@venizia/ignis 0.4.3 → 0.4.4

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-edges.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc;IACvC,MAAM,CAAC,QAAQ,CAAC,UAAU,eAAe;IACzC,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;CAC5C;AAED,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG;IAC5C,IAAI,EAAE,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC"}

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrincipalPolicyEdges = void 0;
-class PrincipalPolicyEdges {
-    static { this.DIRECT = 'direct'; }
-    static { this.ROLE_EDGE = 'roleEdge'; }
-    static { this.ROLE_GRANT = 'roleGrant'; }
-    static { this.DOMAIN_EDGE = 'domainEdge'; }
-}
-exports.PrincipalPolicyEdges = PrincipalPolicyEdges;
-//# sourceMappingURL=policy-edges.js.map

package/dist/components/auth/authorize/adapters/scoped-casbin/policy-edges.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-edges.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/scoped-casbin/policy-edges.ts"],"names":[],"mappings":";;;AAIA,MAAa,oBAAoB;aACf,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,UAAU,CAAC;aACvB,eAAU,GAAG,WAAW,CAAC;aACzB,gBAAW,GAAG,YAAY,CAAC;;AAJ7C,oDAKC","sourcesContent":["import type { IdType } from '@/base';\nimport type { TConstValue, TNullable } from '@venizia/ignis-helpers/common';\nimport type { TGrantRow } from './common';\n\nexport class PrincipalPolicyEdges {\n  static readonly DIRECT = 'direct';\n  static readonly ROLE_EDGE = 'roleEdge';\n  static readonly ROLE_GRANT = 'roleGrant';\n  static readonly DOMAIN_EDGE = 'domainEdge';\n}\n\n/** A row from the single principal-policy statement; `kind` says which branch produced it. */\nexport type TPrincipalPolicyRow = TGrantRow & {\n  kind: TConstValue<typeof PrincipalPolicyEdges>;\n  variant: string;\n  targetType: TNullable<string>;\n  targetId: IdType;\n};\n"]}

package/dist/components/auth/authorize/component.d.ts

@@ -1,10 +0,0 @@
-import type { BaseApplication } from '../../../base/applications/base';
-import { BaseComponent } from '@venizia/ignis-kernel';
-import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
-export declare class AuthorizeComponent extends BaseComponent {
-    private application;
-    constructor(application: BaseApplication);
-    binding(): ValueOrPromise<void>;
-    private bindAlwaysAllowRoles;
-}
-//# sourceMappingURL=component.d.ts.map

package/dist/components/auth/authorize/component.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAItD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAOpE,qBAAa,kBAAmB,SAAQ,aAAa;IAEG,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,eAAe;IAQjF,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;IAsBxC,OAAO,CAAC,oBAAoB;CAS7B"}

package/dist/components/auth/authorize/component.js

@@ -1,60 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var AuthorizeComponent_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizeComponent = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_4 = require("@venizia/ignis-kernel");
-let AuthorizeComponent = AuthorizeComponent_1 = class AuthorizeComponent extends ignis_kernel_1.BaseComponent {
-    constructor(application) {
-        super({
-            scope: AuthorizeComponent_1.name,
-            initDefault: { enable: true, container: application },
-        });
-        this.application = application;
-    }
-    binding() {
-        const options = this.application.get({
-            key: ignis_kernel_4.AuthorizeBindingKeys.OPTIONS,
-            isOptional: true,
-        });
-        if (!options) {
-            throw (0, core_1.getError)({
-                message: '[AuthorizeComponent] No authorize options found. Bind options to AuthorizeBindingKeys.OPTIONS before registering the component.',
-            });
-        }
-        this.bindAlwaysAllowRoles({ options });
-        // The registry otherwise finds options only through a registered enforcer's container, so
-        // `defaultDecision` would be unreadable in the one case it decides: no enforcer registered.
-        ignis_kernel_4.AuthorizationEnforcerRegistry.getInstance().setOptions({ options });
-        this.logger.for(this.binding.name).info('Authorization configured');
-    }
-    bindAlwaysAllowRoles(opts) {
-        if (!opts.options.alwaysAllowRoles?.length) {
-            return;
-        }
-        this.application
-            .bind({ key: ignis_kernel_4.AuthorizeBindingKeys.ALWAYS_ALLOW_ROLES })
-            .toValue(opts.options.alwaysAllowRoles);
-    }
-};
-exports.AuthorizeComponent = AuthorizeComponent;
-exports.AuthorizeComponent = AuthorizeComponent = AuthorizeComponent_1 = __decorate([
-    __param(0, (0, ignis_kernel_2.inject)({ key: ignis_kernel_3.CoreBindings.APPLICATION_INSTANCE })),
-    __metadata("design:paramtypes", [Function])
-], AuthorizeComponent);
-//# sourceMappingURL=component.js.map

