@venizia/ignis 0.4.3 → 0.4.4

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.js

@@ -1,393 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScopedCasbinAdapter = void 0;
-const drizzle_orm_1 = require("drizzle-orm");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const base_filtered_1 = require("../base-filtered");
-const custom_grant_expander_1 = require("../custom-grant-expander");
-const policy_edges_1 = require("./policy-edges");
-const common_1 = require("./common");
-/**
- * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,
- * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.
- *
- * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.
- * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications
- * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion
- * filter would sweep those unknown rows into a branch that has no idea what they mean. The current
- * shape makes an undeclared variant inert, which is what makes sharing the table safe.
- */
-class ScopedCasbinAdapter extends base_filtered_1.BaseFilteredAdapter {
-    constructor(opts) {
-        super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });
-        this.entities = opts.entities;
-        this.resolveDomainEdges = opts.resolveDomainEdges;
-        this.customGrantExpander = new custom_grant_expander_1.CustomGrantExpander({
-            dataSource: opts.dataSource,
-            entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },
-        });
-    }
-    /**
-     * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -
-     * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot
-     * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does
-     * not wait for the structural-edges query either: both run concurrently once the closure is known.
-     */
-    async loadFilteredPolicy(model, filter) {
-        const { principal } = filter;
-        const { principals } = this.entities;
-        const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });
-        const structuralEdgesPromise = this.queryEdgePolicies();
-        const principalRows = await principalPoliciesPromise;
-        const lines = [];
-        const directGrants = [];
-        const roleGrants = [];
-        const domainClosure = new Set();
-        for (const row of principalRows) {
-            switch (row.kind) {
-                case policy_edges_1.PrincipalPolicyEdges.ROLE_EDGE: {
-                    lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`);
-                    break;
-                }
-                case policy_edges_1.PrincipalPolicyEdges.ROLE_GRANT: {
-                    roleGrants.push(row);
-                    break;
-                }
-                case policy_edges_1.PrincipalPolicyEdges.DOMAIN_EDGE: {
-                    lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`);
-                    // Both ends are, by construction, members of the principal's domain_closure CTE.
-                    domainClosure.add(String(row.subjectId));
-                    domainClosure.add(String(row.targetId));
-                    break;
-                }
-                default: {
-                    if (row.variant === ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.action) {
-                        domainClosure.add(`${row.targetType}_${row.targetId}`);
-                    }
-                    this.collectDirectRow({ row, principal, lines, directGrants });
-                    break;
-                }
-            }
-        }
-        const hookLinesPromise = this.resolveDomainEdgeLines({
-            principal,
-            domains: [...domainClosure],
-        });
-        lines.push(...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })));
-        lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));
-        const [structuralEdges, hookLines] = await Promise.all([
-            structuralEdgesPromise,
-            hookLinesPromise,
-        ]);
-        lines.push(...structuralEdges);
-        lines.push(...hookLines);
-        await this.loadLines({ model, lines });
-    }
-    /** Route one `direct` row to its casbin line, or to the grant batch. */
-    collectDirectRow(opts) {
-        const { row, principal, lines, directGrants } = opts;
-        const { principals } = this.entities;
-        switch (row.variant) {
-            case ignis_kernel_2.AuthorizationPolicyVariants.ASSIGN_ROLE.action: {
-                lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`);
-                break;
-            }
-            case ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.action: {
-                lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`);
-                break;
-            }
-            case ignis_kernel_2.AuthorizationPolicyVariants.GRANT.action: {
-                directGrants.push(row);
-                break;
-            }
-            default: {
-                this.logger
-                    .for(this.collectDirectRow.name)
-                    .error('Unexpected variant in the direct branch | variant: %s', row.variant);
-                break;
-            }
-        }
-    }
-    /**
-     * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using
-     * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no
-     * edges - the rows already gathered for this principal still load. This is the safe direction:
-     * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the
-     * failure degrades to less access rather than either an outage or excess access.
