npm - @venizia/ignis - Versions diffs - 0.4.3 → 0.4.4 - Mend

@venizia/ignis 0.4.3 → 0.4.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1612) hide show

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAQnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GAQnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,UAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,mBAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,8BAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,2BAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,mBAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,QAAQ,CAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,kDAAkD,0BAA0B,CAAC,IAAI,KAAK,0BAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,eAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtaY,2BAA2B;IAoBnC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CAsavC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport type {\n Enforcer as CasbinEnforcerType,\n Helper as CasbinHelperType,\n RoleManager as CasbinRoleManagerType,\n} from 'casbin';\nimport { type Env } from 'hono';\nimport { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';\nimport {\n AuthorizationDecisions,\n AuthorizationDomainScopes,\n AuthorizationEnforcerTypes,\n AuthorizationPolicyVariants,\n AuthorizeBindingKeys,\n CasbinDomainMatchingFunctions,\n CasbinEnforcerModelDrivers,\n CasbinRuleVariants,\n type IAuthorizationEnforcer,\n type IAuthorizationUser,\n type ICasbinEnforcerOptions,\n type ICasbinRules,\n type IAuthorizationRequest,\n type TAuthorizationDecision,\n type TCasbinDomainMatchingFunction,\n} from '@venizia/ignis-kernel';\nimport { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy';\nimport { CasbinModule } from './casbin-module';\nimport { MembershipRoleManager } from '../role-managers/membership';\nimport { ResourceRoleManager } from '../role-managers/resource';\nimport { PolicyLineCodec } from './policy-line-codec';\nimport { UserPolicyLineCache } from './user-policy-line-cache';\n\n/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */\ntype TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {\n user: IAuthorizationUser;\n action: TAction;\n resource: TResource;\n context: TContext<E, string>;\n}) => { subject: string; resource: string; action: string; domain?: string };\n\n/** `addDomainHierarchy` lives on casbin's `DefaultRoleManager`, not on the `RoleManager` interface or the `Enforcer` facade - feature-detect it on whatever `getNamedRoleManager` returns. */\ninterface ICasbinRoleManagerWithDomainHierarchy {\n addDomainHierarchy?(rm: CasbinRoleManagerType): Promise<void>;\n}\n\n// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.\n\nexport class CasbinAuthorizationEnforcer<\n E extends Env = Env,\n TAction extends string = string,\n TResource extends string = string,\n>\n extends BaseHelper\n implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules>\n{\n name = CasbinAuthorizationEnforcer.name;\n private readonly MIN_EXPIRES_IN = 10_000;\n\n private pool: TNullable<BasePoolHelper<CasbinEnforcerType>> = null;\n private helper: TNullable<typeof CasbinHelperType> = null;\n // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.\n private userPolicyLineCache: TNullable<UserPolicyLineCache> = null;\n\n // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).\n private resolvedPayloadFn: TNullable<TNormalizePayloadFn<E, TAction, TResource>> = null;\n\n constructor(\n @inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })\n private options: ICasbinEnforcerOptions<E, TAction, TResource>,\n ) {\n super({ scope: CasbinAuthorizationEnforcer.name });\n }\n\n // Lifecycle\n\n async configure(): Promise<void> {\n const casbin = await CasbinModule.load();\n\n if (!this.options.model) {\n throw getError({\n message: '[CasbinAuthorizationEnforcer] options.model is required.',\n });\n }\n\n this.helper = casbin.Helper;\n\n this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();\n\n const { cached } = this.options;\n if (cached.use) {\n this.validateExpiresIn({ expiresIn: cached.options.expiresIn });\n }\n\n this.pool = new BasePoolHelper<CasbinEnforcerType>({\n scope: `${CasbinAuthorizationEnforcer.name}.Pool`,\n size: this.options.poolSize ?? 16,\n acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,\n create: async () => {\n const model = this.resolveModel({ casbin, model: this.options.model });\n\n const enforcer = await casbin.newEnforcer(model);\n await this.registerMatchers({ enforcer, casbin });\n this.assertMatcherCompilesSync({ enforcer });\n\n return enforcer;\n },\n });\n await this.pool.warmup();\n\n this.logger\n .for(this.configure.name)\n .info(\n 'Casbin enforcer pool ready (size: %s, cached: %s)',\n this.options.poolSize ?? 16,\n cached.use ? cached.driver : 'none',\n );\n }\n\n destroy(): void {\n this.pool?.destroy().catch((error) => {\n this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);\n });\n }\n\n /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */\n protected assertMatcherCompilesSync(opts: { enforcer: CasbinEnforcerType }) {\n try {\n if (this.options.isScoped || this.options.normalizePayloadFn) {\n opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');\n return;\n }\n\n opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');\n } catch (error) {\n throw getError({\n message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,\n });\n }\n }\n\n // IAuthorizationEnforcer - public API\n\n async buildRules(opts: {\n user: IAuthorizationUser;\n context: TContext<E, string>;\n }): Promise<ICasbinRules> {\n const { user } = opts;\n const cached = this.options.cached;\n\n const lines = cached.use\n ? await this.requireRedisCache().fetch({ user })\n : await this.extractUserLines({ user });\n\n return { user, lines };\n }\n\n async evaluate(opts: {\n rules: ICasbinRules;\n request: IAuthorizationRequest<TAction, TResource>;\n context: TContext<E, string>;\n }): Promise<TAuthorizationDecision> {\n if (!this.pool) {\n throw getError({\n message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',\n });\n }\n\n if (!opts.request?.action || !opts.request?.resource) {\n throw getError({\n message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',\n });\n }\n\n const { rules, request, context } = opts;\n const { user, lines } = rules;\n\n return this.pool.use({\n execution: async (enforcer) => {\n await this.loadPolicyLinesIntoModel({ enforcer, lines });\n\n const normalizePayloadFn = this.resolvedPayloadFn;\n\n if (!normalizePayloadFn) {\n const subject = `${user.principalType}_${user.userId}`;\n const isAllowed = this.enforceWithExplain({\n enforcer,\n vals: [subject, String(request.resource), String(request.action)],\n });\n return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n }\n\n const normalized = normalizePayloadFn({\n user,\n action: request.action,\n resource: request.resource,\n context,\n });\n\n // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.\n const domain =\n normalized.domain ??\n request.domain ??