package/dist/components/auth/authorize/component.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authorize/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,wDAA+C;AAC/C,wDAAqD;AACrD,sDAAuD;AAEvD,wDAI+B;AAE/B,IAAa,kBAAkB,0BAA/B,MAAa,kBAAmB,SAAQ,4BAAa;IACnD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,oBAAkB,CAAC,IAAI;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;SACtD,CAAC,CAAC;QALyD,gBAAW,GAAX,WAAW,CAAiB;IAM1F,CAAC;IAEQ,OAAO;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAoB;YACtD,GAAG,EAAE,mCAAoB,CAAC,OAAO;YACjC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,iIAAiI;aACpI,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvC,0FAA0F;QAC1F,4FAA4F;QAC5F,4CAA6B,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAEO,oBAAoB,CAAC,IAAoC;QAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAAW,EAAE,GAAG,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC;aAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAzCY,gDAAkB;6BAAlB,kBAAkB;IAE1B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,kBAAkB,CAyC9B","sourcesContent":["import type { BaseApplication } from '@/base/applications/base';\nimport { BaseComponent } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { CoreBindings } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport {\n  AuthorizationEnforcerRegistry,\n  AuthorizeBindingKeys,\n  type IAuthorizeOptions,\n} from '@venizia/ignis-kernel';\n\nexport class AuthorizeComponent extends BaseComponent {\n  constructor(\n    @inject({ key: CoreBindings.APPLICATION_INSTANCE }) private application: BaseApplication,\n  ) {\n    super({\n      scope: AuthorizeComponent.name,\n      initDefault: { enable: true, container: application },\n    });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    const options = this.application.get<IAuthorizeOptions>({\n      key: AuthorizeBindingKeys.OPTIONS,\n      isOptional: true,\n    });\n\n    if (!options) {\n      throw getError({\n        message:\n          '[AuthorizeComponent] No authorize options found. Bind options to AuthorizeBindingKeys.OPTIONS before registering the component.',\n      });\n    }\n\n    this.bindAlwaysAllowRoles({ options });\n\n    // The registry otherwise finds options only through a registered enforcer's container, so\n    // `defaultDecision` would be unreadable in the one case it decides: no enforcer registered.\n    AuthorizationEnforcerRegistry.getInstance().setOptions({ options });\n\n    this.logger.for(this.binding.name).info('Authorization configured');\n  }\n\n  private bindAlwaysAllowRoles(opts: { options: IAuthorizeOptions }): void {\n    if (!opts.options.alwaysAllowRoles?.length) {\n      return;\n    }\n\n    this.application\n      .bind<string[]>({ key: AuthorizeBindingKeys.ALWAYS_ALLOW_ROLES })\n      .toValue(opts.options.alwaysAllowRoles);\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/casbin-module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"casbin-module.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAEA,iOAAiO;AACjO,qBAAa,YAAY;WACV,IAAI,IAAI,OAAO,CAAC,cAAc,QAAQ,CAAC,CAAC;CAUtD"}

package/dist/components/auth/authorize/enforcers/casbin-module.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CasbinModule = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
-/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */
-class CasbinModule {
-    static async load() {
-        try {
-            return await import('casbin');
-        }
-        catch {
-            throw (0, core_1.getError)({
-                message: '[CasbinModule] "casbin" is not installed | Install the optional peer casbin to use the casbin enforcer',
-            });
-        }
-    }
-}
-exports.CasbinModule = CasbinModule;
-//# sourceMappingURL=casbin-module.js.map

package/dist/components/auth/authorize/enforcers/casbin-module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAEvD,iOAAiO;AACjO,MAAa,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAXD,oCAWC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\n\n/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */\nexport class CasbinModule {\n  static async load(): Promise<typeof import('casbin')> {\n    try {\n      return await import('casbin');\n    } catch {\n      throw getError({\n        message:\n          '[CasbinModule] \"casbin\" is not installed | Install the optional peer casbin to use the casbin enforcer',\n      });\n    }\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/casbin.enforcer.d.ts

