@venizia/ignis 0.4.6 → 0.4.7-1

package/dist/esm/components/auth/authorize/enforcers/casbin.enforcer.js.map

@@ -1 +1 @@
-{"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAQnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GAQnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,UAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG;YACtB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,mBAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,8BAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,2BAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,mBAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,QAAQ,CAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,kDAAkD,0BAA0B,CAAC,IAAI,KAAK,0BAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,eAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtaY,2BAA2B;IAoBnC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CAsavC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  RoleManager as CasbinRoleManagerType,\n} from 'casbin';\nimport { type Env } from 'hono';\nimport { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationEnforcerTypes,\n  AuthorizationPolicyVariants,\n  AuthorizeBindingKeys,\n  CasbinDomainMatchingFunctions,\n  CasbinEnforcerModelDrivers,\n  CasbinRuleVariants,\n  type IAuthorizationEnforcer,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n  type ICasbinRules,\n  type IAuthorizationRequest,\n  type TAuthorizationDecision,\n  type TCasbinDomainMatchingFunction,\n} from '@venizia/ignis-kernel';\nimport { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy';\nimport { CasbinModule } from './casbin-module';\nimport { MembershipRoleManager } from '../role-managers/membership';\nimport { ResourceRoleManager } from '../role-managers/resource';\nimport { PolicyLineCodec } from './policy-line-codec';\nimport { UserPolicyLineCache } from './user-policy-line-cache';\n\n/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */\ntype TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {\n  user: IAuthorizationUser;\n  action: TAction;\n  resource: TResource;\n  context: TContext<E, string>;\n}) => { subject: string; resource: string; action: string; domain?: string };\n\n/** `addDomainHierarchy` lives on casbin's `DefaultRoleManager`, not on the `RoleManager` interface or the `Enforcer` facade - feature-detect it on whatever `getNamedRoleManager` returns. */\ninterface ICasbinRoleManagerWithDomainHierarchy {\n  addDomainHierarchy?(rm: CasbinRoleManagerType): Promise<void>;\n}\n\n// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.\n\nexport class CasbinAuthorizationEnforcer<\n  E extends Env = Env,\n  TAction extends string = string,\n  TResource extends string = string,\n>\n  extends BaseHelper\n  implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules>\n{\n  name = CasbinAuthorizationEnforcer.name;\n  private readonly MIN_EXPIRES_IN = 10_000;\n\n  private pool: TNullable<BasePoolHelper<CasbinEnforcerType>> = null;\n  private helper: TNullable<typeof CasbinHelperType> = null;\n  // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.\n  private userPolicyLineCache: TNullable<UserPolicyLineCache> = null;\n\n  // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).\n  private resolvedPayloadFn: TNullable<TNormalizePayloadFn<E, TAction, TResource>> = null;\n\n  constructor(\n    @inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })\n    private options: ICasbinEnforcerOptions<E, TAction, TResource>,\n  ) {\n    super({ scope: CasbinAuthorizationEnforcer.name });\n  }\n\n  // Lifecycle\n\n  async configure(): Promise<void> {\n    const casbin = await CasbinModule.load();\n\n    if (!this.options.model) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] options.model is required.',\n      });\n    }\n\n    this.helper = casbin.Helper;\n\n    this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();\n\n    const { cached } = this.options;\n    if (cached.use) {\n      this.validateExpiresIn({ expiresIn: cached.options.expiresIn });\n    }\n\n    this.pool = new BasePoolHelper<CasbinEnforcerType>({\n      scope: `${CasbinAuthorizationEnforcer.name}.Pool`,\n      size: this.options.poolSize ?? 16,\n      acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,\n      create: async () => {\n        const model = this.resolveModel({ casbin, model: this.options.model });\n\n        const enforcer = await casbin.newEnforcer(model);\n        await this.registerMatchers({ enforcer, casbin });\n        this.assertMatcherCompilesSync({ enforcer });\n\n        return enforcer;\n      },\n    });\n    await this.pool.warmup();\n\n    this.logger\n      .for(this.configure.name)\n      .info(\n        'Casbin enforcer pool ready (size: %s, cached: %s)',\n        this.options.poolSize ?? 16,\n        cached.use ? cached.driver : 'none',\n      );\n  }\n\n  destroy(): void {\n    this.pool?.destroy().catch((error) => {\n      this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);\n    });\n  }\n\n  /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */\n  protected assertMatcherCompilesSync(opts: { enforcer: CasbinEnforcerType }) {\n    try {\n      if (this.options.isScoped || this.options.normalizePayloadFn) {\n        opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');\n        return;\n      }\n\n      opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');\n    } catch (error) {\n      throw getError({\n        message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,\n      });\n    }\n  }\n\n  // IAuthorizationEnforcer - public API\n\n  async buildRules(opts: {\n    user: IAuthorizationUser;\n    context: TContext<E, string>;\n  }): Promise<ICasbinRules> {\n    const { user } = opts;\n    const cached = this.options.cached;\n\n    const lines = cached.use\n      ? await this.requireRedisCache().fetch({ user })\n      : await this.extractUserLines({ user });\n\n    return { user, lines };\n  }\n\n  async evaluate(opts: {\n    rules: ICasbinRules;\n    request: IAuthorizationRequest<TAction, TResource>;\n    context: TContext<E, string>;\n  }): Promise<TAuthorizationDecision> {\n    if (!this.pool) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',\n      });\n    }\n\n    if (!opts.request?.action || !opts.request?.resource) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',\n      });\n    }\n\n    const { rules, request, context } = opts;\n    const { user, lines } = rules;\n\n    return this.pool.use({\n      execution: async (enforcer) => {\n        await this.loadPolicyLinesIntoModel({ enforcer, lines });\n\n        const normalizePayloadFn = this.resolvedPayloadFn;\n\n        if (!normalizePayloadFn) {\n          const subject = `${user.principalType}_${user.userId}`;\n          const isAllowed = this.enforceWithExplain({\n            enforcer,\n            vals: [subject, String(request.resource), String(request.action)],\n          });\n          return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n        }\n\n        const normalized = normalizePayloadFn({\n          user,\n          action: request.action,\n          resource: request.resource,\n          context,\n        });\n\n        // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.\n        const domain =\n          normalized.domain ??\n          request.domain ??\n          (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);\n\n        const vals = domain\n          ? [normalized.subject, domain, normalized.resource, normalized.action]\n          : [normalized.subject, normalized.resource, normalized.action];\n        const isAllowed = this.enforceWithExplain({ enforcer, vals });\n\n        return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n      },\n    });\n  }\n\n  /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */\n  protected enforceWithExplain(opts: { enforcer: CasbinEnforcerType; vals: string[] }): boolean {\n    const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);\n\n    if (!isAllowed) {\n      this.logger\n        .for(this.evaluate.name)\n        .info(\n          'DENY | request: [%s] | matchedPolicy: %s',\n          opts.vals.join(', '),\n          matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>',\n        );\n    }\n\n    return isAllowed;\n  }\n\n  // Cache management - optional IAuthorizationEnforcer members (on-demand)\n  async invalidateUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ invalidatedKeys: number }> {\n    const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({\n      user: opts.user,\n    });\n\n    this.logger\n      .for(this.invalidateUserCache.name)\n      .info(\n        'Invalidated authz cache | user: %s | key: %s | deleted: %s',\n        opts.user.userId,\n        cacheKey,\n        invalidatedKeys,\n      );\n\n    return { invalidatedKeys };\n  }\n\n  async rebuildUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lineCount: number }> {\n    // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.\n    const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });\n\n    this.logger\n      .for(this.rebuildUserCache.name)\n      .info(\n        'Rebuilt authz cache | user: %s | key: %s | lines: %s',\n        opts.user.userId,\n        cacheKey,\n        lines.length,\n      );\n\n    return { cacheKey, lineCount: lines.length };\n  }\n\n  /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */\n  protected requireRedisCache(): UserPolicyLineCache {\n    const { cached } = this.options;\n\n    if (!cached.use) {\n      throw getError({\n        message:\n          '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',\n      });\n    }\n\n    return (this.userPolicyLineCache ??