@venizia/ignis 0.4.2 → 0.4.4

package/dist/components/auth/authorize/adapters/custom-grant-expander.js

@@ -1,111 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomGrantExpander = void 0;
-const utilities_1 = require("../../../../utilities");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const drizzle_orm_1 = require("drizzle-orm");
-const connector_1 = require("./connector");
-const DEFAULT_SCHEMA = 'public';
-/**
- * Expands "custom" operation-subset grants (`metadata.ops`) into one casbin line per catalogued
- * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL
- * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.
- */
-class CustomGrantExpander extends core_1.BaseHelper {
-    constructor(opts) {
-        super({ scope: CustomGrantExpander.name });
-        this.dataSource = opts.dataSource;
-        this.permission = opts.entities.permission;
-        this.softDelete = opts.entities.softDelete;
-    }
-    /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */
-    rejectCustomRow(opts) {
-        const { row, parsed, isCustomAction, metadataColumnName } = opts;
-        if (isCustomAction && !metadataColumnName) {
-            return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;
-        }
-        if (isCustomAction && !parsed) {
-            return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;
-        }
-        if (!isCustomAction && parsed) {
-            return `Skipping grant - metadata.ops is present but action is not "${ignis_kernel_1.AuthorizationActions.CUSTOM}", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;
-        }
-        if (row.objectMethod !== ignis_kernel_1.AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {
-            return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;
-        }
-        return null;
-    }
-    /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */
-    async expandCustomGrants(opts) {
-        if (!opts.customRows.length) {
-            return { lines: [], rejections: [] };
-        }
-        const seen = new Set();
-        const pairs = [];
-        const candidates = opts.customRows.flatMap((row) => row.ops.map((op) => ({ subject: row.objectSubject, method: op })));
-        for (const candidate of candidates) {
-            const key = `${candidate.subject}.${candidate.method}`;
-            if (seen.has(key)) {
-                continue;
-            }
-            seen.add(key);
-            pairs.push(candidate);
-        }
-        const catalog = await this.queryOperationCatalog({ pairs });
-        const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));
-        const lines = [];
-        const rejections = [];
-        for (const row of opts.customRows) {
-            const { valid, unknown } = ignis_kernel_1.GrantBuilder.getInstance().validateCustomGrantOps({
-                ops: row.ops,
-                subject: row.objectSubject,
-                catalog,
-            });
-            if (unknown.length) {
-                rejections.push(`Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`);
-            }
-            for (const op of valid) {
-                const entry = byKey.get(`${row.objectSubject}.${op}`);
-                lines.push(`${ignis_kernel_1.AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`);
-            }
-        }
-        return { lines, rejections };
-    }
-    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
-    qualifiedTable(opts) {
-        const { table } = opts;
-        const schema = table.schemaName ?? DEFAULT_SCHEMA;
-        return (0, drizzle_orm_1.sql) `${drizzle_orm_1.sql.identifier(schema)}.${drizzle_orm_1.sql.identifier(table.tableName)}`;
-    }
-    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
-    softDeleteClause(opts) {
-        const sd = this.softDelete;
-        if (!sd?.use) {
-            return drizzle_orm_1.sql.empty();
-        }
-        return (0, drizzle_orm_1.sql) ` AND ${drizzle_orm_1.sql.raw(opts.alias)}.${drizzle_orm_1.sql.identifier(sd.columnName)} IS NULL`;
-    }
-    /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */
-    async queryOperationCatalog(opts) {
-        if (!opts.pairs.length) {
-            return [];
-        }
-        const permissionTable = this.qualifiedTable({ table: this.permission });
-        const connector = connector_1.PolicyConnectorResolver.resolve({
-            source: this.dataSource,
-            caller: CustomGrantExpander.name,
-        });
-        const result = await connector.execute((0, drizzle_orm_1.sql) `
-      SELECT permission.subject, permission.method, permission.code, permission.action
-      FROM ${permissionTable} permission
-      WHERE (permission.subject, permission.method) IN (${drizzle_orm_1.sql.join(opts.pairs.map((pair) => (0, drizzle_orm_1.sql) `(${pair.subject}, ${pair.method})`), (0, drizzle_orm_1.sql) `, `)})
-        AND permission.method <> ${ignis_kernel_1.AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause({ alias: 'permission' })}
-    `);
-        return (0, utilities_1.readResultRows)({
-            result,
-        });
-    }
-}
-exports.CustomGrantExpander = CustomGrantExpander;
-//# sourceMappingURL=custom-grant-expander.js.map

