@venizia/ignis 0.4.3 → 0.4.4

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts

@@ -0,0 +1,93 @@
+import type { IdType } from '../../../../../base/index.js';
+import { type Model } from 'casbin';
+import { type SQL } from 'drizzle-orm';
+import { BaseFilteredAdapter } from '../base-filtered.js';
+import { CustomGrantExpander } from '../custom-grant-expander.js';
+import type { ICasbinPolicySource, IScopedCasbinEntities } from '../common/index.js';
+import { type TPrincipalPolicyRow } from './policy-edges.js';
+import { type IScopedCasbinPolicyFilter, type TGrantRow, type TResolveDomainEdgesFn } from './common/index.js';
+/**
+ * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
+ * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
+ *
+ * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.
+ * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications
+ * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion
+ * filter would sweep those unknown rows into a branch that has no idea what they mean. The current
+ * shape makes an undeclared variant inert, which is what makes sharing the table safe.
+ */
+export declare class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {
+    protected readonly entities: IScopedCasbinEntities;
+    protected readonly customGrantExpander: CustomGrantExpander;
+    protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;
+    constructor(opts: {
+        dataSource: ICasbinPolicySource;
+        entities: IScopedCasbinEntities;
+        resolveDomainEdges?: TResolveDomainEdgesFn;
+    });
+    /**
+     * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -
+     * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot
+     * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does
+     * not wait for the structural-edges query either: both run concurrently once the closure is known.
+     */
+    loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void>;
+    /** Route one `direct` row to its casbin line, or to the grant batch. */
+    protected collectDirectRow(opts: {
+        row: TPrincipalPolicyRow;
+        principal: {
+            type: string;
+            id: IdType;
+        };
+        lines: string[];
+        directGrants: TGrantRow[];
+    }): void;
+    /**
+     * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using
+     * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no
+     * edges - the rows already gathered for this principal still load. This is the safe direction:
+     * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the
+     * failure degrades to less access rather than either an outage or excess access.
+     */
+    protected resolveDomainEdgeLines(opts: {
+        principal: {
+            type: string;
+            id: IdType;
+        };
+        domains: string[];
+    }): Promise<string[]>;
+    /** Schema for a table, defaulting to `public`. */
+    protected schemaOf(table: {
+        schemaName?: string;
+    }): string;
+    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
+    protected domainTokenSelection(opts: {
+        alias: string;
+    }): SQL;
+    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
+    protected qualifiedTable(opts: {
+        table: {
+            schemaName?: string;
+            tableName: string;
+        };
+    }): SQL;
+    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
+    protected softDeleteClause(opts: {
+        alias: string;
+    }): SQL;
+    /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */
+    protected queryPrincipalPolicies(opts: {
+        principal: {
+            type: string;
+            id: IdType;
+        };
+    }): Promise<TPrincipalPolicyRow[]>;
+    /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */
+    protected buildGrantLines(opts: {
+        subjectType: string;
+        rows: TGrantRow[];
+    }): Promise<string[]>;
+    /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
+    protected queryEdgePolicies(): Promise<string[]>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAQ5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB,CAAC,yBAAyB,CAAC;IACrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;gBAElD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,qBAAqB,CAAC;QAChC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;KAC5C;IAUD;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmExF,wEAAwE;IACxE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,EAAE,CAAC;KAC3B,GAAG,IAAI;IAiCR;;;;;;OAMG;cACa,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BrB,kDAAkD;IAClD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAI1D,4SAA4S;IAC5S,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IAY5D,uGAAuG;IACvG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,GAAG;IAK1F,4LAA4L;IAC5L,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IASxD,iOAAiO;cACjN,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA8IlC,iGAAiG;cACjF,eAAe,CAAC,IAAI,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4FrB,2OAA2O;cAC3N,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CA6BvD"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.js

@@ -0,0 +1,389 @@
+import { sql } from 'drizzle-orm';
+import { GrantBuilder } from '@venizia/ignis-kernel';
+import { AuthorizationActions, AuthorizationDecisions, AuthorizationDomainScopes, AuthorizationPolicyVariants, } from '@venizia/ignis-kernel';
+import { BaseFilteredAdapter } from '../base-filtered.js';
+import { CustomGrantExpander } from '../custom-grant-expander.js';
+import { PrincipalPolicyEdges } from './policy-edges.js';
+import { DEFAULT_SCHEMA, } from './common/index.js';
+/**
+ * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
+ * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
+ *
+ * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.
+ * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications
+ * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion
+ * filter would sweep those unknown rows into a branch that has no idea what they mean. The current
+ * shape makes an undeclared variant inert, which is what makes sharing the table safe.
+ */
+export class ScopedCasbinAdapter extends BaseFilteredAdapter {
+    constructor(opts) {
+        super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });
+        this.entities = opts.entities;
+        this.resolveDomainEdges = opts.resolveDomainEdges;
+        this.customGrantExpander = new CustomGrantExpander({
+            dataSource: opts.dataSource,
+            entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },
+        });
+    }
+    /**
+     * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -
+     * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot
+     * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does
+     * not wait for the structural-edges query either: both run concurrently once the closure is known.
+     */
+    async loadFilteredPolicy(model, filter) {
+        const { principal } = filter;
+        const { principals } = this.entities;
+        const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });
+        const structuralEdgesPromise = this.queryEdgePolicies();
+        const principalRows = await principalPoliciesPromise;
+        const lines = [];
+        const directGrants = [];
+        const roleGrants = [];
+        const domainClosure = new Set();
+        for (const row of principalRows) {
+            switch (row.kind) {
+                case PrincipalPolicyEdges.ROLE_EDGE: {
+                    lines.push(`${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`);
+                    break;
+                }
+                case PrincipalPolicyEdges.ROLE_GRANT: {
+                    roleGrants.push(row);
+                    break;
+                }
+                case PrincipalPolicyEdges.DOMAIN_EDGE: {
+                    lines.push(`${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`);
+                    // Both ends are, by construction, members of the principal's domain_closure CTE.
+                    domainClosure.add(String(row.subjectId));
+                    domainClosure.add(String(row.targetId));
+                    break;
+                }
+                default: {
+                    if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {
+                        domainClosure.add(`${row.targetType}_${row.targetId}`);
+                    }
+                    this.collectDirectRow({ row, principal, lines, directGrants });
+                    break;
+                }
+            }
+        }
+        const hookLinesPromise = this.resolveDomainEdgeLines({
+            principal,
+            domains: [...domainClosure],
+        });
+        lines.push(...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })));
+        lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));
+        const [structuralEdges, hookLines] = await Promise.all([
+            structuralEdgesPromise,
+            hookLinesPromise,
+        ]);
+        lines.push(...structuralEdges);
+        lines.push(...hookLines);
+        await this.loadLines({ model, lines });
+    }
+    /** Route one `direct` row to its casbin line, or to the grant batch. */
+    collectDirectRow(opts) {
+        const { row, principal, lines, directGrants } = opts;
+        const { principals } = this.entities;
+        switch (row.variant) {
+            case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {
+                lines.push(`${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`);
+                break;
+            }
+            case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {
+                lines.push(`${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`);
+                break;
+            }
+            case AuthorizationPolicyVariants.GRANT.action: {
+                directGrants.push(row);
+                break;
+            }
+            default: {
+                this.logger
+                    .for(this.collectDirectRow.name)
+                    .error('Unexpected variant in the direct branch | variant: %s', row.variant);
+                break;
+            }
+        }
+    }
+    /**
+     * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using
+     * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no
+     * edges - the rows already gathered for this principal still load. This is the safe direction:
+     * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the
+     * failure degrades to less access rather than either an outage or excess access.