-     */
-    async resolveDomainEdgeLines(opts) {
-        if (!this.resolveDomainEdges) {
-            return [];
-        }
-        let edges;
-        try {
-            edges = await this.resolveDomainEdges(opts);
-        }
-        catch (error) {
-            this.logger
-                .for(this.resolveDomainEdgeLines.name)
-                .error('resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s', opts.principal.type, opts.principal.id, error);
-            return [];
-        }
-        return edges.map((edge) => `${ignis_kernel_2.AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`);
-    }
-    /** Schema for a table, defaulting to `public`. */
-    schemaOf(table) {
-        return table.schemaName ?? common_1.DEFAULT_SCHEMA;
-    }
-    /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */
-    domainTokenSelection(opts) {
-        const column = (name) => (0, drizzle_orm_1.sql) `${drizzle_orm_1.sql.raw(opts.alias)}.${drizzle_orm_1.sql.identifier(name)}`;
-        const domainType = column('domain_type');
-        const domainId = column('domain_id');
-        return (0, drizzle_orm_1.sql) `CASE
-      WHEN ${domainType} IS NULL THEN NULL
-      WHEN ${domainId} IS NULL THEN ${domainType}
-      ELSE ${domainType} || '_' || ${domainId}::text
-    END AS "domain"`;
-    }
-    /** Schema-qualified table reference (`"<schema>"."<table>"`) for use after FROM/JOIN with an alias. */
-    qualifiedTable(opts) {
-        const { table } = opts;
-        return (0, drizzle_orm_1.sql) `${drizzle_orm_1.sql.identifier(this.schemaOf(table))}.${drizzle_orm_1.sql.identifier(table.tableName)}`;
-    }
-    /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */
-    softDeleteClause(opts) {
-        const sd = this.entities.softDelete;
-        if (!sd?.use) {
-            return drizzle_orm_1.sql.empty();
-        }
-        return (0, drizzle_orm_1.sql) ` AND ${drizzle_orm_1.sql.raw(opts.alias)}.${drizzle_orm_1.sql.identifier(sd.columnName)} IS NULL`;
-    }
-    /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */
-    async queryPrincipalPolicies(opts) {
-        const { policyDefinition, permission, principals, domainTypes } = this.entities;
-        const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });
-        const permissionTable = this.qualifiedTable({ table: permission });
-        const { principal } = opts;
-        const metadataColumnName = policyDefinition.metadata?.columnName;
-        const metadataSelection = metadataColumnName
-            ? (0, drizzle_orm_1.sql) `, policyDefinition.${drizzle_orm_1.sql.identifier(metadataColumnName)} AS "metadata"`
-            : drizzle_orm_1.sql.empty();
-        const metadataNull = metadataColumnName ? (0, drizzle_orm_1.sql) `, NULL::jsonb AS "metadata"` : drizzle_orm_1.sql.empty();
-        const domainTypeList = drizzle_orm_1.sql.join(domainTypes.map((domainType) => (0, drizzle_orm_1.sql) `${domainType}`), (0, drizzle_orm_1.sql) `, `);
-        const rows = await this.query({
-            statement: (0, drizzle_orm_1.sql) `
-      WITH RECURSIVE role_closure AS (
-        SELECT policyDefinition.target_id AS role_id
-        FROM ${policyDefinitionTable} policyDefinition
-        WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.ASSIGN_ROLE.action}
-          AND policyDefinition.subject_type = ${principal.type}
-          AND policyDefinition.subject_id = ${principal.id}
-          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-        UNION
-
-        SELECT policyDefinition.target_id
-        FROM ${policyDefinitionTable} policyDefinition
-          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
-        WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-      ),
-
-      domain_closure AS (
-        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id
-        FROM ${policyDefinitionTable} policyDefinition
-        WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.action}
-          AND policyDefinition.subject_type = ${principal.type}
-          AND policyDefinition.subject_id = ${principal.id}
-          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-        UNION
-
-        SELECT policyDefinition.target_type, policyDefinition.target_id
-        FROM ${policyDefinitionTable} policyDefinition
-          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type
-                             AND policyDefinition.subject_id = domain_closure.dom_id
-        WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-      )
-
-      SELECT
-        ${policy_edges_1.PrincipalPolicyEdges.DIRECT}::text AS "kind",
-        policyDefinition.variant,
-        policyDefinition.subject_id::text AS "subjectId",
-        policyDefinition.target_type AS "targetType",
-        policyDefinition.target_id::text AS "targetId",
-        policyDefinition.action,
-        policyDefinition.effect,