= new UserPolicyLineCache({\n      cached,\n      loadLines: (opts) => this.extractUserLines(opts),\n    }));\n  }\n\n  // Matchers & model resolvers\n\n  protected async registerMatchers(opts: {\n    enforcer: CasbinEnforcerType;\n    casbin: typeof import('casbin');\n  }): Promise<void> {\n    const { enforcer, casbin } = opts;\n    const { domainMatching, isScoped } = this.options;\n\n    if (domainMatching) {\n      if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {\n        throw getError({\n          message: `[registerMatchers] Role definition \"${domainMatching.roleDefinition}\" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \\`g = _, _, _\\`) before enabling domainMatching.`,\n        });\n      }\n\n      const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });\n      await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);\n    }\n\n    if (isScoped) {\n      await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);\n      await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);\n\n      // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.\n      enforcer.setNamedRoleManager(\n        AuthorizationPolicyVariants.RESOURCE_INHERITS.rule,\n        new ResourceRoleManager(),\n      );\n\n      // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the\n      // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss\n      // per-request g3 edges - g2 needs the same freshness for a just-created child domain.\n      // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is\n      // repopulated from whatever `g3` lines this principal's own policy line set carries.\n      const domainHierarchyOverlay = new Map<string, Set<string>>();\n\n      // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G2,\n        new MembershipRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G3,\n        new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs\n      // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.\n      const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G) as\n        | (CasbinRoleManagerType & ICasbinRoleManagerWithDomainHierarchy)\n        | undefined;\n\n      if (!gRoleManager?.addDomainHierarchy) {\n        throw getError({\n          message:\n            '[registerMatchers] The \"g\" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for \"g\".',\n        });\n      }\n\n      await gRoleManager.addDomainHierarchy(\n        new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }),\n      );\n    }\n\n    await enforcer.buildRoleLinks();\n  }\n\n  /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */\n  protected resolveDomainMatchingFn(opts: {\n    casbin: typeof import('casbin');\n    name: TCasbinDomainMatchingFunction;\n  }): (arg1: string, arg2: string) => boolean {\n    // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.\n    const { Util } = opts.casbin;\n    switch (opts.name) {\n      case CasbinDomainMatchingFunctions.KEY_MATCH: {\n        return Util.keyMatchFunc;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_2: {\n        return Util.keyMatch2Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_3: {\n        return Util.keyMatch3Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_4: {\n        return Util.keyMatch4Func;\n      }\n      case CasbinDomainMatchingFunctions.REGEX_MATCH: {\n        return Util.regexMatchFunc;\n      }\n      default: {\n        throw getError({\n          message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,\n        });\n      }\n    }\n  }\n\n  /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */\n  protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined {\n    if (!this.options.isScoped) {\n      return undefined;\n    }\n\n    return (opts: {\n      user: IAuthorizationUser;\n      action: TAction;\n      resource: TResource;\n    }): { subject: string; resource: string; action: string; domain?: string } => {\n      // No domain here - evaluate() fills it from request.domain (set by the provider).\n      return {\n        subject: `${opts.user.principalType}_${opts.user.userId}`,\n        resource: String(opts.resource),\n        action: String(opts.action),\n      };\n    };\n  }\n\n  protected resolveModel(opts: {\n    casbin: typeof import('casbin');\n    model: ICasbinEnforcerOptions['model'];\n  }) {\n    const { casbin, model } = opts;\n\n    switch (model.driver) {\n      case CasbinEnforcerModelDrivers.FILE: {\n        return casbin.newModelFromFile(model.definition);\n      }\n      case CasbinEnforcerModelDrivers.TEXT: {\n        return casbin.newModelFromString(model.definition);\n      }\n      default: {\n        throw getError({\n          message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,\n        });\n      }\n    }\n  }\n\n  protected validateExpiresIn(opts: { expiresIn: number }): void {\n    if (opts.expiresIn >= this.MIN_EXPIRES_IN) {\n      return;\n    }\n\n    throw getError({\n      message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,\n    });\n  }\n\n  // Policy loading internals\n\n  /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */\n  protected async extractUserLines(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const casbin = await CasbinModule.load();\n    const model = this.resolveModel({ casbin, model: this.options.model });\n\n    return PolicyLineCodec.extractUserLines({\n      casbin,\n      model,\n      adapter: this.options.adapter,\n      user: opts.user,\n    });\n  }\n\n  /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */\n  protected async loadPolicyLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n  }): Promise<void> {\n    if (!this.helper) {\n      throw getError({\n        message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',\n      });\n    }\n\n    await PolicyLineCodec.loadLinesIntoModel({\n      enforcer: opts.enforcer,\n      lines: opts.lines,\n      helper: this.helper,\n    });\n  }\n}\n"]}
+{"version":3,"file":"casbin.enforcer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/enforcers/casbin.enforcer.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAQnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GAQnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAe/D,sMAAsM;AAEtM,IAAa,2BAA2B,mCAAxC,MAAa,2BAKX,SAAQ,UAAU;IAclB,YAEE,OAA8D;QAE9D,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAA+C;QAbhE,SAAI,GAAG,6BAA2B,CAAC,IAAI,CAAC;QACvB,mBAAc,GAAG,MAAM,CAAC;QAEjC,SAAI,GAAkD,IAAI,CAAC;QAC3D,WAAM,GAAuC,IAAI,CAAC;QAC1D,yJAAyJ;QACjJ,wBAAmB,GAAmC,IAAI,CAAC;QAEnE,qHAAqH;QAC7G,sBAAiB,GAA0D,IAAI,CAAC;IAOxF,CAAC;IAED,YAAY;IAEZ,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAqB;YACjD,KAAK,EAAE,GAAG,6BAA2B,CAAC,IAAI,OAAO;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;YACjC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC3D,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7C,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEzB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB,IAAI,CACH,mDAAmD,EACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CACpC,CAAC;IACN,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0MAA0M;IAChM,yBAAyB,CAAC,IAAsC;QACxE,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,sMAAsM,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sCAAsC;IAEtC,KAAK,CAAC,UAAU,CAAC,IAGhB;QACC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,IAAI,KAAe,CAAC;QACpB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,uEAAuE;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5B,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAElD,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC;wBACxC,QAAQ;wBACR,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAClE,CAAC,CAAC;oBACH,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBAChF,CAAC;gBAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;oBACpC,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO;iBACR,CAAC,CAAC;gBAEH,8LAA8L;gBAC9L,MAAM,MAAM,GACV,UAAU,CAAC,MAAM;oBACjB,OAAO,CAAC,MAAM;oBACd,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE9E,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;oBACtE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9D,OAAO,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAChF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IAC/F,kBAAkB,CAAC,IAAsD;QACjF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CACH,0CAA0C,EAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACpB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAC1E,CAAC;QACN,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,CAAC,IAEzB;QACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC9E,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;aAClC,IAAI,CACH,4DAA4D,EAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,eAAe,CAChB,CAAC;QAEJ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAEtB;QACC,gKAAgK;QAChK,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC/B,IAAI,CACH,sDAAsD,EACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,QAAQ,EACR,KAAK,CAAC,MAAM,CACb,CAAC;QAEJ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED,kMAAkM;IACxL,iBAAiB;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,0GAA0G;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,mBAAmB,CAAC;YAC3D,MAAM;YACN,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B;IAEnB,KAAK,CAAC,gBAAgB,CAAC,IAGhC;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAElD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjE,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,uCAAuC,cAAc,CAAC,cAAc,kIAAkI;iBAChN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1F,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,EAAE,8BAA8B,CAAC,WAAW,CAAC,CAAC;YAEtF,8KAA8K;YAC9K,QAAQ,CAAC,mBAAmB,CAC1B,2BAA2B,CAAC,iBAAiB,CAAC,IAAI,EAClD,IAAI,mBAAmB,EAAE,CAC1B,CAAC;YAEF,mFAAmF;YACnF,mFAAmF;YACnF,sFAAsF;YACtF,4FAA4F;YAC5F,qFAAqF;YACrF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAE9D,uFAAuF;YACvF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAC/D,CAAC;YAEF,QAAQ,CAAC,mBAAmB,CAC1B,kBAAkB,CAAC,EAAE,EACrB,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpE,CAAC;YAEF,qFAAqF;YACrF,2FAA2F;YAC3F,MAAM,YAAY,GAAG,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAEzD,CAAC;YAEd,