\n  /** casbin calls this after buildRoleLinks purely as a debug hook; none of the role managers log from here. */\n  async printRoles(): Promise<void> {}\n\n  async getDomains(): Promise<string[]> {\n    return [];\n  }\n\n  async getAllDomains(): Promise<string[]> {\n    return [];\n  }\n\n  /** Logs the initialized-overlay line once per `clear()` cycle; `build` is only invoked the first time so counts stay lazy. */\n  protected reportGraphOnce(build: () => { message: string; args: unknown[] }): void {\n    if (this.graphReported) {\n      return;\n    }\n    this.graphReported = true;\n\n    const { message, args } = build();\n    this.logger.for(this.syncedHasLink.name).debug(message, ...args);\n  }\n\n  /** Node and edge counts of a domain-hierarchy overlay, for the once-per-`clear()` debug log. */\n  protected static overlayStats(overlay?: Map<string, Set<string>>): {\n    nodeCount: number;\n    edgeCount: number;\n  } {\n    if (!overlay) {\n      return { nodeCount: 0, edgeCount: 0 };\n    }\n\n    let edgeCount = 0;\n    const overlayValues = overlay.values();\n    for (const parents of overlayValues) {\n      edgeCount += parents.size;\n    }\n\n    return { nodeCount: overlay.size, edgeCount };\n  }\n\n  /** `node` itself plus every ancestor reachable by walking the overlay's child->parent edges,\n   * node first. Cycle-safe: visited Set + index cursor, never shift(). Static - `ResourceRoleManager`\n   * extends this base with no overlay of this shape, so this must not force instance state onto it. */\n  protected static collectAncestors(opts: {\n    overlay?: Map<string, Set<string>>;\n    node: string;\n  }): string[] {\n    const { overlay, node } = opts;\n    const result: string[] = [node];\n    const visited = new Set<string>([node]);\n    const queue: string[] = [node];\n\n    let head = 0;\n    while (head < queue.length) {\n      const current = queue[head];\n      head += 1;\n\n      const parents = overlay?.get(current);\n      if (!parents) {\n        continue;\n      }\n\n      for (const parent of parents) {\n        if (visited.has(parent)) {\n          continue;\n        }\n        visited.add(parent);\n        result.push(parent);\n        queue.push(parent);\n      }\n    }\n\n    return result;\n  }\n}\n"]}

package/dist/components/auth/authorize/role-managers/domain-hierarchy.d.ts

@@ -25,4 +25,3 @@ export declare class DomainHierarchyRoleManager extends BaseRoleManager implemen
     /** True when `start` is `target`, or reaches it through the overlay. */
     private reaches;
 }
-//# sourceMappingURL=domain-hierarchy.d.ts.map

