@venizia/ignis 0.4.6 → 0.4.7-1

package/dist/esm/components/auth/authenticate/services/bearer/abstract.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AASvD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAI1F,gGAAgG;AAChG,MAAM,OAAgB,0BAAgD,SAAQ,WAAW;IAAzF;;QAYY,QAAG,GAA0B,IAAI,CAAC;QAClC,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAoC,IAAI,GAAG,EAAE,CAAC;QAEnE,iFAAiF;QACvE,gBAAW,GAA2B,IAAI,CAAC;IA6QvD,CAAC;IA7RC,oDAAoD;aACpC,sBAAiB,GAAG,IAAI,GAAG,CAAmB;QAC5D,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAC,AAR+B,CAQ9B;IASH,mIAAmI;IACzH,0BAA0B,CAAC,IAOpC;QACC,MAAM,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE5F,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,IAAI,CAAC;QAEhC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,kIAAkI;aAC5I,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uLAAuL;YACvL,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAKd;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,IAAI,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,cAAc,CAAC,IAAiC;QACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,OAAyB;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAA2B,EAAE,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,uEAAuE;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAES,gBAAgB,CAAC,IAAoC;QAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACO,eAAe,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CACT,gFAAgF,EAChF,OAAO,CAAC,GAAG,EACX,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,IAAmD;QAChE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAA2B,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,EAAE,GAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC","sourcesContent":["import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers';\nimport { AES } from '@venizia/ignis-helpers';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type {\n  IJWTIssueClaims,\n  IJWTSignOptions,\n  IJWTTokenPayload,\n  IPayloadFieldCodec,\n  TContext,\n  TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { Authentication, AuthenticationErrors, BaseService } from '@venizia/ignis-kernel';\nimport type { Env } from 'hono';\nimport type { JWTPayload, JWTVerifyResult, SignJWT } from 'jose';\n\n/** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */\nexport abstract class AbstractBearerTokenService<E extends Env = Env> extends BaseService {\n  /** Standard JWT fields that are never encrypted. */\n  static readonly JWT_COMMON_FIELDS = new Set<keyof JWTPayload>([\n    'iss',\n    'sub',\n    'aud',\n    'jti',\n    'nbf',\n    'exp',\n    'iat',\n  ]);\n\n  protected aes: IPayloadCipher | null = null;\n  protected applicationSecret: string | null = null;\n  protected fieldCodecs: Map<string, IPayloadFieldCodec> = new Map();\n\n  /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */\n  protected signOptions: IJWTSignOptions | null = null;\n\n  /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */\n  protected configurePayloadEncryption(opts: {\n    aesAlgorithm?: AESAlgorithmType;\n    applicationSecret?: string;\n    fieldCodecs?: IPayloadFieldCodec[];\n    /** Overrides the cipher. Pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope; `aesAlgorithm` is then the cipher's own concern and is ignored here. */\n    cipher?: IPayloadCipher;\n    sign?: IJWTSignOptions;\n  }): void {\n    const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher, sign } = opts;\n\n    this.signOptions = sign ?? null;\n\n    if (fieldCodecs) {\n      for (const codec of fieldCodecs) {\n        this.fieldCodecs.set(codec.key, codec);\n      }\n    }\n\n    if (!applicationSecret) {\n      return;\n    }\n\n    this.aes = cipher ?? AES.withAlgorithm(aesAlgorithm);\n    this.applicationSecret = applicationSecret;\n  }\n\n  extractCredentials(context: TContext<E, string>): { type: string; token: string } {\n    const request = context.req;\n\n    const authHeaderValue = request.header('Authorization');\n    if (!authHeaderValue) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MISSING,\n        message: 'Unauthorized user! Missing authorization header',\n      });\n    }\n\n    if (!authHeaderValue.startsWith(Authentication.TYPE_BEARER)) {\n      throw getError({\n        error: AuthenticationErrors.SCHEME_INVALID,\n        message: 'Unauthorized user! Invalid schema of request token!',\n      });\n    }\n\n    const parts = authHeaderValue.split(' ');\n    if (parts.length !== 2) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MALFORMED,\n        message: `Authorization header value is invalid format. It must follow the pattern: 'Bearer xx.yy.zz' where xx.yy.zz is a valid JWT token.`,\n      });\n    }\n\n    const [tokenType, tokenValue] = parts;\n    return { type: tokenType, token: tokenValue };\n  }\n\n  async verify(opts: { type: string; token: string }): Promise<IJWTTokenPayload> {\n    const { token } = opts;\n    if (!token) {\n      this.logger.for(this.verify.name).error('Missing token for validating request!');\n      throw getError({\n        error: AuthenticationErrors.TOKEN_MISSING,\n        message: '[verify] Invalid request token!',\n      });\n    }\n\n    try {\n      return await this.doVerify(token);\n    } catch (error) {\n      // No log here - `cause` carries the reason (JWTExpired, signature mismatch) to the error handler, which logs the request once. An expired token is the caller's problem, hence `warn`.\n      throw getError({\n        error: AuthenticationErrors.TOKEN_INVALID,\n        message: '[verify] Invalid or expired token',\n        logLevel: 'warn',\n        cause: error,\n      });\n    }\n  }\n\n  async generate(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn?: TGetTokenExpiresFn;\n    /** Per-token registered claims. The supported way to vary `aud` / `sub`; the payload is not. */\n    claims?: IJWTIssueClaims;\n  }): Promise<string> {\n    const { payload, claims, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;\n\n    if (!payload) {\n      throw getError({\n        error: AuthenticationErrors.TOKEN_PAYLOAD_INVALID,\n        message: '[generate] Invalid token payload!',\n      });\n    }\n\n    const signer = await this.getSigner({ payload, getTokenExpiresFn, claims });\n\n    try {\n      const rs = await signer.sign(await this.getSigningKey());\n      return rs;\n    } catch (error) {\n      this.logger.for(this.generate.name).error('Failed to generate token | Error: %s', error);\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[generate] Failed to generate token',\n      });\n    }\n  }\n\n  protected serializeField(opts: { key: string; value: any }): string {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.serialize({ value });\n    }\n\n    return JSON.stringify(value);\n  }\n\n  encryptPayload(payload: IJWTTokenPayload): Record<string, any> {\n    if (!this.aes || !this.applicationSecret) {\n      return payload;\n    }\n\n    const rs: Record<string, string> = {};\n\n    const keys = Object.keys(payload);\n    for (const key of keys) {\n      const value = payload[key];\n\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = value;\n        continue;\n      }\n\n      // NOTE: Skip undefined or null values because they cannot be encrypted\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      const encryptedKey = this.aes.encrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n\n      const serialized = this.serializeField({ key, value });\n\n      rs[encryptedKey] = this.aes.encrypt({\n        message: serialized,\n        secret: this.applicationSecret,\n      });\n    }\n\n    return rs;\n  }\n\n  protected deserializeField(opts: { key: string; value: string }) {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.deserialize({ raw: value });\n    }\n\n    return JSON.parse(value);\n  }\n\n  /**\n   * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.\n   *\n   * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride\n   * through the AES envelope in the clear and an application-shaped payload can carry them - an\n   * issuer identity any payload could overwrite would not be an identity. A conflicting payload\n   * claim is overwritten and reported.\n   *\n   * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller\n   * that legitimately needs one says so.\n   */\n  protected applySignClaims(opts: {\n    signer: SignJWT;\n    payload: Record<string, any>;\n    claims?: IJWTIssueClaims;\n  }): SignJWT {\n    const { signer, payload, claims } = opts;\n    const configured = this.signOptions;\n\n    const issuer = claims?.issuer ?? configured?.issuer;\n    const audience = claims?.audience ?? configured?.audience;\n\n    const logger = this.logger.for(this.applySignClaims.name);\n\n    if (issuer !== undefined) {\n      if (payload.iss !== undefined && payload.iss !== issuer) {\n        logger.warn(\n          'Payload iss overridden by the configured issuer | payload: %s | configured: %s',\n          payload.iss,\n          issuer,\n        );\n      }\n\n      signer.setIssuer(issuer);\n    }\n\n    if (audience !== undefined) {\n      if (payload.aud !== undefined) {\n        logger.warn('Payload aud overridden | payload: %j | applied: %j', payload.aud, audience);\n      }\n\n      signer.setAudience(audience);\n    }\n\n    if (claims?.subject !== undefined) {\n      signer.setSubject(claims.subject);\n    }\n\n    if (claims?.jwtId !== undefined) {\n      signer.setJti(claims.jwtId);\n    }\n\n    return signer;\n  }\n\n  decryptPayload(opts: { result: JWTVerifyResult<IJWTTokenPayload> }): IJWTTokenPayload {\n    const { payload, protectedHeader } = opts.result;\n\n    if (!this.aes || !this.applicationSecret) {\n      return payload as IJWTTokenPayload;\n    }\n\n    this.logger\n      .for(this.decryptPayload.name)\n      .debug('JWT Token | payload: %j | header: %j', payload, protectedHeader);\n\n    const rs: any = {};\n    for (const key in payload) {\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = payload[key];\n        continue;\n      }\n\n      const decryptedKey = this.aes.decrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n      const decryptedValue = this.aes.decrypt({\n        message: payload[key],\n        secret: this.applicationSecret,\n      });\n\n      rs[decryptedKey] = this.deserializeField({ key: decryptedKey, value: decryptedValue });\n    }\n\n    return rs;\n  }\n\n  protected abstract doVerify(token: string): Promise<IJWTTokenPayload>;\n\n  abstract getSigner(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n    claims?: IJWTIssueClaims;\n  }): Promise<SignJWT>;\n\n  protected abstract getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;\n\n  protected abstract getDefaultTokenExpiresFn(): TGetTokenExpiresFn;\n}\n"]}
+{"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AASvD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAI1F,gGAAgG;AAChG,MAAM,OAAgB,0BAAgD,SAAQ,WAAW;IAAzF;;QAYY,QAAG,GAA0B,IAAI,CAAC;QAClC,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAoC,IAAI,GAAG,EAAE,CAAC;QAEnE,iFAAiF;QACvE,gBAAW,GAA2B,IAAI,CAAC;IA+QvD,CAAC;IA/RC,oDAAoD;aACpC,sBAAiB,GAAG,IAAI,GAAG,CAAmB;QAC5D,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAC,AAR+B,CAQ9B;IASH,mIAAmI;IACzH,0BAA0B,CAAC,IAOpC;QACC,MAAM,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE5F,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,IAAI,CAAC;QAEhC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,kIAAkI;aAC5I,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uLAAuL;YACvL,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAKd;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,IAAI,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,oBAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,cAAc,CAAC,IAAiC;QACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,OAAyB;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAA2B,EAAE,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,uEAAuE;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAES,gBAAgB,CAAC,IAAoC;QAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACO,eAAe,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CACT,gFAAgF,EAChF,OAAO,CAAC,GAAG,EACX,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,IAAmD;QAChE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAA2B,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,EAAE,GAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC","sourcesContent":["import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers';\nimport { AES } from '@venizia/ignis-helpers';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type {\n  IJWTIssueClaims,\n  IJWTSignOptions,\n  IJWTTokenPayload,\n  IPayloadFieldCodec,\n  TContext,\n  TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { Authentication, AuthenticationErrors, BaseService } from '@venizia/ignis-kernel';\nimport type { Env } from 'hono';\nimport type { JWTPayload, JWTVerifyResult, SignJWT } from 'jose';\n\n/** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */\nexport abstract class AbstractBearerTokenService<E extends Env = Env> extends BaseService {\n  /** Standard JWT fields that are never encrypted. */\n  static readonly JWT_COMMON_FIELDS = new Set<keyof JWTPayload>([\n    'iss',\n    'sub',\n    'aud',\n    'jti',\n    'nbf',\n    'exp',\n    'iat',\n  ]);\n\n  protected aes: IPayloadCipher | null = null;\n  protected applicationSecret: string | null = null;\n  protected fieldCodecs: Map<string, IPayloadFieldCodec> = new Map();\n\n  /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */\n  protected signOptions: IJWTSignOptions | null = null;\n\n  /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */\n  protected configurePayloadEncryption(opts: {\n    aesAlgorithm?: AESAlgorithmType;\n    applicationSecret?: string;\n    fieldCodecs?: IPayloadFieldCodec[];\n    /** Overrides the cipher. Pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope; `aesAlgorithm` is then the cipher's own concern and is ignored here. */\n    cipher?: IPayloadCipher;\n    sign?: IJWTSignOptions;\n  }): void {\n    const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher, sign } = opts;\n\n    this.signOptions = sign ?? null;\n\n    if (fieldCodecs) {\n      for (const codec of fieldCodecs) {\n        this.fieldCodecs.set(codec.key, codec);\n      }\n    }\n\n    if (!applicationSecret) {\n      return;\n    }\n\n    this.aes = cipher ?? AES.withAlgorithm(aesAlgorithm);\n    this.applicationSecret = applicationSecret;\n  }\n\n  extractCredentials(context: TContext<E, string>): { type: string; token: string } {\n    const request = context.req;\n\n    const authHeaderValue = request.header('Authorization');\n    if (!authHeaderValue) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MISSING,\n        message: 'Unauthorized user! Missing authorization header',\n      });\n    }\n\n    if (!authHeaderValue.startsWith(Authentication.TYPE_BEARER)) {\n      throw getError({\n        error: AuthenticationErrors.SCHEME_INVALID,\n        message: 'Unauthorized user! Invalid schema of request token!',\n      });\n    }\n\n    const parts = authHeaderValue.split(' ');\n    if (parts.length !== 2) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MALFORMED,\n        message: `Authorization header value is invalid format. It must follow the pattern: 'Bearer xx.yy.zz' where xx.yy.zz is a valid JWT token.`,\n      });\n    }\n\n    const [tokenType, tokenValue] = parts;\n    return { type: tokenType, token: tokenValue };\n  }\n\n  async verify(opts: { type: string; token: string }): Promise<IJWTTokenPayload> {\n    const { token } = opts;\n    if (!token) {\n      this.logger.for(this.verify.name).error('Missing token for validating request!');\n      throw getError({\n        error: AuthenticationErrors.TOKEN_MISSING,\n        message: '[verify] Invalid request token!',\n      });\n    }\n\n    try {\n      const result = await this.doVerify(token);\n      return result;\n    } catch (error) {\n      // No log here - `cause` carries the reason (JWTExpired, signature mismatch) to the error handler, which logs the request once. An expired token is the caller's problem, hence `warn`.\n      throw getError({\n        error: AuthenticationErrors.TOKEN_INVALID,\n        message: '[verify] Invalid or expired token',\n        logLevel: 'warn',\n        cause: error,\n      });\n    }\n  }\n\n  async generate(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn?: TGetTokenExpiresFn;\n    /** Per-token registered claims. The supported way to vary `aud` / `sub`; the payload is not. */\n    claims?: IJWTIssueClaims;\n  }): Promise<string> {\n    const { payload, claims, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;\n\n    if (!payload) {\n      throw getError({\n        error: AuthenticationErrors.TOKEN_PAYLOAD_INVALID,\n        message: '[generate] Invalid token payload!',\n      });\n    }\n\n    const signer = await this.getSigner({ payload, getTokenExpiresFn, claims });\n\n    try {\n      const result = await this.getSigningKey();\n      const rs = await signer.sign(result);\n      return rs;\n    } catch (error) {\n      this.logger.for(this.generate.name).error('Failed to generate token | Error: %s', error);\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[generate] Failed to generate token',\n      });\n    }\n  }\n\n  protected serializeField(opts: { key: string; value: any }): string {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.serialize({ value });\n    }\n\n    return JSON.stringify(value);\n  }\n\n  encryptPayload(payload: IJWTTokenPayload): Record<string, any> {\n    if (!this.aes || !this.applicationSecret) {\n      return payload;\n    }\n\n    const rs: Record<string, string> = {};\n\n    const keys = Object.keys(payload);\n    for (const key of keys) {\n      const value = payload[key];\n\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = value;\n        continue;\n      }\n\n      // NOTE: Skip undefined or null values because they cannot be encrypted\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      const encryptedKey = this.aes.encrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n\n      const serialized = this.serializeField({ key, value });\n\n      rs[encryptedKey] = this.aes.encrypt({\n        message: serialized,\n        secret: this.applicationSecret,\n      });\n    }\n\n    return rs;\n  }\n\n  protected deserializeField(opts: { key: string; value: string }) {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.deserialize({ raw: value });\n    }\n\n    return JSON.parse(value);\n  }\n\n  /**\n   * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.\n   *\n   * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride\n   * through the AES envelope in the clear and an application-shaped payload can carry them - an\n   * issuer identity any payload could overwrite would not be an identity. A conflicting payload\n   * claim is overwritten and reported.\n   *\n   * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller\n   * that legitimately needs one says so.\n   */\n  protected applySignClaims(opts: {\n    signer: SignJWT;\n    payload: Record<string, any>;\n    claims?: IJWTIssueClaims;\n  }): SignJWT {\n    const { signer, payload, claims } = opts;\n    const configured = this.signOptions;\n\n    const issuer = claims?.issuer ?? configured?.issuer;\n    const audience = claims?.audience ?? configured?.audience;\n\n    const logger = this.logger.for(this.applySignClaims.name);\n\n    if (issuer !== undefined) {\n      if (payload.iss !== undefined && payload.iss !== issuer) {\n        logger.warn(\n          'Payload iss overridden by the configured issuer | payload: %s | configured: %s',\n          payload.iss,\n          issuer,\n        );\n      }\n\n      signer.setIssuer(issuer);\n    }\n\n    if (audience !== undefined) {\n      if (payload.aud !== undefined) {\n        logger.warn('Payload aud overridden | payload: %j | applied: %j', payload.aud, audience);\n      }\n\n      signer.setAudience(audience);\n    }\n\n    if (claims?.subject !== undefined) {\n      signer.setSubject(claims.subject);\n    }\n\n    if (claims?.jwtId !== undefined) {\n      signer.setJti(claims.jwtId);\n    }\n\n    return signer;\n  }\n\n  decryptPayload(opts: { result: JWTVerifyResult<IJWTTokenPayload> }): IJWTTokenPayload {\n    const { payload, protectedHeader } = opts.result;\n\n    if (!this.aes || !this.applicationSecret) {\n      return payload as IJWTTokenPayload;\n    }\n\n    this.logger\n      .for(this.decryptPayload.name)\n      .debug('JWT Token | payload: %j | header: %j', payload, protectedHeader);\n\n    const rs: any = {};\n    for (const key in payload) {\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = payload[key];\n        continue;\n      }\n\n      const decryptedKey = this.aes.decrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n      const decryptedValue = this.aes.decrypt({\n        message: payload[key],\n        secret: this.applicationSecret,\n      });\n\n      rs[decryptedKey] = this.deserializeField({ key: decryptedKey, value: decryptedValue });\n    }\n\n    return rs;\n  }\n\n  protected abstract doVerify(token: string): Promise<IJWTTokenPayload>;\n\n  abstract getSigner(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n    claims?: IJWTIssueClaims;\n  }): Promise<SignJWT>;\n\n  protected abstract getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;\n\n  protected abstract getDefaultTokenExpiresFn(): TGetTokenExpiresFn;\n}\n"]}