\n (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);\n\n const vals = domain\n ? [normalized.subject, domain, normalized.resource, normalized.action]\n : [normalized.subject, normalized.resource, normalized.action];\n const isAllowed = this.enforceWithExplain({ enforcer, vals });\n\n return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n },\n });\n }\n\n /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */\n protected enforceWithExplain(opts: { enforcer: CasbinEnforcerType; vals: string[] }): boolean {\n const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);\n\n if (!isAllowed) {\n this.logger\n .for(this.evaluate.name)\n .info(\n 'DENY | request: [%s] | matchedPolicy: %s',\n opts.vals.join(', '),\n matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>',\n );\n }\n\n return isAllowed;\n }\n\n // Cache management - optional IAuthorizationEnforcer members (on-demand)\n async invalidateUserCache(opts: {\n user: IAuthorizationUser;\n }): Promise<{ invalidatedKeys: number }> {\n const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({\n user: opts.user,\n });\n\n this.logger\n .for(this.invalidateUserCache.name)\n .info(\n 'Invalidated authz cache | user: %s | key: %s | deleted: %s',\n opts.user.userId,\n cacheKey,\n invalidatedKeys,\n );\n\n return { invalidatedKeys };\n }\n\n async rebuildUserCache(opts: {\n user: IAuthorizationUser;\n }): Promise<{ cacheKey: string; lineCount: number }> {\n // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.\n const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });\n\n this.logger\n .for(this.rebuildUserCache.name)\n .info(\n 'Rebuilt authz cache | user: %s | key: %s | lines: %s',\n opts.user.userId,\n cacheKey,\n lines.length,\n );\n\n return { cacheKey, lineCount: lines.length };\n }\n\n /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */\n protected requireRedisCache(): UserPolicyLineCache {\n const { cached } = this.options;\n\n if (!cached.use) {\n throw getError({\n message:\n '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',\n });\n }\n\n return (this.userPolicyLineCache ??= new UserPolicyLineCache({\n cached,\n loadLines: (opts) => this.extractUserLines(opts),\n }));\n }\n\n // Matchers & model resolvers\n\n protected async registerMatchers(opts: {\n enforcer: CasbinEnforcerType;\n casbin: typeof import('casbin');\n }): Promise<void> {\n const { enforcer, casbin } = opts;\n const { domainMatching, isScoped } = this.options;\n\n if (domainMatching) {\n if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {\n throw getError({\n message: `[registerMatchers] Role definition \"${domainMatching.roleDefinition}\" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \\`g = _, _, _\\`) before enabling domainMatching.`,\n });\n }\n\n const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });\n await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);\n }\n\n if (isScoped) {\n await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);\n await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);\n\n // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.\n enforcer.setNamedRoleManager(\n AuthorizationPolicyVariants.RESOURCE_INHERITS.rule,\n new ResourceRoleManager(),\n );\n\n // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the\n // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss\n // per-request g3 edges - g2 needs the same freshness for a just-created child domain.\n // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is\n // repopulated from whatever `g3` lines this principal's own policy line set carries.\n const domainHierarchyOverlay = new Map<string, Set<string>>();\n\n // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.\n enforcer.setNamedRoleManager(\n CasbinRuleVariants.G2,\n new MembershipRoleManager({ overlay: domainHierarchyOverlay }),\n );\n\n enforcer.setNamedRoleManager(\n CasbinRuleVariants.G3,\n new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }),\n );\n\n // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs\n // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.\n const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G) as\n | (CasbinRoleManagerType & ICasbinRoleManagerWithDomainHierarchy)\n | undefined;\n\n if (!gRoleManager?.addDomainHierarchy) {\n throw getError({\n message:\n '[registerMatchers] The \"g\" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for \"g\".',\n });\n }\n\n await gRoleManager.addDomainHierarchy(\n new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }),\n );\n }\n\n await enforcer.buildRoleLinks();\n }\n\n /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */\n protected resolveDomainMatchingFn(opts: {\n casbin: typeof import('casbin');\n name: TCasbinDomainMatchingFunction;\n }): (arg1: string, arg2: string) => boolean {\n // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.\n const { Util } = opts.casbin;\n switch (opts.name) {\n case CasbinDomainMatchingFunctions.KEY_MATCH: {\n return Util.keyMatchFunc;\n }\n case CasbinDomainMatchingFunctions.KEY_MATCH_2: {\n return Util.keyMatch2Func;\n }\n case CasbinDomainMatchingFunctions.KEY_MATCH_3: {\n return Util.keyMatch3Func;\n }\n case CasbinDomainMatchingFunctions.KEY_MATCH_4: {\n return Util.keyMatch4Func;\n }\n case CasbinDomainMatchingFunctions.REGEX_MATCH: {\n return Util.regexMatchFunc;\n }\n default: {\n throw getError({\n message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,\n });\n }\n }\n }\n\n /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */\n protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined {\n if (!this.options.isScoped) {\n return undefined;\n }\n\n return (opts: {\n user: IAuthorizationUser;\n action: TAction;\n resource: TResource;\n }): { subject: string; resource: string; action: string; domain?: string } => {\n // No domain here - evaluate() fills it from request.domain (set by the provider).\n return {\n subject: `${opts.user.principalType}_${opts.user.userId}`,\n resource: String(opts.resource),\n action: String(opts.action),\n };\n };\n }\n\n protected resolveModel(opts: {\n casbin: typeof import('casbin');\n model: ICasbinEnforcerOptions['model'];\n }) {\n const { casbin, model } = opts;\n\n switch (model.driver) {\n case CasbinEnforcerModelDrivers.FILE: {\n return casbin.newModelFromFile(model.definition);\n }\n case CasbinEnforcerModelDrivers.TEXT: {\n return casbin.newModelFromString(model.definition);\n }\n default: {\n throw getError({\n message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,\n });\n }\n }\n }\n\n protected validateExpiresIn(opts: { expiresIn: number }): void {\n if (opts.expiresIn >= this.MIN_EXPIRES_IN) {\n return;\n }\n\n throw getError({\n message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,\n });\n }\n\n // Policy loading internals\n\n /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */\n protected async extractUserLines(opts: { user: IAuthorizationUser }): Promise<string[]> {\n const casbin = await CasbinModule.load();\n const model = this.resolveModel({ casbin, model: this.options.model });\n\n return PolicyLineCodec.extractUserLines({\n casbin,\n model,\n adapter: this.options.adapter,\n user: opts.user,\n });\n }\n\n /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */\n protected async loadPolicyLinesIntoModel(opts: {\n enforcer: CasbinEnforcerType;\n lines: string[];\n }): Promise<void> {\n if (!this.helper) {\n throw getError({\n message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',\n });\n }\n\n await PolicyLineCodec.loadLinesIntoModel({\n enforcer: opts.enforcer,\n lines: opts.lines,\n helper: this.helper,\n });\n }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/index.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+export * from '@venizia/ignis-kernel';
+export * from './casbin.enforcer.js';
+export * from './models/index.js';
+export * from './policy-line-codec.js';
+export * from './user-policy-line-cache.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/enforcers/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}