+     */
+    async resolveDomainEdgeLines(opts) {
+        if (!this.resolveDomainEdges) {
+            return [];
+        }
+        let edges;
+        try {
+            edges = await this.resolveDomainEdges(opts);
+        }
+        catch (error) {
+            this.logger
+                .for(this.resolveDomainEdgeLines.name)
+                .error('resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s', opts.principal.type, opts.principal.id, error);
+            return [];
+        }
+        return edges.map((edge) => `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`);
+    }
+    /** Schema for a table, defaulting to `public`. */
+    schemaOf(table) {
+        return table.schemaName ?? DEFAULT_SCHEMA;
+    }
+    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
+    domainTokenSelection(opts) {
+        const column = (name) => sql `${sql.raw(opts.alias)}.${sql.identifier(name)}`;
+        const domainType = column('domain_type');
+        const domainId = column('domain_id');
+        return sql `CASE
+      WHEN ${domainType} IS NULL THEN NULL
+      WHEN ${domainId} IS NULL THEN ${domainType}
+      ELSE ${domainType} || '_' || ${domainId}::text
+    END AS "domain"`;
+    }
+    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
+    qualifiedTable(opts) {
+        const { table } = opts;
+        return sql `${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;
+    }
+    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
+    softDeleteClause(opts) {
+        const sd = this.entities.softDelete;
+        if (!sd?.use) {
+            return sql.empty();
+        }
+        return sql ` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;
+    }
+    /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */
+    async queryPrincipalPolicies(opts) {
+        const { policyDefinition, permission, principals, domainTypes } = this.entities;
+        const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });
+        const permissionTable = this.qualifiedTable({ table: permission });
+        const { principal } = opts;
+        const metadataColumnName = policyDefinition.metadata?.columnName;
+        const metadataSelection = metadataColumnName
+            ? sql `, policyDefinition.${sql.identifier(metadataColumnName)} AS "metadata"`
+            : sql.empty();
+        const metadataNull = metadataColumnName ? sql `, NULL::jsonb AS "metadata"` : sql.empty();
+        const domainTypeList = sql.join(domainTypes.map((domainType) => sql `${domainType}`), sql `, `);
+        const rows = await this.query({
+            statement: sql `
+      WITH RECURSIVE role_closure AS (
+        SELECT policyDefinition.target_id AS role_id
+        FROM ${policyDefinitionTable} policyDefinition
+        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}
+          AND policyDefinition.subject_type = ${principal.type}
+          AND policyDefinition.subject_id = ${principal.id}
+          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+        UNION
+
+        SELECT policyDefinition.target_id
+        FROM ${policyDefinitionTable} policyDefinition
+          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
+        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+      ),
+
+      domain_closure AS (
+        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id
+        FROM ${policyDefinitionTable} policyDefinition
+        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}
+          AND policyDefinition.subject_type = ${principal.type}
+          AND policyDefinition.subject_id = ${principal.id}
+          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+        UNION
+
+        SELECT policyDefinition.target_type, policyDefinition.target_id
+        FROM ${policyDefinitionTable} policyDefinition
+          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type
+                             AND policyDefinition.subject_id = domain_closure.dom_id
+        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+      )
+
+      SELECT
+        ${PrincipalPolicyEdges.DIRECT}::text AS "kind",
+        policyDefinition.variant,
+        policyDefinition.subject_id::text AS "subjectId",
+        policyDefinition.target_type AS "targetType",
+        policyDefinition.target_id::text AS "targetId",
+        policyDefinition.action,
+        policyDefinition.effect,
+        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
+        permission.code AS "objectCode",
+        permission.subject AS "objectSubject",
+        permission.method AS "objectMethod"${metadataSelection}
+      FROM ${policyDefinitionTable} policyDefinition
+        LEFT JOIN ${permissionTable} permission
+          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}
+      WHERE policyDefinition.subject_type = ${principal.type}
+        AND policyDefinition.subject_id = ${principal.id}
+        AND policyDefinition.variant IN (
+          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},
+          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},
+          ${AuthorizationPolicyVariants.GRANT.action}
+        )
+        AND (
+          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}
+          OR policyDefinition.target_type IN (${domainTypeList})
+        )${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+      UNION ALL
+
+      SELECT
+        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS "kind",
+        policyDefinition.variant,
