@venizia/ignis 0.4.2 → 0.4.4

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,gHAAgH;AAChH,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,KAAK,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\n\nexport type TDomainHierarchyEdge = { child: string; parent: string };\n\nexport interface IScopedCasbinPolicyFilter {\n  principal: { type: string; id: IdType };\n}\n\n/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */\nexport type TGrantRow = {\n  subjectId: IdType;\n  objectCode: TNullable<string>;\n  objectSubject: TNullable<string>;\n  objectMethod: TNullable<string>;\n  action: TNullable<string>;\n  effect: TNullable<string>;\n  domain: TNullable<string>;\n  metadata?: unknown;\n};\n\n/**\n * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant\n * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app\n * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the\n * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own\n * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side\n * re-formats them.\n *\n * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both\n * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via\n * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported\n * from a mechanism that derived its domains from `assign_role` will silently lose access for\n * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.\n *\n * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one\n * function per axis and concatenate their results here - this hook deliberately takes a single\n * function, so composition stays visible in the application, not hidden inside the framework:\n * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.\n */\nexport type TResolveDomainEdgesFn = (opts: {\n  principal: { type: string; id: IdType };\n  domains: string[];\n}) => Promise<TDomainHierarchyEdge[]>;\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/index.d.ts

@@ -0,0 +1,4 @@
+export type { IScopedCasbinPolicyFilter, TDomainHierarchyEdge, TGrantRow, TResolveDomainEdgesFn, } from './common/index.js';
+export * from './policy-edges.js';
+export * from './adapter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,yBAAyB,EACzB,oBAAoB,EACpB,SAAS,EACT,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/index.js

@@ -0,0 +1,3 @@
+export * from './policy-edges.js';
+export * from './adapter.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC","sourcesContent":["// DEFAULT_SCHEMA (common/constants.ts) was module-private in the pre-split file - re-export only\n// the types, never the whole './common' barrel, or it leaks into the public surface.\nexport type {\n  IScopedCasbinPolicyFilter,\n  TDomainHierarchyEdge,\n  TGrantRow,\n  TResolveDomainEdgesFn,\n} from './common';\nexport * from './policy-edges';\nexport * from './adapter';\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts

@@ -0,0 +1,17 @@
+import type { IdType } from '../../../../../base/index.js';
+import type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';
+import type { TGrantRow } from './common/index.js';
+export declare class PrincipalPolicyEdges {
+    static readonly DIRECT = "direct";
+    static readonly ROLE_EDGE = "roleEdge";
+    static readonly ROLE_GRANT = "roleGrant";
+    static readonly DOMAIN_EDGE = "domainEdge";
+}
+/** A row from the single principal-policy statement; `kind` says which branch produced it. */
+export type TPrincipalPolicyRow = TGrantRow & {
+    kind: TConstValue<typeof PrincipalPolicyEdges>;
+    variant: string;
+    targetType: TNullable<string>;
+    targetId: IdType;
+};
+//# sourceMappingURL=policy-edges.d.ts.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-edges.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IACvC,MAAM,CAAC,QAAQ,CAAC,UAAU,eAAe;IACzC,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;CAC5C;AAED,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG;IAC5C,IAAI,EAAE,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/policy-edges.js

@@ -0,0 +1,7 @@
+export class PrincipalPolicyEdges {
+    static { this.DIRECT = 'direct'; }
+    static { this.ROLE_EDGE = 'roleEdge'; }
+    static { this.ROLE_GRANT = 'roleGrant'; }
+    static { this.DOMAIN_EDGE = 'domainEdge'; }
+}
+//# sourceMappingURL=policy-edges.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/policy-edges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-edges.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,UAAU,CAAC;aACvB,eAAU,GAAG,WAAW,CAAC;aACzB,gBAAW,GAAG,YAAY,CAAC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';\nimport type { TGrantRow } from './common';\n\nexport class PrincipalPolicyEdges {\n  static readonly DIRECT = 'direct';\n  static readonly ROLE_EDGE = 'roleEdge';\n  static readonly ROLE_GRANT = 'roleGrant';\n  static readonly DOMAIN_EDGE = 'domainEdge';\n}\n\n/** A row from the single principal-policy statement; `kind` says which branch produced it. */\nexport type TPrincipalPolicyRow = TGrantRow & {\n  kind: TConstValue<typeof PrincipalPolicyEdges>;\n  variant: string;\n  targetType: TNullable<string>;\n  targetId: IdType;\n};\n"]}