@@ -1,90 +0,0 @@
-import { type TContext } from '@venizia/ignis-kernel';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import type { Enforcer as CasbinEnforcerType } from 'casbin';
-import { type Env } from 'hono';
-import { type IAuthorizationEnforcer, type IAuthorizationUser, type ICasbinEnforcerOptions, type ICasbinRules, type IAuthorizationRequest, type TAuthorizationDecision, type TCasbinDomainMatchingFunction } from '@venizia/ignis-kernel';
-import { UserPolicyLineCache } from './user-policy-line-cache';
-/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */
-type TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {
-    user: IAuthorizationUser;
-    action: TAction;
-    resource: TResource;
-    context: TContext<E, string>;
-}) => {
-    subject: string;
-    resource: string;
-    action: string;
-    domain?: string;
-};
-export declare class CasbinAuthorizationEnforcer<E extends Env = Env, TAction extends string = string, TResource extends string = string> extends BaseHelper implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules> {
-    private options;
-    name: string;
-    private readonly MIN_EXPIRES_IN;
-    private pool;
-    private helper;
-    private userPolicyLineCache;
-    private resolvedPayloadFn;
-    constructor(options: ICasbinEnforcerOptions<E, TAction, TResource>);
-    configure(): Promise<void>;
-    destroy(): void;
-    /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */
-    protected assertMatcherCompilesSync(opts: {
-        enforcer: CasbinEnforcerType;
-    }): void;
-    buildRules(opts: {
-        user: IAuthorizationUser;
-        context: TContext<E, string>;
-    }): Promise<ICasbinRules>;
-    evaluate(opts: {
-        rules: ICasbinRules;
-        request: IAuthorizationRequest<TAction, TResource>;
-        context: TContext<E, string>;
-    }): Promise<TAuthorizationDecision>;
-    /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */
-    protected enforceWithExplain(opts: {
-        enforcer: CasbinEnforcerType;
-        vals: string[];
-    }): boolean;
-    invalidateUserCache(opts: {
-        user: IAuthorizationUser;
-    }): Promise<{
-        invalidatedKeys: number;
-    }>;
-    rebuildUserCache(opts: {
-        user: IAuthorizationUser;
-    }): Promise<{
-        cacheKey: string;
-        lineCount: number;
-    }>;
-    /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */
-    protected requireRedisCache(): UserPolicyLineCache;
-    protected registerMatchers(opts: {
-        enforcer: CasbinEnforcerType;
-        casbin: typeof import('casbin');
-    }): Promise<void>;
-    /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */
-    protected resolveDomainMatchingFn(opts: {
-        casbin: typeof import('casbin');
-        name: TCasbinDomainMatchingFunction;
-    }): (arg1: string, arg2: string) => boolean;
-    /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */
-    protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined;
-    protected resolveModel(opts: {
-        casbin: typeof import('casbin');
-        model: ICasbinEnforcerOptions['model'];
-    }): import("casbin").Model;
-    protected validateExpiresIn(opts: {
-        expiresIn: number;
-    }): void;
-    /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */
-    protected extractUserLines(opts: {
-        user: IAuthorizationUser;
-    }): Promise<string[]>;
-    /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */
-    protected loadPolicyLinesIntoModel(opts: {
-        enforcer: CasbinEnforcerType;
-        lines: string[];
-    }): Promise<void>;
-}
-export {};
-//# sourceMappingURL=casbin.enforcer.d.ts.map

package/dist/components/auth/authorize/enforcers/casbin.enforcer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"casbin.enforcer.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAA4B,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAG/B,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EACnC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,mFAAmF;AACnF,KAAK,mBAAmB,CAAC,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,qBAAa,2BAA2B,CACtC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CAEjC,SAAQ,UACR,YAAW,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;IAepE,OAAO,CAAC,OAAO;IAbjB,IAAI,SAAoC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC,OAAO,CAAC,IAAI,CAAuD;IACnE,OAAO,CAAC,MAAM,CAA4C;IAE1D,OAAO,CAAC,mBAAmB,CAAwC;IAGnE,OAAO,CAAC,iBAAiB,CAA+D;gBAI9E,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC;IAO1D,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IA2ChC,OAAO,IAAI,IAAI;IAMf,0MAA0M;IAC1M,SAAS,CAAC,yBAAyB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE;IAiBpE,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;QACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAWnB,QAAQ,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsDnC,yGAAyG;IACzG,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO;IAiBvF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBlC,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBpD,kMAAkM;IAClM,SAAS,CAAC,iBAAiB,IAAI,mBAAmB;cAkBlC,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgEjB,gFAAgF;IAChF,SAAS,CAAC,uBAAuB,CAAC,IAAI,EAAE;QACtC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,IAAI,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO;IA2B3C,gGAAgG;IAChG,SAAS,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS;IAmB1F,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;KACxC;IAkBD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAY9D,gNAAgN;cAChM,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvF,oJAAoJ;cACpI,wBAAwB,CAAC,IAAI,EAAE;QAC7C,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAalB"}

