@venizia/ignis 0.4.7-0 → 0.4.7-1

package/dist/esm/components/auth/authorize/adapters/custom-grant-expander.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,2BAA2B,EAC3B,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,oBAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,8BAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAA;;aAEjC,eAAe;0DAC8B,GAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAChE,GAAG,CAAA,IAAI,CACR;mCAC4B,8BAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,cAAc,CAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationActions,\n  AuthorizationPermissionBuilder,\n  AuthorizationPolicyVariants,\n  GrantBuilder,\n  type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */\nexport type TCustomGrantRow = {\n  subjectId: IdType;\n  objectSubject: string;\n  ops: string[];\n  domain: string;\n  effect: string;\n};\n\n/**\n * Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n */\nexport class CustomGrantExpander extends BaseHelper {\n  protected readonly dataSource: ICasbinPolicySource;\n  protected readonly permission: IScopedCasbinEntities['permission'];\n  protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;\n  }) {\n    super({ scope: CustomGrantExpander.name });\n    this.dataSource = opts.dataSource;\n    this.permission = opts.entities.permission;\n    this.softDelete = opts.entities.softDelete;\n  }\n\n  /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */\n  rejectCustomRow(opts: {\n    row: { subjectId: IdType; objectCode: string; objectMethod: string };\n    parsed: TCustomGrantMetadata | null;\n    isCustomAction: boolean;\n    metadataColumnName?: string;\n  }): string | null {\n    const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n    if (isCustomAction && !metadataColumnName) {\n      return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (isCustomAction && !parsed) {\n      return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (!isCustomAction && parsed) {\n      return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n      return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    return null;\n  }\n\n  /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */\n  async expandCustomGrants(opts: {\n    subjectType: string;\n    customRows: TCustomGrantRow[];\n  }): Promise<{ lines: string[]; rejections: string[] }> {\n    if (!opts.customRows.length) {\n      return { lines: [], rejections: [] };\n    }\n\n    const seen = new Set<string>();\n    const pairs: Array<{ subject: string; method: string }> = [];\n\n    const candidates = opts.customRows.flatMap((row) =>\n      row.ops.map((op) => ({ subject: row.objectSubject, method: op })),\n    );\n\n    for (const candidate of candidates) {\n      const key = `${candidate.subject}.${candidate.method}`;\n      if (seen.has(key)) {\n        continue;\n      }\n\n      seen.add(key);\n      pairs.push(candidate);\n    }\n\n    const catalog = await this.queryOperationCatalog({ pairs });\n    const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));\n    const lines: string[] = [];\n    const rejections: string[] = [];\n\n    for (const row of opts.customRows) {\n      const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n        ops: row.ops,\n        subject: row.objectSubject,\n        catalog,\n      });\n\n      if (unknown.length) {\n        rejections.push(\n          `Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`,\n        );\n      }\n\n      for (const op of valid) {\n        const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n        );\n      }\n    }\n\n    return { lines, rejections };\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    const schema = table.schemaName ?? DEFAULT_SCHEMA;\n    return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  private softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n  private async queryOperationCatalog(opts: {\n    pairs: Array<{ subject: string; method: string }>;\n  }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n    if (!opts.pairs.length) {\n      return [];\n    }\n\n    const permissionTable = this.qualifiedTable({ table: this.permission });\n    const connector = PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: CustomGrantExpander.name,\n    });\n\n    const result = await connector.execute(sql`\n      SELECT permission.subject, permission.method, permission.code, permission.action\n      FROM ${permissionTable} permission\n      WHERE (permission.subject, permission.method) IN (${sql.join(\n        opts.pairs.map((pair) => sql`(${pair.subject}, ${pair.method})`),\n        sql`, `,\n      )})\n        AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n          { alias: 'permission' },\n        )}\n    `);\n\n    return readResultRows<{ subject: string; method: string; code: string; action: string }>({\n      result,\n    });\n  }\n}\n"]}