package/dist/esm/components/auth/authorize/component.d.ts

@@ -0,0 +1,10 @@
+import type { BaseApplication } from '../../../base/applications/base.js';
+import { BaseComponent } from '@venizia/ignis-kernel';
+import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
+export declare class AuthorizeComponent extends BaseComponent {
+    private application;
+    constructor(application: BaseApplication);
+    binding(): ValueOrPromise<void>;
+    private bindAlwaysAllowRoles;
+}
+//# sourceMappingURL=component.d.ts.map

package/dist/esm/components/auth/authorize/component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAItD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAOpE,qBAAa,kBAAmB,SAAQ,aAAa;IAEG,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,eAAe;IAQjF,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;IAsBxC,OAAO,CAAC,oBAAoB;CAS7B"}

package/dist/esm/components/auth/authorize/component.js

@@ -0,0 +1,57 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthorizeComponent_1;
+import { BaseComponent } from '@venizia/ignis-kernel';
+import { inject } from '@venizia/ignis-kernel';
+import { CoreBindings } from '@venizia/ignis-kernel';
+import { getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationEnforcerRegistry, AuthorizeBindingKeys, } from '@venizia/ignis-kernel';
+let AuthorizeComponent = AuthorizeComponent_1 = class AuthorizeComponent extends BaseComponent {
+    constructor(application) {
+        super({
+            scope: AuthorizeComponent_1.name,
+            initDefault: { enable: true, container: application },
+        });
+        this.application = application;
+    }
+    binding() {
+        const options = this.application.get({
+            key: AuthorizeBindingKeys.OPTIONS,
+            isOptional: true,
+        });
+        if (!options) {
+            throw getError({
+                message: '[AuthorizeComponent] No authorize options found. Bind options to AuthorizeBindingKeys.OPTIONS before registering the component.',
+            });
+        }
+        this.bindAlwaysAllowRoles({ options });
+        // The registry otherwise finds options only through a registered enforcer's container, so
+        // `defaultDecision` would be unreadable in the one case it decides: no enforcer registered.
+        AuthorizationEnforcerRegistry.getInstance().setOptions({ options });
+        this.logger.for(this.binding.name).info('Authorization configured');
+    }
+    bindAlwaysAllowRoles(opts) {
+        if (!opts.options.alwaysAllowRoles?.length) {
+            return;
+        }
+        this.application
+            .bind({ key: AuthorizeBindingKeys.ALWAYS_ALLOW_ROLES })
+            .toValue(opts.options.alwaysAllowRoles);
+    }
+};
+AuthorizeComponent = AuthorizeComponent_1 = __decorate([
+    __param(0, inject({ key: CoreBindings.APPLICATION_INSTANCE })),
+    __metadata("design:paramtypes", [Function])
+], AuthorizeComponent);
+export { AuthorizeComponent };
+//# sourceMappingURL=component.js.map

package/dist/esm/components/auth/authorize/component.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAE/B,IAAa,kBAAkB,0BAA/B,MAAa,kBAAmB,SAAQ,aAAa;IACnD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,oBAAkB,CAAC,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;SACtD,CAAC,CAAC;QALyD,gBAAW,GAAX,WAAW,CAAiB;IAM1F,CAAC;IAEQ,OAAO;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAoB;YACtD,GAAG,EAAE,oBAAoB,CAAC,OAAO;YACjC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,iIAAiI;aACpI,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6BAA6B,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAEO,oBAAoB,CAAC,IAAoC;QAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAAW,EAAE,GAAG,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;aAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAzCY,kBAAkB;IAE1B,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,kBAAkB,CAyC9B","sourcesContent":["import type { BaseApplication } from '@/base/applications/base';\nimport { BaseComponent } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { CoreBindings } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationEnforcerRegistry,\n  AuthorizeBindingKeys,\n  type IAuthorizeOptions,\n} from '@venizia/ignis-kernel';\n\nexport class AuthorizeComponent extends BaseComponent {\n  constructor(\n    @inject({ key: CoreBindings.APPLICATION_INSTANCE }) private application: BaseApplication,\n  ) {\n    super({\n      scope: AuthorizeComponent.name,\n      initDefault: { enable: true, container: application },\n    });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    const options = this.application.get<IAuthorizeOptions>({\n      key: AuthorizeBindingKeys.OPTIONS,\n      isOptional: true,\n    });\n\n    if (!options) {\n      throw getError({\n        message:\n          '[AuthorizeComponent] No authorize options found. Bind options to AuthorizeBindingKeys.OPTIONS before registering the component.',\n      });\n    }\n\n    this.bindAlwaysAllowRoles({ options });\n\n    // The registry otherwise finds options only through a registered enforcer's container, so\n    // `defaultDecision` would be unreadable in the one case it decides: no enforcer registered.\n    AuthorizationEnforcerRegistry.getInstance().setOptions({ options });\n\n    this.logger.for(this.binding.name).info('Authorization configured');\n  }\n\n  private bindAlwaysAllowRoles(opts: { options: IAuthorizeOptions }): void {\n    if (!opts.options.alwaysAllowRoles?.length) {\n      return;\n    }\n\n    this.application\n      .bind<string[]>({ key: AuthorizeBindingKeys.ALWAYS_ALLOW_ROLES })\n      .toValue(opts.options.alwaysAllowRoles);\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/casbin-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"casbin-module.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAEA,iOAAiO;AACjO,qBAAa,YAAY;WACV,IAAI,IAAI,OAAO,CAAC,cAAc,QAAQ,CAAC,CAAC;CAUtD"}