package/dist/esm/components/auth/authorize/enforcers/index.js ADDED Viewed

@@ -0,0 +1,7 @@
+// `enforcer-registry.ts` moved to the kernel - `casbin.enforcer.ts` registers itself into it.
+export * from '@venizia/ignis-kernel';
+export * from './casbin.enforcer.js';
+export * from './models/index.js';
+export * from './policy-line-codec.js';
+export * from './user-policy-line-cache.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/enforcers/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,cAAc,uBAAuB,CAAC;AAEtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC","sourcesContent":["// `enforcer-registry.ts` moved to the kernel - `casbin.enforcer.ts` registers itself into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './casbin.enforcer';\nexport * from './models';\nexport * from './policy-line-codec';\nexport * from './user-policy-line-cache';\n"]}

package/dist/esm/components/auth/authorize/enforcers/models/index.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './rbac-domain.model.js';
2	+ //# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/enforcers/models/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/esm/components/auth/authorize/enforcers/models/index.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export * from './rbac-domain.model.js';
2	+ //# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/enforcers/models/index.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/enforcers/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC","sourcesContent":["export * from './rbac-domain.model';\n"]}

package/dist/esm/components/auth/authorize/enforcers/models/rbac-domain.model.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"rbac-domain.model.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":"AAEA,iKAAiK;AACjK,eAAO,MAAM,+BAA+B,geAmB3C,CAAC"}

package/dist/esm/components/auth/authorize/enforcers/models/rbac-domain.model.js ADDED Viewed

@@ -0,0 +1,24 @@
+// Relation semantics live on AuthorizationPolicyVariants; g's KEY_MATCH domain fn makes `*`-domain links match any request domain; `objectMatch` appears directly in the matcher because hasLink only walks stored nodes.
+// g3/g4/g5 rely on DefaultRoleManager self-links (hasLink(name, name)) - a custom role manager must preserve them.
+/** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */
+export const CASBIN_RBAC_DOMAIN_SCOPED_MODEL = `
+[request_definition]
+r = sub, dom, obj, act
+[policy_definition]
+p = sub, dom, obj, act, eft
+[role_definition]
+g = _, _, _
+g2 = _, _
+g3 = _, _
+g4 = _, _
+g5 = _, _
+[policy_effect]
+e = some(where (p.eft == allow)) && !some(where (p.eft == deny))
+[matchers]
+m = g(r.sub, p.sub, r.dom) && (p.dom == "SYSTEM_WIDE" || (p.dom == "ANY_MEMBER" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)
+`;
+//# sourceMappingURL=rbac-domain.model.js.map

package/dist/esm/components/auth/authorize/enforcers/models/rbac-domain.model.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"rbac-domain.model.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/enforcers/models/rbac-domain.model.ts"],"names":[],"mappings":"AAAA,0NAA0N;AAC1N,mHAAmH;AACnH,iKAAiK;AACjK,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;CAmB9C,CAAC","sourcesContent":["// Relation semantics live on AuthorizationPolicyVariants; g's KEY_MATCH domain fn makes `*`-domain links match any request domain; `objectMatch` appears directly in the matcher because hasLink only walks stored nodes.\n// g3/g4/g5 rely on DefaultRoleManager self-links (hasLink(name, name)) - a custom role manager must preserve them.\n/** Scoped RBAC model (v2). Effect = casbin `allow-and-deny` (default-DENY: needs a matching allow AND no matching deny), NOT `deny-override` (default-ALLOW). */\nexport const CASBIN_RBAC_DOMAIN_SCOPED_MODEL = `\n[request_definition]\nr = sub, dom, obj, act\n\n[policy_definition]\np = sub, dom, obj, act, eft\n\n[role_definition]\ng = _, _, _\ng2 = _, _\ng3 = _, _\ng4 = _, _\ng5 = _, _\n\n[policy_effect]\ne = some(where (p.eft == allow)) && !some(where (p.eft == deny))\n\n[matchers]\nm = g(r.sub, p.sub, r.dom) && (p.dom == \"SYSTEM_WIDE\" || (p.dom == \"ANY_MEMBER\" && g2(r.sub, r.dom)) || g3(r.dom, p.dom)) && (objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)) && g5(r.act, p.act)\n`;\n"]}

package/dist/esm/components/auth/authorize/enforcers/policy-line-codec.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy-line-codec.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAC9B,MAAM,IAAI,gBAAgB,EAC1B,KAAK,IAAI,eAAe,EACzB,MAAM,QAAQ,CAAC;AAEhB;;;GAGG;AACH,qBAAa,eAAe;IAC1B,wKAAwK;WAC3J,gBAAgB,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,eAAe,CAAC;QACvB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBrB,mNAAmN;WACtM,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BxF,4FAA4F;WAC/E,kBAAkB,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlB"}

package/dist/esm/components/auth/authorize/enforcers/policy-line-codec.js ADDED Viewed