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACtC,MAAM,QAAQ,CAAC;oBACb,OAAO,EACL,iSAAiS;iBACpS,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,CAAC,kBAAkB,CACnC,IAAI,0BAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED,gFAAgF;IACtE,uBAAuB,CAAC,IAGjC;QACC,+OAA+O;QAC/O,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,KAAK,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IACtF,sBAAsB;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAIP,EAA0E,EAAE;YAC3E,kFAAkF;YAClF,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5B,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAGtB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YACD,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,kDAAkD,0BAA0B,CAAC,IAAI,KAAK,0BAA0B,CAAC,IAAI,GAAG;iBAClI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,IAA2B;QACrD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,OAAO,EAAE,qEAAqE,IAAI,CAAC,cAAc,qBAAqB,IAAI,CAAC,SAAS,EAAE;SACvI,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAE3B,gNAAgN;IACtM,KAAK,CAAC,gBAAgB,CAAC,IAAkC;QACjE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,OAAO,eAAe,CAAC,gBAAgB,CAAC;YACtC,MAAM;YACN,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oJAAoJ;IAC1I,KAAK,CAAC,wBAAwB,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,oEAAoE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,CAAC,kBAAkB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA3aY,2BAA2B;IAoBnC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;;GApBhF,2BAA2B,CA2avC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseHelper, BasePoolHelper, getError } from '@venizia/ignis-helpers/core';\nimport { type TNullable } from '@venizia/ignis-helpers/common';\nimport type {\n  Enforcer as CasbinEnforcerType,\n  Helper as CasbinHelperType,\n  RoleManager as CasbinRoleManagerType,\n} from 'casbin';\nimport { type Env } from 'hono';\nimport { AuthorizationPermissionBuilder } from '@venizia/ignis-kernel';\nimport {\n  AuthorizationDecisions,\n  AuthorizationDomainScopes,\n  AuthorizationEnforcerTypes,\n  AuthorizationPolicyVariants,\n  AuthorizeBindingKeys,\n  CasbinDomainMatchingFunctions,\n  CasbinEnforcerModelDrivers,\n  CasbinRuleVariants,\n  type IAuthorizationEnforcer,\n  type IAuthorizationUser,\n  type ICasbinEnforcerOptions,\n  type ICasbinRules,\n  type IAuthorizationRequest,\n  type TAuthorizationDecision,\n  type TCasbinDomainMatchingFunction,\n} from '@venizia/ignis-kernel';\nimport { DomainHierarchyRoleManager } from '../role-managers/domain-hierarchy';\nimport { CasbinModule } from './casbin-module';\nimport { MembershipRoleManager } from '../role-managers/membership';\nimport { ResourceRoleManager } from '../role-managers/resource';\nimport { PolicyLineCodec } from './policy-line-codec';\nimport { UserPolicyLineCache } from './user-policy-line-cache';\n\n/** Payload shape for the scoped/custom path, matching defaultScopedPayloadFn(). */\ntype TNormalizePayloadFn<E extends Env, TAction, TResource> = (opts: {\n  user: IAuthorizationUser;\n  action: TAction;\n  resource: TResource;\n  context: TContext<E, string>;\n}) => { subject: string; resource: string; action: string; domain?: string };\n\n/** `addDomainHierarchy` lives on casbin's `DefaultRoleManager`, not on the `RoleManager` interface or the `Enforcer` facade - feature-detect it on whatever `getNamedRoleManager` returns. */\ninterface ICasbinRoleManagerWithDomainHierarchy {\n  addDomainHierarchy?(rm: CasbinRoleManagerType): Promise<void>;\n}\n\n// Wraps casbin (optional peer dep). Each request borrows its own pooled enforcer; any error during use destroys it (fail-closed). Pooled enforcers carry no adapter - only extractUserLines uses one.\n\nexport class CasbinAuthorizationEnforcer<\n  E extends Env = Env,\n  TAction extends string = string,\n  TResource extends string = string,\n>\n  extends BaseHelper\n  implements IAuthorizationEnforcer<E, TAction, TResource, ICasbinRules>\n{\n  name = CasbinAuthorizationEnforcer.name;\n  private readonly MIN_EXPIRES_IN = 10_000;\n\n  private pool: TNullable<BasePoolHelper<CasbinEnforcerType>> = null;\n  private helper: TNullable<typeof CasbinHelperType> = null;\n  // Lazily created on first cache use (see requireRedisCache) - one instance for the enforcer's lifetime so its single-flight de-dup map actually dedupes.\n  private userPolicyLineCache: TNullable<UserPolicyLineCache> = null;\n\n  // Memoized in configure() (options are fixed after) to avoid rebuilding this closure on every evaluate() (hot path).\n  private resolvedPayloadFn: TNullable<TNormalizePayloadFn<E, TAction, TResource>> = null;\n\n  constructor(\n    @inject({ key: AuthorizeBindingKeys.enforcerOptions(AuthorizationEnforcerTypes.CASBIN) })\n    private options: ICasbinEnforcerOptions<E, TAction, TResource>,\n  ) {\n    super({ scope: CasbinAuthorizationEnforcer.name });\n  }\n\n  // Lifecycle\n\n  async configure(): Promise<void> {\n    const casbin = await CasbinModule.load();\n\n    if (!this.options.model) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] options.model is required.',\n      });\n    }\n\n    this.helper = casbin.Helper;\n\n    this.resolvedPayloadFn = this.options.normalizePayloadFn ?? this.defaultScopedPayloadFn();\n\n    const { cached } = this.options;\n    if (cached.use) {\n      this.validateExpiresIn({ expiresIn: cached.options.expiresIn });\n    }\n\n    this.pool = new BasePoolHelper<CasbinEnforcerType>({\n      scope: `${CasbinAuthorizationEnforcer.name}.Pool`,\n      size: this.options.poolSize ?? 16,\n      acquireTimeoutMs: this.options.poolAcquireTimeoutMs ?? 5000,\n      create: async () => {\n        const model = this.resolveModel({ casbin, model: this.options.model });\n\n        const enforcer = await casbin.newEnforcer(model);\n        await this.registerMatchers({ enforcer, casbin });\n        this.assertMatcherCompilesSync({ enforcer });\n\n        return enforcer;\n      },\n    });\n    await this.pool.warmup();\n\n    this.logger\n      .for(this.configure.name)\n      .info(\n        'Casbin enforcer pool ready (size: %s, cached: %s)',\n        this.options.poolSize ?? 16,\n        cached.use ? cached.driver : 'none',\n      );\n  }\n\n  destroy(): void {\n    this.pool?.destroy().catch((error) => {\n      this.logger.for(this.destroy.name).warn('Pool destroy failed: %s', error);\n    });\n  }\n\n  /** casbin compiles the matcher lazily (first enforce, not newEnforcer/buildRoleLinks); this dummy enforceSync forces the compile at warmup so syntax / unregistered-function / arity errors fail boot. */\n  protected assertMatcherCompilesSync(opts: { enforcer: CasbinEnforcerType }) {\n    try {\n      if (this.options.isScoped || this.options.normalizePayloadFn) {\n        opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup', '::warmup');\n        return;\n      }\n\n      opts.enforcer.enforceSync('::warmup', '::warmup', '::warmup');\n    } catch (error) {\n      throw getError({\n        message: `[CasbinAuthorizationEnforcer] Matcher smoke test failed at warmup - the model matcher did not compile (check matcher syntax, that every referenced function is registered, and the request arity). ${String(error)}`,\n      });\n    }\n  }\n\n  // IAuthorizationEnforcer - public API\n\n  async buildRules(opts: {\n    user: IAuthorizationUser;\n    context: TContext<E, string>;\n  }): Promise<ICasbinRules> {\n    const { user } = opts;\n    const cached = this.options.cached;\n\n    let lines: string[];\n    if (cached.use) {\n      const fetched = await this.requireRedisCache().fetch({ user });\n      lines = fetched;\n    } else {\n      const extracted = await this.extractUserLines({ user });\n      lines = extracted;\n    }\n\n    return { user, lines };\n  }\n\n  async evaluate(opts: {\n    rules: ICasbinRules;\n    request: IAuthorizationRequest<TAction, TResource>;\n    context: TContext<E, string>;\n  }): Promise<TAuthorizationDecision> {\n    if (!this.pool) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] Not configured. Call configure() first.',\n      });\n    }\n\n    if (!opts.request?.action || !opts.request?.resource) {\n      throw getError({\n        message: '[CasbinAuthorizationEnforcer] request.action and request.resource are required.',\n      });\n    }\n\n    const { rules, request, context } = opts;\n    const { user, lines } = rules;\n\n    return this.pool.use({\n      execution: async (enforcer) => {\n        await this.loadPolicyLinesIntoModel({ enforcer, lines });\n\n        const normalizePayloadFn = this.resolvedPayloadFn;\n\n        if (!normalizePayloadFn) {\n          const subject = `${user.principalType}_${user.userId}`;\n          const isAllowed = this.enforceWithExplain({\n            enforcer,\n            vals: [subject, String(request.resource), String(request.action)],\n          });\n          return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n        }\n\n        const normalized = normalizePayloadFn({\n          user,\n          action: request.action,\n          resource: request.resource,\n          context,\n        });\n\n        // Scoped model is 4-token (sub, dom, obj, act): a request with no resolvable domain still needs one - default SYSTEM_WIDE, never the 3-arg path, which misaligns args and silently misjudges.\n        const domain =\n          normalized.domain ??\n          request.domain ??