package/dist/components/auth/authorize/role-managers/domain-hierarchy.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-hierarchy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,sBAAe;IAO7D,YAAY,IAAgE;QAC1E,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,GAAG,EAAuB,CAAC;IAChE,CAAC;IAED,8JAA8J;IAC9J,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvF,OAAO;gBACL,OAAO,EAAE,kFAAkF;gBAC3F,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAE7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IAChE,OAAO,CAAC,IAAuC;QACrD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;YAC5D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAlFD,gEAkFC"}
+{"version":3,"file":"domain-hierarchy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,sBAAe;IAO7D,YAAY,IAAgE;QAC1E,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,GAAG,EAAuB,CAAC;IAChE,CAAC;IAED,8JAA8J;IAC9J,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvF,OAAO;gBACL,OAAO,EAAE,kFAAkF;gBAC3F,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAE7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IAChE,OAAO,CAAC,IAAuC;QACrD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;YAC5D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAlFD,gEAkFC","sourcesContent":["import type { RoleManager } from 'casbin';\nimport { BaseRoleManager } from './base';\n\n/**\n * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's\n * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.\n * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears\n * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`\n * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.\n */\nexport class DomainHierarchyRoleManager extends BaseRoleManager implements RoleManager {\n  private readonly reversed: boolean;\n  private readonly overlay: Map<\n    string, // child domain\n    Set<string> // set of parent domains\n  >;\n\n  constructor(opts: { reversed?: boolean; overlay?: Map<string, Set<string>> }) {\n    super({ scope: DomainHierarchyRoleManager.name });\n    this.reversed = opts.reversed ?? false;\n    this.overlay = opts.overlay ?? new Map<string, Set<string>>();\n  }\n\n  /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */\n  async clear(): Promise<void> {\n    this.overlay.clear();\n    this.graphReported = false;\n  }\n\n  async addLink(child: string, parent: string): Promise<void> {\n    const existing = this.overlay.get(child);\n    if (existing) {\n      existing.add(parent);\n    } else {\n      this.overlay.set(child, new Set<string>([parent]));\n    }\n\n    if (!this.overlay.has(parent)) {\n      this.overlay.set(parent, new Set<string>());\n    }\n  }\n\n  async deleteLink(child: string, parent: string): Promise<void> {\n    this.overlay.get(child)?.delete(parent);\n  }\n\n  syncedHasLink(name1: string, name2: string): boolean {\n    this.reportGraphOnce(() => {\n      const { nodeCount, edgeCount } = DomainHierarchyRoleManager.overlayStats(this.overlay);\n      return {\n        message: 'domain-hierarchy role manager initialized | nodes: %d | edges: %d | reversed: %s',\n        args: [nodeCount, edgeCount, this.reversed],\n      };\n    });\n\n    const start = this.reversed ? name2 : name1;\n    const target = this.reversed ? name1 : name2;\n\n    return this.reaches({ start, target });\n  }\n\n  /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */\n  async getRoles(name: string): Promise<string[]> {\n    return [...(this.overlay.get(name) ?? [])];\n  }\n\n  async getUsers(name: string): Promise<string[]> {\n    const users: string[] = [];\n\n    for (const [child, parents] of this.overlay) {\n      if (parents.has(name)) {\n        users.push(child);\n      }\n    }\n\n    return users;\n  }\n\n  /** True when `start` is `target`, or reaches it through the overlay. */\n  private reaches(opts: { start: string; target: string }): boolean {\n    const { start, target } = opts;\n\n    if (start === target) {\n      return true;\n    }\n\n    const ancestors = DomainHierarchyRoleManager.collectAncestors({\n      overlay: this.overlay,\n      node: start,\n    });\n    return ancestors.includes(target);\n  }\n}\n"]}

package/dist/components/auth/authorize/role-managers/index.d.ts

@@ -2,4 +2,3 @@ export * from './base';
 export * from './domain-hierarchy';
 export * from './membership';
 export * from './resource';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/role-managers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,qDAAmC;AACnC,+CAA6B;AAC7B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,qDAAmC;AACnC,+CAA6B;AAC7B,6CAA2B","sourcesContent":["export * from './base';\nexport * from './domain-hierarchy';\nexport * from './membership';\nexport * from './resource';\n"]}

package/dist/components/auth/authorize/role-managers/membership.d.ts

@@ -18,4 +18,3 @@ export declare class MembershipRoleManager extends BaseRoleManager implements Ro
     getRoles(name: string): Promise<string[]>;
     getUsers(name: string): Promise<string[]>;
 }
-//# sourceMappingURL=membership.d.ts.map