package/dist/esm/components/auth/authenticate/services/service/signer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAK3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YA0BjC,iBAAiB;YAWjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}
+{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAK3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA2BrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YA0BjC,iBAAiB;YAYjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}

package/dist/esm/components/auth/authenticate/services/service/signer.service.js

@@ -53,7 +53,7 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
         const { SignJWT } = await JoseLoader.load();
         const now = Math.floor(Date.now() / 1000);
         const lifetime = this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;
-        return new SignJWT({ htm: method.toUpperCase(), htu: path })
+        const assertion = new SignJWT({ htm: method.toUpperCase(), htu: path })
             .setProtectedHeader({
             alg: ServiceAssertion.ALGORITHM,
             kid: this.getKeyId(),
@@ -64,8 +64,9 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
             .setAudience(audience)
             .setJti(this.requestIdGenerator.nextId())
             .setIssuedAt(now)
-            .setExpirationTime(now + lifetime)
-            .sign(await this.resolvePrivateKey());
+            .setExpirationTime(now + lifetime);
+        const privateKey = await this.resolvePrivateKey();
+        return assertion.sign(privateKey);
     }
     /**
      * The document `/svc-certs` serves, built from the PUBLIC key only.
@@ -101,7 +102,8 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
         }
         const { importPKCS8 } = await JoseLoader.load();
         const raw = await this.readKey({ source: this.options.keys.private });
-        this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);
+        const result = await importPKCS8(raw, ServiceAssertion.ALGORITHM);
+        this.privateKey = result;
         return this.privateKey;
     }
     async readKey(opts) {