+{"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,2BAA2B,EAC3B,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,oBAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,8BAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,GAAG,CAAA,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAA,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAA;;aAEjC,eAAe;0DAC8B,GAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAChE,GAAG,CAAA,IAAI,CACR;mCAC4B,8BAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,oBAAoB,CAAC,cAAc,CAKvC;YACD,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { IdType } from '@/base';\nimport { DrizzleResultUtility } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationActions,\n  AuthorizationPermissionBuilder,\n  AuthorizationPolicyVariants,\n  GrantBuilder,\n  type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. */\nexport type TCustomGrantRow = {\n  subjectId: IdType;\n  objectSubject: string;\n  ops: string[];\n  domain: string;\n  effect: string;\n};\n\n/**\n * Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n */\nexport class CustomGrantExpander extends BaseHelper {\n  protected readonly dataSource: ICasbinPolicySource;\n  protected readonly permission: IScopedCasbinEntities['permission'];\n  protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n  constructor(opts: {\n    dataSource: ICasbinPolicySource;\n    entities: Pick<IScopedCasbinEntities, 'permission' | 'softDelete'>;\n  }) {\n    super({ scope: CustomGrantExpander.name });\n    this.dataSource = opts.dataSource;\n    this.permission = opts.entities.permission;\n    this.softDelete = opts.entities.softDelete;\n  }\n\n  /** Why a custom-looking grant row cannot be honoured, or null when it is well formed. */\n  rejectCustomRow(opts: {\n    row: { subjectId: IdType; objectCode: string; objectMethod: string };\n    parsed: TCustomGrantMetadata | null;\n    isCustomAction: boolean;\n    metadataColumnName?: string;\n  }): string | null {\n    const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n    if (isCustomAction && !metadataColumnName) {\n      return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (isCustomAction && !parsed) {\n      return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (!isCustomAction && parsed) {\n      return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n      return `Skipping custom grant - the target must be a subject-level resource node | subject id: ${row.subjectId} | object: ${row.objectCode}`;\n    }\n\n    return null;\n  }\n\n  /** Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. */\n  async expandCustomGrants(opts: {\n    subjectType: string;\n    customRows: TCustomGrantRow[];\n  }): Promise<{ lines: string[]; rejections: string[] }> {\n    if (!opts.customRows.length) {\n      return { lines: [], rejections: [] };\n    }\n\n    const seen = new Set<string>();\n    const pairs: Array<{ subject: string; method: string }> = [];\n\n    const candidates = opts.customRows.flatMap((row) =>\n      row.ops.map((op) => ({ subject: row.objectSubject, method: op })),\n    );\n\n    for (const candidate of candidates) {\n      const key = `${candidate.subject}.${candidate.method}`;\n      if (seen.has(key)) {\n        continue;\n      }\n\n      seen.add(key);\n      pairs.push(candidate);\n    }\n\n    const catalog = await this.queryOperationCatalog({ pairs });\n    const byKey = new Map(catalog.map((entry) => [`${entry.subject}.${entry.method}`, entry]));\n    const lines: string[] = [];\n    const rejections: string[] = [];\n\n    for (const row of opts.customRows) {\n      const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n        ops: row.ops,\n        subject: row.objectSubject,\n        catalog,\n      });\n\n      if (unknown.length) {\n        rejections.push(\n          `Skipping unresolvable operations in a custom grant | subject id: ${row.subjectId} | resource: ${row.objectSubject} | unknown: ${unknown.join(', ')}`,\n        );\n      }\n\n      for (const op of valid) {\n        const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n        lines.push(\n          `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n        );\n      }\n    }\n\n    return { lines, rejections };\n  }\n\n  /** Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. */\n  private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n    const { table } = opts;\n    const schema = table.schemaName ?? DEFAULT_SCHEMA;\n    return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n  }\n\n  /** `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. */\n  private softDeleteClause(opts: { alias: string }): SQL {\n    const sd = this.softDelete;\n    if (!sd?.use) {\n      return sql.empty();\n    }\n\n    return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n  }\n\n  /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n  private async queryOperationCatalog(opts: {\n    pairs: Array<{ subject: string; method: string }>;\n  }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n    if (!opts.pairs.length) {\n      return [];\n    }\n\n    const permissionTable = this.qualifiedTable({ table: this.permission });\n    const connector = PolicyConnectorResolver.resolve({\n      source: this.dataSource,\n      caller: CustomGrantExpander.name,\n    });\n\n    const result = await connector.execute(sql`\n      SELECT permission.subject, permission.method, permission.code, permission.action\n      FROM ${permissionTable} permission\n      WHERE (permission.subject, permission.method) IN (${sql.join(\n        opts.pairs.map((pair) => sql`(${pair.subject}, ${pair.method})`),\n        sql`, `,\n      )})\n        AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n          { alias: 'permission' },\n        )}\n    `);\n\n    return DrizzleResultUtility.readResultRows<{\n      subject: string;\n      method: string;\n      code: string;\n      action: string;\n    }>({\n      result,\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/models/entities/columns.d.ts