package/dist/components/auth/authorize/enforcers/casbin.enforcer.js

@@ -1,320 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var CasbinAuthorizationEnforcer_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CasbinAuthorizationEnforcer = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const domain_hierarchy_1 = require("../role-managers/domain-hierarchy");
-const casbin_module_1 = require("./casbin-module");
-const membership_1 = require("../role-managers/membership");
-const resource_1 = require("../role-managers/resource");
-const policy_line_codec_1 = require("./policy-line-codec");
-const user_policy_line_cache_1 = require("./user-policy-line-cache");
-// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.
-let CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer_1 = class CasbinAuthorizationEnforcer extends core_1.BaseHelper {
-    constructor(options) {
-        super({ scope: CasbinAuthorizationEnforcer_1.name });
-        this.options = options;
-        this.name = CasbinAuthorizationEnforcer_1.name;
-        this.MIN_EXPIRES_IN = 10_000;
-        this.pool = null;
-        this.helper = null;
-        // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.
-        this.userPolicyLineCache = null;
-        // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).
-        this.resolvedPayloadFn = null;
-    }
-    // Lifecycle
-    async configure() {
-        const casbin = await casbin_module_1.CasbinModule.load();
-        if (!this.options.model) {
-            throw (0, core_1.getError)({
-                message: '[CasbinAuthorizationEnforcer] options.model is required.',
-            });
-        }
-        this.helper = casbin.Helper;
-        this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();
-        const { cached } = this.options;
-        if (cached.use) {
-            this.validateExpiresIn({ expiresIn: cached.options.expiresIn });
-        }
-        this.pool = new core_1.BasePoolHelper({
-            scope: `${CasbinAuthorizationEnforcer_1.name}.Pool`,
-            size: this.options.poolSize ?? 16,
-            acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,
-            create: async () => {
-                const model = this.resolveModel({ casbin, model: this.options.model });
-                const enforcer = await casbin.newEnforcer(model);
-                await this.registerMatchers({ enforcer, casbin });
-                this.assertMatcherCompilesSync({ enforcer });
-                return enforcer;
-            },
-        });
-        await this.pool.warmup();
-        this.logger
-            .for(this.configure.name)
-            .info('Casbin enforcer pool ready (size: %s, cached: %s)', this.options.poolSize ?? 16, cached.use ? cached.driver : 'none');
-    }
-    destroy() {
-        this.pool?.destroy().catch((error) => {
-            this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);
-        });
-    }
-    /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */
-    assertMatcherCompilesSync(opts) {
-        try {
-            if (this.options.isScoped || this.options.normalizePayloadFn) {
-                opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');
-                return;
-            }
-            opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');
-        }
-        catch (error) {
-            throw (0, core_1.getError)({
-                message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,
-            });
-        }
-    }
-    // IAuthorizationEnforcer - public API
-    async buildRules(opts) {
-        const { user } = opts;
-        const cached = this.options.cached;
-        const lines = cached.use
-            ? await this.requireRedisCache().fetch({ user })
-            : await this.extractUserLines({ user });
-        return { user, lines };
-    }
-    async evaluate(opts) {
-        if (!this.pool) {
-            throw (0, core_1.getError)({
-                message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',
-            });
-        }
-        if (!opts.request?.action || !opts.request?.resource) {
-            throw (0, core_1.getError)({
-                message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',
-            });
-        }
-        const { rules, request, context } = opts;
-        const { user, lines } = rules;
-        return this.pool.use({
-            execution: async (enforcer) => {
-                await this.loadPolicyLinesIntoModel({ enforcer, lines });
-                const normalizePayloadFn = this.resolvedPayloadFn;
-                if (!normalizePayloadFn) {
-                    const subject = `${user.principalType}_${user.userId}`;
-                    const isAllowed = this.enforceWithExplain({
-                        enforcer,
-                        vals: [subject, String(request.resource), String(request.action)],
-                    });
-                    return isAllowed ? ignis_kernel_3.AuthorizationDecisions.ALLOW : ignis_kernel_3.AuthorizationDecisions.DENY;
-                }
-                const normalized = normalizePayloadFn({
-                    user,
-                    action: request.action,
-                    resource: request.resource,
-                    context,
-                });
-                // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.
-                const domain = normalized.domain ??
-                    request.domain ??
-                    (this.options.isScoped ? ignis_kernel_3.AuthorizationDomainScopes.SYSTEM_WIDE : undefined);
-                const vals = domain
-                    ? [normalized.subject, domain, normalized.resource, normalized.action]
-                    : [normalized.subject, normalized.resource, normalized.action];
-                const isAllowed = this.enforceWithExplain({ enforcer, vals });
-                return isAllowed ? ignis_kernel_3.AuthorizationDecisions.ALLOW : ignis_kernel_3.AuthorizationDecisions.DENY;
-            },
-        });
-    }
-    /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */
-    enforceWithExplain(opts) {
-        const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);
-        if (!isAllowed) {
-            this.logger
-                .for(this.evaluate.name)
-                .info('DENY | request: [%s] | matchedPolicy: %s', opts.vals.join(', '), matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>');
-        }
-        return isAllowed;
-    }
-    // Cache management - optional IAuthorizationEnforcer members (on-demand)
-    async invalidateUserCache(opts) {
-        const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({
-            user: opts.user,
-        });
-        this.logger
-            .for(this.invalidateUserCache.name)
-            .info('Invalidated authz cache | user: %s | key: %s | deleted: %s', opts.user.userId, cacheKey, invalidatedKeys);
-        return { invalidatedKeys };
-    }
-    async rebuildUserCache(opts) {
-        // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.
-        const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });
-        this.logger
-            .for(this.rebuildUserCache.name)
-            .info('Rebuilt authz cache | user: %s | key: %s | lines: %s', opts.user.userId, cacheKey, lines.length);