@@ -0,0 +1,55 @@
+import { getError } from '@venizia/ignis-helpers/core';
+import { CasbinRuleVariants, } from '@venizia/ignis-kernel';
+/**
+ * Serializes casbin policy state to/from plain string lines. Pure - no pool, no cache, no
+ * lifecycle; every method takes exactly what it needs from the caller instead of holding state.
+ */
+export class PolicyLineCodec {
+    /** Extract a user's lines from an ISOLATED throwaway enforcer (own model + adapter), never a pooled serving one, so concurrent requests cannot change what we cache. */
+    static async extractUserLines(opts) {
+        const { casbin, model, adapter, user } = opts;
+        const loader = await casbin.newEnforcer(model, adapter);
+        if (!loader.loadFilteredPolicy) {
+            throw getError({
+                message: '[PolicyLineCodec] Adapter does not support loadFilteredPolicy.',
+            });
+        }
+        await loader.loadFilteredPolicy({
+            principal: { type: user.principalType, id: user.userId },
+        });
+        return PolicyLineCodec.extractLinesFrom({ enforcer: loader });
+    }
+    /** Serialize ALL p-types and g-types (not just `p`/`g`) back into casbin lines so the cached payload is complete for the scoped model; it reads stored rules, so the loader needs no matching funcs registered. */
+    static async extractLinesFrom(opts) {
+        const { enforcer } = opts;
+        const model = enforcer.getModel();
+        const lines = [];
+        const policyTypes = model.model.get(CasbinRuleVariants.P);
+        const policyTypesKeys = policyTypes?.keys() ?? [];
+        for (const ptype of policyTypesKeys) {
+            const rules = await enforcer.getNamedPolicy(ptype);
+            for (const rule of rules) {
+                lines.push([ptype, ...rule].join(', '));
+            }
+        }
+        const groupingTypes = model.model.get(CasbinRuleVariants.G);
+        const groupingTypesKeys = groupingTypes?.keys() ?? [];
+        for (const gtype of groupingTypesKeys) {
+            const rules = await enforcer.getNamedGroupingPolicy(gtype);
+            for (const rule of rules) {
+                lines.push([gtype, ...rule].join(', '));
+            }
+        }
+        return lines;
+    }
+    /** Atomically reset a borrowed enforcer's model to exactly `lines` + rebuild role links. */
+    static async loadLinesIntoModel(opts) {
+        const model = opts.enforcer.getModel();
+        model.clearPolicy();
+        for (const line of opts.lines) {
+            opts.helper.loadPolicyLine(line, model);
+        }
+        await opts.enforcer.buildRoleLinks();
+    }
+}
+//# sourceMappingURL=policy-line-codec.js.map

package/dist/esm/components/auth/authorize/enforcers/policy-line-codec.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy-line-codec.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/policy-line-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EACL,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAO/B;;;GAGG;AACH,MAAM,OAAO,eAAe;IAC1B,wKAAwK;IACxK,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAK7B;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,kBAAkB,CAAC;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;SACzD,CAAC,CAAC;QAEH,OAAO,eAAe,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,mNAAmN;IACnN,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAsC;QAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;CACF","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport {\n CasbinRuleVariants,\n type IAuthorizationUser,\n type ICasbinEnforcerOptions,\n} from '@venizia/ignis-kernel';\nimport type {\n Enforcer as CasbinEnforcerType,\n Helper as CasbinHelperType,\n Model as CasbinModelType,\n} from 'casbin';\n\n/**\n * Serializes casbin policy state to/from plain string lines. Pure - no pool, no cache, no\n * lifecycle; every method takes exactly what it needs from the caller instead of holding state.\n */\nexport class PolicyLineCodec {\n /** Extract a user's lines from an ISOLATED throwaway enforcer (own model + adapter), never a pooled serving one, so concurrent requests cannot change what we cache. */\n static async extractUserLines(opts: {\n casbin: typeof import('casbin');\n model: CasbinModelType;\n adapter: ICasbinEnforcerOptions['adapter'];\n user: IAuthorizationUser;\n }): Promise<string[]> {\n const { casbin, model, adapter, user } = opts;\n const loader = await casbin.newEnforcer(model, adapter);\n\n if (!loader.loadFilteredPolicy) {\n throw getError({\n message: '[PolicyLineCodec] Adapter does not support loadFilteredPolicy.',\n });\n }\n\n await loader.loadFilteredPolicy({\n principal: { type: user.principalType, id: user.userId },\n });\n\n return PolicyLineCodec.extractLinesFrom({ enforcer: loader });\n }\n\n /** Serialize ALL p-types and g-types (not just `p`/`g`) back into casbin lines so the cached payload is complete for the scoped model; it reads stored rules, so the loader needs no matching funcs registered. */\n static async extractLinesFrom(opts: { enforcer: CasbinEnforcerType }): Promise<string[]> {\n const { enforcer } = opts;\n const model = enforcer.getModel();\n const lines: string[] = [];\n\n const policyTypes = model.model.get(CasbinRuleVariants.P);\n const policyTypesKeys = policyTypes?.keys() ?? [];\n for (const ptype of policyTypesKeys) {\n const rules = await enforcer.getNamedPolicy(ptype);\n for (const rule of rules) {\n lines.push([ptype, ...rule].join(', '));\n }\n }\n\n const groupingTypes = model.model.get(CasbinRuleVariants.G);\n const groupingTypesKeys = groupingTypes?.keys() ?? [];\n for (const gtype of groupingTypesKeys) {\n const rules = await enforcer.getNamedGroupingPolicy(gtype);\n for (const rule of rules) {\n lines.push([gtype, ...rule].join(', '));\n }\n }\n\n return lines;\n }\n\n /** Atomically reset a borrowed enforcer's model to exactly `lines` + rebuild role links. */\n static async loadLinesIntoModel(opts: {\n enforcer: CasbinEnforcerType;\n lines: string[];\n helper: typeof CasbinHelperType;\n }): Promise<void> {\n const model = opts.enforcer.getModel();\n model.clearPolicy();\n\n for (const line of opts.lines) {\n opts.helper.loadPolicyLine(line, model);\n }\n\n await opts.enforcer.buildRoleLinks();\n }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/user-policy-line-cache.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"user-policy-line-cache.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,sKAAsK;AACtK,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAE1F;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAG9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;gBAE/D,IAAI,EAAE;QAChB,MAAM,EAAE,0BAA0B,GAAG;YAAE,GAAG,EAAE,IAAI,CAAA;SAAE,CAAC;QACnD,SAAS,EAAE,iBAAiB,CAAC;KAC9B;IAMD,uMAAuM;IACjM,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiClE,oCAAoC;IAC9B,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAO1D,uMAAuM;IACjM,OAAO,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAUlD,+FAA+F;YACjF,eAAe;IAY7B,0FAA0F;YAC5E,UAAU;IAQxB,kGAAkG;IAClG,OAAO,CAAC,UAAU;CAkBnB"}

package/dist/esm/components/auth/authorize/enforcers/user-policy-line-cache.js ADDED Viewed