package/dist/components/auth/authorize/adapters/custom-grant-expander.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":";;;AACA,2CAA6C;AAC7C,sDAAyD;AACzD,wDAM+B;AAC/B,6CAA4C;AAC5C,2CAAsD;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,mCAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,6CAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,2BAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,mCAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;aAEjC,eAAe;0DAC8B,iBAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAChE,IAAA,iBAAG,EAAA,IAAI,CACR;mCAC4B,6CAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,IAAA,0BAAc,EAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAlJD,kDAkJC","sourcesContent":["import type { IdType } from '@/base';\nimport { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationActions,\n  AuthorizationPermissionBuilder,\n  AuthorizationPolicyVariants,\n  GrantBuilder,\n  type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */\nexport type TCustomGrantRow = {\n  subjectId: IdType;\n  objectSubject: string;\n  ops: string[];\n  domain: string;\n  effect: string;\n};\n\n/**\n * Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n */\nexport class CustomGrantExpander extends BaseHelper {\n  protected readonly dataSource: ICasbinPolicySource;\n  protected readonly permission: IScopedCasbinEntities['permission'];\n  protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;\n  }) {\n    super({ scope: CustomGrantExpander.name });\n    this.dataSource = opts.dataSource;\n    this.permission = opts.entities.permission;\n    this.softDelete = opts.entities.softDelete;\n  }\n\n  /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */\n  rejectCustomRow(opts: {\n    row: { subjectId: IdType; objectCode: string; objectMethod: string };\n    parsed: TCustomGrantMetadata | null;\n    isCustomAction: boolean;\n    metadataColumnName?: string;\n  }): string | null {\n    const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n    if (isCustomAction && !metadataColumnName) {\n      return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (isCustomAction && !parsed) {\n      return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (!isCustomAction && parsed) {\n      return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n      return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    return null;\n  }\n\n  /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */\n  async expandCustomGrants(opts: {\n    subjectType: string;\n    customRows: TCustomGrantRow[];\n  }): Promise<{ lines: string[]; rejections: string[] }> {\n    if (!opts.customRows.length) {\n      return { lines: [], rejections: [] };\n    }\n\n    const seen = new Set<string>();\n    const pairs: Array<{ subject: string; method: string }> = [];\n\n    const candidates = opts.customRows.flatMap((row) =>\n      row.ops.map((op) => ({ subject: row.objectSubject, method: op })),\n    );\n\n    for (const candidate of candidates) {\n      const key = `${candidate.subject}.${candidate.method}`;\n      if (seen.has(key)) {\n        continue;\n      }\n\n      seen.add(key);\n      pairs.push(candidate);\n    }\n\n    const catalog = await this.queryOperationCatalog({ pairs });\n    const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));\n    const lines: string[] = [];\n    const rejections: string[] = [];\n\n    for (const row of opts.customRows) {\n      const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n        ops: row.ops,\n        subject: row.objectSubject,\n        catalog,\n      });\n\n      if (unknown.length) {\n        rejections.push(\n          `Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`,\n        );\n      }\n\n      for (const op of valid) {\n        const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n        );\n      }\n    }\n\n    return { lines, rejections };\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    const schema = table.schemaName ?? DEFAULT_SCHEMA;\n    return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  private softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n  private async queryOperationCatalog(opts: {\n    pairs: Array<{ subject: string; method: string }>;\n  }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n    if (!opts.pairs.length) {\n      return [];\n    }\n\n    const permissionTable = this.qualifiedTable({ table: this.permission });\n    const connector = PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: CustomGrantExpander.name,\n    });\n\n    const result = await connector.execute(sql`\n      SELECT permission.subject, permission.method, permission.code, permission.action\n      FROM ${permissionTable} permission\n      WHERE (permission.subject, permission.method) IN (${sql.join(\n        opts.pairs.map((pair) => sql`(${pair.subject}, ${pair.method})`),\n        sql`, `,\n      )})\n        AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n          { alias: 'permission' },\n        )}\n    `);\n\n    return readResultRows<{ subject: string; method: string; code: string; action: string }>({\n      result,\n    });\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/index.d.ts