-        return { cacheKey, lineCount: lines.length };
-    }
-    /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */
-    requireRedisCache() {
-        const { cached } = this.options;
-        if (!cached.use) {
-            throw (0, core_1.getError)({
-                message: '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',
-            });
-        }
-        return (this.userPolicyLineCache ??= new user_policy_line_cache_1.UserPolicyLineCache({
-            cached,
-            loadLines: (opts) => this.extractUserLines(opts),
-        }));
-    }
-    // Matchers & model resolvers
-    async registerMatchers(opts) {
-        const { enforcer, casbin } = opts;
-        const { domainMatching, isScoped } = this.options;
-        if (domainMatching) {
-            if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {
-                throw (0, core_1.getError)({
-                    message: `[registerMatchers] Role definition "${domainMatching.roleDefinition}" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \`g = _, _, _\`) before enabling domainMatching.`,
-                });
-            }
-            const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });
-            await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);
-        }
-        if (isScoped) {
-            await enforcer.addNamedDomainMatchingFunc(ignis_kernel_3.CasbinRuleVariants.G, casbin.Util.keyMatchFunc);
-            await enforcer.addFunction('objectMatch', ignis_kernel_2.AuthorizationPermissionBuilder.objectMatch);
-            // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.
-            enforcer.setNamedRoleManager(ignis_kernel_3.AuthorizationPolicyVariants.RESOURCE_INHERITS.rule, new resource_1.ResourceRoleManager());
-            // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the
-            // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss
-            // per-request g3 edges - g2 needs the same freshness for a just-created child domain.
-            // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is
-            // repopulated from whatever `g3` lines this principal's own policy line set carries.
-            const domainHierarchyOverlay = new Map();
-            // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.
-            enforcer.setNamedRoleManager(ignis_kernel_3.CasbinRuleVariants.G2, new membership_1.MembershipRoleManager({ overlay: domainHierarchyOverlay }));
-            enforcer.setNamedRoleManager(ignis_kernel_3.CasbinRuleVariants.G3, new domain_hierarchy_1.DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }));
-            // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs
-            // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.
-            const gRoleManager = enforcer.getNamedRoleManager(ignis_kernel_3.CasbinRuleVariants.G);
-            if (!gRoleManager?.addDomainHierarchy) {
-                throw (0, core_1.getError)({
-                    message: '[registerMatchers] The "g" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for "g".',
-                });
-            }
-            await gRoleManager.addDomainHierarchy(new domain_hierarchy_1.DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }));
-        }
-        await enforcer.buildRoleLinks();
-    }
-    /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */
-    resolveDomainMatchingFn(opts) {
-        // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.
-        const { Util } = opts.casbin;
-        switch (opts.name) {
-            case ignis_kernel_3.CasbinDomainMatchingFunctions.KEY_MATCH: {
-                return Util.keyMatchFunc;
-            }
-            case ignis_kernel_3.CasbinDomainMatchingFunctions.KEY_MATCH_2: {
-                return Util.keyMatch2Func;
-            }
-            case ignis_kernel_3.CasbinDomainMatchingFunctions.KEY_MATCH_3: {
-                return Util.keyMatch3Func;
-            }
-            case ignis_kernel_3.CasbinDomainMatchingFunctions.KEY_MATCH_4: {
-                return Util.keyMatch4Func;
-            }
-            case ignis_kernel_3.CasbinDomainMatchingFunctions.REGEX_MATCH: {
-                return Util.regexMatchFunc;
-            }
-            default: {
-                throw (0, core_1.getError)({
-                    message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...ignis_kernel_3.CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,
-                });
-            }
-        }
-    }
-    /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */
-    defaultScopedPayloadFn() {
-        if (!this.options.isScoped) {
-            return undefined;
-        }
-        return (opts) => {
-            // No domain here - evaluate() fills it from request.domain (set by the provider).
-            return {
-                subject: `${opts.user.principalType}_${opts.user.userId}`,
-                resource: String(opts.resource),
-                action: String(opts.action),
-            };
-        };
-    }
-    resolveModel(opts) {
-        const { casbin, model } = opts;
-        switch (model.driver) {
-            case ignis_kernel_3.CasbinEnforcerModelDrivers.FILE: {
-                return casbin.newModelFromFile(model.definition);
-            }
-            case ignis_kernel_3.CasbinEnforcerModelDrivers.TEXT: {
-                return casbin.newModelFromString(model.definition);
-            }
-            default: {
-                throw (0, core_1.getError)({
-                    message: `[resolveModel] Invalid model.driver | Valids: [${ignis_kernel_3.CasbinEnforcerModelDrivers.FILE}, ${ignis_kernel_3.CasbinEnforcerModelDrivers.TEXT}]`,
-                });
-            }
-        }
-    }
-    validateExpiresIn(opts) {
-        if (opts.expiresIn >= this.MIN_EXPIRES_IN) {
-            return;
-        }
-        throw (0, core_1.getError)({
-            message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,
-        });
-    }
-    // Policy loading internals
-    /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */
-    async extractUserLines(opts) {
-        const casbin = await casbin_module_1.CasbinModule.load();
-        const model = this.resolveModel({ casbin, model: this.options.model });
-        return policy_line_codec_1.PolicyLineCodec.extractUserLines({
-            casbin,
-            model,
-            adapter: this.options.adapter,
-            user: opts.user,
-        });
-    }
-    /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */
-    async loadPolicyLinesIntoModel(opts) {
-        if (!this.helper) {
-            throw (0, core_1.getError)({
-                message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',
-            });
-        }
-        await policy_line_codec_1.PolicyLineCodec.loadLinesIntoModel({
-            enforcer: opts.enforcer,
-            lines: opts.lines,
-            helper: this.helper,
-        });
-    }
-};
-exports.CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer;
-exports.CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_3.AuthorizeBindingKeys.enforcerOptions(ignis_kernel_3.AuthorizationEnforcerTypes.CASBIN) })),
-    __metadata("design:paramtypes", [Object])
-], CasbinAuthorizationEnforcer);
-//# sourceMappingURL=casbin.enforcer.js.map