@@ -0,0 +1,94 @@
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationErrors, } from '@venizia/ignis-kernel';
+/**
+ * Per-user redis cache of casbin policy lines. Owns the cache key, the TTL, and concurrent-miss
+ * de-duplication so N simultaneous misses for the same user collapse onto one extraction.
+ */
+export class UserPolicyLineCache extends BaseHelper {
+    constructor(opts) {
+        super({ scope: UserPolicyLineCache.name });
+        // cacheKey -> in-progress line-fetch; concurrent misses for the same user share one extraction instead of all hitting the DB (see fetch()).
+        this.pendingLineFetches = new Map();
+        this.cached = opts.cached;
+        this.loadLines = opts.loadLines;
+    }
+    /** Fetch the user's lines, collapsing concurrent misses per key onto one extraction. Best-effort: two misses may race past the cache read and both extract (benign - per-user lines are identical). */
+    async fetch(opts) {
+        const cacheKey = await this.resolveCacheKey({ user: opts.user });
+        // Cache hit - Redis owns expiry (PX on write), so a present key is fresh; a corrupted/legacy entry must NOT 500 the request, so it is discarded and refetched.
+        const raw = await this.cached.options.connection.get({ key: cacheKey });
+        if (raw) {
+            const lines = this.parseLines({ raw, cacheKey });
+            if (lines) {
+                return lines;
+            }
+        }
+        const existing = this.pendingLineFetches.get(cacheKey);
+        if (existing) {
+            return existing;
+        }
+        // Cache miss (or discarded corrupt entry) - extract from an ISOLATED enforcer so a concurrent load cannot contaminate the cache, persist it, then return the lines for THIS request.
+        const task = async () => {
+            const lines = await this.loadLines({ user: opts.user });
+            await this.writeLines({ cacheKey, lines });
+            return lines;
+        };
+        const promise = task().finally(() => {
+            this.pendingLineFetches.delete(cacheKey);
+        });
+        this.pendingLineFetches.set(cacheKey, promise);
+        return promise;
+    }
+    /** Drop the user's cached entry. */
+    async invalidate(opts) {
+        const cacheKey = await this.resolveCacheKey({ user: opts.user });
+        const invalidatedKeys = await this.cached.options.connection.del({ keys: [cacheKey] });
+        return { cacheKey, invalidatedKeys };
+    }
+    /** Drop then recompute the user's cached entry via `loadLines` - an isolated extraction (never a pooled serving enforcer), so a concurrent request cannot make the cache hold another user's lines. */
+    async rebuild(opts) {
+        const cacheKey = await this.resolveCacheKey({ user: opts.user });
+        await this.cached.options.connection.del({ keys: [cacheKey] });
+        const lines = await this.loadLines({ user: opts.user });
+        await this.writeLines({ cacheKey, lines });
+        return { cacheKey, lines };
+    }
+    /** Compute the user's cache key and reject an empty result - consistent with the read path. */
+    async resolveCacheKey(opts) {
+        const cacheKey = await this.cached.options.keyFn({ user: opts.user });
+        if (!cacheKey) {
+            throw getError({
+                error: AuthorizationErrors.CACHE_KEY_INVALID,
+                message: '[UserPolicyLineCache] keyFn returned an empty cache key.',
+            });
+        }
+        return cacheKey;
+    }
+    /** Single source of truth for the cache encoding. Used by the miss path and rebuild(). */
+    async writeLines(opts) {
+        await this.cached.options.connection.set({
+            key: opts.cacheKey,
+            value: opts.lines,
+            options: { expiresIn: this.cached.options.expiresIn },
+        });
+    }
+    /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */
+    parseLines(opts) {
+        try {
+            const parsed = JSON.parse(opts.raw);
+            if (!Array.isArray(parsed) || parsed.some((line) => typeof line !== 'string')) {
+                throw getError({
+                    message: '[UserPolicyLineCache] Cached payload is not an array of policy lines.',
+                });
+            }
+            return parsed;
+        }
+        catch (error) {
+            this.logger
+                .for(this.parseLines.name)
+                .warn('Discarding corrupted authz cache entry | key: %s | error: %s', opts.cacheKey, error);
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=user-policy-line-cache.js.map