package/dist/components/auth/authorize/role-managers/membership.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/membership.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;sEAEsE;AACtE,MAAa,qBAAsB,SAAQ,sBAAe;IAUxD,YAAY,IAA4C;QACtD,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QANvC,gBAAW,GAAG,IAAI,GAAG,EAG1B,CAAC;QAIF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,MAAc;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,kNAAkN;IAClN,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,6DAA6D;gBACtE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,gBAAgB,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA7ED,sDA6EC"}
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/membership.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC;;sEAEsE;AACtE,MAAa,qBAAsB,SAAQ,sBAAe;IAUxD,YAAY,IAA4C;QACtD,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QANvC,gBAAW,GAAG,IAAI,GAAG,EAG1B,CAAC;QAIF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,MAAc;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,kNAAkN;IAClN,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,6DAA6D;gBACtE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,gBAAgB,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA7ED,sDA6EC","sourcesContent":["import type { RoleManager } from 'casbin';\nimport { BaseRoleManager } from './base';\n\n/** `g2` axis (`g2(r.sub, r.dom)`): membership holds when the user joined the request domain or any\n * ancestor of it, walking the shared per-request domain-hierarchy overlay. Memberships are\n * per-principal and rebuilt every request, so `clear()` wipes all. */\nexport class MembershipRoleManager extends BaseRoleManager implements RoleManager {\n  private readonly overlay?: Map<\n    string, // child domain\n    Set<string> // set of parent domains\n  >;\n  private memberships = new Map<\n    string, // user\n    Set<string> // set of joined domains\n  >();\n\n  constructor(opts: { overlay?: Map<string, Set<string>> }) {\n    super({ scope: MembershipRoleManager.name });\n    this.overlay = opts.overlay;\n  }\n\n  async clear(): Promise<void> {\n    this.memberships = new Map<string, Set<string>>();\n    this.graphReported = false;\n  }\n\n  async addLink(user: string, domain: string): Promise<void> {\n    const existing = this.memberships.get(user);\n    if (existing) {\n      existing.add(domain);\n    } else {\n      this.memberships.set(user, new Set<string>([domain]));\n    }\n  }\n\n  async deleteLink(user: string, domain: string): Promise<void> {\n    this.memberships.get(user)?.delete(domain);\n  }\n\n  /** True when `name1` (user) joined `name2` (request domain) itself, or any ancestor of it. Walks UP from the request domain only - walking down from every joined domain would fan out over the whole subtree. */\n  syncedHasLink(name1: string, name2: string): boolean {\n    this.reportGraphOnce(() => {\n      const { nodeCount, edgeCount } = MembershipRoleManager.overlayStats(this.overlay);\n      return {\n        message: 'membership role manager initialized | nodes: %d | edges: %d',\n        args: [nodeCount, edgeCount],\n      };\n    });\n\n    const joined = this.memberships.get(name1);\n    if (!joined || joined.size === 0) {\n      return false;\n    }\n\n    const ancestors = MembershipRoleManager.collectAncestors({\n      overlay: this.overlay,\n      node: name2,\n    });\n    for (const ancestor of ancestors) {\n      if (joined.has(ancestor)) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  /** Local membership state only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */\n  async getRoles(name: string): Promise<string[]> {\n    return [...(this.memberships.get(name) ?? [])];\n  }\n\n  async getUsers(name: string): Promise<string[]> {\n    const users: string[] = [];\n\n    for (const [user, domains] of this.memberships) {\n      if (domains.has(name)) {\n        users.push(user);\n      }\n    }\n\n    return users;\n  }\n}\n"]}

package/dist/components/auth/authorize/role-managers/resource.d.ts

@@ -13,4 +13,3 @@ export declare class ResourceRoleManager extends BaseRoleManager implements Role
     /** All stored prefix ancestors of a dotted code (`a.b.c` -> `a.b` -> `a`), not only the deepest, plus a literal stored `'*'` node - `objectMatch(anything, '*')` is always true, so a `g4` edge whose child is `'*'` must stay reachable from every request object. */
     private collectStoredAncestors;
 }
-//# sourceMappingURL=resource.d.ts.map