@@ -0,0 +1,99 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+import { RoleStatuses, UserStatuses, UserTypes } from '@venizia/ignis-kernel';
+import type { TAuthorizationDecision, TIdSchemaType, TSubsetGrantMetadata } from '@venizia/ignis-kernel';
+import type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';
+import { integer, text } from 'drizzle-orm/pg-core';
+import type { TPermissionCommonColumns, TPermissionOptions } from './permission.model.js';
+import type { TPolicyDefinitionOptions } from './policy-definition.model.js';
+type TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {
+    idType: infer IdType;
+} ? IdType extends 'string' ? TPermissionCommonColumns & {
+    parentId: PgTextBuilderInitial<string, [string, ...string[]]>;
+} : TPermissionCommonColumns & {
+    parentId: PgIntegerBuilderInitial<string>;
+} : TPermissionCommonColumns & {
+    parentId: PgIntegerBuilderInitial<string>;
+};
+/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */
+type TExtraPolicyVariantOf<Opts> = Opts extends {
+    extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
+} ? ExtraVariant : never;
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata>() => {
+    metadata: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">, Metadata>;
+    variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
+    subjectType: import("drizzle-orm").NotNull<PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
+    targetType: import("drizzle-orm").NotNull<PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
+    domainType: PgTextBuilderInitial<"domain_type", [string, ...string[]]>;
+    action: PgTextBuilderInitial<"action", [string, ...string[]]>;
+    effect: import("drizzle-orm").$Type<PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
+};
+export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;
+type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata> = Opts extends {
+    idType: 'string';
+} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
+    subjectId: ReturnType<typeof text>;
+    targetId: ReturnType<typeof text>;
+    domainId: ReturnType<typeof text>;
+} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
+    subjectId: ReturnType<typeof integer>;
+    targetId: ReturnType<typeof integer>;
+    domainId: ReturnType<typeof integer>;
+};
+/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */
+export declare class AuthModelColumns {
+    static buildUser(opts?: {
+        idType: TIdSchemaType;
+    }): {
+        realm: import("drizzle-orm").HasDefault<PgTextBuilderInitial<"realm", [string, ...string[]]>>;
+        status: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"status", [string, ...string[]]>, TConstValue<typeof UserStatuses>>>>;
+        type: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"type", [string, ...string[]]>, TConstValue<typeof UserTypes>>>>;
+        activatedAt: import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+            name: string;
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string | import("@venizia/ignis-filter").TIsoTimestamp;
+            driverParam: string;
+            enumValues: undefined;
+        }>;
+        lastLoginAt: import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+            name: string;
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string | import("@venizia/ignis-filter").TIsoTimestamp;
+            driverParam: string;
+            enumValues: undefined;
+        }>;
+        parentId: PgTextBuilderInitial<"parent_id", [string, ...string[]]> | PgIntegerBuilderInitial<"parent_id">;
+    };
+    static buildRole(): {
+        identifier: import("drizzle-orm").NotNull<PgTextBuilderInitial<"identifier", [string, ...string[]]>>;
+        name: import("drizzle-orm").NotNull<PgTextBuilderInitial<"name", [string, ...string[]]>>;
+        description: PgTextBuilderInitial<"description", [string, ...string[]]>;
+        priority: import("drizzle-orm").NotNull<PgIntegerBuilderInitial<"priority">>;
+        status: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm").$Type<PgTextBuilderInitial<"status", [string, ...string[]]>, TConstValue<typeof RoleStatuses>>>>;
+    };
+    static buildPermission<Opts extends TPermissionOptions | undefined>(opts?: Opts): TPermissionColumnDef<Opts>;
+    /**
+     * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
+     * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
+     * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
+     * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
+     */
+    static buildPolicyDefinition<const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata>(opts?: Opts): TPolicyDefinitionColumnDef<Opts, Metadata>;
+    /**
+     * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
+     * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
+     * table-level CHECK rejects.