package/dist/esm/components/auth/authorize/enforcers/user-policy-line-cache.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"user-policy-line-cache.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/user-policy-line-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAK/B;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAOjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAP7C,4IAA4I;QAC3H,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAOzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,KAAK,CAAC,IAAkC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,+JAA+J;QAC/J,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,qLAAqL;QACrL,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,UAAU,CAAC,IAEhB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEvF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvC,CAAC;IAED,uMAAuM;IACvM,KAAK,CAAC,OAAO,CAAC,IAEb;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,eAAe,CAAC,IAAkC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,mBAAmB,CAAC,iBAAiB;gBAC5C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,UAAU,CAAC,IAA2C;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvC,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,UAAU,CAAC,IAAuC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC9E,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,uEAAuE;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAkB,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,8DAA8D,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["import { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\nimport {\n AuthorizationErrors,\n type IAuthorizationUser,\n type ICasbinEnforcerCachedRedis,\n} from '@venizia/ignis-kernel';\n\n/** Computes a user's policy lines on a cache miss - CasbinAuthorizationEnforcer wires this to its isolated-enforcer extraction (PolicyLineCodec.extractUserLines). */\nexport type TPolicyLineLoader = (opts: { user: IAuthorizationUser }) => Promise<string[]>;\n\n/**\n * Per-user redis cache of casbin policy lines. Owns the cache key, the TTL, and concurrent-miss\n * de-duplication so N simultaneous misses for the same user collapse onto one extraction.\n */\nexport class UserPolicyLineCache extends BaseHelper {\n private readonly cached: ICasbinEnforcerCachedRedis & { use: true };\n private readonly loadLines: TPolicyLineLoader;\n\n // cacheKey -> in-progress line-fetch; concurrent misses for the same user share one extraction instead of all hitting the DB (see fetch()).\n private readonly pendingLineFetches = new Map<string, Promise<string[]>>();\n\n constructor(opts: {\n cached: ICasbinEnforcerCachedRedis & { use: true };\n loadLines: TPolicyLineLoader;\n }) {\n super({ scope: UserPolicyLineCache.name });\n this.cached = opts.cached;\n this.loadLines = opts.loadLines;\n }\n\n /** Fetch the user's lines, collapsing concurrent misses per key onto one extraction. Best-effort: two misses may race past the cache read and both extract (benign - per-user lines are identical). */\n async fetch(opts: { user: IAuthorizationUser }): Promise<string[]> {\n const cacheKey = await this.resolveCacheKey({ user: opts.user });\n\n // Cache hit - Redis owns expiry (PX on write), so a present key is fresh; a corrupted/legacy entry must NOT 500 the request, so it is discarded and refetched.\n const raw = await this.cached.options.connection.get({ key: cacheKey });\n if (raw) {\n const lines = this.parseLines({ raw, cacheKey });\n\n if (lines) {\n return lines;\n }\n }\n\n const existing = this.pendingLineFetches.get(cacheKey);\n if (existing) {\n return existing;\n }\n\n // Cache miss (or discarded corrupt entry) - extract from an ISOLATED enforcer so a concurrent load cannot contaminate the cache, persist it, then return the lines for THIS request.\n const task = async () => {\n const lines = await this.loadLines({ user: opts.user });\n await this.writeLines({ cacheKey, lines });\n return lines;\n };\n\n const promise = task().finally(() => {\n this.pendingLineFetches.delete(cacheKey);\n });\n\n this.pendingLineFetches.set(cacheKey, promise);\n return promise;\n }\n\n /** Drop the user's cached entry. */\n async invalidate(opts: {\n user: IAuthorizationUser;\n }): Promise<{ cacheKey: string; invalidatedKeys: number }> {\n const cacheKey = await this.resolveCacheKey({ user: opts.user });\n const invalidatedKeys = await this.cached.options.connection.del({ keys: [cacheKey] });\n\n return { cacheKey, invalidatedKeys };\n }\n\n /** Drop then recompute the user's cached entry via `loadLines` - an isolated extraction (never a pooled serving enforcer), so a concurrent request cannot make the cache hold another user's lines. */\n async rebuild(opts: {\n user: IAuthorizationUser;\n }): Promise<{ cacheKey: string; lines: string[] }> {\n const cacheKey = await this.resolveCacheKey({ user: opts.user });\n await this.cached.options.connection.del({ keys: [cacheKey] });\n\n const lines = await this.loadLines({ user: opts.user });\n await this.writeLines({ cacheKey, lines });\n\n return { cacheKey, lines };\n }\n\n /** Compute the user's cache key and reject an empty result - consistent with the read path. */\n private async resolveCacheKey(opts: { user: IAuthorizationUser }): Promise<string> {\n const cacheKey = await this.cached.options.keyFn({ user: opts.user });\n if (!cacheKey) {\n throw getError({\n error: AuthorizationErrors.CACHE_KEY_INVALID,\n message: '[UserPolicyLineCache] keyFn returned an empty cache key.',\n });\n }\n\n return cacheKey;\n }\n\n /** Single source of truth for the cache encoding. Used by the miss path and rebuild(). */\n private async writeLines(opts: { cacheKey: string; lines: string[] }): Promise<void> {\n await this.cached.options.connection.set({\n key: opts.cacheKey,\n value: opts.lines,\n options: { expiresIn: this.cached.options.expiresIn },\n });\n }\n\n /** Decode cached policy lines; on any corruption, log and return null so the caller refetches. */\n private parseLines(opts: { raw: string; cacheKey: string }): TNullable<string[]> {\n try {\n const parsed = JSON.parse(opts.raw);\n\n if (!Array.isArray(parsed) || parsed.some((line) => typeof line !== 'string')) {\n throw getError({\n message: '[UserPolicyLineCache] Cached payload is not an array of policy lines.',\n });\n }\n\n return parsed as string[];\n } catch (error) {\n this.logger\n .for(this.parseLines.name)\n .warn('Discarding corrupted authz cache entry | key: %s | error: %s', opts.cacheKey, error);\n return null;\n }\n }\n}\n"]}

package/dist/esm/components/auth/authorize/index.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+export * from '@venizia/ignis-kernel';
+export * from './adapters/index.js';
+export * from './component.js';
+export * from './enforcers/index.js';
+export * from './role-managers/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}

package/dist/esm/components/auth/authorize/index.js ADDED Viewed

@@ -0,0 +1,8 @@
+// `builders`, `common`, `middlewares`, `models` and `providers` moved to the kernel in full;
+// `enforcer-registry.ts` moved out of `enforcers` too (see `./enforcers/index.ts`).
+export * from '@venizia/ignis-kernel';
+export * from './adapters/index.js';
+export * from './component.js';
+export * from './enforcers/index.js';
+export * from './role-managers/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/index.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,oFAAoF;AACpF,cAAc,uBAAuB,CAAC;AAEtC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC","sourcesContent":["// `builders`, `common`, `middlewares`, `models` and `providers` moved to the kernel in full;\n// `enforcer-registry.ts` moved out of `enforcers` too (see `./enforcers/index.ts`).\nexport * from '@venizia/ignis-kernel';\n\nexport * from './adapters';\nexport * from './component';\nexport * from './enforcers';\nexport * from './role-managers';\n"]}

package/dist/esm/components/auth/authorize/role-managers/base.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,8BAAsB,eAAgB,SAAQ,UAAU;IACtD,SAAS,CAAC,aAAa,UAAS;IAEhC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAEvD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,8GAA8G;IACxG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAI/B,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,8HAA8H;IAC9H,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,GAAG,IAAI;IAUlF,gGAAgG;IAChG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;IAcD;;yGAEqG;IACrG,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACtC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,MAAM,EAAE;CA4Bb"}