\n          (this.options.isScoped ? AuthorizationDomainScopes.SYSTEM_WIDE : undefined);\n\n        const vals = domain\n          ? [normalized.subject, domain, normalized.resource, normalized.action]\n          : [normalized.subject, normalized.resource, normalized.action];\n        const isAllowed = this.enforceWithExplain({ enforcer, vals });\n\n        return isAllowed ? AuthorizationDecisions.ALLOW : AuthorizationDecisions.DENY;\n      },\n    });\n  }\n\n  /** On DENY, logs the deciding policy rule; matchedPolicy is `[]` when nothing matched (default-deny). */\n  protected enforceWithExplain(opts: { enforcer: CasbinEnforcerType; vals: string[] }): boolean {\n    const [isAllowed, matchedPolicy] = opts.enforcer.enforceExSync(...opts.vals);\n\n    if (!isAllowed) {\n      this.logger\n        .for(this.evaluate.name)\n        .info(\n          'DENY | request: [%s] | matchedPolicy: %s',\n          opts.vals.join(', '),\n          matchedPolicy.length ? matchedPolicy.join(', ') : '<none - default-deny>',\n        );\n    }\n\n    return isAllowed;\n  }\n\n  // Cache management - optional IAuthorizationEnforcer members (on-demand)\n  async invalidateUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ invalidatedKeys: number }> {\n    const { cacheKey, invalidatedKeys } = await this.requireRedisCache().invalidate({\n      user: opts.user,\n    });\n\n    this.logger\n      .for(this.invalidateUserCache.name)\n      .info(\n        'Invalidated authz cache | user: %s | key: %s | deleted: %s',\n        opts.user.userId,\n        cacheKey,\n        invalidatedKeys,\n      );\n\n    return { invalidatedKeys };\n  }\n\n  async rebuildUserCache(opts: {\n    user: IAuthorizationUser;\n  }): Promise<{ cacheKey: string; lineCount: number }> {\n    // Extraction runs on an isolated throwaway enforcer (not a serving model), so a concurrent request cannot make us cache another user's policies under this key.\n    const { cacheKey, lines } = await this.requireRedisCache().rebuild({ user: opts.user });\n\n    this.logger\n      .for(this.rebuildUserCache.name)\n      .info(\n        'Rebuilt authz cache | user: %s | key: %s | lines: %s',\n        opts.user.userId,\n        cacheKey,\n        lines.length,\n      );\n\n    return { cacheKey, lineCount: lines.length };\n  }\n\n  /** Narrow `options.cached` to the redis variant and lazily create the per-user line cache - memoized so its single-flight de-dup map is shared across calls rather than reset on every access. */\n  protected requireRedisCache(): UserPolicyLineCache {\n    const { cached } = this.options;\n\n    if (!cached.use) {\n      throw getError({\n        message:\n          '[CasbinAuthorizationEnforcer] Cache management requires the redis cache driver, but caching is disabled.',\n      });\n    }\n\n    return (this.userPolicyLineCache ??= new UserPolicyLineCache({\n      cached,\n      loadLines: (opts) => this.extractUserLines(opts),\n    }));\n  }\n\n  // Matchers & model resolvers\n\n  protected async registerMatchers(opts: {\n    enforcer: CasbinEnforcerType;\n    casbin: typeof import('casbin');\n  }): Promise<void> {\n    const { enforcer, casbin } = opts;\n    const { domainMatching, isScoped } = this.options;\n\n    if (domainMatching) {\n      if (!enforcer.getNamedRoleManager(domainMatching.roleDefinition)) {\n        throw getError({\n          message: `[registerMatchers] Role definition \"${domainMatching.roleDefinition}\" is not declared in the Casbin model. Declare it under [role_definition] (e.g. \\`g = _, _, _\\`) before enabling domainMatching.`,\n        });\n      }\n\n      const matchFn = this.resolveDomainMatchingFn({ casbin, name: domainMatching.fn });\n      await enforcer.addNamedDomainMatchingFunc(domainMatching.roleDefinition, matchFn);\n    }\n\n    if (isScoped) {\n      await enforcer.addNamedDomainMatchingFunc(CasbinRuleVariants.G, casbin.Util.keyMatchFunc);\n      await enforcer.addFunction('objectMatch', AuthorizationPermissionBuilder.objectMatch);\n\n      // A dedicated role manager for the resource axis, NOT addNamedMatchingFunc: a matching func sets casbin's `hasPattern`, which makes every hasLink rebuild the whole g4 graph.\n      enforcer.setNamedRoleManager(\n        AuthorizationPolicyVariants.RESOURCE_INHERITS.rule,\n        new ResourceRoleManager(),\n      );\n\n      // Shared across g2, g3, and the reversed `g` instance below: casbin never puts the\n      // `g`-axis hierarchy manager in rmMap, so it never receives addLink and would miss\n      // per-request g3 edges - g2 needs the same freshness for a just-created child domain.\n      // This is a per-REQUEST overlay: `clear()` empties it every buildRoleLinks cycle, and it is\n      // repopulated from whatever `g3` lines this principal's own policy line set carries.\n      const domainHierarchyOverlay = new Map<string, Set<string>>();\n\n      // g2 (membership) and g3 (domain nesting, request-domain-first) sit on their own axes.\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G2,\n        new MembershipRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      enforcer.setNamedRoleManager(\n        CasbinRuleVariants.G3,\n        new DomainHierarchyRoleManager({ overlay: domainHierarchyOverlay }),\n      );\n\n      // addNamedDomainMatchingFunc(G, keyMatchFunc) above must stay: generateTempRoles ORs\n      // hasDomainPattern with hasDomainHierarchy, and role_inherits `*` rides the keyMatch path.\n      const gRoleManager = enforcer.getNamedRoleManager(CasbinRuleVariants.G) as\n        | (CasbinRoleManagerType & ICasbinRoleManagerWithDomainHierarchy)\n        | undefined;\n\n      if (!gRoleManager?.addDomainHierarchy) {\n        throw getError({\n          message:\n            '[registerMatchers] The \"g\" role manager does not expose addDomainHierarchy() - the scoped model requires casbin\\'s DefaultRoleManager on the g axis (present in casbin ^5.51.1, this package\\'s pinned range). Upgrade casbin, or check that a custom role manager was not substituted for \"g\".',\n        });\n      }\n\n      await gRoleManager.addDomainHierarchy(\n        new DomainHierarchyRoleManager({ reversed: true, overlay: domainHierarchyOverlay }),\n      );\n    }\n\n    await enforcer.buildRoleLinks();\n  }\n\n  /** Map a CasbinDomainMatchingFunctions value to casbin's Util.*Func matcher. */\n  protected resolveDomainMatchingFn(opts: {\n    casbin: typeof import('casbin');\n    name: TCasbinDomainMatchingFunction;\n  }): (arg1: string, arg2: string) => boolean {\n    // casbin Util built-ins: (requestValue, policyValue) => match. keyMatchFunc only special-cases `*` (never splits on `/` or `:`), so it cannot pattern-match a `Merchant_<uuid>`; see CasbinDomainMatchingFunctions for per-function semantics.\n    const { Util } = opts.casbin;\n    switch (opts.name) {\n      case CasbinDomainMatchingFunctions.KEY_MATCH: {\n        return Util.keyMatchFunc;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_2: {\n        return Util.keyMatch2Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_3: {\n        return Util.keyMatch3Func;\n      }\n      case CasbinDomainMatchingFunctions.KEY_MATCH_4: {\n        return Util.keyMatch4Func;\n      }\n      case CasbinDomainMatchingFunctions.REGEX_MATCH: {\n        return Util.regexMatchFunc;\n      }\n      default: {\n        throw getError({\n          message: `[resolveDomainMatchingFn] Unsupported func: ${opts.name} | Valids: [${[...CasbinDomainMatchingFunctions.SCHEME_SET].join(', ')}]`,\n        });\n      }\n    }\n  }\n\n  /** Default (sub,dom,obj,act) payload for the scoped model; domain comes from request.domain. */\n  protected defaultScopedPayloadFn(): TNormalizePayloadFn<E, TAction, TResource> | undefined {\n    if (!this.options.isScoped) {\n      return undefined;\n    }\n\n    return (opts: {\n      user: IAuthorizationUser;\n      action: TAction;\n      resource: TResource;\n    }): { subject: string; resource: string; action: string; domain?: string } => {\n      // No domain here - evaluate() fills it from request.domain (set by the provider).\n      return {\n        subject: `${opts.user.principalType}_${opts.user.userId}`,\n        resource: String(opts.resource),\n        action: String(opts.action),\n      };\n    };\n  }\n\n  protected resolveModel(opts: {\n    casbin: typeof import('casbin');\n    model: ICasbinEnforcerOptions['model'];\n  }) {\n    const { casbin, model } = opts;\n\n    switch (model.driver) {\n      case CasbinEnforcerModelDrivers.FILE: {\n        return casbin.newModelFromFile(model.definition);\n      }\n      case CasbinEnforcerModelDrivers.TEXT: {\n        return casbin.newModelFromString(model.definition);\n      }\n      default: {\n        throw getError({\n          message: `[resolveModel] Invalid model.driver | Valids: [${CasbinEnforcerModelDrivers.FILE}, ${CasbinEnforcerModelDrivers.TEXT}]`,\n        });\n      }\n    }\n  }\n\n  protected validateExpiresIn(opts: { expiresIn: number }): void {\n    if (opts.expiresIn >= this.MIN_EXPIRES_IN) {\n      return;\n    }\n\n    throw getError({\n      message: `[CasbinAuthorizationEnforcer] cached.options.expiresIn must be >= ${this.MIN_EXPIRES_IN} (ms) | Received: ${opts.expiresIn}`,\n    });\n  }\n\n  // Policy loading internals\n\n  /** Resolves this enforcer's model, then delegates the isolated-enforcer extraction (own model + adapter, never a pooled serving one, so concurrent requests cannot change what we cache) to PolicyLineCodec. */\n  protected async extractUserLines(opts: { user: IAuthorizationUser }): Promise<string[]> {\n    const casbin = await CasbinModule.load();\n    const model = this.resolveModel({ casbin, model: this.options.model });\n\n    return PolicyLineCodec.extractUserLines({\n      casbin,\n      model,\n      adapter: this.options.adapter,\n      user: opts.user,\n    });\n  }\n\n  /** Requires configure() to have resolved the casbin Helper; the clearPolicy + loadPolicyLine + buildRoleLinks ordering lives in PolicyLineCodec. */\n  protected async loadPolicyLinesIntoModel(opts: {\n    enforcer: CasbinEnforcerType;\n    lines: string[];\n  }): Promise<void> {\n    if (!this.helper) {\n      throw getError({\n        message: '[loadPolicyLinesIntoModel] Not configured. Call configure() first.',\n      });\n    }\n\n    await PolicyLineCodec.loadLinesIntoModel({\n      enforcer: opts.enforcer,\n      lines: opts.lines,\n      helper: this.helper,\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/models/entities/columns.d.ts