+        policyDefinition.subject_id::text AS "subjectId",
+        policyDefinition.target_type AS "targetType",
+        policyDefinition.target_id::text AS "targetId",
+        NULL AS "action",
+        NULL AS "effect",
+        NULL AS "domain",
+        NULL AS "objectCode",
+        NULL AS "objectSubject",
+        NULL AS "objectMethod"${metadataNull}
+      FROM ${policyDefinitionTable} policyDefinition
+        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
+      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+      UNION ALL
+
+      SELECT
+        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS "kind",
+        policyDefinition.variant,
+        policyDefinition.subject_id::text AS "subjectId",
+        policyDefinition.target_type AS "targetType",
+        policyDefinition.target_id::text AS "targetId",
+        policyDefinition.action,
+        policyDefinition.effect,
+        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
+        permission.code AS "objectCode",
+        permission.subject AS "objectSubject",
+        permission.method AS "objectMethod"${metadataSelection}
+      FROM ${policyDefinitionTable} policyDefinition
+        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
+        LEFT JOIN ${permissionTable} permission
+          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}
+      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}
+        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+      UNION ALL
+
+      SELECT
+        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS "kind",
+        policyDefinition.variant,
+        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS "subjectId",
+        NULL AS "targetType",
+        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS "targetId",
+        NULL AS "action",
+        NULL AS "effect",
+        NULL AS "domain",
+        NULL AS "objectCode",
+        NULL AS "objectSubject",
+        NULL AS "objectMethod"${metadataNull}
+      FROM ${policyDefinitionTable} policyDefinition
+        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type
+                           AND policyDefinition.subject_id = domain_closure.dom_id
+      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+    `,
+        });
+        return rows;
+    }
+    /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */
+    async buildGrantLines(opts) {
+        const { subjectType, rows } = opts;
+        const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;
+        const lines = [];
+        const customRows = [];
+        for (const row of rows) {
+            if (!row.objectCode) {
+                this.logger
+                    .for(this.buildGrantLines.name)
+                    .error('Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s', subjectType, row.subjectId);
+                continue;
+            }
+            const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;
+            const effect = row.effect ?? AuthorizationDecisions.ALLOW;
+            const parsed = metadataColumnName
+                ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })
+                : null;
+            const isCustomAction = row.action === AuthorizationActions.CUSTOM;
+            const isCustomRow = isCustomAction || Boolean(parsed);
+            if (!isCustomRow && !row.action) {
+                this.logger
+                    .for(this.buildGrantLines.name)
+                    .error('Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s', subjectType, row.subjectId, row.objectCode);
+                continue;
+            }
+            if (!isCustomRow) {
+                lines.push(`${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`);
+                continue;
+            }
+            if (!row.objectSubject || !row.objectMethod) {
+                this.logger
+                    .for(this.buildGrantLines.name)
+                    .error('Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s', subjectType, row.subjectId, row.objectCode);
+                continue;
+            }
+            const rejection = this.customGrantExpander.rejectCustomRow({
+                row: {
+                    subjectId: row.subjectId,
+                    objectCode: row.objectCode,
+                    objectMethod: row.objectMethod,
+                },
+                parsed,
+                isCustomAction,
+                metadataColumnName,
+            });
+            if (rejection) {
+                this.logger.for(this.buildGrantLines.name).error(rejection);
+                continue;
+            }
+            customRows.push({
+                subjectId: row.subjectId,
+                objectSubject: row.objectSubject,
+                ops: parsed.ops,
+                domain,
+                effect,
+            });
+        }
+        const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });
+        for (const rejection of expanded.rejections) {
+            this.logger.for(this.buildGrantLines.name).error(rejection);
+        }
+        lines.push(...expanded.lines);
+        return lines;
+    }
+    /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
+    async queryEdgePolicies() {
+        const { policyDefinition, permission } = this.entities;
+        const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });
+        const permissionTable = this.qualifiedTable({ table: permission });
+        const rows = await this.query({