package/dist/esm/components/auth/authorize/enforcers/casbin-module.js

@@ -0,0 +1,15 @@
+import { getError } from '@venizia/ignis-helpers/core';
+/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */
+export class CasbinModule {
+    static async load() {
+        try {
+            return await import('casbin');
+        }
+        catch {
+            throw getError({
+                message: '[CasbinModule] "casbin" is not installed | Install the optional peer casbin to use the casbin enforcer',
+            });
+        }
+    }
+}
+//# sourceMappingURL=casbin-module.js.map

package/dist/esm/components/auth/authorize/enforcers/casbin-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,iOAAiO;AACjO,MAAM,OAAO,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\n\n/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */\nexport class CasbinModule {\n  static async load(): Promise<typeof import('casbin')> {\n    try {\n      return await import('casbin');\n    } catch {\n      throw getError({\n        message:\n          '[CasbinModule] \"casbin\" is not installed | Install the optional peer casbin to use the casbin enforcer',\n      });\n    }\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.d.ts

@@ -0,0 +1,90 @@
+import { type TContext } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import type { Enforcer as CasbinEnforcerType } from 'casbin';
+import { type Env } from 'hono';
+import { type IAuthorizationEnforcer, type IAuthorizationUser, type ICasbinEnforcerOptions, type ICasbinRules, type IAuthorizationRequest, type TAuthorizationDecision, type TCasbinDomainMatchingFunction } from '@venizia/ignis-kernel';
+import { UserPolicyLineCache } from './user-policy-line-cache.js';
+/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */
+type TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {
+    user: IAuthorizationUser;
+    action: TAction;
+    resource: TResource;
+    context: TContext<E, string>;
+}) => {
+    subject: string;
+    resource: string;
+    action: string;
+    domain?: string;
+};
+export declare class CasbinAuthorizationEnforcer<E extends Env = Env, TAction extends string = string, TResource extends string = string> extends BaseHelper implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules> {
+    private options;
+    name: string;
+    private readonly MIN_EXPIRES_IN;
+    private pool;
+    private helper;
+    private userPolicyLineCache;
+    private resolvedPayloadFn;
+    constructor(options: ICasbinEnforcerOptions<E, TAction, TResource>);
+    configure(): Promise<void>;
+    destroy(): void;
+    /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */
+    protected assertMatcherCompilesSync(opts: {
+        enforcer: CasbinEnforcerType;
+    }): void;
+    buildRules(opts: {
+        user: IAuthorizationUser;
+        context: TContext<E, string>;
+    }): Promise<ICasbinRules>;
+    evaluate(opts: {
+        rules: ICasbinRules;
+        request: IAuthorizationRequest<TAction, TResource>;
+        context: TContext<E, string>;
+    }): Promise<TAuthorizationDecision>;
+    /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */
+    protected enforceWithExplain(opts: {
+        enforcer: CasbinEnforcerType;
+        vals: string[];
+    }): boolean;
+    invalidateUserCache(opts: {
+        user: IAuthorizationUser;
+    }): Promise<{
+        invalidatedKeys: number;
+    }>;
+    rebuildUserCache(opts: {
+        user: IAuthorizationUser;
+    }): Promise<{
+        cacheKey: string;
+        lineCount: number;
+    }>;
+    /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */
+    protected requireRedisCache(): UserPolicyLineCache;
+    protected registerMatchers(opts: {
+        enforcer: CasbinEnforcerType;
+        casbin: typeof import('casbin');
+    }): Promise<void>;
+    /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */
+    protected resolveDomainMatchingFn(opts: {
+        casbin: typeof import('casbin');
+        name: TCasbinDomainMatchingFunction;
+    }): (arg1: string, arg2: string) => boolean;
+    /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */
+    protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined;
+    protected resolveModel(opts: {
+        casbin: typeof import('casbin');
+        model: ICasbinEnforcerOptions['model'];
+    }): import("casbin").Model;
+    protected validateExpiresIn(opts: {
+        expiresIn: number;
+    }): void;
+    /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */
+    protected extractUserLines(opts: {
+        user: IAuthorizationUser;
+    }): Promise<string[]>;
+    /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */
+    protected loadPolicyLinesIntoModel(opts: {
+        enforcer: CasbinEnforcerType;
+        lines: string[];
+    }): Promise<void>;
+}
+export {};
+//# sourceMappingURL=casbin.enforcer.d.ts.map