@@ -0,0 +1,99 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+import { RoleStatuses, UserStatuses, UserTypes } from '@venizia/ignis-kernel';
+import type { TAuthorizationDecision, TIdSchemaType, TSubsetGrantMetadata } from '@venizia/ignis-kernel';
+import type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';
+import { integer, text } from 'drizzle-orm/pg-core';
+import type { TPermissionCommonColumns, TPermissionOptions } from './permission.model.js';
+import type { TPolicyDefinitionOptions } from './policy-definition.model.js';
+type TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {
+    idType: infer IdType;
+} ? IdType extends 'string' ? TPermissionCommonColumns & {
+    parentId: PgTextBuilderInitial<string, [string, ...string[]]>;
+} : TPermissionCommonColumns & {
+    parentId: PgIntegerBuilderInitial<string>;
+} : TPermissionCommonColumns & {
+    parentId: PgIntegerBuilderInitial<string>;
+};
+/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */
+type TExtraPolicyVariantOf<Opts> = Opts extends {
+    extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
+} ? ExtraVariant : never;
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata>() => {
+    metadata: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">, Metadata>;
+    variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
+    subjectType: import("drizzle-orm").NotNull<PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
+    targetType: import("drizzle-orm").NotNull<PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
+    domainType: PgTextBuilderInitial<"domain_type", [string, ...string[]]>;
+    action: PgTextBuilderInitial<"action", [string, ...string[]]>;
+    effect: import("drizzle-orm").$Type<PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
+};
+export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;
+type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata> = Opts extends {
+    idType: 'string';
+} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
+    subjectId: ReturnType<typeof text>;
+    targetId: ReturnType<typeof text>;
+    domainId: ReturnType<typeof text>;
+} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
+    subjectId: ReturnType<typeof integer>;
+    targetId: ReturnType<typeof integer>;
+    domainId: ReturnType<typeof integer>;
+};
+/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */
+export declare class AuthModelColumns {
+    static buildUser(opts?: {
+        idType: TIdSchemaType;
+    }): {
+        realm: import("drizzle-orm").HasDefault<PgTextBuilderInitial<"realm", [string, ...string[]]>>;
+        status: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"status", [string, ...string[]]>, TConstValue<typeof UserStatuses>>>>;
+        type: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"type", [string, ...string[]]>, TConstValue<typeof UserTypes>>>>;
+        activatedAt: import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+            name: string;
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string | import("@venizia/ignis-filter").TIsoTimestamp;
+            driverParam: string;
+            enumValues: undefined;
+        }>;
+        lastLoginAt: import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+            name: string;
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string | import("@venizia/ignis-filter").TIsoTimestamp;
+            driverParam: string;
+            enumValues: undefined;
+        }>;
+        parentId: PgTextBuilderInitial<"parent_id", [string, ...string[]]> | PgIntegerBuilderInitial<"parent_id">;
+    };
+    static buildRole(): {
+        identifier: import("drizzle-orm").NotNull<PgTextBuilderInitial<"identifier", [string, ...string[]]>>;
+        name: import("drizzle-orm").NotNull<PgTextBuilderInitial<"name", [string, ...string[]]>>;
+        description: PgTextBuilderInitial<"description", [string, ...string[]]>;
+        priority: import("drizzle-orm").NotNull<PgIntegerBuilderInitial<"priority">>;
+        status: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"status", [string, ...string[]]>, TConstValue<typeof RoleStatuses>>>>;
+    };
+    static buildPermission<Opts extends TPermissionOptions | undefined>(opts?: Opts): TPermissionColumnDef<Opts>;
+    /**
+     * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
+     * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
+     * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
+     * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
+     */
+    static buildPolicyDefinition<const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata>(opts?: Opts): TPolicyDefinitionColumnDef<Opts, Metadata>;
+    /**
+     * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
+     * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
+     * table-level CHECK rejects.
+     *
+     * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
+     * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
+     * with no type passes.
+     */
+    static buildPolicyDefinitionDomainShapeCheck(opts?: {
+        domainTypeColumn?: string;
+        domainIdColumn?: string;
+    }): string;
+}
+export {};
+//# sourceMappingURL=columns.d.ts.map