-        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
-        permission.code AS "objectCode",
-        permission.subject AS "objectSubject",
-        permission.method AS "objectMethod"${metadataSelection}
-      FROM ${policyDefinitionTable} policyDefinition
-        LEFT JOIN ${permissionTable} permission
-          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}
-      WHERE policyDefinition.subject_type = ${principal.type}
-        AND policyDefinition.subject_id = ${principal.id}
-        AND policyDefinition.variant IN (
-          ${ignis_kernel_2.AuthorizationPolicyVariants.ASSIGN_ROLE.action},
-          ${ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.action},
-          ${ignis_kernel_2.AuthorizationPolicyVariants.GRANT.action}
-        )
-        AND (
-          policyDefinition.variant <> ${ignis_kernel_2.AuthorizationPolicyVariants.JOIN_DOMAIN.action}
-          OR policyDefinition.target_type IN (${domainTypeList})
-        )${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-      UNION ALL
-
-      SELECT
-        ${policy_edges_1.PrincipalPolicyEdges.ROLE_EDGE}::text AS "kind",
-        policyDefinition.variant,
-        policyDefinition.subject_id::text AS "subjectId",
-        policyDefinition.target_type AS "targetType",
-        policyDefinition.target_id::text AS "targetId",
-        NULL AS "action",
-        NULL AS "effect",
-        NULL AS "domain",
-        NULL AS "objectCode",
-        NULL AS "objectSubject",
-        NULL AS "objectMethod"${metadataNull}
-      FROM ${policyDefinitionTable} policyDefinition
-        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
-      WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-      UNION ALL
-
-      SELECT
-        ${policy_edges_1.PrincipalPolicyEdges.ROLE_GRANT}::text AS "kind",
-        policyDefinition.variant,
-        policyDefinition.subject_id::text AS "subjectId",
-        policyDefinition.target_type AS "targetType",
-        policyDefinition.target_id::text AS "targetId",
-        policyDefinition.action,
-        policyDefinition.effect,
-        ${this.domainTokenSelection({ alias: 'policyDefinition' })},
-        permission.code AS "objectCode",
-        permission.subject AS "objectSubject",
-        permission.method AS "objectMethod"${metadataSelection}
-      FROM ${policyDefinitionTable} policyDefinition
-        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id
-        LEFT JOIN ${permissionTable} permission
-          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}
-      WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.GRANT.action}
-        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-      UNION ALL
-
-      SELECT
-        ${policy_edges_1.PrincipalPolicyEdges.DOMAIN_EDGE}::text AS "kind",
-        policyDefinition.variant,
-        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS "subjectId",
-        NULL AS "targetType",
-        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS "targetId",
-        NULL AS "action",
-        NULL AS "effect",
-        NULL AS "domain",
-        NULL AS "objectCode",
-        NULL AS "objectSubject",
-        NULL AS "objectMethod"${metadataNull}
-      FROM ${policyDefinitionTable} policyDefinition
-        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type
-                           AND policyDefinition.subject_id = domain_closure.dom_id
-      WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-    `,
-        });
-        return rows;
-    }
-    /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */
-    async buildGrantLines(opts) {
-        const { subjectType, rows } = opts;
-        const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;
-        const lines = [];
-        const customRows = [];
-        for (const row of rows) {
-            if (!row.objectCode) {
-                this.logger
-                    .for(this.buildGrantLines.name)
-                    .error('Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s', subjectType, row.subjectId);
-                continue;
-            }
-            const domain = row.domain ?? ignis_kernel_2.AuthorizationDomainScopes.ANY_MEMBER;
-            const effect = row.effect ?? ignis_kernel_2.AuthorizationDecisions.ALLOW;
-            const parsed = metadataColumnName
-                ? ignis_kernel_1.GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })
-                : null;
-            const isCustomAction = row.action === ignis_kernel_2.AuthorizationActions.CUSTOM;
-            const isCustomRow = isCustomAction || Boolean(parsed);
-            if (!isCustomRow && !row.action) {
-                this.logger
-                    .for(this.buildGrantLines.name)
-                    .error('Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s', subjectType, row.subjectId, row.objectCode);
-                continue;