+     *
+     * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
+     * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
+     * with no type passes.
+     */
+    static buildPolicyDefinitionDomainShapeCheck(opts?: {
+        domainTypeColumn?: string;
+        domainIdColumn?: string;
+    }): string;
+}
+export {};
+//# sourceMappingURL=columns.d.ts.map

package/dist/esm/components/auth/models/entities/columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/columns.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAEL,YAAY,EACZ,YAAY,EACZ,SAAS,EACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,sBAAsB,EAEtB,aAAa,EACb,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,KAAK,oBAAoB,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS;IAChG,MAAM,EAAE,MAAM,MAAM,CAAC;CACtB,GACG,MAAM,SAAS,QAAQ,GACrB,wBAAwB,GAAG;IACzB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAC/D,GACD,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,GACH,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;AAEN,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GACtC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB;;;;;;;;CAa9C,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,UAAU,CAAC,OAAO,kCAAkC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACrE,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN,oIAAoI;AACpI,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,aAAa,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;IAcjD,MAAM,CAAC,SAAS;;;;;;;IAahB,MAAM,CAAC,eAAe,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,EAChE,IAAI,CAAC,EAAE,IAAI,GACV,oBAAoB,CAAC,IAAI,CAAC;IAoC7B;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,MAAM,GAAG,oBAAoB,EAC9C,IAAI,CAAC,EAAE,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;IA8B1D;;;;;;;;OAQG;IACH,MAAM,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE;QAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,MAAM;CAcX"}

package/dist/esm/components/auth/models/entities/columns.js

@@ -0,0 +1,133 @@
+import { isoTimestamp } from '@venizia/ignis-connectors/postgres';
+import { getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationDomainScopes, RoleStatuses, UserStatuses, UserTypes, } from '@venizia/ignis-kernel';
+import { integer, jsonb, text } from 'drizzle-orm/pg-core';
+/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
+const buildCommonPolicyDefinitionColumns = () => ({
+    metadata: jsonb('metadata').$type(),
+    variant: text('variant').$type().notNull(),
+    subjectType: text('subject_type').notNull(),
+    targetType: text('target_type').notNull(),
+    // `null` IS `ANY_MEMBER`, not "unknown"; the literal is refused by `AuthModelColumns.buildPolicyDefinitionDomainShapeCheck`.