package/dist/esm/components/auth/models/entities/columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/columns.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAEL,YAAY,EACZ,YAAY,EACZ,SAAS,EACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,sBAAsB,EAEtB,aAAa,EACb,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,KAAK,oBAAoB,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS;IAChG,MAAM,EAAE,MAAM,MAAM,CAAC;CACtB,GACG,MAAM,SAAS,QAAQ,GACrB,wBAAwB,GAAG;IACzB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAC/D,GACD,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,GACH,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;AAEN,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GACtC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB;;;;;;;;CAa9C,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,UAAU,CAAC,OAAO,kCAAkC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACrE,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN,oIAAoI;AACpI,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAcjD,MAAM,CAAC,SAAS;;;;;;;IAahB,MAAM,CAAC,eAAe,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,EAChE,IAAI,CAAC,EAAE,IAAI,GACV,oBAAoB,CAAC,IAAI,CAAC;IAoC7B;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,MAAM,GAAG,oBAAoB,EAC9C,IAAI,CAAC,EAAE,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;IA8B1D;;;;;;;;OAQG;IACH,MAAM,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE;QAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,MAAM;CAcX"}

package/dist/esm/components/auth/models/entities/columns.js

@@ -0,0 +1,133 @@
+import { isoTimestamp } from '@venizia/ignis-connectors/postgres';
+import { getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationDomainScopes, RoleStatuses, UserStatuses, UserTypes, } from '@venizia/ignis-kernel';
+import { integer, jsonb, text } from 'drizzle-orm/pg-core';
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+const buildCommonPolicyDefinitionColumns = () => ({
+    metadata: jsonb('metadata').$type(),
+    variant: text('variant').$type().notNull(),
+    subjectType: text('subject_type').notNull(),
+    targetType: text('target_type').notNull(),
+    // `null` IS `ANY_MEMBER`, not "unknown"; the literal is refused by `AuthModelColumns.buildPolicyDefinitionDomainShapeCheck`.
+    domainType: text('domain_type'),
+    action: text('action'),
+    effect: text('effect').$type(),
+});
+/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */
+export class AuthModelColumns {
+    static buildUser(opts) {
+        return {
+            realm: text('realm').default(''),
+            status: text('status')
+                .$type()
+                .notNull()
+                .default(UserStatuses.UNKNOWN),
+            type: text('type').$type().notNull().default(UserTypes.SYSTEM),
+            activatedAt: isoTimestamp('activated_at', { withTimezone: true }),
+            lastLoginAt: isoTimestamp('last_login_at', { withTimezone: true }),
+            parentId: opts?.idType === 'string' ? text('parent_id') : integer('parent_id'),
+        };
+    }
+    static buildRole() {
+        return {
+            identifier: text('identifier').unique().notNull(),
+            name: text('name').notNull(),
+            description: text('description'),
+            priority: integer('priority').notNull(),
+            status: text('status')
+                .$type()
+                .notNull()
+                .default(RoleStatuses.ACTIVATED),
+        };
+    }
+    static buildPermission(opts) {
+        const { idType = 'number' } = opts ?? {};
+        switch (idType) {
+            case 'number': {
+                return {
+                    code: text('code').unique().notNull(),
+                    name: text('name').notNull(),
+                    subject: text('subject').notNull(),
+                    method: text('method').notNull(),
+                    action: text('action').notNull(),
+                    scope: text('scope').notNull(),
+                    description: text('description'),
+                    parentId: integer('parent_id'),
+                };
+            }
+            case 'string': {
+                return {
+                    code: text('code').unique().notNull(),
+                    name: text('name').notNull(),
+                    subject: text('subject').notNull(),
+                    method: text('method').notNull(),
+                    action: text('action').notNull(),
+                    scope: text('scope').notNull(),
+                    description: text('description'),
+                    parentId: text('parent_id'),
+                };
+            }
+            default: {
+                throw getError({
+                    message: `[AuthModelColumns.buildPermission] Invalid idType | idType: ${idType}`,
+                });
+            }
+        }
+    }
+    /**
+     * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
+     * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
+     * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
+     * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
+     */
+    static buildPolicyDefinition(opts) {
+        const { idType = 'number' } = opts ?? {};
+        const common = buildCommonPolicyDefinitionColumns();
+        switch (idType) {
+            case 'number': {
+                return {
+                    ...common,
+                    subjectId: integer('subject_id').notNull(),
+                    targetId: integer('target_id').notNull(),
+                    domainId: integer('domain_id'),
+                };
+            }
+            case 'string': {
+                return {
+                    ...common,
+                    subjectId: text('subject_id').notNull(),
+                    targetId: text('target_id').notNull(),
+                    domainId: text('domain_id'),
+                };
+            }
+            default: {
+                throw getError({
+                    message: `[AuthModelColumns.buildPolicyDefinition] Invalid idType | idType: ${idType}`,
+                });
+            }
+        }
+    }
+    /**
+     * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
+     * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
+     * table-level CHECK rejects.
+     *
+     * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
+     * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
+     * with no type passes.
+     */
+    static buildPolicyDefinitionDomainShapeCheck(opts) {
+        const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};
+        const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;
+        return [
+            `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,
+            `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,
+            `OR (
+      ${domainTypeColumn} IS NOT NULL
+      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')
+      AND ${domainIdColumn} IS NOT NULL
+    )`,
+        ].join('\n');
+    }
+}
+//# sourceMappingURL=columns.js.map