-            }
-            if (!isCustomRow) {
-                lines.push(`${ignis_kernel_2.AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`);
-                continue;
-            }
-            if (!row.objectSubject || !row.objectMethod) {
-                this.logger
-                    .for(this.buildGrantLines.name)
-                    .error('Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s', subjectType, row.subjectId, row.objectCode);
-                continue;
-            }
-            const rejection = this.customGrantExpander.rejectCustomRow({
-                row: {
-                    subjectId: row.subjectId,
-                    objectCode: row.objectCode,
-                    objectMethod: row.objectMethod,
-                },
-                parsed,
-                isCustomAction,
-                metadataColumnName,
-            });
-            if (rejection) {
-                this.logger.for(this.buildGrantLines.name).error(rejection);
-                continue;
-            }
-            customRows.push({
-                subjectId: row.subjectId,
-                objectSubject: row.objectSubject,
-                ops: parsed.ops,
-                domain,
-                effect,
-            });
-        }
-        const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });
-        for (const rejection of expanded.rejections) {
-            this.logger.for(this.buildGrantLines.name).error(rejection);
-        }
-        lines.push(...expanded.lines);
-        return lines;
-    }
-    /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
-    async queryEdgePolicies() {
-        const { policyDefinition, permission } = this.entities;
-        const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });
-        const permissionTable = this.qualifiedTable({ table: permission });
-        const rows = await this.query({
-            statement: (0, drizzle_orm_1.sql) `
-      SELECT
-        ${ignis_kernel_2.AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS "rel",
-        child_permission.code AS "child",
-        parent_permission.code AS "parent"
-      FROM ${policyDefinitionTable} policyDefinition
-        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id
-        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id
-      WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-
-      UNION ALL
-
-      SELECT
-        ${ignis_kernel_2.AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS "rel",
-        policyDefinition.subject_id::text AS "child",
-        policyDefinition.target_id::text AS "parent"
-      FROM ${policyDefinitionTable} policyDefinition
-      WHERE policyDefinition.variant = ${ignis_kernel_2.AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}
-    `,
-        });
-        return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);
-    }
-}
-exports.ScopedCasbinAdapter = ScopedCasbinAdapter;
-//# sourceMappingURL=adapter.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,wDAAqD;AACrD,wDAK+B;AAC/B,oDAAuD;AACvD,oEAAqF;AAErF,iDAAgF;AAChF,qCAMkB;AAElB;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,mCAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,2CAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,mCAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,0CAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,0CAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,uBAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,IAAA,iBAAG,EAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,IAAA,iBAAG,EAAA,sBAAsB,iBAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,6BAA6B,CAAC,CAAC,CAAC,iBAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,iBAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAA,iBAAG,EAAA,GAAG,UAAU,EAAE,CAAC,EACnD,IAAA,iBAAG,EAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,IAAA,iBAAG,EAAA;;;eAGL,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,mCAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,0CAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,0CAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,mCAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,0CAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,mCAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,0CAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,mCAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,wCAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,qCAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,2BAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,mCAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,IAAA,iBAAG,EAAA;;UAEV,0CAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,0CAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,0CAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,0CAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AAxdD,kDAwdC","sourcesContent":["import