package/dist/components/auth/authorize/enforcers/casbin.enforcer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,sDAAmF;AAQnF,wDAAuE;AACvE,wDAgB+B;AAC/B,wEAA+E;AAC/E,mDAA+C;AAC/C,4DAAoE;AACpE,wDAAgE;AAChE,2DAAsD;AACtD,qEAA+D;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,iBAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,qBAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wCAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,qCAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,4CAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,iCAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,6CAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,0CAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,8BAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,kCAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,iCAAkB,CAAC,EAAE,EACrB,IAAI,6CAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,iCAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,6CAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,4CAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,4CAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,4CAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,yCAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,kDAAkD,yCAA0B,CAAC,IAAI,KAAK,yCAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,mCAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mCAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtaY,kEAA2B;sCAA3B,2BAA2B;IAoBnC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,mCAAoB,CAAC,eAAe,CAAC,yCAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CAsavC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  RoleManager as CasbinRoleManagerType,\n} from 'casbin';\nimport { type Env } from 'hono';\nimport { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationEnforcerTypes,\n  AuthorizationPolicyVariants,\n  AuthorizeBindingKeys,\n  CasbinDomainMatchingFunctions,\n  CasbinEnforcerModelDrivers,\n  CasbinRuleVariants,\n  type IAuthorizationEnforcer,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n  type ICasbinRules,\n  type IAuthorizationRequest,\n  type TAuthorizationDecision,\n  type TCasbinDomainMatchingFunction,\n} from '@venizia/ignis-kernel';\nimport { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy';\nimport { CasbinModule } from './casbin-module';\nimport { MembershipRoleManager } from '../role-managers/membership';\nimport { ResourceRoleManager } from '../role-managers/resource';\nimport { PolicyLineCodec } from './policy-line-codec';\nimport { UserPolicyLineCache } from './user-policy-line-cache';\n\n/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */\ntype TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {\n  user: IAuthorizationUser;\n  action: TAction;\n  resource: TResource;\n  context: TContext<E, string>;\n}) => { subject: string; resource: string; action: string; domain?: string };\n\n/** `addDomainHierarchy` lives on casbin's `DefaultRoleManager`, not on the `RoleManager` interface or the `Enforcer` facade - feature-detect it on whatever `getNamedRoleManager` returns. */\ninterface ICasbinRoleManagerWithDomainHierarchy {\n  addDomainHierarchy?(rm: CasbinRoleManagerType): Promise<void>;\n}\n\n// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.\n\nexport class CasbinAuthorizationEnforcer<\n  E extends Env = Env,\n  TAction extends string = string,\n  TResource extends string = string,\n>\n  extends BaseHelper\n  implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules>\n{\n  name = CasbinAuthorizationEnforcer.name;\n  private readonly MIN_EXPIRES_IN = 10_000;\n\n  private pool: TNullable<BasePoolHelper<CasbinEnforcerType>> = null;\n  private helper: TNullable<typeof CasbinHelperType> = null;\n  // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.\n  private userPolicyLineCache: TNullable<UserPolicyLineCache> = null;\n\n  // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).\n  private resolvedPayloadFn: TNullable<TNormalizePayloadFn<E, TAction, TResource>> = null;\n\n  constructor(\n    @inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })\n    private options: ICasbinEnforcerOptions<E, TAction, TResource>,\n  ) {\n    super({ scope: CasbinAuthorizationEnforcer.name });\n  }\n\n  // Lifecycle\n\n  async configure(): Promise<void> {\n    const casbin = await CasbinModule.load();\n\n    if (!this.options.model) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] options.model is required.',\n      });\n    }\n\n    this.helper = casbin.Helper;\n\n    this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();\n\n    const { cached } = this.options;\n    if (cached.use) {\n      this.validateExpiresIn({ expiresIn: cached.options.expiresIn });\n    }\n\n    this.pool = new BasePoolHelper<CasbinEnforcerType>({\n      scope: `${CasbinAuthorizationEnforcer.name}.Pool`,\n      size: this.options.poolSize ?? 16,\n      acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,\n      create: async () => {\n        const model = this.resolveModel({ casbin, model: this.options.model });\n\n        const enforcer = await casbin.newEnforcer(model);\n        await this.registerMatchers({ enforcer, casbin });\n        this.assertMatcherCompilesSync({ enforcer });\n\n        return enforcer;\n      },\n    });\n    await this.pool.warmup();\n\n    this.logger\n      .for(this.configure.name)\n      .info(\n        'Casbin enforcer pool ready (size: %s, cached: %s)',\n        this.options.poolSize ?? 