package/dist/esm/components/auth/models/entities/columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/columns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,SAAS,GACV,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAyB3D,iHAAiH;AACjH,MAAM,kCAAkC,GAAG,GAGvC,EAAE,CAAC,CAAC;IACN,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAY;IAC7C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAA8C,CAAC,OAAO,EAAE;IAEtF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAEzC,6HAA6H;IAC7H,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAA0B;CACvD,CAAC,CAAC;AAsBH,oIAAoI;AACpI,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,IAAgC;QAC/C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;iBACnB,KAAK,EAAoC;iBACzC,OAAO,EAAE;iBACT,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAiC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;YAC7F,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjE,WAAW,EAAE,YAAY,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAClE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS;QACd,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;YACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;iBACnB,KAAK,EAAoC;iBACzC,OAAO,EAAE;iBACT,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,eAAe,CACpB,IAAW;QAEX,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QAEzC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;oBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;oBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;iBACD,CAAC;YAClC,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;oBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;oBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;iBACE,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,+DAA+D,MAAM,EAAE;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAG1B,IAAW;QACX,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,kCAAkC,EAAyC,CAAC;QAE3F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;oBAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;oBACxC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;iBACe,CAAC;YAClD,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;oBACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;oBACrC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;iBACkB,CAAC;YAClD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,qEAAqE,MAAM,EAAE;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,qCAAqC,CAAC,IAG5C;QACC,MAAM,EAAE,gBAAgB,GAAG,aAAa,EAAE,cAAc,GAAG,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QACtF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,yBAAyB,CAAC;QAE9D,OAAO;YACL,IAAI,gBAAgB,gBAAgB,cAAc,WAAW;YAC7D,OAAO,gBAAgB,OAAO,WAAW,SAAS,cAAc,WAAW;YAC3E;QACE,gBAAgB;YACZ,gBAAgB,aAAa,UAAU,OAAO,WAAW;YACzD,cAAc;MACpB;SACD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF","sourcesContent":["import { isoTimestamp } from '@venizia/ignis-connectors/postgres';\nimport type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationDomainScopes,\n  RoleStatuses,\n  UserStatuses,\n  UserTypes,\n} from '@venizia/ignis-kernel';\nimport type {\n  TAuthorizationDecision,\n  TAuthorizationPolicyVariant,\n  TIdSchemaType,\n  TSubsetGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';\nimport { integer, jsonb, text } from 'drizzle-orm/pg-core';\nimport type { TPermissionCommonColumns, TPermissionOptions } from './permission.model';\nimport type { TPolicyDefinitionOptions } from './policy-definition.model';\n\ntype TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {\n  idType: infer IdType;\n}\n  ? IdType extends 'string'\n    ? TPermissionCommonColumns & {\n        parentId: PgTextBuilderInitial<string, [string, ...string[]]>;\n      }\n    : TPermissionCommonColumns & {\n        parentId: PgIntegerBuilderInitial<string>;\n      }\n  : TPermissionCommonColumns & {\n      parentId: PgIntegerBuilderInitial<string>;\n    };\n\n/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */\ntype TExtraPolicyVariantOf<Opts> = Opts extends {\n  extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;\n}\n  ? ExtraVariant\n  : never;\n\n/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */\nconst buildCommonPolicyDefinitionColumns = <\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n>() => ({\n  metadata: jsonb('metadata').$type<Metadata>(),\n  variant: text('variant').$type<TAuthorizationPolicyVariant | ExtraVariant>().notNull(),\n\n  subjectType: text('subject_type').notNull(),\n  targetType: text('target_type').notNull(),\n\n  // `null` IS `ANY_MEMBER`, not \"unknown\"; the literal is refused by `AuthModelColumns.buildPolicyDefinitionDomainShapeCheck`.\n  domainType: text('domain_type'),\n\n  action: text('action'),\n  effect: text('effect').$type<TAuthorizationDecision>(),\n});\n\nexport type TPolicyDefinitionCommonColumns<\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;\n\ntype TPolicyDefinitionColumnDef<\n  Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n  Metadata extends object = TSubsetGrantMetadata,\n> = Opts extends { idType: 'string' }\n  ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof text>;\n      targetId: ReturnType<typeof text>;\n      domainId: ReturnType<typeof text>;\n    }\n  : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof integer>;\n      targetId: ReturnType<typeof integer>;\n      domainId: ReturnType<typeof integer>;\n    };\n\n/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */\nexport class AuthModelColumns {\n  static buildUser(opts?: { idType: TIdSchemaType }) {\n    return {\n      realm: text('realm').default(''),\n      status: text('status')\n        .$type<TConstValue<typeof UserStatuses>>()\n        .notNull()\n        .default(UserStatuses.UNKNOWN),\n      type: text('type').$type<TConstValue<typeof UserTypes>>().notNull().default(UserTypes.SYSTEM),\n      activatedAt: isoTimestamp('activated_at', { withTimezone: true }),\n      lastLoginAt: isoTimestamp('last_login_at', { withTimezone: true }),\n      parentId: opts?.idType === 'string' ? text('parent_id') : integer('parent_id'),\n    };\n  }\n\n  static buildRole() {\n    return {\n      identifier: text('identifier').unique().notNull(),\n      name: text('name').notNull(),\n      description: text('description'),\n      priority: integer('priority').notNull(),\n      status: text('status')\n        .$type<TConstValue<typeof RoleStatuses>>()\n        .notNull()\n        .default(RoleStatuses.ACTIVATED),\n    };\n  }\n\n  static buildPermission<Opts extends TPermissionOptions | undefined>(\n    opts?: Opts,\n  ): TPermissionColumnDef<Opts> {\n    const { idType = 'number' } = opts ?? {};\n\n    switch (idType) {\n      case 'number': {\n        return {\n          code: text('code').unique().notNull(),\n          name: text('name').notNull(),\n          subject: text('subject').notNull(),\n          method: text('method').notNull(),\n          action: text('action').notNull(),\n          scope: text('scope').notNull(),\n          description: text('description'),\n          parentId: integer('parent_id'),\n        } as TPermissionColumnDef<Opts>;\n      }\n      case 'string': {\n        return {\n          code: text('code').unique().notNull(),\n          name: text('name').notNull(),\n          subject: text('subject').notNull(),\n          method: text('method').notNull(),\n          action: text('action').notNull(),\n          scope: text('scope').notNull(),\n          description: text('description'),\n          parentId: text('parent_id'),\n        } as TPermissionColumnDef<Opts>;\n      }\n      default: {\n        throw getError({\n          message: `[AuthModelColumns.buildPermission] Invalid idType | idType: ${idType}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime\n   * value to infer from, so supplying it means spelling `Opts` too (no partial inference):\n   * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.\n   * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.\n   */\n  static buildPolicyDefinition<\n    const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n    Metadata extends object = TSubsetGrantMetadata,\n  >(opts?: Opts): TPolicyDefinitionColumnDef<Opts, Metadata> {\n    const { idType = 'number' } = opts ?? {};\n\n    const common = buildCommonPolicyDefinitionColumns<TExtraPolicyVariantOf<Opts>, Metadata>();\n\n    switch (idType) {\n      case 'number': {\n        return {\n          ...common,\n          subjectId: integer('subject_id').notNull(),\n          targetId: integer('target_id').notNull(),\n          domainId: integer('domain_id'),\n        } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n      }\n      case 'string': {\n        return {\n          ...common,\n          subjectId: text('subject_id').notNull(),\n          targetId: text('target_id').notNull(),\n          domainId: text('domain_id'),\n        } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n      }\n      default: {\n        throw getError({\n          message: `[AuthModelColumns.buildPolicyDefinition] Invalid idType | idType: ${idType}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,\n   * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a\n   * table-level CHECK rejects.\n   *\n   * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL\n   * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id\n   * with no type passes.\n   */\n  static buildPolicyDefinitionDomainShapeCheck(opts?: {\n    domainTypeColumn?: string;\n    domainIdColumn?: string;\n  }): string {\n    const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};\n    const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;\n\n    return [\n      `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,\n      `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,\n      `OR (\n      ${domainTypeColumn} IS NOT NULL\n      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')\n      AND ${domainIdColumn} IS NOT NULL\n    )`,\n    ].join('\\n');\n  }\n}\n"]}

package/dist/esm/components/auth/models/entities/index.d.ts

@@ -1,5 +1,4 @@
+export * from './columns.js';
 export * from './permission.model.js';
 export * from './policy-definition.model.js';
-export * from './role.model.js';
-export * from './user.model.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/models/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/esm/components/auth/models/entities/index.js