type { IdType } from '@/base';\nimport { type Model } from 'casbin';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { GrantBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '@venizia/ignis-kernel';\nimport { BaseFilteredAdapter } from '../base-filtered';\nimport { CustomGrantExpander, type TCustomGrantRow } from '../custom-grant-expander';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';\nimport { PrincipalPolicyEdges, type TPrincipalPolicyRow } from './policy-edges';\nimport {\n  DEFAULT_SCHEMA,\n  type IScopedCasbinPolicyFilter,\n  type TDomainHierarchyEdge,\n  type TGrantRow,\n  type TResolveDomainEdgesFn,\n} from './common';\n\n/**\n * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,\n * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.\n *\n * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.\n * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications\n * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion\n * filter would sweep those unknown rows into a branch that has no idea what they mean. The current\n * shape makes an undeclared variant inert, which is what makes sharing the table safe.\n */\nexport class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {\n  protected readonly entities: IScopedCasbinEntities;\n  protected readonly customGrantExpander: CustomGrantExpander;\n  protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: IScopedCasbinEntities;\n    resolveDomainEdges?: TResolveDomainEdgesFn;\n  }) {\n    super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });\n    this.entities = opts.entities;\n    this.resolveDomainEdges = opts.resolveDomainEdges;\n    this.customGrantExpander = new CustomGrantExpander({\n      dataSource: opts.dataSource,\n      entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },\n    });\n  }\n\n  /**\n   * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -\n   * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot\n   * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does\n   * not wait for the structural-edges query either: both run concurrently once the closure is known.\n   */\n  async loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void> {\n    const { principal } = filter;\n    const { principals } = this.entities;\n\n    const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });\n    const structuralEdgesPromise = this.queryEdgePolicies();\n    const principalRows = await principalPoliciesPromise;\n\n    const lines: string[] = [];\n    const directGrants: TGrantRow[] = [];\n    const roleGrants: TGrantRow[] = [];\n    const domainClosure = new Set<string>();\n\n    for (const row of principalRows) {\n      switch (row.kind) {\n        case PrincipalPolicyEdges.ROLE_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`,\n          );\n          break;\n        }\n\n        case PrincipalPolicyEdges.ROLE_GRANT: {\n          roleGrants.push(row);\n          break;\n        }\n\n        case PrincipalPolicyEdges.DOMAIN_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`,\n          );\n          // Both ends are, by construction, members of the principal's domain_closure CTE.\n          domainClosure.add(String(row.subjectId));\n          domainClosure.add(String(row.targetId));\n          break;\n        }\n\n        default: {\n          if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {\n            domainClosure.add(`${row.targetType}_${row.targetId}`);\n          }\n          this.collectDirectRow({ row, principal, lines, directGrants });\n          break;\n        }\n      }\n    }\n\n    const hookLinesPromise = this.resolveDomainEdgeLines({\n      principal,\n      domains: [...domainClosure],\n    });\n\n    lines.push(\n      ...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })),\n    );\n    lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));\n\n    const [structuralEdges, hookLines] = await Promise.all([\n      structuralEdgesPromise,\n      hookLinesPromise,\n    ]);\n    lines.push(...structuralEdges);\n    lines.push(...hookLines);\n\n    await this.loadLines({ model, lines });\n  }\n\n  /** Route one `direct` row to its casbin line, or to the grant batch. */\n  protected collectDirectRow(opts: {\n    row: TPrincipalPolicyRow;\n    principal: { type: string; id: IdType };\n    lines: string[];\n    directGrants: TGrantRow[];\n  }): void {\n    const { row, principal, lines, directGrants } = opts;\n    const { principals } = this.entities;\n\n    switch (row.variant) {\n      case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.GRANT.action: {\n        directGrants.push(row);\n        break;\n      }\n\n      default: {\n        this.logger\n          .for(this.collectDirectRow.name)\n          .error('Unexpected variant in the direct branch | variant: %s', row.variant);\n        break;\n      }\n    }\n  }\n\n  /**\n   * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using\n   * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no\n   * edges - the rows already gathered for this principal still load. This is the safe direction:\n   * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the\n   * failure degrades to less access rather than either an outage or excess access.