16,\n        cached.use ? cached.driver : 'none',\n      );\n  }\n\n  destroy(): void {\n    this.pool?.destroy().catch((error) => {\n      this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);\n    });\n  }\n\n  /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */\n  protected assertMatcherCompilesSync(opts: { enforcer: CasbinEnforcerType }) {\n    try {\n      if (this.options.isScoped || this.options.normalizePayloadFn) {\n        opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');\n        return;\n      }\n\n      opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');\n    } catch (error) {\n      throw getError({\n        message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,\n      });\n    }\n  }\n\n  // IAuthorizationEnforcer - public API\n\n  async buildRules(opts: {\n    user: IAuthorizationUser;\n    context: TContext<E, string>;\n  }): Promise<ICasbinRules> {\n    const { user } = opts;\n    const cached = this.options.cached;\n\n    const lines = cached.use\n      ? await this.requireRedisCache().fetch({ user })\n      : await this.extractUserLines({ user });\n\n    return { user, lines };\n  }\n\n  async evaluate(opts: {\n    rules: ICasbinRules;\n    request: IAuthorizationRequest<TAction, TResource>;\n    context: TContext<E, string>;\n  }): Promise<TAuthorizationDecision> {\n    if (!this.pool) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',\n      });\n    }\n\n    if (!opts.request?.action || !opts.request?.resource) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',\n      });\n    }\n\n    const { rules, request, context } = opts;\n    const { user, lines } = rules;\n\n    return this.pool.use({\n      execution: async (enforcer) => {\n        await this.loadPolicyLinesIntoModel({ enforcer, lines });\n\n        const normalizePayloadFn = this.resolvedPayloadFn;\n\n        if (!normalizePayloadFn) {\n          const subject = `${user.principalType}_${user.userId}`;\n          const isAllowed = this.enforceWithExplain({\n            enforcer,\n            vals: [subject, String(request.resource), String(request.action)],\n          });\n          return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n        }\n\n        const normalized = normalizePayloadFn({\n          user,\n          action: request.action,\n          resource: request.resource,\n          context,\n        });\n\n        // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.\n        const domain =\n          normalized.domain ??\n          request.domain ??\n          (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);\n\n        const vals = domain\n          ? [normalized.subject, domain, normalized.resource, normalized.action]\n          : [normalized.subject, normalized.resource, normalized.action];\n        const isAllowed = this.enforceWithExplain({ enforcer, vals });\n\n        return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n      },\n    });\n  }\n\n  /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */\n  protected enforceWithExplain(opts: { enforcer: CasbinEnforcerType; vals: string[] }): boolean {\n    const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);\n\n    if (!isAllowed) {\n      this.logger\n        .for(this.evaluate.name)\n        .info(\n          'DENY | request: [%s] | matchedPolicy: %s',\n          opts.vals.join(', '),\n          matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>',\n        );\n    }\n\n    return isAllowed;\n  }\n\n  // Cache management - optional IAuthorizationEnforcer members (on-demand)\n  async invalidateUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ invalidatedKeys: number }> {\n    const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({\n      user: opts.user,\n    });\n\n    this.logger\n      .for(this.invalidateUserCache.name)\n      .info(\n        'Invalidated authz cache | user: %s | key: %s | deleted: %s',\n        opts.user.userId,\n        cacheKey,\n        invalidatedKeys,\n      );\n\n    return { invalidatedKeys };\n  }\n\n  async rebuildUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lineCount: number }> {\n    // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.\n    const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });\n\n    this.logger\n      .for(this.rebuildUserCache.name)\n      .info(\n        'Rebuilt authz cache | user: %s | key: %s | lines: %s',\n        opts.user.userId,\n        cacheKey,\n        lines.length,\n      );\n\n    return { cacheKey, lineCount: lines.length };\n  }\n\n  /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */\n  protected requireRedisCache(): UserPolicyLineCache {\n    const { cached } = this.options;\n\n    if (!cached.use) {\n      throw getError({\n        message:\n          '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',\n      });\n    }\n\n    return (this.userPolicyLineCache ??= new UserPolicyLineCache({\n      cached,\n      loadLines: (opts) => this.extractUserLines(opts),\n    }));\n  }\n\n  // Matchers & model resolvers\n\n  protected async registerMatchers(opts: {\n    enforcer: CasbinEnforcerType;\n    casbin: typeof import('casbin');\n  }): Promise<void> {\n    const { enforcer, casbin } = opts;\n    const { domainMatching, isScoped } = this.options;\n\n    if (domainMatching) {\n      if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {\n        throw getError({\n          message: `[registerMatchers] Role definition \"${domainMatching.roleDefinition}\" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \\`g = _, _, _\\`) before enabling domainMatching.