package/dist/esm/components/auth/authenticate/services/service/signer.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,WAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,kBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,gBAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,cAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,6BAA6B;IASrC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC","sourcesContent":["import { inject } from '@/base/metadata';\nimport { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';\nimport type { IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';\nimport { JoseLoader } from '../jose-loader';\n\n/**\n * Mints the outgoing assertion, and publishes the public half for callees to verify against.\n *\n * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured\n * no keys, and the component then mounts no certs route.\n */\nexport class ServiceAssertionSignerService extends BaseService {\n  private readonly requestIdGenerator = new RequestIdGenerator({\n    scope: ServiceAssertionSignerService.name,\n  });\n\n  private privateKey?: CryptoKey;\n  private jwks?: { keys: JWK[] };\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionSignerService.name });\n  }\n\n  isEnabled(): boolean {\n    return Boolean(this.options.keys);\n  }\n\n  /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */\n  getKeyId(): string {\n    const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n    return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\\//, '')}`;\n  }\n\n  /**\n   * One assertion, bound to this exact call.\n   *\n   * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares\n   * against the same shape, and a decoded path here would fail every route carrying a space or a\n   * non-ASCII slug.\n   */\n  async sign(opts: { method: string; path: string; audience: string }): Promise<string> {\n    const { method, path, audience } = opts;\n\n    this.assertEnabled();\n\n    const { SignJWT } = await JoseLoader.load();\n    const now = Math.floor(Date.now() / 1000);\n    const lifetime =\n      this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;\n\n    return new SignJWT({ htm: method.toUpperCase(), htu: path })\n      .setProtectedHeader({\n        alg: ServiceAssertion.ALGORITHM,\n        kid: this.getKeyId(),\n        typ: ServiceAssertion.TYP,\n      })\n      .setIssuer(this.options.name)\n      .setSubject(this.options.name)\n      .setAudience(audience)\n      .setJti(this.requestIdGenerator.nextId())\n      .setIssuedAt(now)\n      .setExpirationTime(now + lifetime)\n      .sign(await this.resolvePrivateKey());\n  }\n\n  /**\n   * The document `/svc-certs` serves, built from the PUBLIC key only.\n   *\n   * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable\n   * from here by construction rather than by care. The JWK format is deliberately NOT accepted for\n   * this path: `importJWK` imports whatever it is handed, and a private JWK marked `\"ext\": true`\n   * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.\n   */\n  async getPublicJWKS(): Promise<{ keys: JWK[] }> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    this.assertEnabled();\n\n    const { exportJWK, importSPKI } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.public });\n    const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);\n    const jwk = await exportJWK(publicKey);\n\n    if (jwk.d !== undefined) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,\n      });\n    }\n\n    this.jwks = {\n      keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],\n    };\n\n    return this.jwks;\n  }\n\n  private async resolvePrivateKey(): Promise<CryptoKey> {\n    if (this.privateKey) {\n      return this.privateKey;\n    }\n\n    const { importPKCS8 } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.private });\n    this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);\n    return this.privateKey;\n  }\n\n  private async readKey(opts: { source: string }): Promise<string> {\n    const { format, driver } = this.options.keys!;\n\n    if (format !== JWKSKeyFormats.PEM) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,\n      });\n    }\n\n    if (driver === JWKSKeyDrivers.FILE) {\n      return readFile(opts.source, 'utf-8');\n    }\n\n    return opts.source;\n  }\n\n  private assertEnabled(): void {\n    if (this.options.keys) {\n      return;\n    }\n\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: `[${ServiceAssertionSignerService.name}] This service has no signing keys | it can verify assertions but not mint them`,\n    });\n  }\n}\n"]}
+{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,WAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,kBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,6BAA6B,CAAC;QAErF,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACpE,kBAAkB,CAAC;YAClB,GAAG,EAAE,gBAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,cAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AApIY,6BAA6B;IASrC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAoIzC","sourcesContent":["import { inject } from '@/base/metadata';\nimport { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';\nimport type { IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';\nimport { JoseLoader } from '../jose-loader';\n\n/**\n * Mints the outgoing assertion, and publishes the public half for callees to verify against.\n *\n * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured\n * no keys, and the component then mounts no certs route.\n */\nexport class ServiceAssertionSignerService extends BaseService {\n  private readonly requestIdGenerator = new RequestIdGenerator({\n    scope: ServiceAssertionSignerService.name,\n  });\n\n  private privateKey?: CryptoKey;\n  private jwks?: { keys: JWK[] };\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionSignerService.name });\n  }\n\n  isEnabled(): boolean {\n    return Boolean(this.options.keys);\n  }\n\n  /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */\n  getKeyId(): string {\n    const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n    return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\\//, '')}`;\n  }\n\n  /**\n   * One assertion, bound to this exact call.\n   *\n   * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares\n   * against the same shape, and a decoded path here would fail every route carrying a space or a\n   * non-ASCII slug.\n   */\n  async sign(opts: { method: string; path: string; audience: string }): Promise<string> {\n    const { method, path, audience } = opts;\n\n    this.assertEnabled();\n\n    const { SignJWT } = await JoseLoader.load();\n    const now = Math.floor(Date.now() / 1000);\n    const lifetime =\n      this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;\n\n    const assertion = new SignJWT({ htm: method.toUpperCase(), htu: path })\n      .setProtectedHeader({\n        alg: ServiceAssertion.ALGORITHM,\n        kid: this.getKeyId(),\n        typ: ServiceAssertion.TYP,\n      })\n      .setIssuer(this.options.name)\n      .setSubject(this.options.name)\n      .setAudience(audience)\n      .setJti(this.requestIdGenerator.nextId())\n      .setIssuedAt(now)\n      .setExpirationTime(now + lifetime);\n\n    const privateKey = await this.resolvePrivateKey();\n    return assertion.sign(privateKey);\n  }\n\n  /**\n   * The document `/svc-certs` serves, built from the PUBLIC key only.\n   *\n   * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable\n   * from here by construction rather than by care. The JWK format is deliberately NOT accepted for\n   * this path: `importJWK` imports whatever it is handed, and a private JWK marked `\"ext\": true`\n   * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.\n   */\n  async getPublicJWKS(): Promise<{ keys: JWK[] }> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    this.assertEnabled();\n\n    const { exportJWK, importSPKI } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.public });\n    const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);\n    const jwk = await exportJWK(publicKey);\n\n    if (jwk.d !== undefined) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,\n      });\n    }\n\n    this.jwks = {\n      keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],\n    };\n\n    return this.jwks;\n  }\n\n  private async resolvePrivateKey(): Promise<CryptoKey> {\n    if (this.privateKey) {\n      return this.privateKey;\n    }\n\n    const { importPKCS8 } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.private });\n    const result = await importPKCS8(raw, ServiceAssertion.ALGORITHM);\n    this.privateKey = result;\n    return this.privateKey;\n  }\n\n  private async readKey(opts: { source: string }): Promise<string> {\n    const { format, driver } = this.options.keys!;\n\n    if (format !== JWKSKeyFormats.PEM) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,\n      });\n    }\n\n    if (driver === JWKSKeyDrivers.FILE) {\n      return readFile(opts.source, 'utf-8');\n    }\n\n    return opts.source;\n  }\n\n  private assertEnabled(): void {\n    if (this.options.keys) {\n      return;\n    }\n\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: `[${ServiceAssertionSignerService.name}] This service has no signing keys | it can verify assertions but not mint them`,\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/adapters/base-filtered.js

@@ -1,4 +1,4 @@
-import { readResultRows } from '../../../../utilities/index.js';
+import { DrizzleResultUtility } from '../../../../utilities/index.js';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { CasbinModule } from '../enforcers/casbin-module.js';
 import { PolicyConnectorResolver } from './connector.js';
@@ -17,7 +17,7 @@ export class BaseFilteredAdapter extends BaseHelper {
     /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */
     async query(opts) {
         const result = await this.connector.execute(opts.statement);
-        return readResultRows({ result });
+        return DrizzleResultUtility.readResultRows({ result });
     }
     isFiltered() {
         return true;