package/dist/esm/components/auth/authorize/role-managers/base.js ADDED Viewed

@@ -0,0 +1,73 @@
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+/**
+ * Shared casbin `RoleManager` scaffolding for the resource, domain-hierarchy, and membership
+ * role managers: the debug-only interface members (`printRoles`, `getDomains`, `getAllDomains`),
+ * the `hasLink` wrapper around the synchronous `syncedHasLink`, the once-per-`clear()`
+ * overlay-initialized log line, and the shared ancestor walk both hierarchy-aware managers use.
+ */
+export class BaseRoleManager extends BaseHelper {
+    constructor() {
+        super(...arguments);
+        this.graphReported = false;
+    }
+    async hasLink(name1, name2) {
+        return this.syncedHasLink(name1, name2);
+    }
+    /** casbin calls this after buildRoleLinks purely as a debug hook; none of the role managers log from here. */
+    async printRoles() { }
+    async getDomains() {
+        return [];
+    }
+    async getAllDomains() {
+        return [];
+    }
+    /** Logs the initialized-overlay line once per `clear()` cycle; `build` is only invoked the first time so counts stay lazy. */
+    reportGraphOnce(build) {
+        if (this.graphReported) {
+            return;
+        }
+        this.graphReported = true;
+        const { message, args } = build();
+        this.logger.for(this.syncedHasLink.name).debug(message, ...args);
+    }
+    /** Node and edge counts of a domain-hierarchy overlay, for the once-per-`clear()` debug log. */
+    static overlayStats(overlay) {
+        if (!overlay) {
+            return { nodeCount: 0, edgeCount: 0 };
+        }
+        let edgeCount = 0;
+        const overlayValues = overlay.values();
+        for (const parents of overlayValues) {
+            edgeCount += parents.size;
+        }
+        return { nodeCount: overlay.size, edgeCount };
+    }
+    /** `node` itself plus every ancestor reachable by walking the overlay's child->parent edges,
+     * node first. Cycle-safe: visited Set + index cursor, never shift(). Static - `ResourceRoleManager`
+     * extends this base with no overlay of this shape, so this must not force instance state onto it. */
+    static collectAncestors(opts) {
+        const { overlay, node } = opts;
+        const result = [node];
+        const visited = new Set([node]);
+        const queue = [node];
+        let head = 0;
+        while (head < queue.length) {
+            const current = queue[head];
+            head += 1;
+            const parents = overlay?.get(current);
+            if (!parents) {
+                continue;
+            }
+            for (const parent of parents) {
+                if (visited.has(parent)) {
+                    continue;
+                }
+                visited.add(parent);
+                result.push(parent);
+                queue.push(parent);
+            }
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/esm/components/auth/authorize/role-managers/base.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,OAAgB,eAAgB,SAAQ,UAAU;IAAxD;;QACY,kBAAa,GAAG,KAAK,CAAC;IAkFlC,CAAC;IA9EC,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAAa;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,UAAU;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8HAA8H;IACpH,eAAe,CAAC,KAAiD;QACzE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,gGAAgG;IACtF,MAAM,CAAC,YAAY,CAAC,OAAkC;QAI9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;yGAEqG;IAC3F,MAAM,CAAC,gBAAgB,CAAC,IAGjC;QACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["import { BaseHelper } from '@venizia/ignis-helpers/core';\n\n/**\n * Shared casbin `RoleManager` scaffolding for the resource, domain-hierarchy, and membership\n * role managers: the debug-only interface members (`printRoles`, `getDomains`, `getAllDomains`),\n * the `hasLink` wrapper around the synchronous `syncedHasLink`, the once-per-`clear()`\n * overlay-initialized log line, and the shared ancestor walk both hierarchy-aware managers use.\n */\nexport abstract class BaseRoleManager extends BaseHelper {\n protected graphReported = false;\n\n abstract syncedHasLink(name1: string, name2: string): boolean;\n\n async hasLink(name1: string, name2: string): Promise<boolean> {\n return this.syncedHasLink(name1, name2);\n }\n\n /** casbin calls this after buildRoleLinks purely as a debug hook; none of the role managers log from here. */\n async printRoles(): Promise<void> {}\n\n async getDomains(): Promise<string[]> {\n return [];\n }\n\n async getAllDomains(): Promise<string[]> {\n return [];\n }\n\n /** Logs the initialized-overlay line once per `clear()` cycle; `build` is only invoked the first time so counts stay lazy. */\n protected reportGraphOnce(build: () => { message: string; args: unknown[] }): void {\n if (this.graphReported) {\n return;\n }\n this.graphReported = true;\n\n const { message, args } = build();\n this.logger.for(this.syncedHasLink.name).debug(message, ...args);\n }\n\n /** Node and edge counts of a domain-hierarchy overlay, for the once-per-`clear()` debug log. */\n protected static overlayStats(overlay?: Map<string, Set<string>>): {\n nodeCount: number;\n edgeCount: number;\n } {\n if (!overlay) {\n return { nodeCount: 0, edgeCount: 0 };\n }\n\n let edgeCount = 0;\n const overlayValues = overlay.values();\n for (const parents of overlayValues) {\n edgeCount += parents.size;\n }\n\n return { nodeCount: overlay.size, edgeCount };\n }\n\n /** `node` itself plus every ancestor reachable by walking the overlay's child->parent edges,\n * node first. Cycle-safe: visited Set + index cursor, never shift(). Static - `ResourceRoleManager`\n * extends this base with no overlay of this shape, so this must not force instance state onto it. */\n protected static collectAncestors(opts: {\n overlay?: Map<string, Set<string>>;\n node: string;\n }): string[] {\n const { overlay, node } = opts;\n const result: string[] = [node];\n const visited = new Set<string>([node]);\n const queue: string[] = [node];\n\n let head = 0;\n while (head < queue.length) {\n const current = queue[head];\n head += 1;\n\n const parents = overlay?.get(current);\n if (!parents) {\n continue;\n }\n\n for (const parent of parents) {\n if (visited.has(parent)) {\n continue;\n }\n visited.add(parent);\n result.push(parent);\n queue.push(parent);\n }\n }\n\n return result;\n }\n}\n"]}

package/dist/esm/components/auth/authorize/role-managers/domain-hierarchy.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+import type { RoleManager } from 'casbin';
+import { BaseRoleManager } from './base.js';
+/**
+ * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's
+ * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.
+ * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears
+ * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`
+ * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.
+ */
+export declare class DomainHierarchyRoleManager extends BaseRoleManager implements RoleManager {
+    private readonly reversed;
+    private readonly overlay;
+    constructor(opts: {
+        reversed?: boolean;
+        overlay?: Map<string, Set<string>>;
+    });
+    /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */
+    clear(): Promise<void>;
+    addLink(child: string, parent: string): Promise<void>;
+    deleteLink(child: string, parent: string): Promise<void>;
+    syncedHasLink(name1: string, name2: string): boolean;
+    /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
+    getRoles(name: string): Promise<string[]>;
+    getUsers(name: string): Promise<string[]>;
+    /** True when `start` is `target`, or reaches it through the overlay. */
+    private reaches;
+}
+//# sourceMappingURL=domain-hierarchy.d.ts.map

package/dist/esm/components/auth/authorize/role-managers/domain-hierarchy.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"domain-hierarchy.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,eAAgB,YAAW,WAAW;IACpF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGtB;gBAEU,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;KAAE;IAM5E,8JAA8J;IACxJ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAarD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAepD,8GAA8G;IACxG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAY/C,wEAAwE;IACxE,OAAO,CAAC,OAAO;CAahB"}

package/dist/esm/components/auth/authorize/role-managers/domain-hierarchy.js ADDED Viewed