package/dist/components/auth/authorize/role-managers/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/resource.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC,yQAAyQ;AACzQ,MAAa,mBAAoB,SAAQ,sBAAe;IAMtD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QANrC,YAAO,GAAG,IAAI,GAAG,EAGtB,CAAC;IAIJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5F,OAAO;gBACL,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;QAEnC,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uQAAuQ;IAC/P,sBAAsB,CAAC,IAAsB;QACnD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1HD,kDA0HC"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/role-managers/resource.ts"],"names":[],"mappings":";;;AACA,iCAAyC;AAEzC,yQAAyQ;AACzQ,MAAa,mBAAoB,SAAQ,sBAAe;IAMtD;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QANrC,YAAO,GAAG,IAAI,GAAG,EAGtB,CAAC;IAIJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5F,OAAO;gBACL,OAAO,EAAE,mDAAmD;gBAC5D,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;aAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;QAEnC,uFAAuF;QACvF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAErB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uQAAuQ;IAC/P,sBAAsB,CAAC,IAAsB;QACnD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1HD,kDA0HC","sourcesContent":["import type { RoleManager } from 'casbin';\nimport { BaseRoleManager } from './base';\n\n/** Resource-axis (`g4`) role manager: `addMatchingFunc` would set `hasPattern` and disable DefaultRoleManager's O(1) fast path, so prefix ancestors are walked manually; `addLink` must stay idempotent because `buildRoleLinks` re-adds every edge once per request. */\nexport class ResourceRoleManager extends BaseRoleManager implements RoleManager {\n  private parents = new Map<\n    string, // Child module\n    Set<string> // Set of Parent modules\n  >();\n\n  constructor() {\n    super({ scope: ResourceRoleManager.name });\n  }\n\n  async clear(): Promise<void> {\n    this.parents = new Map<string, Set<string>>();\n    this.graphReported = false;\n  }\n\n  async addLink(child: string, parent: string): Promise<void> {\n    const existing = this.parents.get(child);\n\n    if (existing) {\n      existing.add(parent);\n    } else {\n      this.parents.set(child, new Set<string>([parent]));\n    }\n\n    if (!this.parents.has(parent)) {\n      this.parents.set(parent, new Set<string>());\n    }\n  }\n\n  async deleteLink(child: string, parent: string): Promise<void> {\n    this.parents.get(child)?.delete(parent);\n  }\n\n  syncedHasLink(name1: string, name2: string): boolean {\n    this.reportGraphOnce(() => {\n      const nodeCount = this.parents.size;\n      const edgeCount = Array.from(this.parents.values()).reduce((sum, set) => sum + set.size, 0);\n      return {\n        message: 'resource-role initialized | nodes: %d | edges: %d',\n        args: [nodeCount, edgeCount],\n      };\n    });\n\n    if (name1 === name2) {\n      return true;\n    }\n\n    const seeds = this.collectStoredAncestors({ name: name1 });\n    if (seeds.length === 0) {\n      return false;\n    }\n\n    const visited = new Set<string>();\n    const queue: string[] = [...seeds];\n\n    // Index cursor rather than shift(): shift() is O(n) and would make the walk quadratic.\n    let head = 0;\n    while (head < queue.length) {\n      const current = queue[head];\n      head += 1;\n\n      if (current === name2) {\n        return true;\n      }\n\n      if (visited.has(current)) {\n        continue;\n      }\n      visited.add(current);\n\n      const parents = this.parents.get(current);\n      if (parents) {\n        queue.push(...parents);\n      }\n    }\n\n    return false;\n  }\n\n  async getRoles(name: string): Promise<string[]> {\n    return [...(this.parents.get(name) ?? [])];\n  }\n\n  async getUsers(name: string): Promise<string[]> {\n    const users: string[] = [];\n\n    for (const [child, parents] of this.parents) {\n      if (parents.has(name)) {\n        users.push(child);\n      }\n    }\n\n    return users;\n  }\n\n  /** All stored prefix ancestors of a dotted code (`a.b.c` -> `a.b` -> `a`), not only the deepest, plus a literal stored `'*'` node - `objectMatch(anything, '*')` is always true, so a `g4` edge whose child is `'*'` must stay reachable from every request object. */\n  private collectStoredAncestors(opts: { name: string }): string[] {\n    const ancestors: string[] = [];\n\n    if (this.parents.has(opts.name)) {\n      ancestors.push(opts.name);\n    }\n\n    let current = opts.name;\n    for (;;) {\n      const index = current.lastIndexOf('.');\n      if (index === -1) {\n        break;\n      }\n\n      current = current.slice(0, index);\n      if (this.parents.has(current)) {\n        ancestors.push(current);\n      }\n    }\n\n    if (this.parents.has('*') && !ancestors.includes('*')) {\n      ancestors.push('*');\n    }\n\n    return ancestors;\n  }\n}\n"]}

package/dist/components/auth/index.d.ts

@@ -2,4 +2,3 @@ export * from '@venizia/ignis-kernel';
 export * from './authenticate';
 export * from './authorize';
 export * from './models';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+FAA+F;AAC/F,iFAAiF;AACjF,wDAAsC;AAEtC,iDAA+B;AAC/B,8CAA4B;AAC5B,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+FAA+F;AAC/F,iFAAiF;AACjF,wDAAsC;AAEtC,iDAA+B;AAC/B,8CAA4B;AAC5B,2CAAyB","sourcesContent":["// `base` and `context-variables` moved to the kernel in full; `models/requests` moved too (see\n// `./models/index.ts`). Re-exported here so `@/components/auth` keeps resolving.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './authenticate';\nexport * from './authorize';\nexport * from './models';\n"]}

package/dist/components/auth/models/entities/index.d.ts

@@ -2,4 +2,3 @@ export * from './permission.model';
 export * from './policy-definition.model';
 export * from './role.model';
 export * from './user.model';
-//# sourceMappingURL=index.d.ts.map