package/dist/esm/components/auth/authorize/adapters/base-filtered.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,0LAA0L;AAC1L,MAAM,OAAgB,mBACpB,SAAQ,UAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,uBAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,cAAc,CAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF","sourcesContent":["import { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { type FilteredAdapter, type Model } from 'casbin';\nimport type { SQL } from 'drizzle-orm';\nimport { CasbinModule } from '../enforcers/casbin-module';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */\nexport abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter>\n  extends BaseHelper\n  implements FilteredAdapter\n{\n  protected readonly dataSource: ICasbinPolicySource;\n\n  constructor(opts: { scope: string; dataSource: ICasbinPolicySource }) {\n    super({ scope: opts.scope });\n    this.dataSource = opts.dataSource;\n  }\n\n  protected get connector(): TCasbinPolicyConnector {\n    return PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: 'BaseFilteredAdapter',\n    });\n  }\n\n  /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */\n  protected async query<TRow>(opts: { statement: SQL }): Promise<TRow[]> {\n    const result = await this.connector.execute(opts.statement);\n    return readResultRows<TRow>({ result });\n  }\n\n  /** Load ONLY the policies matching `filter` into `model` (the store is read for one principal). */\n  abstract loadFilteredPolicy(model: Model, filter: TFilter): Promise<void>;\n\n  isFiltered(): boolean {\n    return true;\n  }\n\n  // Read-only adapter - write methods are intentional no-ops.\n  async loadPolicy(): Promise<void> {}\n  async savePolicy(): Promise<boolean> {\n    return true;\n  }\n  async addPolicy(): Promise<void> {}\n  async removePolicy(): Promise<void> {}\n  async removeFilteredPolicy(): Promise<void> {}\n\n  /** Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */\n  protected async loadLines(opts: { model: Model; lines: string[] }): Promise<void> {\n    const { Helper } = await CasbinModule.load();\n    for (const line of opts.lines) {\n      Helper.loadPolicyLine(line, opts.model);\n    }\n  }\n}\n"]}
+{"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,0LAA0L;AAC1L,MAAM,OAAgB,mBACpB,SAAQ,UAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,uBAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,oBAAoB,CAAC,cAAc,CAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF","sourcesContent":["import { DrizzleResultUtility } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { type FilteredAdapter, type Model } from 'casbin';\nimport type { SQL } from 'drizzle-orm';\nimport { CasbinModule } from '../enforcers/casbin-module';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. */\nexport abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter>\n  extends BaseHelper\n  implements FilteredAdapter\n{\n  protected readonly dataSource: ICasbinPolicySource;\n\n  constructor(opts: { scope: string; dataSource: ICasbinPolicySource }) {\n    super({ scope: opts.scope });\n    this.dataSource = opts.dataSource;\n  }\n\n  protected get connector(): TCasbinPolicyConnector {\n    return PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: 'BaseFilteredAdapter',\n    });\n  }\n\n  /** Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. */\n  protected async query<TRow>(opts: { statement: SQL }): Promise<TRow[]> {\n    const result = await this.connector.execute(opts.statement);\n    return DrizzleResultUtility.readResultRows<TRow>({ result });\n  }\n\n  /** Load ONLY the policies matching `filter` into `model` (the store is read for one principal). */\n  abstract loadFilteredPolicy(model: Model, filter: TFilter): Promise<void>;\n\n  isFiltered(): boolean {\n    return true;\n  }\n\n  // Read-only adapter - write methods are intentional no-ops.\n  async loadPolicy(): Promise<void> {}\n  async savePolicy(): Promise<boolean> {\n    return true;\n  }\n  async addPolicy(): Promise<void> {}\n  async removePolicy(): Promise<void> {}\n  async removeFilteredPolicy(): Promise<void> {}\n\n  /** Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */\n  protected async loadLines(opts: { model: Model; lines: string[] }): Promise<void> {\n    const { Helper } = await CasbinModule.load();\n    for (const line of opts.lines) {\n      Helper.loadPolicyLine(line, opts.model);\n    }\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/adapters/custom-grant-expander.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-grant-expander.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAI3E,kHAAkH;AAClH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAEvD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC;KACpE;IAOD,yFAAyF;IACzF,eAAe,CAAC,IAAI,EAAE;QACpB,GAAG,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,MAAM,GAAG,IAAI;IAsBjB,4NAA4N;IACtN,kBAAkB,CAAC,IAAI,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,eAAe,EAAE,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAoDtD,uGAAuG;IACvG,OAAO,CAAC,cAAc;IAMtB,4LAA4L;IAC5L,OAAO,CAAC,gBAAgB;IASxB,sGAAsG;YACxF,qBAAqB;CA6BpC"}
+{"version":3,"file":"custom-grant-expander.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAI3E,kHAAkH;AAClH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAEvD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,GAAG,YAAY,CAAC,CAAC;KACpE;IAOD,yFAAyF;IACzF,eAAe,CAAC,IAAI,EAAE;QACpB,GAAG,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,MAAM,GAAG,IAAI;IAsBjB,4NAA4N;IACtN,kBAAkB,CAAC,IAAI,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,eAAe,EAAE,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAoDtD,uGAAuG;IACvG,OAAO,CAAC,cAAc;IAMtB,4LAA4L;IAC5L,OAAO,CAAC,gBAAgB;IASxB,sGAAsG;YACxF,qBAAqB;CAkCpC"}

package/dist/esm/components/auth/authorize/adapters/custom-grant-expander.js

@@ -1,4 +1,4 @@
-import { readResultRows } from '../../../../utilities/index.js';
+import { DrizzleResultUtility } from '../../../../utilities/index.js';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { AuthorizationActions, AuthorizationPermissionBuilder, AuthorizationPolicyVariants, GrantBuilder, } from '@venizia/ignis-kernel';
 import { sql } from 'drizzle-orm';
@@ -99,7 +99,7 @@ export class CustomGrantExpander extends BaseHelper {
       WHERE (permission.subject, permission.method) IN (${sql.join(opts.pairs.map((pair) => sql `(${pair.subject}, ${pair.method})`), sql `, `)})
         AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause({ alias: 'permission' })}
     `);
-        return readResultRows({
+        return DrizzleResultUtility.readResultRows({
             result,
         });
     }

package/dist/esm/components/auth/authorize/adapters/custom-grant-expander.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,2BAA2B,EAC3B,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,oBAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,8BAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAA;;aAEjC,eAAe;0DAC8B,GAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAChE,GAAG,CAAA,IAAI,CACR;mCAC4B,8BAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,cAAc,CAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationActions,\n  AuthorizationPermissionBuilder,\n  AuthorizationPolicyVariants,\n  GrantBuilder,\n  type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */\nexport type TCustomGrantRow = {\n  subjectId: IdType;\n  objectSubject: string;\n  ops: string[];\n  domain: string;\n  effect: string;\n};\n\n/**\n * Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n */\nexport class CustomGrantExpander extends BaseHelper {\n  protected readonly dataSource: ICasbinPolicySource;\n  protected readonly permission: IScopedCasbinEntities['permission'];\n  protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;\n  }) {\n    super({ scope: CustomGrantExpander.name });\n    this.dataSource = opts.dataSource;\n    this.permission = opts.entities.permission;\n    this.softDelete = opts.entities.softDelete;\n  }\n\n  /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */\n  rejectCustomRow(opts: {\n    row: { subjectId: IdType; objectCode: string; objectMethod: string };\n    parsed: TCustomGrantMetadata | null;\n    isCustomAction: boolean;\n    metadataColumnName?: string;\n  }): string | null {\n    const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n    if (isCustomAction && !metadataColumnName) {\n      return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (isCustomAction && !parsed) {\n      return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (!isCustomAction && parsed) {\n      return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n      return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    return null;\n  }\n\n  /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */\n  async expandCustomGrants(opts: {\n    subjectType: string;\n    customRows: TCustomGrantRow[];\n  }): Promise<{ lines: string[]; rejections: string[] }> {\n    if (!opts.customRows.length) {\n      return { lines: [], rejections: [] };\n    }\n\n    const seen = new Set<string>();\n    const pairs: Array<{ subject: string; method: string }> = [];\n\n    const candidates = opts.customRows.flatMap((row) =>\n      row.ops.map((op) => ({ subject: row.objectSubject, method: op })),\n    );\n\n    for (const candidate of candidates) {\n      const key = `${candidate.subject}.${candidate.method}`;\n      if (seen.has(key)) {\n        continue;\n      }\n\n      seen.add(key);\n      pairs.push(candidate);\n    }\n\n    const catalog = await this.queryOperationCatalog({ pairs });\n    const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));\n    const lines: string[] = [];\n    const rejections: string[] = [];\n\n    for (const row of opts.customRows) {\n      const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n        ops: row.ops,\n        subject: row.objectSubject,\n        catalog,\n      });\n\n      if (unknown.length) {\n        rejections.push(\n          `Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`,\n        );\n      }\n\n      for (const op of valid) {\n        const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n        );\n      }\n    }\n\n    return { lines, rejections };\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    const schema = table.schemaName ?? DEFAULT_SCHEMA;\n    return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  private softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n  private async queryOperationCatalog(opts: {\n    pairs: Array<{ subject: string; method: string }>;\n  }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n    if (!opts.pairs.length) {\n      return [];\n    }\n\n    const permissionTable = this.qualifiedTable({ table: this.permission });\n    const connector = PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: CustomGrantExpander.name,\n    });\n\n    const result = await connector.execute(sql`\n      SELECT permission.subject, permission.method, permission.code, permission.action\n      FROM ${permissionTable} permission\n      WHERE (permission.subject, permission.method) IN (${sql.join(\n        opts.pairs.map((pair) => sql`(${pair.subject}, ${pair.method})`),\n        sql`, `,\n      )})\n        AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n          { alias: 'permission' },\n        )}\n    `);\n\n    return readResultRows<{ subject: string; method: string; code: string; action: string }>({\n      result,\n    });\n  }\n}\n"]}
+{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,2BAA2B,EAC3B,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,oBAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,8BAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAA;;aAEjC,eAAe;0DAC8B,GAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAChE,GAAG,CAAA,IAAI,CACR;mCAC4B,8BAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,oBAAoB,CAAC,cAAc,CAKvC;YACD,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { DrizzleResultUtility } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationActions,\n  AuthorizationPermissionBuilder,\n  AuthorizationPolicyVariants,\n  GrantBuilder,\n  type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */\nexport type TCustomGrantRow = {\n  subjectId: IdType;\n  objectSubject: string;\n  ops: string[];\n  domain: string;\n  effect: string;\n};\n\n/**\n * Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n */\nexport class CustomGrantExpander extends BaseHelper {\n  protected readonly dataSource: ICasbinPolicySource;\n  protected readonly permission: IScopedCasbinEntities['permission'];\n  protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;\n  }) {\n    super({ scope: CustomGrantExpander.name });\n    this.dataSource = opts.dataSource;\n    this.permission = opts.entities.permission;\n    this.softDelete = opts.entities.softDelete;\n  }\n\n  /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */\n  rejectCustomRow(opts: {\n    row: { subjectId: IdType; objectCode: string; objectMethod: string };\n    parsed: TCustomGrantMetadata | null;\n    isCustomAction: boolean;\n    metadataColumnName?: string;\n  }): string | null {\n    const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n    if (isCustomAction && !metadataColumnName) {\n      return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (isCustomAction && !parsed) {\n      return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (!isCustomAction && parsed) {\n      return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n      return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    return null;\n  }\n\n  /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */\n  async expandCustomGrants(opts: {\n    subjectType: string;\n    customRows: TCustomGrantRow[];\n  }): Promise<{ lines: string[]; rejections: string[] }> {\n    if (!opts.customRows.length) {\n      return { lines: [], rejections: [] };\n    }\n\n    const seen = new Set<string>();\n    const pairs: Array<{ subject: string; method: string }> = [];\n\n    const candidates = opts.customRows.flatMap((row) =>\n      row.ops.map((op) => ({ subject: row.objectSubject, method: op })),\n    );\n\n    for (const candidate of candidates) {\n      const key = `${candidate.subject}.${candidate.method}`;\n      if (seen.has(key)) {\n        continue;\n      }\n\n      seen.add(key);\n      pairs.push(candidate);\n    }\n\n    const catalog = await this.queryOperationCatalog({ pairs });\n    const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));\n    const lines: string[] = [];\n    const rejections: string[] = [];\n\n    for (const row of opts.customRows) {\n      const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n        ops: row.ops,\n        subject: row.objectSubject,\n        catalog,\n      });\n\n      if (unknown.length) {\n        rejections.push(\n          `Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`,\n        );\n      }\n\n      for (const op of valid) {\n        const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n        );\n      }\n    }\n\n    return { lines, rejections };\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    const schema = table.schemaName ?? DEFAULT_SCHEMA;\n    return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  private softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n  private async queryOperationCatalog(opts: {\n    pairs: Array<{ subject: string; method: string }>;\n  }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n    if (!opts.pairs.length) {\n      return [];\n    }\n\n    const permissionTable = this.qualifiedTable({ table: this.permission });\n    const connector = PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: CustomGrantExpander.name,\n    });\n\n    const result = await connector.execute(sql`\n      SELECT permission.subject, permission.method, permission.code, permission.action\n      FROM ${permissionTable} permission\n      WHERE (permission.subject, permission.method) IN (${sql.join(\n        opts.pairs.map((pair) => sql`(${pair.subject}, ${pair.method})`),\n        sql`, `,\n      )})\n        AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n          { alias: 'permission' },\n        )}\n    `);\n\n    return DrizzleResultUtility.readResultRows<{\n      subject: string;\n      method: string;\n      code: string;\n      action: string;\n    }>({\n      result,\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAQ5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB,CAAC,yBAAyB,CAAC;IACrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;gBAElD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,qBAAqB,CAAC;QAChC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;KAC5C;IAUD;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmExF,wEAAwE;IACxE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,EAAE,CAAC;KAC3B,GAAG,IAAI;IAiCR;;;;;;OAMG;cACa,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BrB,kDAAkD;IAClD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAI1D,4SAA4S;IAC5S,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IAY5D,uGAAuG;IACvG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,GAAG;IAK1F,4LAA4L;IAC5L,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IASxD,iOAAiO;cACjN,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA8IlC,iGAAiG;cACjF,eAAe,CAAC,IAAI,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4FrB,2OAA2O;cAC3N,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CA6BvD"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAQ5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB,CAAC,yBAAyB,CAAC;IACrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACnD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;gBAElD,IAAI,EAAE;QAChB,UAAU,EAAE,mBAAmB,CAAC;QAChC,QAAQ,EAAE,qBAAqB,CAAC;QAChC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;KAC5C;IAUD;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmExF,wEAAwE;IACxE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,EAAE,CAAC;KAC3B,GAAG,IAAI;IAiCR;;;;;;OAMG;cACa,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BrB,kDAAkD;IAClD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAI1D,4SAA4S;IAC5S,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IAY5D,uGAAuG;IACvG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,GAAG;IAK1F,4LAA4L;IAC5L,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG;IASxD,iOAAiO;cACjN,sBAAsB,CAAC,IAAI,EAAE;QAC3C,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA8IlC,iGAAiG;cACjF,eAAe,CAAC,IAAI,EAAE;QACpC,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4FrB,2OAA2O;cAC3N,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CA6BvD"}