\n   */\n  protected async resolveDomainEdgeLines(opts: {\n    principal: { type: string; id: IdType };\n    domains: string[];\n  }): Promise<string[]> {\n    if (!this.resolveDomainEdges) {\n      return [];\n    }\n\n    let edges: TDomainHierarchyEdge[];\n    try {\n      edges = await this.resolveDomainEdges(opts);\n    } catch (error) {\n      this.logger\n        .for(this.resolveDomainEdgeLines.name)\n        .error(\n          'resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s',\n          opts.principal.type,\n          opts.principal.id,\n          error,\n        );\n      return [];\n    }\n\n    return edges.map(\n      (edge) =>\n        `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`,\n    );\n  }\n\n  /** Schema for a table, defaulting to `public`. */\n  protected schemaOf(table: { schemaName?: string }): string {\n    return table.schemaName ?? DEFAULT_SCHEMA;\n  }\n\n  /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */\n  protected domainTokenSelection(opts: { alias: string }): SQL {\n    const column = (name: string) => sql`${sql.raw(opts.alias)}.${sql.identifier(name)}`;\n    const domainType = column('domain_type');\n    const domainId = column('domain_id');\n\n    return sql`CASE\n      WHEN ${domainType} IS NULL THEN NULL\n      WHEN ${domainId} IS NULL THEN ${domainType}\n      ELSE ${domainType} || '_' || ${domainId}::text\n    END AS \"domain\"`;\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  protected qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    return sql`${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  protected softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.entities.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */\n  protected async queryPrincipalPolicies(opts: {\n    principal: { type: string; id: IdType };\n  }): Promise<TPrincipalPolicyRow[]> {\n    const { policyDefinition, permission, principals, domainTypes } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n    const { principal } = opts;\n\n    const metadataColumnName = policyDefinition.metadata?.columnName;\n    const metadataSelection = metadataColumnName\n      ? sql`, policyDefinition.${sql.identifier(metadataColumnName)} AS \"metadata\"`\n      : sql.empty();\n    const metadataNull = metadataColumnName ? sql`, NULL::jsonb AS \"metadata\"` : sql.empty();\n\n    const domainTypeList = sql.join(\n      domainTypes.map((domainType) => sql`${domainType}`),\n      sql`, `,\n    );\n\n    const rows = await this.query<TPrincipalPolicyRow>({\n      statement: sql`\n      WITH RECURSIVE role_closure AS (\n        SELECT policyDefinition.target_id AS role_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      ),\n\n      domain_closure AS (\n        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_type, policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                             AND policyDefinition.subject_id = domain_closure.dom_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      )\n\n      SELECT\n        ${PrincipalPolicyEdges.DIRECT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.subject_type = ${principal.type}\n        AND policyDefinition.subject_id = ${principal.id}\n        AND policyDefinition.variant IN (\n          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},\n          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},\n          ${AuthorizationPolicyVariants.GRANT.action}\n        )\n        AND (\n          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          OR policyDefinition.target_type IN (${domainTypeList})\n        )${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}\n        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS \"subjectId\",\n        NULL AS \"targetType\",\n        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                           AND policyDefinition.subject_id = domain_closure.dom_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows;\n  }\n\n  /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */\n  protected async buildGrantLines(opts: {\n    subjectType: string;\n    rows: TGrantRow[];\n  }): Promise<string[]> {\n    const { subjectType, rows } = opts;\n    const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;\n\n    const lines: string[] = [];\n    const customRows: TCustomGrantRow[] = [];\n\n    for (const row of rows) {\n      if (!row.objectCode) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s',\n            subjectType,\n            