+            statement: sql `
+      SELECT
+        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS "rel",
+        child_permission.code AS "child",
+        parent_permission.code AS "parent"
+      FROM ${policyDefinitionTable} policyDefinition
+        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id
+        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id
+      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+
+      UNION ALL
+
+      SELECT
+        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS "rel",
+        policyDefinition.subject_id::text AS "child",
+        policyDefinition.target_id::text AS "parent"
+      FROM ${policyDefinitionTable} policyDefinition
+      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
+    `,
+        });
+        return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAA4B,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,cAAc,GAKf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,mBAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,GAAG,CAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,GAAG,CAAA,sBAAsB,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAA,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,UAAU,EAAE,CAAC,EACnD,GAAG,CAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,GAAG,CAAA;;;eAGL,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,oBAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,oBAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,oBAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,2BAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,oBAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,GAAG,CAAA;;UAEV,2BAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,2BAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,2BAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { type Model } from 'casbin';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { GrantBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '@venizia/ignis-kernel';\nimport { BaseFilteredAdapter } from '../base-filtered';\nimport { CustomGrantExpander, type TCustomGrantRow } from '../custom-grant-expander';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';\nimport { PrincipalPolicyEdges, type TPrincipalPolicyRow } from './policy-edges';\nimport {\n  DEFAULT_SCHEMA,\n  type IScopedCasbinPolicyFilter,\n  type TDomainHierarchyEdge,\n  type TGrantRow,\n  type TResolveDomainEdgesFn,\n} from './common';\n\n/**\n * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,\n * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.\n *\n * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.\n * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications\n * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion\n * filter would sweep those unknown rows into a branch that has no idea what they mean. The current\n * shape makes an undeclared variant inert, which is what makes sharing the table safe.\n */\nexport class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {\n  protected readonly entities: IScopedCasbinEntities;\n  protected readonly customGrantExpander: CustomGrantExpander;\n  protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: IScopedCasbinEntities;\n    resolveDomainEdges?: TResolveDomainEdgesFn;\n  }) {\n    super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });\n    this.entities = opts.entities;\n    this.resolveDomainEdges = opts.resolveDomainEdges;\n    this.customGrantExpander = new CustomGrantExpander({\n      dataSource: opts.dataSource,\n      entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },\n    });\n  }\n\n  /**\n   * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -\n   * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot\n   * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does\n   * not wait for the structural-edges query either: both run concurrently once the closure is known.\n   */\n  async loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void> {\n    const { principal } = filter;\n    const { principals } = this.entities;\n\n    const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });\n    const structuralEdgesPromise = this.queryEdgePolicies();\n    const principalRows = await principalPoliciesPromise;\n\n    const lines: string[] = [];\n    const directGrants: TGrantRow[] = [];\n    const roleGrants: TGrantRow[] = [];\n    const domainClosure = new Set<string>();\n\n    for (const row of principalRows) {\n      switch (row.kind) {\n        case PrincipalPolicyEdges.ROLE_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`,\n          );\n          break;\n        }\n\n        case PrincipalPolicyEdges.ROLE_GRANT: {\n          roleGrants.push(row);\n          break;\n        }\n\n        case PrincipalPolicyEdges.DOMAIN_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`,\n          );\n          // Both ends are, by construction, members of the principal's domain_closure CTE.\n          domainClosure.add(String(row.subjectId));\n          domainClosure.add(String(row.targetId));\n          break;\n        }\n\n        default: {\n          if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {\n            domainClosure.add(`${row.targetType}_${row.targetId}`);\n          }\n          this.collectDirectRow({ row, principal, lines, directGrants });\n          break;\n        }\n      }\n    }\n\n    const hookLinesPromise = this.resolveDomainEdgeLines({\n      principal,\n      domains: [...domainClosure],\n    });\n\n    lines.push(\n      ...