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.js

@@ -71,8 +71,10 @@ export class ScopedCasbinAdapter extends BaseFilteredAdapter {
             principal,
             domains: [...domainClosure],
         });
-        lines.push(...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })));
-        lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));
+        const result = await this.buildGrantLines({ subjectType: principal.type, rows: directGrants });
+        lines.push(...result);
+        const result2 = await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants });
+        lines.push(...result2);
         const [structuralEdges, hookLines] = await Promise.all([
             structuralEdgesPromise,
             hookLinesPromise,
@@ -119,7 +121,8 @@ export class ScopedCasbinAdapter extends BaseFilteredAdapter {
         }
         let edges;
         try {
-            edges = await this.resolveDomainEdges(opts);
+            const result = await this.resolveDomainEdges(opts);
+            edges = result;
         }
         catch (error) {
             this.logger

package/dist/esm/components/auth/authorize/adapters/scoped-casbin/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAA4B,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,cAAc,GAKf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,mBAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CACrF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,GAAG,CAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,GAAG,CAAA,sBAAsB,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAA,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,UAAU,EAAE,CAAC,EACnD,GAAG,CAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,GAAG,CAAA;;;eAGL,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,oBAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,oBAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,oBAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,2BAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,oBAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,GAAG,CAAA;;UAEV,2BAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,2BAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,2BAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { type Model } from 'casbin';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { GrantBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '@venizia/ignis-kernel';\nimport { BaseFilteredAdapter } from '../base-filtered';\nimport { CustomGrantExpander, type TCustomGrantRow } from '../custom-grant-expander';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';\nimport { PrincipalPolicyEdges, type TPrincipalPolicyRow } from './policy-edges';\nimport {\n  DEFAULT_SCHEMA,\n  type IScopedCasbinPolicyFilter,\n  type TDomainHierarchyEdge,\n  type TGrantRow,\n  type TResolveDomainEdgesFn,\n} from './common';\n\n/**\n * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,\n * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.\n *\n * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.\n * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications\n * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion\n * filter would sweep those unknown rows into a branch that has no idea what they mean. The current\n * shape makes an undeclared variant inert, which is what makes sharing the table safe.\n */\nexport class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {\n  protected readonly entities: IScopedCasbinEntities;\n  protected readonly customGrantExpander: CustomGrantExpander;\n  protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: IScopedCasbinEntities;\n    resolveDomainEdges?: TResolveDomainEdgesFn;\n  }) {\n    super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });\n    this.entities = opts.entities;\n    this.resolveDomainEdges = opts.resolveDomainEdges;\n    this.customGrantExpander = new CustomGrantExpander({\n      dataSource: opts.dataSource,\n      entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },\n    });\n  }\n\n  /**\n   * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -\n   * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot\n   * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does\n   * not wait for the structural-edges query either: both run concurrently once the closure is known.\n   */\n  async loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void> {\n    const { principal } = filter;\n    const { principals } = this.entities;\n\n    const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });\n    const structuralEdgesPromise = this.queryEdgePolicies();\n    const principalRows = await principalPoliciesPromise;\n\n    const lines: string[] = [];\n    const directGrants: TGrantRow[] = [];\n    const roleGrants: TGrantRow[] = [];\n    const domainClosure = new Set<string>();\n\n    for (const row of principalRows) {\n      switch (row.kind) {\n        case PrincipalPolicyEdges.ROLE_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`,\n          );\n          break;\n        }\n\n        case PrincipalPolicyEdges.ROLE_GRANT: {\n          roleGrants.push(row);\n          break;\n        }\n\n        case PrincipalPolicyEdges.DOMAIN_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`,\n          );\n          // Both ends are, by construction, members of the principal's domain_closure CTE.\n          domainClosure.add(String(row.subjectId));\n          domainClosure.add(String(row.targetId));\n          break;\n        }\n\n        default: {\n          if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {\n            domainClosure.add(`${row.targetType}_${row.targetId}`);\n          }\n          this.collectDirectRow({ row, principal, lines, directGrants });\n          break;\n        }\n      }\n    }\n\n    const hookLinesPromise = this.resolveDomainEdgeLines({\n      principal,\n      domains: [...domainClosure],\n    });\n\n    lines.push(\n      ...(await this.buildGrantLines({ subjectType: principal.type, rows: directGrants })),\n    );\n    lines.push(...(await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants })));\n\n    const [structuralEdges, hookLines] = await Promise.all([\n      structuralEdgesPromise,\n      hookLinesPromise,\n    ]);\n    lines.push(...structuralEdges);\n    lines.push(...hookLines);\n\n    await this.loadLines({ model, lines });\n  }\n\n  /** Route one `direct` row to its casbin line, or to the grant batch. */\n  protected collectDirectRow(opts: {\n    row: TPrincipalPolicyRow;\n    principal: { type: string; id: IdType };\n    lines: string[];\n    directGrants: TGrantRow[];\n  }): void {\n    const { row, principal, lines, directGrants } = opts;\n    const { principals } = this.entities;\n\n    switch (row.variant) {\n      case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.GRANT.action: {\n        directGrants.push(row);\n        break;\n      }\n\n      default: {\n        this.logger\n          .for(this.collectDirectRow.name)\n          .error('Unexpected variant in the direct branch | variant: %s', row.variant);\n        break;\n      }\n    }\n  }\n\n  /**\n   * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using\n   * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no\n   * edges - the rows already gathered for this principal still load. This is the safe direction:\n   * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the\n   * failure degrades to less access rather than either an outage or excess access.\n   */\n  protected async resolveDomainEdgeLines(opts: {\n    principal: { type: string; id: IdType };\n    domains: string[];\n  }): Promise<string[]> {\n    if (!this.resolveDomainEdges) {\n      return [];\n    }\n\n    let edges: TDomainHierarchyEdge[];\n    try {\n      edges = await this.resolveDomainEdges(opts);\n    } catch (error) {\n      this.logger\n        .for(this.resolveDomainEdgeLines.name)\n        .error(\n          'resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s',\n          opts.principal.type,\n          opts.principal.id,\n          error,\n        );\n      return [];\n    }\n\n    return edges.map(\n      (edge) =>\n        `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`,\n    );\n  }\n\n  /** Schema for a table, defaulting to `public`. */\n  protected schemaOf(table: { schemaName?: string }): string {\n    return table.schemaName ?? DEFAULT_SCHEMA;\n  }\n\n  /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */\n  protected domainTokenSelection(opts: { alias: string }): SQL {\n    const column = (name: string) => sql`${sql.raw(opts.alias)}.${sql.identifier(name)}`;\n    const domainType = column('domain_type');\n    const domainId = column('domain_id');\n\n    return sql`CASE\n      WHEN ${domainType} IS NULL THEN NULL\n      WHEN ${domainId} IS NULL THEN ${domainType}\n      ELSE ${domainType} || '_' || ${domainId}::text\n    END AS \"domain\"`;\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  protected qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    return sql`${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  protected softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.entities.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */\n  protected async queryPrincipalPolicies(opts: {\n    principal: { type: string; id: IdType };\n  }): Promise<TPrincipalPolicyRow[]> {\n    const { policyDefinition, permission, principals, domainTypes } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n    const { principal } = opts;\n\n    const metadataColumnName = policyDefinition.metadata?.columnName;\n    const metadataSelection = metadataColumnName\n      ? sql`, policyDefinition.${sql.identifier(metadataColumnName)} AS \"metadata\"`\n      : sql.empty();\n    const metadataNull = metadataColumnName ? sql`, NULL::jsonb AS \"metadata\"` : sql.empty();\n\n    const domainTypeList = sql.join(\n      domainTypes.map((domainType) => sql`${domainType}`),\n      sql`, `,\n    );\n\n    const rows = await this.query<TPrincipalPolicyRow>({\n      statement: sql`\n      WITH RECURSIVE role_closure AS (\n        SELECT policyDefinition.target_id AS role_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      ),\n\n      domain_closure AS (\n        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_type, policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                             AND policyDefinition.subject_id = domain_closure.dom_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      )\n\n      SELECT\n        ${PrincipalPolicyEdges.DIRECT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.subject_type = ${principal.type}\n        AND policyDefinition.subject_id = ${principal.id}\n        AND policyDefinition.variant IN (\n          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},\n          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},\n          ${AuthorizationPolicyVariants.GRANT.action}\n        )\n        AND (\n          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          OR policyDefinition.target_type IN (${domainTypeList})\n        )${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}\n        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS \"subjectId\",\n        NULL AS \"targetType\",\n        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                           AND policyDefinition.subject_id = domain_closure.dom_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows;\n  }\n\n  /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */\n  protected async buildGrantLines(opts: {\n    subjectType: string;\n    rows: TGrantRow[];\n  }): Promise<string[]> {\n    const { subjectType, rows } = opts;\n    const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;\n\n    const lines: string[] = [];\n    const customRows: TCustomGrantRow[] = [];\n\n    for (const row of rows) {\n      if (!row.objectCode) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s',\n            subjectType,\n            row.subjectId,\n          );\n        continue;\n      }\n\n      const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;\n      const effect = row.effect ?? AuthorizationDecisions.ALLOW;\n      const parsed = metadataColumnName\n        ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })\n        : null;\n      const isCustomAction = row.action === AuthorizationActions.CUSTOM;\n      const isCustomRow = isCustomAction || Boolean(parsed);\n\n      if (!isCustomRow && !row.action) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      if (!isCustomRow) {\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`,\n        );\n        continue;\n      }\n\n      if (!row.objectSubject || !row.objectMethod) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      