row.subjectId,\n          );\n        continue;\n      }\n\n      const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;\n      const effect = row.effect ?? AuthorizationDecisions.ALLOW;\n      const parsed = metadataColumnName\n        ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })\n        : null;\n      const isCustomAction = row.action === AuthorizationActions.CUSTOM;\n      const isCustomRow = isCustomAction || Boolean(parsed);\n\n      if (!isCustomRow && !row.action) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      if (!isCustomRow) {\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`,\n        );\n        continue;\n      }\n\n      if (!row.objectSubject || !row.objectMethod) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      const rejection = this.customGrantExpander.rejectCustomRow({\n        row: {\n          subjectId: row.subjectId,\n          objectCode: row.objectCode,\n          objectMethod: row.objectMethod,\n        },\n        parsed,\n        isCustomAction,\n        metadataColumnName,\n      });\n\n      if (rejection) {\n        this.logger.for(this.buildGrantLines.name).error(rejection);\n        continue;\n      }\n\n      customRows.push({\n        subjectId: row.subjectId,\n        objectSubject: row.objectSubject,\n        ops: parsed!.ops,\n        domain,\n        effect,\n      });\n    }\n\n    const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });\n    for (const rejection of expanded.rejections) {\n      this.logger.for(this.buildGrantLines.name).error(rejection);\n    }\n    lines.push(...expanded.lines);\n\n    return lines;\n  }\n\n  /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */\n  protected async queryEdgePolicies(): Promise<string[]> {\n    const { policyDefinition, permission } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n\n    const rows = await this.query<{ rel: string; child: string; parent: string }>({\n      statement: sql`\n      SELECT\n        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS \"rel\",\n        child_permission.code AS \"child\",\n        parent_permission.code AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id\n        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS \"rel\",\n        policyDefinition.subject_id::text AS \"child\",\n        policyDefinition.target_id::text AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);\n  }\n}\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,WAAW,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.js

@@ -1,5 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_SCHEMA = void 0;
-exports.DEFAULT_SCHEMA = 'public';
-//# sourceMappingURL=constants.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,QAAQ,CAAC","sourcesContent":["export const DEFAULT_SCHEMA = 'public';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts

@@ -1,3 +0,0 @@
-export * from './types';
-export * from './constants';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./types"), exports);
-__exportStar(require("./constants"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8CAA4B","sourcesContent":["export * from './types';\nexport * from './constants';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts

@@ -1,50 +0,0 @@
-import type { IdType } from '../../../../../../base';
-import type { TNullable } from '@venizia/ignis-helpers/common';
-export type TDomainHierarchyEdge = {
-    child: string;
-    parent: string;
-};
-export interface IScopedCasbinPolicyFilter {
-    principal: {
-        type: string;
-        id: IdType;
-    };
-}
-/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */
-export type TGrantRow = {
-    subjectId: IdType;
-    objectCode: TNullable<string>;
-    objectSubject: TNullable<string>;
-    objectMethod: TNullable<string>;
-    action: TNullable<string>;
-    effect: TNullable<string>;
-    domain: TNullable<string>;
-    metadata?: unknown;
-};
-/**
- * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant
- * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app
- * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the
- * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own
- * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side
- * re-formats them.
- *
- * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both
- * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via
- * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported
- * from a mechanism that derived its domains from `assign_role` will silently lose access for
- * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.
- *
- * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one
- * function per axis and concatenate their results here - this hook deliberately takes a single
- * function, so composition stays visible in the application, not hidden inside the framework:
- * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.