@@ -0,0 +1,73 @@
+import { BaseRoleManager } from './base.js';
+/**
+ * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's
+ * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.
+ * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears
+ * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`
+ * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.
+ */
+export class DomainHierarchyRoleManager extends BaseRoleManager {
+    constructor(opts) {
+        super({ scope: DomainHierarchyRoleManager.name });
+        this.reversed = opts.reversed ?? false;
+        this.overlay = opts.overlay ?? new Map();
+    }
+    /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */
+    async clear() {
+        this.overlay.clear();
+        this.graphReported = false;
+    }
+    async addLink(child, parent) {
+        const existing = this.overlay.get(child);
+        if (existing) {
+            existing.add(parent);
+        }
+        else {
+            this.overlay.set(child, new Set([parent]));
+        }
+        if (!this.overlay.has(parent)) {
+            this.overlay.set(parent, new Set());
+        }
+    }
+    async deleteLink(child, parent) {
+        this.overlay.get(child)?.delete(parent);
+    }
+    syncedHasLink(name1, name2) {
+        this.reportGraphOnce(() => {
+            const { nodeCount, edgeCount } = DomainHierarchyRoleManager.overlayStats(this.overlay);
+            return {
+                message: 'domain-hierarchy role manager initialized | nodes: %d | edges: %d | reversed: %s',
+                args: [nodeCount, edgeCount, this.reversed],
+            };
+        });
+        const start = this.reversed ? name2 : name1;
+        const target = this.reversed ? name1 : name2;
+        return this.reaches({ start, target });
+    }
+    /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */
+    async getRoles(name) {
+        return [...(this.overlay.get(name) ?? [])];
+    }
+    async getUsers(name) {
+        const users = [];
+        for (const [child, parents] of this.overlay) {
+            if (parents.has(name)) {
+                users.push(child);
+            }
+        }
+        return users;
+    }
+    /** True when `start` is `target`, or reaches it through the overlay. */
+    reaches(opts) {
+        const { start, target } = opts;
+        if (start === target) {
+            return true;
+        }
+        const ancestors = DomainHierarchyRoleManager.collectAncestors({
+            overlay: this.overlay,
+            node: start,
+        });
+        return ancestors.includes(target);
+    }
+}
+//# sourceMappingURL=domain-hierarchy.js.map

package/dist/esm/components/auth/authorize/role-managers/domain-hierarchy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"domain-hierarchy.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/domain-hierarchy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,eAAe;IAO7D,YAAY,IAAgE;QAC1E,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,GAAG,EAAuB,CAAC;IAChE,CAAC;IAED,8JAA8J;IAC9J,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,MAAc;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAc;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAa;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvF,OAAO;gBACL,OAAO,EAAE,kFAAkF;gBAC3F,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAE7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IAChE,OAAO,CAAC,IAAuC;QACrD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;YAC5D,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF","sourcesContent":["import type { RoleManager } from 'casbin';\nimport { BaseRoleManager } from './base';\n\n/**\n * Serves the `g3` axis (`g3(r.dom, p.dom)`) and, with `reversed`, casbin's\n * `DefaultRoleManager.addDomainHierarchy()` on `g`, which asks in the opposite argument order.\n * `clear()` wipes only the overlay, never shared across requests: `buildRoleLinksInternal` clears\n * every registered role manager each request. Pass both instances one `overlay` so per-request `g3`\n * edges reach the `g` axis, which casbin never puts in `rmMap` and so never feeds `addLink`.\n */\nexport class DomainHierarchyRoleManager extends BaseRoleManager implements RoleManager {\n private readonly reversed: boolean;\n private readonly overlay: Map<\n string, // child domain\n Set<string> // set of parent domains\n >;\n\n constructor(opts: { reversed?: boolean; overlay?: Map<string, Set<string>> }) {\n super({ scope: DomainHierarchyRoleManager.name });\n this.reversed = opts.reversed ?? false;\n this.overlay = opts.overlay ?? new Map<string, Set<string>>();\n }\n\n /** Mutates the map in place - never reassigns `this.overlay` - so a caller sharing this map with another instance (see `opts.overlay`) sees the clear too. */\n async clear(): Promise<void> {\n this.overlay.clear();\n this.graphReported = false;\n }\n\n async addLink(child: string, parent: string): Promise<void> {\n const existing = this.overlay.get(child);\n if (existing) {\n existing.add(parent);\n } else {\n this.overlay.set(child, new Set<string>([parent]));\n }\n\n if (!this.overlay.has(parent)) {\n this.overlay.set(parent, new Set<string>());\n }\n }\n\n async deleteLink(child: string, parent: string): Promise<void> {\n this.overlay.get(child)?.delete(parent);\n }\n\n syncedHasLink(name1: string, name2: string): boolean {\n this.reportGraphOnce(() => {\n const { nodeCount, edgeCount } = DomainHierarchyRoleManager.overlayStats(this.overlay);\n return {\n message: 'domain-hierarchy role manager initialized | nodes: %d | edges: %d | reversed: %s',\n args: [nodeCount, edgeCount, this.reversed],\n };\n });\n\n const start = this.reversed ? name2 : name1;\n const target = this.reversed ? name1 : name2;\n\n return this.reaches({ start, target });\n }\n\n /** Local overlay only, not the shared graph - correct for hasLink, incomplete for casbin's management API. */\n async getRoles(name: string): Promise<string[]> {\n return [...(this.overlay.get(name) ?? [])];\n }\n\n async getUsers(name: string): Promise<string[]> {\n const users: string[] = [];\n\n for (const [child, parents] of this.overlay) {\n if (parents.has(name)) {\n users.push(child);\n }\n }\n\n return users;\n }\n\n /** True when `start` is `target`, or reaches it through the overlay. */\n private reaches(opts: { start: string; target: string }): boolean {\n const { start, target } = opts;\n\n if (start === target) {\n return true;\n }\n\n const ancestors = DomainHierarchyRoleManager.collectAncestors({\n overlay: this.overlay,\n node: start,\n });\n return ancestors.includes(target);\n }\n}\n"]}

package/dist/esm/components/auth/authorize/role-managers/index.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+export * from './base.js';
+export * from './domain-hierarchy.js';
+export * from './membership.js';
+export * from './resource.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authorize/role-managers/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/esm/components/auth/authorize/role-managers/index.js ADDED Viewed

@@ -0,0 +1,5 @@
+export * from './base.js';
+export * from './domain-hierarchy.js';
+export * from './membership.js';
+export * from './resource.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authorize/role-managers/index.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/role-managers/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC","sourcesContent":["export * from './base';\nexport * from './domain-hierarchy';\nexport * from './membership';\nexport * from './resource';\n"]}