const rejection = this.customGrantExpander.rejectCustomRow({\n        row: {\n          subjectId: row.subjectId,\n          objectCode: row.objectCode,\n          objectMethod: row.objectMethod,\n        },\n        parsed,\n        isCustomAction,\n        metadataColumnName,\n      });\n\n      if (rejection) {\n        this.logger.for(this.buildGrantLines.name).error(rejection);\n        continue;\n      }\n\n      customRows.push({\n        subjectId: row.subjectId,\n        objectSubject: row.objectSubject,\n        ops: parsed!.ops,\n        domain,\n        effect,\n      });\n    }\n\n    const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });\n    for (const rejection of expanded.rejections) {\n      this.logger.for(this.buildGrantLines.name).error(rejection);\n    }\n    lines.push(...expanded.lines);\n\n    return lines;\n  }\n\n  /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */\n  protected async queryEdgePolicies(): Promise<string[]> {\n    const { policyDefinition, permission } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n\n    const rows = await this.query<{ rel: string; child: string; parent: string }>({\n      statement: sql`\n      SELECT\n        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS \"rel\",\n        child_permission.code AS \"child\",\n        parent_permission.code AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id\n        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS \"rel\",\n        policyDefinition.subject_id::text AS \"child\",\n        policyDefinition.target_id::text AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);\n  }\n}\n"]}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authorize/adapters/scoped-casbin/adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAA4B,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,cAAc,GAKf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAA8C;IAKrF,YAAY,IAIX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,IAAI,mBAAmB,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAY,EAAE,MAAiC;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,MAAM,wBAAwB,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;QAErD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;oBACpC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAChI,CAAC;oBACF,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;oBACtC,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;oBACF,iFAAiF;oBACjF,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;oBACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxC,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,IAAI,GAAG,CAAC,OAAO,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;wBACnE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACzD,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/D,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACnD,SAAS;YACT,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAEvB,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,sBAAsB;YACtB,gBAAgB;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wEAAwE;IAC9D,gBAAgB,CAAC,IAK1B;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAC/I,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CACxH,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;qBAC/B,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,sBAAsB,CAAC,IAGtC;QACC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;iBACrC,KAAK,CACJ,2GAA2G,EAC3G,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,EAAE,EACjB,KAAK,CACN,CAAC;YACJ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,2BAA2B,CAAC,eAAe,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,kDAAkD;IACxC,QAAQ,CAAC,KAA8B;QAC/C,OAAO,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;IAC5C,CAAC;IAED,4SAA4S;IAClS,oBAAoB,CAAC,IAAuB;QACpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,GAAG,CAAA;aACD,UAAU;aACV,QAAQ,iBAAiB,UAAU;aACnC,UAAU,cAAc,QAAQ;oBACzB,CAAC;IACnB,CAAC;IAED,uGAAuG;IAC7F,cAAc,CAAC,IAA2D;QAClF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,4LAA4L;IAClL,gBAAgB,CAAC,IAAuB;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,iOAAiO;IACvN,KAAK,CAAC,sBAAsB,CAAC,IAEtC;QACC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,iBAAiB,GAAG,kBAAkB;YAC1C,CAAC,CAAC,GAAG,CAAA,sBAAsB,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB;YAC7E,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAA,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAEzF,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,UAAU,EAAE,CAAC,EACnD,GAAG,CAAA,IAAI,CACR,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAsB;YACjD,SAAS,EAAE,GAAG,CAAA;;;eAGL,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;+CACX,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKtG,qBAAqB;;2CAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKnI,qBAAqB;2CACO,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACzC,SAAS,CAAC,IAAI;8CAChB,SAAS,CAAC,EAAE;iDACT,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;eAKxG,qBAAqB;;;2CAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;UAI1I,oBAAoB,CAAC,MAAM;;;;;;;UAO3B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;oBACd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;8CACzD,SAAS,CAAC,IAAI;4CAChB,SAAS,CAAC,EAAE;;YAE5C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,WAAW,CAAC,MAAM;YAC9C,2BAA2B,CAAC,KAAK,CAAC,MAAM;;;wCAGZ,2BAA2B,CAAC,WAAW,CAAC,MAAM;gDACtC,cAAc;WACnD,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKrD,oBAAoB,CAAC,SAAS;;;;;;;;;;gCAUR,YAAY;aAC/B,qBAAqB;;yCAEO,2BAA2B,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAKtI,oBAAoB,CAAC,UAAU;;;;;;;UAO/B,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;6CAGrB,iBAAiB;aACjD,qBAAqB;;oBAEd,eAAe;yDACsB,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yCAC9D,2BAA2B,CAAC,KAAK,CAAC,MAAM;8CACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1G,oBAAoB,CAAC,WAAW;;;;;;;;;;gCAUV,YAAY;aAC/B,qBAAqB;;;yCAGO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACvF,KAAK,CAAC,eAAe,CAAC,IAG/B;QACC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAE/E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,8GAA8G,EAC9G,WAAW,EACX,GAAG,CAAC,SAAS,CACd,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAC1D,MAAM,MAAM,GAAG,kBAAkB;gBAC/B,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,CAAC;YAClE,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,uHAAuH,EACvH,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CACrI,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;qBAC9B,KAAK,CACJ,yIAAyI,EACzI,WAAW,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;gBACJ,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;gBACzD,GAAG,EAAE;oBACH,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACD,MAAM;gBACN,cAAc;gBACd,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,GAAG,EAAE,MAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2OAA2O;IACjO,KAAK,CAAC,iBAAiB;QAC/B,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAiD;YAC5E,SAAS,EAAE,GAAG,CAAA;;UAEV,2BAA2B,CAAC,iBAAiB,CAAC,IAAI;;;aAG/C,qBAAqB;qBACb,eAAe;qBACf,eAAe;yCACK,2BAA2B,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;;;;;UAK1I,2BAA2B,CAAC,eAAe,CAAC,IAAI;;;aAG7C,qBAAqB;yCACO,2BAA2B,CAAC,eAAe,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;KAC7I;SACA,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { type Model } from 'casbin';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { GrantBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationActions,\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationPolicyVariants,\n} from '@venizia/ignis-kernel';\nimport { BaseFilteredAdapter } from '../base-filtered';\nimport { CustomGrantExpander, type TCustomGrantRow } from '../custom-grant-expander';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from '../common';\nimport { PrincipalPolicyEdges, type TPrincipalPolicyRow } from './policy-edges';\nimport {\n  DEFAULT_SCHEMA,\n  type IScopedCasbinPolicyFilter,\n  type TDomainHierarchyEdge,\n  type TGrantRow,\n  type TResolveDomainEdgesFn,\n} from './common';\n\n/**\n * Filtered casbin adapter for the scoped RBAC model: loads ONE principal's edges (role assignments,\n * memberships, grants) plus the shared structural hierarchy trees as casbin lines. Read-only.\n *\n * EVERY branch below must select by `variant = <known value>` or `variant IN (<known values>)`.\n * Never `variant NOT IN (...)`, and never a bare select that classifies afterwards. Applications\n * store their own edge kinds in this same table (declared via `extraVariants`), and an exclusion\n * filter would sweep those unknown rows into a branch that has no idea what they mean. The current\n * shape makes an undeclared variant inert, which is what makes sharing the table safe.\n */\nexport class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasbinPolicyFilter> {\n  protected readonly entities: IScopedCasbinEntities;\n  protected readonly customGrantExpander: CustomGrantExpander;\n  protected readonly resolveDomainEdges?: TResolveDomainEdgesFn;\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: IScopedCasbinEntities;\n    resolveDomainEdges?: TResolveDomainEdgesFn;\n  }) {\n    super({ scope: ScopedCasbinAdapter.name, dataSource: opts.dataSource });\n    this.entities = opts.entities;\n    this.resolveDomainEdges = opts.resolveDomainEdges;\n    this.customGrantExpander = new CustomGrantExpander({\n      dataSource: opts.dataSource,\n      entities: { permission: opts.entities.permission, softDelete: opts.entities.softDelete },\n    });\n  }\n\n  /**\n   * One wave: the principal-scoped CTE and the merged structural-edges query are issued together -\n   * the role closure resolves in SQL, so neither waits on the other. `resolveDomainEdges` cannot\n   * join that wave - it needs the domain closure the principal-scoped CTE produces - but it does\n   * not wait for the structural-edges query either: both run concurrently once the closure is known.\n   */\n  async loadFilteredPolicy(model: Model, filter: IScopedCasbinPolicyFilter): Promise<void> {\n    const { principal } = filter;\n    const { principals } = this.entities;\n\n    const principalPoliciesPromise = this.queryPrincipalPolicies({ principal });\n    const structuralEdgesPromise = this.queryEdgePolicies();\n    const principalRows = await principalPoliciesPromise;\n\n    const lines: string[] = [];\n    const directGrants: TGrantRow[] = [];\n    const roleGrants: TGrantRow[] = [];\n    const domainClosure = new Set<string>();\n\n    for (const row of principalRows) {\n      switch (row.kind) {\n        case PrincipalPolicyEdges.ROLE_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.ROLE_INHERITS.rule}, ${principals.role}_${row.subjectId}, ${principals.role}_${row.targetId}, *`,\n          );\n          break;\n        }\n\n        case PrincipalPolicyEdges.ROLE_GRANT: {\n          roleGrants.push(row);\n          break;\n        }\n\n        case PrincipalPolicyEdges.DOMAIN_EDGE: {\n          lines.push(\n            `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${row.subjectId}, ${row.targetId}`,\n          );\n          // Both ends are, by construction, members of the principal's domain_closure CTE.\n          domainClosure.add(String(row.subjectId));\n          domainClosure.add(String(row.targetId));\n          break;\n        }\n\n        default: {\n          if (row.variant === AuthorizationPolicyVariants.JOIN_DOMAIN.action) {\n            domainClosure.add(`${row.targetType}_${row.targetId}`);\n          }\n          this.collectDirectRow({ row, principal, lines, directGrants });\n          break;\n        }\n      }\n    }\n\n    const hookLinesPromise = this.resolveDomainEdgeLines({\n      principal,\n      domains: [...domainClosure],\n    });\n\n    const result = await this.buildGrantLines({ subjectType: principal.type, rows: directGrants });\n    lines.push(...result);\n    const result2 = await this.buildGrantLines({ subjectType: principals.role, rows: roleGrants });\n    lines.push(...result2);\n\n    const [structuralEdges, hookLines] = await Promise.all([\n      structuralEdgesPromise,\n      hookLinesPromise,\n    ]);\n    lines.push(...structuralEdges);\n    lines.push(...hookLines);\n\n    await this.loadLines({ model, lines });\n  }\n\n  /** Route one `direct` row to its casbin line, or to the grant batch. */\n  protected collectDirectRow(opts: {\n    row: TPrincipalPolicyRow;\n    principal: { type: string; id: IdType };\n    lines: string[];\n    directGrants: TGrantRow[];\n  }): void {\n    const { row, principal, lines, directGrants } = opts;\n    const { principals } = this.entities;\n\n    switch (row.variant) {\n      case AuthorizationPolicyVariants.ASSIGN_ROLE.