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"casbin.enforcer.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAA4B,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAG/B,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EACnC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,mFAAmF;AACnF,KAAK,mBAAmB,CAAC,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,qBAAa,2BAA2B,CACtC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CAEjC,SAAQ,UACR,YAAW,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;IAepE,OAAO,CAAC,OAAO;IAbjB,IAAI,SAAoC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC,OAAO,CAAC,IAAI,CAAuD;IACnE,OAAO,CAAC,MAAM,CAA4C;IAE1D,OAAO,CAAC,mBAAmB,CAAwC;IAGnE,OAAO,CAAC,iBAAiB,CAA+D;gBAI9E,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC;IAO1D,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IA2ChC,OAAO,IAAI,IAAI;IAMf,0MAA0M;IAC1M,SAAS,CAAC,yBAAyB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE;IAiBpE,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;QACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAWnB,QAAQ,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsDnC,yGAAyG;IACzG,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO;IAiBvF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBlC,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBpD,kMAAkM;IAClM,SAAS,CAAC,iBAAiB,IAAI,mBAAmB;cAkBlC,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgEjB,gFAAgF;IAChF,SAAS,CAAC,uBAAuB,CAAC,IAAI,EAAE;QACtC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,IAAI,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO;IA2B3C,gGAAgG;IAChG,SAAS,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS;IAmB1F,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;KACxC;IAkBD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAY9D,gNAAgN;cAChM,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvF,oJAAoJ;cACpI,wBAAwB,CAAC,IAAI,EAAE;QAC7C,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAalB"}