@@ -1,6 +0,0 @@
-export * from './base-filtered';
-export * from './common';
-export * from './connector';
-export * from './custom-grant-expander';
-export * from './scoped-casbin';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authorize/adapters/index.js

@@ -1,22 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./base-filtered"), exports);
-__exportStar(require("./common"), exports);
-__exportStar(require("./connector"), exports);
-__exportStar(require("./custom-grant-expander"), exports);
-__exportStar(require("./scoped-casbin"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,2CAAyB;AACzB,8CAA4B;AAC5B,0DAAwC;AACxC,kDAAgC","sourcesContent":["export * from './base-filtered';\nexport * from './common';\nexport * from './connector';\nexport * from './custom-grant-expander';\nexport * from './scoped-casbin';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts

@@ -1,93 +0,0 @@
-import type { IdType } from '../../../../../base';
-import { type Model } from 'casbin';
-import { type SQL } from 'drizzle-orm';
-import { BaseFilteredAdapter } from '../base-filtered';
-import { CustomGrantExpander } from '../custom-grant-expander';
-import type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';
-import { type TPrincipalPolicyRow } from './policy-edges';
-import { type IScopedCasbinPolicyFilter, type TGrantRow, type TResolveDomainEdgesFn } from './common';
-/**
- * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
- * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
- *
- * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.
- * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications
- * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion
- * filter would sweep those unknown rows into a branch that has no idea what they mean. The current
- * shape makes an undeclared variant inert, which is what makes sharing the table safe.
- */
-export declare class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {
-    protected readonly entities: IScopedCasbinEntities;
-    protected readonly customGrantExpander: CustomGrantExpander;
-    protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;
-    constructor(opts: {
-        dataSource: ICasbinPolicySource;
-        entities: IScopedCasbinEntities;
-        resolveDomainEdges?: TResolveDomainEdgesFn;
-    });
-    /**
-     * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -
-     * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot
-     * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does
-     * not wait for the structural-edges query either: both run concurrently once the closure is known.
-     */
-    loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void>;
-    /** Route one `direct` row to its casbin line, or to the grant batch. */
-    protected collectDirectRow(opts: {
-        row: TPrincipalPolicyRow;
-        principal: {
-            type: string;
-            id: IdType;
-        };
-        lines: string[];
-        directGrants: TGrantRow[];
-    }): void;
-    /**
-     * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using
-     * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no
-     * edges - the rows already gathered for this principal still load. This is the safe direction:
-     * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the
-     * failure degrades to less access rather than either an outage or excess access.
-     */
-    protected resolveDomainEdgeLines(opts: {
-        principal: {
-            type: string;
-            id: IdType;
-        };
-        domains: string[];
-    }): Promise<string[]>;
-    /** Schema for a table, defaulting to `public`. */
-    protected schemaOf(table: {
-        schemaName?: string;
-    }): string;
-    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
-    protected domainTokenSelection(opts: {
-        alias: string;
-    }): SQL;
-    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
-    protected qualifiedTable(opts: {
-        table: {
-            schemaName?: string;
-            tableName: string;
-        };
-    }): SQL;
-    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
-    protected softDeleteClause(opts: {
-        alias: string;
-    }): SQL;
-    /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */
-    protected queryPrincipalPolicies(opts: {
-        principal: {
-            type: string;
-            id: IdType;
-        };
-    }): Promise<TPrincipalPolicyRow[]>;
-    /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */
-    protected buildGrantLines(opts: {
-        subjectType: string;
-        rows: TGrantRow[];
-    }): Promise<string[]>;
-    /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
-    protected queryEdgePolicies(): Promise<string[]>;
-}
-//# sourceMappingURL=adapter.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAQ5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB,CAAC,yBAAyB,CAAC;IACrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;gBAElD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,qBAAqB,CAAC;QAChC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;KAC5C;IAUD;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmExF,wEAAwE;IACxE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,EAAE,CAAC;KAC3B,GAAG,IAAI;IAiCR;;;;;;OAMG;cACa,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BrB,kDAAkD;IAClD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAI1D,4SAA4S;IAC5S,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IAY5D,uGAAuG;IACvG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,GAAG;IAK1F,4LAA4L;IAC5L,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IASxD,iOAAiO;cACjN,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA8IlC,iGAAiG;cACjF,eAAe,CAAC,IAAI,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4FrB,2OAA2O;cAC3N,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CA6BvD"}