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.ASSIGN_ROLE.rule}, ${principal.type}_${principal.id}, ${principals.role}_${row.targetId}, ${row.domain ?? '*'}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.JOIN_DOMAIN.action: {\n        lines.push(\n          `${AuthorizationPolicyVariants.JOIN_DOMAIN.rule}, ${principal.type}_${principal.id}, ${row.targetType}_${row.targetId}`,\n        );\n        break;\n      }\n\n      case AuthorizationPolicyVariants.GRANT.action: {\n        directGrants.push(row);\n        break;\n      }\n\n      default: {\n        this.logger\n          .for(this.collectDirectRow.name)\n          .error('Unexpected variant in the direct branch | variant: %s', row.variant);\n        break;\n      }\n    }\n  }\n\n  /**\n   * Calls the `resolveDomainEdges` hook, if supplied, and turns its edges into `g3` lines using\n   * the same shape the DOMAIN_EDGE branch emits. A throwing hook is logged and treated as no\n   * edges - the rows already gathered for this principal still load. This is the safe direction:\n   * a missing hierarchy edge can only narrow what `g`/`g2`/`g3` reach, never widen it, so the\n   * failure degrades to less access rather than either an outage or excess access.\n   */\n  protected async resolveDomainEdgeLines(opts: {\n    principal: { type: string; id: IdType };\n    domains: string[];\n  }): Promise<string[]> {\n    if (!this.resolveDomainEdges) {\n      return [];\n    }\n\n    let edges: TDomainHierarchyEdge[];\n    try {\n      const result = await this.resolveDomainEdges(opts);\n      edges = result;\n    } catch (error) {\n      this.logger\n        .for(this.resolveDomainEdgeLines.name)\n        .error(\n          'resolveDomainEdges hook threw - continuing without its edges for this load | principal: %s_%s | error: %s',\n          opts.principal.type,\n          opts.principal.id,\n          error,\n        );\n      return [];\n    }\n\n    return edges.map(\n      (edge) =>\n        `${AuthorizationPolicyVariants.DOMAIN_INHERITS.rule}, ${edge.child}, ${edge.parent}`,\n    );\n  }\n\n  /** Schema for a table, defaulting to `public`. */\n  protected schemaOf(table: { schemaName?: string }): string {\n    return table.schemaName ?? DEFAULT_SCHEMA;\n  }\n\n  /** The casbin domain token, built from the stored pair - one expression for every SELECT so they cannot drift. NULL reaches `buildGrantLines` as `ANY_MEMBER`. The alias is emitted raw for the same reason as in `softDeleteClause`: quoting folds it to a different case than the unquoted FROM alias. */\n  protected domainTokenSelection(opts: { alias: string }): SQL {\n    const column = (name: string) => sql`${sql.raw(opts.alias)}.${sql.identifier(name)}`;\n    const domainType = column('domain_type');\n    const domainId = column('domain_id');\n\n    return sql`CASE\n      WHEN ${domainType} IS NULL THEN NULL\n      WHEN ${domainId} IS NULL THEN ${domainType}\n      ELSE ${domainType} || '_' || ${domainId}::text\n    END AS \"domain\"`;\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  protected qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    return sql`${sql.identifier(this.schemaOf(table))}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  protected softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.entities.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** One statement for everything scoped to a principal: its own edges, the role_inherits edges reachable from its roles, and the grants of that closure. `UNION` in the recursive term is what terminates a cyclic role graph. */\n  protected async queryPrincipalPolicies(opts: {\n    principal: { type: string; id: IdType };\n  }): Promise<TPrincipalPolicyRow[]> {\n    const { policyDefinition, permission, principals, domainTypes } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n    const { principal } = opts;\n\n    const metadataColumnName = policyDefinition.metadata?.columnName;\n    const metadataSelection = metadataColumnName\n      ? sql`, policyDefinition.${sql.identifier(metadataColumnName)} AS \"metadata\"`\n      : sql.empty();\n    const metadataNull = metadataColumnName ? sql`, NULL::jsonb AS \"metadata\"` : sql.empty();\n\n    const domainTypeList = sql.join(\n      domainTypes.map((domainType) => sql`${domainType}`),\n      sql`, `,\n    );\n\n    const rows = await this.query<TPrincipalPolicyRow>({\n      statement: sql`\n      WITH RECURSIVE role_closure AS (\n        SELECT policyDefinition.target_id AS role_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ASSIGN_ROLE.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      ),\n\n      domain_closure AS (\n        SELECT policyDefinition.target_type AS dom_type, policyDefinition.target_id AS dom_id\n        FROM ${policyDefinitionTable} policyDefinition\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          AND policyDefinition.subject_type = ${principal.type}\n          AND policyDefinition.subject_id = ${principal.id}\n          AND policyDefinition.target_type IN (${domainTypeList})${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n        UNION\n\n        SELECT policyDefinition.target_type, policyDefinition.target_id\n        FROM ${policyDefinitionTable} policyDefinition\n          JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                             AND policyDefinition.subject_id = domain_closure.dom_id\n        WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n      )\n\n      SELECT\n        ${PrincipalPolicyEdges.DIRECT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.subject_type = ${principal.type}\n        AND policyDefinition.subject_id = ${principal.id}\n        AND policyDefinition.variant IN (\n          ${AuthorizationPolicyVariants.ASSIGN_ROLE.action},\n          ${AuthorizationPolicyVariants.JOIN_DOMAIN.action},\n          ${AuthorizationPolicyVariants.GRANT.action}\n        )\n        AND (\n          policyDefinition.variant <> ${AuthorizationPolicyVariants.JOIN_DOMAIN.action}\n          OR policyDefinition.target_type IN (${domainTypeList})\n        )${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ROLE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.ROLE_GRANT}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_id::text AS \"subjectId\",\n        policyDefinition.target_type AS \"targetType\",\n        policyDefinition.target_id::text AS \"targetId\",\n        policyDefinition.action,\n        policyDefinition.effect,\n        ${this.domainTokenSelection({ alias: 'policyDefinition' })},\n        permission.code AS \"objectCode\",\n        permission.subject AS \"objectSubject\",\n        permission.method AS \"objectMethod\"${metadataSelection}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN role_closure ON policyDefinition.subject_id = role_closure.role_id\n        LEFT JOIN ${permissionTable} permission\n          ON policyDefinition.target_id = permission.id${this.softDeleteClause({ alias: 'permission' })}\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.GRANT.action}\n        AND policyDefinition.subject_type = ${principals.role}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${PrincipalPolicyEdges.DOMAIN_EDGE}::text AS \"kind\",\n        policyDefinition.variant,\n        policyDefinition.subject_type || '_' || policyDefinition.subject_id::text AS \"subjectId\",\n        NULL AS \"targetType\",\n        policyDefinition.target_type || '_' || policyDefinition.target_id::text AS \"targetId\",\n        NULL AS \"action\",\n        NULL AS \"effect\",\n        NULL AS \"domain\",\n        NULL AS \"objectCode\",\n        NULL AS \"objectSubject\",\n        NULL AS \"objectMethod\"${metadataNull}\n      FROM ${policyDefinitionTable} policyDefinition\n        JOIN domain_closure ON policyDefinition.subject_type = domain_closure.dom_type\n                           AND policyDefinition.subject_id = domain_closure.dom_id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.DOMAIN_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows;\n  }\n\n  /** Turn fetched grant rows into casbin lines. Shared by the direct and role-closure branches. */\n  protected async buildGrantLines(opts: {\n    subjectType: string;\n    rows: TGrantRow[];\n  }): Promise<string[]> {\n    const { subjectType, rows } = opts;\n    const metadataColumnName = this.entities.policyDefinition.metadata?.columnName;\n\n    const lines: string[] = [];\n    const customRows: TCustomGrantRow[] = [];\n\n    for (const row of rows) {\n      if (!row.objectCode) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row whose permission did not resolve - the target is missing or soft-deleted | subject: %s_%s',\n            subjectType,\n            row.subjectId,\n          );\n        continue;\n      }\n\n      const domain = row.domain ?? AuthorizationDomainScopes.ANY_MEMBER;\n      const effect = row.effect ?? AuthorizationDecisions.ALLOW;\n      const parsed = metadataColumnName\n        ? GrantBuilder.getInstance().parseCustomGrantMetadata({ metadata: row.metadata })\n        : null;\n      const isCustomAction = row.action === AuthorizationActions.CUSTOM;\n      const isCustomRow = isCustomAction || Boolean(parsed);\n\n      if (!isCustomRow && !row.action) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping grant row with no action - the permission it should confer is silently missing | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      if (!isCustomRow) {\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${subjectType}_${row.subjectId}, ${domain}, ${row.objectCode}, ${row.action}, ${effect}`,\n        );\n        continue;\n      }\n\n      if (!row.objectSubject || !row.objectMethod) {\n        this.logger\n          .for(this.buildGrantLines.name)\n          .error(\n            'Skipping custom grant row whose subject or method did not resolve - the target is missing or soft-deleted | subject: %s_%s | object: %s',\n            subjectType,\n            row.subjectId,\n            row.objectCode,\n          );\n        continue;\n      }\n\n      const rejection = this.customGrantExpander.rejectCustomRow({\n        row: {\n          subjectId: row.subjectId,\n          objectCode: row.objectCode,\n          objectMethod: row.objectMethod,\n        },\n        parsed,\n        isCustomAction,\n        metadataColumnName,\n      });\n\n      if (rejection) {\n        this.logger.for(this.buildGrantLines.name).error(rejection);\n        continue;\n      }\n\n      customRows.push({\n        subjectId: row.subjectId,\n        objectSubject: row.objectSubject,\n        ops: parsed!.ops,\n        domain,\n        effect,\n      });\n    }\n\n    const expanded = await this.customGrantExpander.expandCustomGrants({ subjectType, customRows });\n    for (const rejection of expanded.rejections) {\n      this.logger.for(this.buildGrantLines.name).error(rejection);\n    }\n    lines.push(...expanded.lines);\n\n    return lines;\n  }\n\n  /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */\n  protected async queryEdgePolicies(): Promise<string[]> {\n    const { policyDefinition, permission } = this.entities;\n    const policyDefinitionTable = this.qualifiedTable({ table: policyDefinition });\n    const permissionTable = this.qualifiedTable({ table: permission });\n\n    const rows = await this.query<{ rel: string; child: string; parent: string }>({\n      statement: sql`\n      SELECT\n        ${AuthorizationPolicyVariants.RESOURCE_INHERITS.rule} AS \"rel\",\n        child_permission.code AS \"child\",\n        parent_permission.code AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n        INNER JOIN ${permissionTable} child_permission ON policyDefinition.subject_id = child_permission.id\n        INNER JOIN ${permissionTable} parent_permission ON policyDefinition.target_id = parent_permission.id\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.RESOURCE_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n\n      UNION ALL\n\n      SELECT\n        ${AuthorizationPolicyVariants.ACTION_INHERITS.rule} AS \"rel\",\n        policyDefinition.subject_id::text AS \"child\",\n        policyDefinition.target_id::text AS \"parent\"\n      FROM ${policyDefinitionTable} policyDefinition\n      WHERE policyDefinition.variant = ${AuthorizationPolicyVariants.ACTION_INHERITS.action}${this.softDeleteClause({ alias: 'policyDefinition' })}\n    `,\n    });\n\n    return rows.map((row) => `${row.rel}, ${row.child}, ${row.parent}`);\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/casbin-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"casbin-module.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAEA,iOAAiO;AACjO,qBAAa,YAAY;WACV,IAAI,IAAI,OAAO,CAAC,cAAc,QAAQ,CAAC,CAAC;CAUtD"}
+{"version":3,"file":"casbin-module.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAEA,iOAAiO;AACjO,qBAAa,YAAY;WACV,IAAI,IAAI,OAAO,CAAC,cAAc,QAAQ,CAAC,CAAC;CAWtD"}