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })),\n    );\n    lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));\n\n    const [structuralEdges, hookLines] = await Promise.all([\n      structuralEdgesPromise,\n      hookLinesPromise,\n    ]);\n    lines.push(...structuralEdges);\n    lines.push(...hookLines);\n\n    await this.loadLines({ model, lines });\n  }\n\n  /** Route one `direct` row to its casbin line, or to the grant batch. */\n  protected collectDirectRow(opts: {\n    row: TPrincipalPolicyRow;\n    principal: { type: string; id: IdType };\n    lines: string[];\n    directGrants: TGrantRow[];\n  }): void {\n    const { row, principal, lines, directGrants } = opts;\n    const { principals } = this.entities;\n\n    switch (row.variant) {\n      case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.GRANT.action: {\n        directGrants.push(row);\n        break;\n      }\n\n      default: {\n        this.logger\n          .for(this.collectDirectRow.name)\n          .error('Unexpected variant in the direct branch | variant: %s', row.variant);\n        break;\n      }\n    }\n  }\n\n  /**\n   * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using\n   * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no\n   * edges - the rows already gathered for this principal still load. This is the safe direction:\n   * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the\n   * failure degrades to less access rather than either an outage or excess access.\n   */\n  protected async resolveDomainEdgeLines(opts: {\n    principal: { type: string; id: IdType };\n    domains: string[];\n  }): Promise<string[]> {\n    if (!this.resolveDomainEdges) {\n      return [];\n    }\n\n    let edges: TDomainHierarchyEdge[];\n    try {\n      edges = await this.resolveDomainEdges(opts);\n    } catch (error) {\n      this.logger\n        .for(this.resolveDomainEdgeLines.name)\n        .error(\n          'resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s',\n          opts.principal.type,\n          opts.principal.id,\n          error,\n        );\n      return [];\n    }\n\n    return edges.map(\n      (edge) =>\n        `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`,\n    );\n  }\n\n  /** Schema for a table, defaulting to `public`. */\n  protected schemaOf(table: { schemaName?: string }): string {\n    return table.schemaName ?? DEFAULT_SCHEMA;\n  }\n\n  /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */\n  protected domainTokenSelection(opts: { alias: string }): SQL {\n    const column = (name: string) => sql`${sql.raw(opts.alias)}.${sql.identifier(name)}`;\n    const domainType = column('domain_type');\n    const domainId = column('domain_id');\n\n    return sql`CASE\n      WHEN ${domainType} IS NULL THEN NULL\n      WHEN ${domainId} IS NULL THEN ${domainType}\n      ELSE ${domainType} || '_' || ${domainId}::text\n    END AS \"domain\"`;\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  protected qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    return sql`${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  protected softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.entities.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */\n  protected async queryPrincipalPolicies(opts: {\n    principal: { type: string; id: IdType };\n  }): Promise<TPrincipalPolicyRow[]> {\n    const { policyDefinition, permission, principals, domainTypes } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n    const { principal } = opts;\n\n    const metadataColumnName = policyDefinition.metadata?.columnName;\n    const metadataSelection = metadataColumnName\n      ? sql`, policyDefinition.${sql.identifier(metadataColumnName)} AS \"metadata\"`\n      : sql.empty();\n    const metadataNull = metadataColumnName ? sql`, NULL::jsonb AS \"metadata\"` : sql.empty();\n\n    const domainTypeList = sql.join(\n      domainTypes.map((domainType) => sql`${domainType}`),\n      sql`, `,\n    );\n\n    const rows = await this.query<TPrincipalPolicyRow>({\n      statement: sql`\n      WITH RECURSIVE role_closure AS (\n        SELECT policyDefinition.target_id AS role_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      ),\n\n      domain_closure AS (\n        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_type, policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                             AND policyDefinition.subject_id = domain_closure.dom_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      )\n\n      SELECT\n        ${PrincipalPolicyEdges.DIRECT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.subject_type = ${principal.type}\n        AND policyDefinition.subject_id = ${principal.id}\n        AND policyDefinition.variant IN (\n          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},\n          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},\n          ${AuthorizationPolicyVariants.GRANT.action}\n        )\n        AND (\n          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          OR policyDefinition.target_type IN (${domainTypeList})\n        )${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}\n        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS \"subjectId\",\n        NULL AS \"targetType\",\n        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                           AND policyDefinition.subject_id = domain_closure.dom_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows;\n  }\n\n  /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */\n  protected async buildGrantLines(opts: {\n    subjectType: string;\n    rows: TGrantRow[];\n  }): Promise<string[]> {\n    const { subjectType, rows } = opts;\n    const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;\n\n    const lines: string[] = [];\n    const customRows: TCustomGrantRow[] = [];\n\n    for (const row of rows) {\n      if (!row.objectCode) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s',\n            subjectType,\n            row.subjectId,\n          );\n        continue;\n      }\n\n      const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;\n      const effect = row.effect ?? AuthorizationDecisions.ALLOW;\n      const parsed = metadataColumnName\n        ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })\n        : null;\n      const isCustomAction = row.action === AuthorizationActions.CUSTOM;\n      const isCustomRow = isCustomAction || Boolean(parsed);\n\n      if (!isCustomRow && !row.action) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      if (!isCustomRow) {\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`,\n        );\n        continue;\n      }\n\n      if (!row.objectSubject || !row.objectMethod) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      const rejection = this.customGrantExpander.rejectCustomRow({\n        row: {\n          subjectId: row.subjectId,\n          objectCode: row.objectCode,\n          objectMethod: row.objectMethod,\n        },\n        parsed,\n        isCustomAction,\n        metadataColumnName,\n      });\n\n      if (rejection) {\n        this.logger.for(this.buildGrantLines.name).error(rejection);\n        continue;\n      }\n\n      customRows.push({\n        subjectId: row.subjectId,\n        objectSubject: row.objectSubject,\n        ops: parsed!.ops,\n        domain,\n        effect,\n      });\n    }\n\n    const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });\n    for (const rejection of expanded.rejections) {\n      this.logger.for(this.buildGrantLines.name).error(rejection);\n    }\n    lines.push(...expanded.lines);\n\n    return lines;\n  }\n\n  /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */\n  protected async queryEdgePolicies(): Promise<string[]> {\n    const { policyDefinition, permission } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n\n    const rows = await this.query<{ rel: string; child: string; parent: string }>({\n      statement: sql`\n      SELECT\n        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS \"rel\",\n        child_permission.code AS \"child\",\n        parent_permission.code AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id\n        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS \"rel\",\n        policyDefinition.subject_id::text AS \"child\",\n        policyDefinition.target_id::text AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,WAAW,CAAC"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/constants.js

@@ -0,0 +1,2 @@
+export const DEFAULT_SCHEMA = 'public';
+//# sourceMappingURL=constants.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC","sourcesContent":["export const DEFAULT_SCHEMA = 'public';\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.js';
+export * from './constants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/index.js

@@ -0,0 +1,3 @@
+export * from './types.js';
+export * from './constants.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC","sourcesContent":["export * from './types';\nexport * from './constants';\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts

@@ -0,0 +1,50 @@
+import type { IdType } from '../../../../../../base/index.js';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+export type TDomainHierarchyEdge = {
+    child: string;
+    parent: string;
+};
+export interface IScopedCasbinPolicyFilter {
+    principal: {
+        type: string;
+        id: IdType;
+    };
+}
+/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */
+export type TGrantRow = {
+    subjectId: IdType;
+    objectCode: TNullable<string>;
+    objectSubject: TNullable<string>;
+    objectMethod: TNullable<string>;
+    action: TNullable<string>;
+    effect: TNullable<string>;
+    domain: TNullable<string>;
+    metadata?: unknown;
+};
+/**
+ * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant
+ * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app
+ * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the
+ * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own
+ * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side
+ * re-formats them.
+ *
+ * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both
+ * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via
+ * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported
+ * from a mechanism that derived its domains from `assign_role` will silently lose access for
+ * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.
+ *
+ * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one
+ * function per axis and concatenate their results here - this hook deliberately takes a single
+ * function, so composition stays visible in the application, not hidden inside the framework:
+ * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.
+ */
+export type TResolveDomainEdgesFn = (opts: {
+    principal: {
+        type: string;
+        id: IdType;
+    };
+    domains: string[];
+}) => Promise<TDomainHierarchyEdge[]>;
+//# sourceMappingURL=types.d.ts.map