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.js

@@ -0,0 +1,317 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CasbinAuthorizationEnforcer_1;
+import { inject } from '@venizia/ignis-kernel';
+import { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';
+import { AuthorizationDecisions, AuthorizationDomainScopes, AuthorizationEnforcerTypes, AuthorizationPolicyVariants, AuthorizeBindingKeys, CasbinDomainMatchingFunctions, CasbinEnforcerModelDrivers, CasbinRuleVariants, } from '@venizia/ignis-kernel';
+import { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy.js';
+import { CasbinModule } from './casbin-module.js';
+import { MembershipRoleManager } from '../role-managers/membership.js';
+import { ResourceRoleManager } from '../role-managers/resource.js';
+import { PolicyLineCodec } from './policy-line-codec.js';
+import { UserPolicyLineCache } from './user-policy-line-cache.js';
+// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.
+let CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer_1 = class CasbinAuthorizationEnforcer extends BaseHelper {
+    constructor(options) {
+        super({ scope: CasbinAuthorizationEnforcer_1.name });
+        this.options = options;
+        this.name = CasbinAuthorizationEnforcer_1.name;
+        this.MIN_EXPIRES_IN = 10_000;
+        this.pool = null;
+        this.helper = null;
+        // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.
+        this.userPolicyLineCache = null;
+        // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).
+        this.resolvedPayloadFn = null;
+    }
+    // Lifecycle
+    async configure() {
+        const casbin = await CasbinModule.load();
+        if (!this.options.model) {
+            throw getError({
+                message: '[CasbinAuthorizationEnforcer] options.model is required.',
+            });
+        }
+        this.helper = casbin.Helper;
+        this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();
+        const { cached } = this.options;
+        if (cached.use) {
+            this.validateExpiresIn({ expiresIn: cached.options.expiresIn });
+        }
+        this.pool = new BasePoolHelper({
+            scope: `${CasbinAuthorizationEnforcer_1.name}.Pool`,
+            size: this.options.poolSize ?? 16,
+            acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,
+            create: async () => {
+                const model = this.resolveModel({ casbin, model: this.options.model });
+                const enforcer = await casbin.newEnforcer(model);
+                await this.registerMatchers({ enforcer, casbin });
+                this.assertMatcherCompilesSync({ enforcer });
+                return enforcer;
+            },
+        });
+        await this.pool.warmup();
+        this.logger
+            .for(this.configure.name)
+            .info('Casbin enforcer pool ready (size: %s, cached: %s)', this.options.poolSize ?? 16, cached.use ? cached.driver : 'none');
+    }
+    destroy() {
+        this.pool?.destroy().catch((error) => {
+            this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);
+        });
+    }
+    /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */
+    assertMatcherCompilesSync(opts) {
+        try {
+            if (this.options.isScoped || this.options.normalizePayloadFn) {
+                opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');
+                return;
+            }
+            opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');
+        }
+        catch (error) {
+            throw getError({
+                message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,
+            });
+        }
+    }
+    // IAuthorizationEnforcer - public API
+    async buildRules(opts) {
+        const { user } = opts;
+        const cached = this.options.cached;
+        const lines = cached.use
+            ? await this.requireRedisCache().fetch({ user })
+            : await this.extractUserLines({ user });
+        return { user, lines };
+    }
+    async evaluate(opts) {
+        if (!this.pool) {
+            throw getError({
+                message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',
+            });
+        }
+        if (!opts.request?.action || !opts.request?.resource) {
+            throw getError({
+                message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',
+            });
+        }
+        const { rules, request, context } = opts;
+        const { user, lines } = rules;
+        return this.pool.use({
+            execution: async (enforcer) => {
+                await this.loadPolicyLinesIntoModel({ enforcer, lines });
+                const normalizePayloadFn = this.resolvedPayloadFn;
+                if (!normalizePayloadFn) {
+                    const subject = `${user.principalType}_${user.userId}`;
+                    const isAllowed = this.enforceWithExplain({
+                        enforcer,
+                        vals: [subject, String(request.resource), String(request.action)],
+                    });
+                    return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;
+                }
+                const normalized = normalizePayloadFn({
+                    user,
+                    action: request.action,
+                    resource: request.resource,
+                    context,
+                });
+                // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.
+                const domain = normalized.domain ??
+                    request.domain ??
+                    (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);
+                const vals = domain
+                    ? [normalized.subject, domain, normalized.resource, normalized.action]
+                    : [normalized.subject, normalized.resource, normalized.action];
+                const isAllowed = this.enforceWithExplain({ enforcer, vals });
+                return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;
+            },
+        });
+    }
+    /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */
+    enforceWithExplain(opts) {
+        const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);
+        if (!isAllowed) {
+            this.logger
+                .for(this.evaluate.name)
+                .info('DENY | request: [%s] | matchedPolicy: %s', opts.vals.join(', '), matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>');
+        }
+        return isAllowed;
+    }
+    // Cache management - optional IAuthorizationEnforcer members (on-demand)
+    async invalidateUserCache(opts) {
+        const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({
+            user: opts.user,
+        });
+        this.logger
+            .for(this.invalidateUserCache.name)
+            .info('Invalidated authz cache | user: %s | key: %s | deleted: %s', opts.user.userId, cacheKey, invalidatedKeys);
+        return { invalidatedKeys };