package/dist/esm/components/auth/authorize/enforcers/casbin-module.js

@@ -3,7 +3,8 @@ import { getError } from '@venizia/ignis-helpers/core';
 export class CasbinModule {
     static async load() {
         try {
-            return await import('casbin');
+            const result = await import('casbin');
+            return result;
         }
         catch {
             throw getError({

package/dist/esm/components/auth/authorize/enforcers/casbin-module.js.map

@@ -1 +1 @@
-{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,iOAAiO;AACjO,MAAM,OAAO,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\n\n/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */\nexport class CasbinModule {\n  static async load(): Promise<typeof import('casbin')> {\n    try {\n      return await import('casbin');\n    } catch {\n      throw getError({\n        message:\n          '[CasbinModule] \"casbin\" is not installed | Install the optional peer casbin to use the casbin enforcer',\n      });\n    }\n  }\n}\n"]}
+{"version":3,"file":"casbin-module.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,iOAAiO;AACjO,MAAM,OAAO,YAAY;IACvB,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\n\n/** Loads the optional peer `casbin`. The specifier stays a literal so a build embeds casbin when it is installed, and the import sits in a `try` so a build without it still succeeds - only using the casbin enforcer fails. */\nexport class CasbinModule {\n  static async load(): Promise<typeof import('casbin')> {\n    try {\n      const result = await import('casbin');\n      return result;\n    } catch {\n      throw getError({\n        message:\n          '[CasbinModule] \"casbin\" is not installed | Install the optional peer casbin to use the casbin enforcer',\n      });\n    }\n  }\n}\n"]}

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"casbin.enforcer.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAA4B,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAG/B,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EACnC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,mFAAmF;AACnF,KAAK,mBAAmB,CAAC,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,qBAAa,2BAA2B,CACtC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CAEjC,SAAQ,UACR,YAAW,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;IAepE,OAAO,CAAC,OAAO;IAbjB,IAAI,SAAoC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC,OAAO,CAAC,IAAI,CAAuD;IACnE,OAAO,CAAC,MAAM,CAA4C;IAE1D,OAAO,CAAC,mBAAmB,CAAwC;IAGnE,OAAO,CAAC,iBAAiB,CAA+D;gBAI9E,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC;IAO1D,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IA2ChC,OAAO,IAAI,IAAI;IAMf,0MAA0M;IAC1M,SAAS,CAAC,yBAAyB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE;IAiBpE,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;QACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAWnB,QAAQ,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsDnC,yGAAyG;IACzG,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO;IAiBvF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBlC,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBpD,kMAAkM;IAClM,SAAS,CAAC,iBAAiB,IAAI,mBAAmB;cAkBlC,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgEjB,gFAAgF;IAChF,SAAS,CAAC,uBAAuB,CAAC,IAAI,EAAE;QACtC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,IAAI,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO;IA2B3C,gGAAgG;IAChG,SAAS,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS;IAmB1F,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;KACxC;IAkBD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAY9D,gNAAgN;cAChM,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvF,oJAAoJ;cACpI,wBAAwB,CAAC,IAAI,EAAE;QAC7C,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAalB"}
+{"version":3,"file":"casbin.enforcer.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAA4B,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EACV,QAAQ,IAAI,kBAAkB,EAG/B,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EACnC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,mFAAmF;AACnF,KAAK,mBAAmB,CAAC,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;CAC9B,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAS7E,qBAAa,2BAA2B,CACtC,CAAC,SAAS,GAAG,GAAG,GAAG,EACnB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CAEjC,SAAQ,UACR,YAAW,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;IAepE,OAAO,CAAC,OAAO;IAbjB,IAAI,SAAoC;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEzC,OAAO,CAAC,IAAI,CAAuD;IACnE,OAAO,CAAC,MAAM,CAA4C;IAE1D,OAAO,CAAC,mBAAmB,CAAwC;IAGnE,OAAO,CAAC,iBAAiB,CAA+D;gBAI9E,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC;IAO1D,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IA2ChC,OAAO,IAAI,IAAI;IAMf,0MAA0M;IAC1M,SAAS,CAAC,yBAAyB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE;IAiBpE,UAAU,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,kBAAkB,CAAC;QACzB,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAgBnB,QAAQ,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsDnC,yGAAyG;IACzG,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO;IAiBvF,mBAAmB,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBlC,gBAAgB,CAAC,IAAI,EAAE;QAC3B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBpD,kMAAkM;IAClM,SAAS,CAAC,iBAAiB,IAAI,mBAAmB;cAkBlC,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgEjB,gFAAgF;IAChF,SAAS,CAAC,uBAAuB,CAAC,IAAI,EAAE;QACtC,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,IAAI,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO;IA2B3C,gGAAgG;IAChG,SAAS,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS;IAmB1F,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,cAAc,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;KACxC;IAkBD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAY9D,gNAAgN;cAChM,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvF,oJAAoJ;cACpI,wBAAwB,CAAC,IAAI,EAAE;QAC7C,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAalB"}

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.js

@@ -90,9 +90,15 @@ let CasbinAuthorizationEnforcer = CasbinAuthorizationEnforcer_1 = class CasbinAu
     async buildRules(opts) {
         const { user } = opts;
         const cached = this.options.cached;
-        const lines = cached.use
-            ? await this.requireRedisCache().fetch({ user })
-            : await this.extractUserLines({ user });
+        let lines;
+        if (cached.use) {
+            const fetched = await this.requireRedisCache().fetch({ user });
+            lines = fetched;
+        }
+        else {
+            const extracted = await this.extractUserLines({ user });
+            lines = extracted;
+        }
         return { user, lines };
     }
     async evaluate(opts) {