- */
-export type TResolveDomainEdgesFn = (opts: {
-    principal: {
-        type: string;
-        id: IdType;
-    };
-    domains: string[];
-}) => Promise<TDomainHierarchyEdge[]>;
-//# sourceMappingURL=types.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,gHAAgH;AAChH,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,KAAK,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/common/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/common/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { TNullable } from '@venizia/ignis-helpers/common';\n\nexport type TDomainHierarchyEdge = { child: string; parent: string };\n\nexport interface IScopedCasbinPolicyFilter {\n  principal: { type: string; id: IdType };\n}\n\n/** A grant row as fetched, before it becomes casbin lines. Permission columns are null when the join misses. */\nexport type TGrantRow = {\n  subjectId: IdType;\n  objectCode: TNullable<string>;\n  objectSubject: TNullable<string>;\n  objectMethod: TNullable<string>;\n  action: TNullable<string>;\n  effect: TNullable<string>;\n  domain: TNullable<string>;\n  metadata?: unknown;\n};\n\n/**\n * Per-principal domain edges sourced from business data the app already owns (e.g. a tenant\n * foreign key) - read live on every cache miss, never duplicated into `domain_inherits`. An app\n * whose hierarchy genuinely lives in `domain_inherits` rows does not need this hook at all: the\n * DOMAIN_EDGE branch above already emits those as `g3` lines. `domains` is the principal's own\n * domain closure, already `<Type>_<id>` tokens; the returned edges must be too - neither side\n * re-formats them.\n *\n * `domains` is the principal's **membership closure** - built from `join_domain` rows plus both\n * ends of every `domainEdge` row. It is NOT the set of domains the principal holds a role in via\n * `assign_role`: a principal can carry `assign_role` at a domain it never joined. A hook ported\n * from a mechanism that derived its domains from `assign_role` will silently lose access for\n * exactly those principals - no error, no log, just fewer edges reaching `g`/`g2`/`g3` than before.\n *\n * More than one hierarchy axis (e.g. an organizer tree and a separate region tree)? Write one\n * function per axis and concatenate their results here - this hook deliberately takes a single\n * function, so composition stays visible in the application, not hidden inside the framework:\n * `resolveDomainEdges: async opts => [...(await organizerEdges(opts)), ...(await regionEdges(opts))]`.\n */\nexport type TResolveDomainEdgesFn = (opts: {\n  principal: { type: string; id: IdType };\n  domains: string[];\n}) => Promise<TDomainHierarchyEdge[]>;\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/index.d.ts

@@ -1,4 +0,0 @@
-export type { IScopedCasbinPolicyFilter, TDomainHierarchyEdge, TGrantRow, TResolveDomainEdgesFn, } from './common';
-export * from './policy-edges';
-export * from './adapter';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/scoped-casbin/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,yBAAyB,EACzB,oBAAoB,EACpB,SAAS,EACT,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./policy-edges"), exports);
-__exportStar(require("./adapter"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAQA,iDAA+B;AAC/B,4CAA0B","sourcesContent":["// DEFAULT_SCHEMA (common/constants.ts) was module-private in the pre-split file - re-export only\n// the types, never the whole './common' barrel, or it leaks into the public surface.\nexport type {\n  IScopedCasbinPolicyFilter,\n  TDomainHierarchyEdge,\n  TGrantRow,\n  TResolveDomainEdgesFn,\n} from './common';\nexport * from './policy-edges';\nexport * from './adapter';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts

@@ -1,17 +0,0 @@
-import type { IdType } from '../../../../../base';
-import type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';
-import type { TGrantRow } from './common';
-export declare class PrincipalPolicyEdges {
-    static readonly DIRECT = "direct";
-    static readonly ROLE_EDGE = "roleEdge";
-    static readonly ROLE_GRANT = "roleGrant";
-    static readonly DOMAIN_EDGE = "domainEdge";
-}
-/** A row from the single principal-policy statement; `kind` says which branch produced it. */
-export type TPrincipalPolicyRow = TGrantRow & {
-    kind: TConstValue<typeof PrincipalPolicyEdges>;
-    variant: string;
-    targetType: TNullable<string>;
-    targetId: IdType;
-};
-//# sourceMappingURL=policy-edges.d.ts.map