@@ -1,5 +1,4 @@
+export * from './columns.js';
 export * from './permission.model.js';
 export * from './policy-definition.model.js';
-export * from './role.model.js';
-export * from './user.model.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/components/auth/models/entities/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC","sourcesContent":["export * from './permission.model';\nexport * from './policy-definition.model';\nexport * from './role.model';\nexport * from './user.model';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC","sourcesContent":["export * from './columns';\nexport * from './permission.model';\nexport * from './policy-definition.model';\n"]}

package/dist/esm/components/auth/models/entities/permission.model.d.ts

@@ -1,6 +1,6 @@
 import type { TIdSchemaType } from '@venizia/ignis-kernel';
 import type { NotNull } from 'drizzle-orm';
-import type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';
+import type { PgTextBuilderInitial } from 'drizzle-orm/pg-core';
 export type TPermissionOptions = {
     idType?: TIdSchemaType;
 };
@@ -13,15 +13,4 @@ export type TPermissionCommonColumns = {
     scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;
     description: PgTextBuilderInitial<string, [string, ...string[]]>;
 };
-type TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {
-    idType: infer IdType;
-} ? IdType extends 'string' ? TPermissionCommonColumns & {
-    parentId: PgTextBuilderInitial<string, [string, ...string[]]>;
-} : TPermissionCommonColumns & {
-    parentId: PgIntegerBuilderInitial<string>;
-} : TPermissionCommonColumns & {
-    parentId: PgIntegerBuilderInitial<string>;
-};
-export declare const extraPermissionColumns: <Opts extends TPermissionOptions | undefined>(opts?: Opts) => TPermissionColumnDef<Opts>;
-export {};
 //# sourceMappingURL=permission.model.d.ts.map

package/dist/esm/components/auth/models/entities/permission.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGzF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,KAAK,oBAAoB,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS;IAChG,MAAM,EAAE,MAAM,MAAM,CAAC;CACtB,GACG,MAAM,SAAS,QAAQ,GACrB,wBAAwB,GAAG;IACzB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAC/D,GACD,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,GACH,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;AAEN,eAAO,MAAM,sBAAsB,GAAI,IAAI,SAAS,kBAAkB,GAAG,SAAS,EAChF,OAAO,IAAI,KACV,oBAAoB,CAAC,IAAI,CAkC3B,CAAC"}
+{"version":3,"file":"permission.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE,CAAC"}

package/dist/esm/components/auth/models/entities/permission.model.js

@@ -1,37 +1,2 @@
-import { getError } from '@venizia/ignis-helpers/core';
-import { integer, text } from 'drizzle-orm/pg-core';
-export const extraPermissionColumns = (opts) => {
-    const { idType = 'number' } = opts ?? {};
-    switch (idType) {
-        case 'number': {
-            return {
-                code: text('code').unique().notNull(),
-                name: text('name').notNull(),
-                subject: text('subject').notNull(),
-                method: text('method').notNull(),
-                action: text('action').notNull(),
-                scope: text('scope').notNull(),
-                description: text('description'),
-                parentId: integer('parent_id'),
-            };
-        }
-        case 'string': {
-            return {
-                code: text('code').unique().notNull(),
-                name: text('name').notNull(),
-                subject: text('subject').notNull(),
-                method: text('method').notNull(),
-                action: text('action').notNull(),
-                scope: text('scope').notNull(),
-                description: text('description'),
-                parentId: text('parent_id'),
-            };
-        }
-        default: {
-            throw getError({
-                message: `[extraPermissionColumns] Invalid idType | idType: ${idType}`,
-            });
-        }
-    }
-};
+export {};
 //# sourceMappingURL=permission.model.js.map

package/dist/esm/components/auth/models/entities/permission.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAIvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AA8BpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,IAAW,EACiB,EAAE;IAC9B,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAEzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;gBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;gBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;gBAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;aACD,CAAC;QAClC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;gBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;gBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;aACE,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,qDAAqD,MAAM,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport type { TIdSchemaType } from '@venizia/ignis-kernel';\nimport type { NotNull } from 'drizzle-orm';\nimport type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';\nimport { integer, text } from 'drizzle-orm/pg-core';\n\nexport type TPermissionOptions = {\n  idType?: TIdSchemaType;\n};\n\nexport type TPermissionCommonColumns = {\n  code: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  name: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  method: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  subject: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  action: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  description: PgTextBuilderInitial<string, [string, ...string[]]>;\n};\n\ntype TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {\n  idType: infer IdType;\n}\n  ? IdType extends 'string'\n    ? TPermissionCommonColumns & {\n        parentId: PgTextBuilderInitial<string, [string, ...string[]]>;\n      }\n    : TPermissionCommonColumns & {\n        parentId: PgIntegerBuilderInitial<string>;\n      }\n  : TPermissionCommonColumns & {\n      parentId: PgIntegerBuilderInitial<string>;\n    };\n\nexport const extraPermissionColumns = <Opts extends TPermissionOptions | undefined>(\n  opts?: Opts,\n): TPermissionColumnDef<Opts> => {\n  const { idType = 'number' } = opts ?? {};\n\n  switch (idType) {\n    case 'number': {\n      return {\n        code: text('code').unique().notNull(),\n        name: text('name').notNull(),\n        subject: text('subject').notNull(),\n        method: text('method').notNull(),\n        action: text('action').notNull(),\n        scope: text('scope').notNull(),\n        description: text('description'),\n        parentId: integer('parent_id'),\n      } as TPermissionColumnDef<Opts>;\n    }\n    case 'string': {\n      return {\n        code: text('code').unique().notNull(),\n        name: text('name').notNull(),\n        subject: text('subject').notNull(),\n        method: text('method').notNull(),\n        action: text('action').notNull(),\n        scope: text('scope').notNull(),\n        description: text('description'),\n        parentId: text('parent_id'),\n      } as TPermissionColumnDef<Opts>;\n    }\n    default: {\n      throw getError({\n        message: `[extraPermissionColumns] Invalid idType | idType: ${idType}`,\n      });\n    }\n  }\n};\n"]}
+{"version":3,"file":"permission.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"","sourcesContent":["import type { TIdSchemaType } from '@venizia/ignis-kernel';\nimport type { NotNull } from 'drizzle-orm';\nimport type { PgTextBuilderInitial } from 'drizzle-orm/pg-core';\n\nexport type TPermissionOptions = {\n  idType?: TIdSchemaType;\n};\n\nexport type TPermissionCommonColumns = {\n  code: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  name: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  method: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  subject: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  action: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  description: PgTextBuilderInitial<string, [string, ...string[]]>;\n};\n"]}

package/dist/esm/components/auth/models/entities/policy-definition.model.d.ts

@@ -1,5 +1,4 @@
-import type { TAuthorizationDecision, TIdSchemaType, TSubsetGrantMetadata } from '@venizia/ignis-kernel';
-import { integer, text } from 'drizzle-orm/pg-core';
+import type { TIdSchemaType } from '@venizia/ignis-kernel';
 export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
     idType?: TIdSchemaType;
     /**
@@ -10,51 +9,4 @@ export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
      */
     extraVariants?: ReadonlyArray<ExtraVariant>;
 };
-/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */
-type TExtraPolicyVariantOf<Opts> = Opts extends {
-    extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
-} ? ExtraVariant : never;
-/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
-declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata>() => {
-    metadata: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">, Metadata>;
-    variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
-    subjectType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
-    targetType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
-    domainType: import("drizzle-orm/pg-core").PgTextBuilderInitial<"domain_type", [string, ...string[]]>;
-    action: import("drizzle-orm/pg-core").PgTextBuilderInitial<"action", [string, ...string[]]>;
-    effect: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
-};
-export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;
-type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata> = Opts extends {
-    idType: 'string';
-} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
-    subjectId: ReturnType<typeof text>;
-    targetId: ReturnType<typeof text>;
-    domainId: ReturnType<typeof text>;
-} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
-    subjectId: ReturnType<typeof integer>;
-    targetId: ReturnType<typeof integer>;
-    domainId: ReturnType<typeof integer>;
-};
-/**
- * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
- * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
- * `extraPolicyDefinitionColumns<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
- * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
- */
-export declare const extraPolicyDefinitionColumns: <const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts, Metadata>;
-/**
- * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
- * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
- * table-level CHECK rejects.
- *
- * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
- * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
- * with no type passes.
- */
-export declare const policyDefinitionDomainShapeCheck: (opts?: {
-    domainTypeColumn?: string;
-    domainIdColumn?: string;
-}) => string;
-export {};
 //# sourceMappingURL=policy-definition.model.d.ts.map

package/dist/esm/components/auth/models/entities/policy-definition.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,aAAa,EAEb,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC;AAEF,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GACtC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB;;;;;;;;CAa9C,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,UAAU,CAAC,OAAO,kCAAkC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACrE,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,MAAM,GAAG,oBAAoB,EAE9C,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CA4B3C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAAI,OAAO;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KAAG,MAaH,CAAC"}
+{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC"}