+    }
+    async rebuildUserCache(opts) {
+        // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.
+        const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });
+        this.logger
+            .for(this.rebuildUserCache.name)
+            .info('Rebuilt authz cache | user: %s | key: %s | lines: %s', opts.user.userId, cacheKey, lines.length);
+        return { cacheKey, lineCount: lines.length };
+    }
+    /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */
+    requireRedisCache() {
+        const { cached } = this.options;
+        if (!cached.use) {
+            throw getError({
+                message: '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',
+            });
+        }
+        return (this.userPolicyLineCache ??= new UserPolicyLineCache({
+            cached,
+            loadLines: (opts) => this.extractUserLines(opts),
+        }));
+    }
+    // Matchers & model resolvers
+    async registerMatchers(opts) {
+        const { enforcer, casbin } = opts;
+        const { domainMatching, isScoped } = this.options;
+        if (domainMatching) {
+            if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {
+                throw getError({
+                    message: `[registerMatchers] Role definition "${domainMatching.roleDefinition}" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \`g = _, _, _\`) before enabling domainMatching.`,
+                });
+            }
+            const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });
+            await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);
+        }
+        if (isScoped) {
+            await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);
+            await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);
+            // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.
+            enforcer.setNamedRoleManager(AuthorizationPolicyVariants.RESOURCE_INHERITS.rule, new ResourceRoleManager());
+            // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the
+            // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss
+            // per-request g3 edges - g2 needs the same freshness for a just-created child domain.
+            // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is
+            // repopulated from whatever `g3` lines this principal's own policy line set carries.
+            const domainHierarchyOverlay = new Map();
+            // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.
+            enforcer.setNamedRoleManager(CasbinRuleVariants.G2, new MembershipRoleManager({ overlay: domainHierarchyOverlay }));
+            enforcer.setNamedRoleManager(CasbinRuleVariants.G3, new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }));
+            // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs
+            // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.
+            const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G);
+            if (!gRoleManager?.addDomainHierarchy) {
+                throw getError({
+                    message: '[registerMatchers] The "g" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for "g".',
+                });
+            }
+            await gRoleManager.addDomainHierarchy(new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }));
+        }
+        await enforcer.buildRoleLinks();
+    }
+    /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */
+    resolveDomainMatchingFn(opts) {
+        // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.
+        const { Util } = opts.casbin;
+        switch (opts.name) {
+            case CasbinDomainMatchingFunctions.KEY_MATCH: {
+                return Util.keyMatchFunc;
+            }
+            case CasbinDomainMatchingFunctions.KEY_MATCH_2: {
+                return Util.keyMatch2Func;
+            }
+            case CasbinDomainMatchingFunctions.KEY_MATCH_3: {
+                return Util.keyMatch3Func;
+            }
+            case CasbinDomainMatchingFunctions.KEY_MATCH_4: {
+                return Util.keyMatch4Func;
+            }
+            case CasbinDomainMatchingFunctions.REGEX_MATCH: {
+                return Util.regexMatchFunc;
+            }
+            default: {
+                throw getError({
+                    message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,
+                });
+            }
+        }
+    }
+    /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */
+    defaultScopedPayloadFn() {
+        if (!this.options.isScoped) {
+            return undefined;
+        }
+        return (opts) => {
+            // No domain here - evaluate() fills it from request.domain (set by the provider).
+            return {
+                subject: `${opts.user.principalType}_${opts.user.userId}`,
+                resource: String(opts.resource),
+                action: String(opts.action),
+            };
+        };
+    }
+    resolveModel(opts) {
+        const { casbin, model } = opts;
+        switch (model.driver) {
+            case CasbinEnforcerModelDrivers.FILE: {
+                return casbin.newModelFromFile(model.definition);
+            }
+            case CasbinEnforcerModelDrivers.TEXT: {
+                return casbin.newModelFromString(model.definition);
+            }
+            default: {
+                throw getError({
+                    message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,
+                });
+            }
+        }
+    }
+    validateExpiresIn(opts) {
+        if (opts.expiresIn >= this.MIN_EXPIRES_IN) {
+            return;
+        }
+        throw getError({
+            message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,
+        });
+    }
+    // Policy loading internals
+    /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */
+    async extractUserLines(opts) {
+        const casbin = await CasbinModule.load();
+        const model = this.resolveModel({ casbin, model: this.options.model });
+        return PolicyLineCodec.extractUserLines({
+            casbin,
+            model,
+            adapter: this.options.adapter,
+            user: opts.user,
+        });
+    }
+    /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */
+    async loadPolicyLinesIntoModel(opts) {
+        if (!this.helper) {
+            throw getError({
+                message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',
+            });
+        }
+        await PolicyLineCodec.loadLinesIntoModel({
+            enforcer: opts.enforcer,
+            lines: opts.lines,
+            helper: this.helper,
+        });
+    }
+};
+CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer_1 = __decorate([
+    __param(0, inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })),
+    __metadata("design:paramtypes", [Object])
+], CasbinAuthorizationEnforcer);
+export { CasbinAuthorizationEnforcer };
+//# sourceMappingURL=casbin.enforcer.js.map