`,\n        });\n      }\n\n      const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });\n      await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);\n    }\n\n    if (isScoped) {\n      await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);\n      await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);\n\n      // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.\n      enforcer.setNamedRoleManager(\n        AuthorizationPolicyVariants.RESOURCE_INHERITS.rule,\n        new ResourceRoleManager(),\n      );\n\n      // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the\n      // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss\n      // per-request g3 edges - g2 needs the same freshness for a just-created child domain.\n      // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is\n      // repopulated from whatever `g3` lines this principal's own policy line set carries.\n      const domainHierarchyOverlay = new Map<string, Set<string>>();\n\n      // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G2,\n        new MembershipRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G3,\n        new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs\n      // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.\n      const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G) as\n        | (CasbinRoleManagerType & ICasbinRoleManagerWithDomainHierarchy)\n        | undefined;\n\n      if (!gRoleManager?.addDomainHierarchy) {\n        throw getError({\n          message:\n            '[registerMatchers] The \"g\" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for \"g\".',\n        });\n      }\n\n      await gRoleManager.addDomainHierarchy(\n        new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }),\n      );\n    }\n\n    await enforcer.buildRoleLinks();\n  }\n\n  /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */\n  protected resolveDomainMatchingFn(opts: {\n    casbin: typeof import('casbin');\n    name: TCasbinDomainMatchingFunction;\n  }): (arg1: string, arg2: string) => boolean {\n    // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.\n    const { Util } = opts.casbin;\n    switch (opts.name) {\n      case CasbinDomainMatchingFunctions.KEY_MATCH: {\n        return Util.keyMatchFunc;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_2: {\n        return Util.keyMatch2Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_3: {\n        return Util.keyMatch3Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_4: {\n        return Util.keyMatch4Func;\n      }\n      case CasbinDomainMatchingFunctions.REGEX_MATCH: {\n        return Util.regexMatchFunc;\n      }\n      default: {\n        throw getError({\n          message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,\n        });\n      }\n    }\n  }\n\n  /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */\n  protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined {\n    if (!this.options.isScoped) {\n      return undefined;\n    }\n\n    return (opts: {\n      user: IAuthorizationUser;\n      action: TAction;\n      resource: TResource;\n    }): { subject: string; resource: string; action: string; domain?: string } => {\n      // No domain here - evaluate() fills it from request.domain (set by the provider).\n      return {\n        subject: `${opts.user.principalType}_${opts.user.userId}`,\n        resource: String(opts.resource),\n        action: String(opts.action),\n      };\n    };\n  }\n\n  protected resolveModel(opts: {\n    casbin: typeof import('casbin');\n    model: ICasbinEnforcerOptions['model'];\n  }) {\n    const { casbin, model } = opts;\n\n    switch (model.driver) {\n      case CasbinEnforcerModelDrivers.FILE: {\n        return casbin.newModelFromFile(model.definition);\n      }\n      case CasbinEnforcerModelDrivers.TEXT: {\n        return casbin.newModelFromString(model.definition);\n      }\n      default: {\n        throw getError({\n          message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,\n        });\n      }\n    }\n  }\n\n  protected validateExpiresIn(opts: { expiresIn: number }): void {\n    if (opts.expiresIn >= this.MIN_EXPIRES_IN) {\n      return;\n    }\n\n    throw getError({\n      message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,\n    });\n  }\n\n  // Policy loading internals\n\n  /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */\n  protected async extractUserLines(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const casbin = await CasbinModule.load();\n    const model = this.resolveModel({ casbin, model: this.options.model });\n\n    return PolicyLineCodec.extractUserLines({\n      casbin,\n      model,\n      adapter: this.options.adapter,\n      user: opts.user,\n    });\n  }\n\n  /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */\n  protected async loadPolicyLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n  }): Promise<void> {\n    if (!this.helper) {\n      throw getError({\n        message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',\n      });\n    }\n\n    await PolicyLineCodec.loadLinesIntoModel({\n      enforcer: opts.enforcer,\n      lines: opts.lines,\n      helper: this.helper,\n    });\n  }\n}\n"]}

package/dist/components/auth/authorize/enforcers/index.d.ts

@@ -1,6 +0,0 @@
-export * from '@venizia/ignis-kernel';
-export * from './casbin.enforcer';
-export * from './models';
-export * from './policy-line-codec';
-export * from './user-policy-line-cache';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/enforcers/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/enforcers/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}