+    domainType: text('domain_type'),
+    action: text('action'),
+    effect: text('effect').$type(),
+});
+/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */
+export class AuthModelColumns {
+    static buildUser(opts) {
+        return {
+            realm: text('realm').default(''),
+            status: text('status')
+                .$type()
+                .notNull()
+                .default(UserStatuses.UNKNOWN),
+            type: text('type').$type().notNull().default(UserTypes.SYSTEM),
+            activatedAt: isoTimestamp('activated_at', { withTimezone: true }),
+            lastLoginAt: isoTimestamp('last_login_at', { withTimezone: true }),
+            parentId: opts?.idType === 'string' ? text('parent_id') : integer('parent_id'),
+        };
+    }
+    static buildRole() {
+        return {
+            identifier: text('identifier').unique().notNull(),
+            name: text('name').notNull(),
+            description: text('description'),
+            priority: integer('priority').notNull(),
+            status: text('status')
+                .$type()
+                .notNull()
+                .default(RoleStatuses.ACTIVATED),
+        };
+    }
+    static buildPermission(opts) {
+        const { idType = 'number' } = opts ?? {};
+        switch (idType) {
+            case 'number': {
+                return {
+                    code: text('code').unique().notNull(),
+                    name: text('name').notNull(),
+                    subject: text('subject').notNull(),
+                    method: text('method').notNull(),
+                    action: text('action').notNull(),
+                    scope: text('scope').notNull(),
+                    description: text('description'),
+                    parentId: integer('parent_id'),
+                };
+            }
+            case 'string': {
+                return {
+                    code: text('code').unique().notNull(),
+                    name: text('name').notNull(),
+                    subject: text('subject').notNull(),
+                    method: text('method').notNull(),
+                    action: text('action').notNull(),
+                    scope: text('scope').notNull(),
+                    description: text('description'),
+                    parentId: text('parent_id'),
+                };
+            }
+            default: {
+                throw getError({
+                    message: `[AuthModelColumns.buildPermission] Invalid idType | idType: ${idType}`,
+                });
+            }
+        }
+    }
+    /**
+     * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
+     * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
+     * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
+     * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
+     */
+    static buildPolicyDefinition(opts) {
+        const { idType = 'number' } = opts ?? {};
+        const common = buildCommonPolicyDefinitionColumns();
+        switch (idType) {
+            case 'number': {
+                return {
+                    ...common,
+                    subjectId: integer('subject_id').notNull(),
+                    targetId: integer('target_id').notNull(),
+                    domainId: integer('domain_id'),
+                };
+            }
+            case 'string': {
+                return {
+                    ...common,
+                    subjectId: text('subject_id').notNull(),
+                    targetId: text('target_id').notNull(),
+                    domainId: text('domain_id'),
+                };
+            }
+            default: {
+                throw getError({
+                    message: `[AuthModelColumns.buildPolicyDefinition] Invalid idType | idType: ${idType}`,
+                });
+            }
+        }
+    }
+    /**
+     * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
+     * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
+     * table-level CHECK rejects.
+     *
+     * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
+     * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
+     * with no type passes.
+     */
+    static buildPolicyDefinitionDomainShapeCheck(opts) {
+        const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};
+        const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;
+        return [
+            `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,
+            `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,
+            `OR (
+      ${domainTypeColumn} IS NOT NULL
+      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')
+      AND ${domainIdColumn} IS NOT NULL
+    )`,
+        ].join('\n');
+    }
+}
+//# sourceMappingURL=columns.js.map

package/dist/esm/components/auth/models/entities/columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/columns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,SAAS,GACV,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAyB3D,iHAAiH;AACjH,MAAM,kCAAkC,GAAG,GAGvC,EAAE,CAAC,CAAC;IACN,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAY;IAC7C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAA8C,CAAC,OAAO,EAAE;IAEtF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAEzC,6HAA6H;IAC7H,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAA0B;CACvD,CAAC,CAAC;AAsBH,oIAAoI;AACpI,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,IAAgC;QAC/C,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;iBACnB,KAAK,EAAoC;iBACzC,OAAO,EAAE;iBACT,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAiC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;YAC7F,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjE,WAAW,EAAE,YAAY,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAClE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS;QACd,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;YACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;iBACnB,KAAK,EAAoC;iBACzC,OAAO,EAAE;iBACT,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,eAAe,CACpB,IAAW;QAEX,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QAEzC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;oBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;oBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;iBACD,CAAC;YAClC,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;oBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;oBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;oBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;oBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;iBACE,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,+DAA+D,MAAM,EAAE;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAG1B,IAAW;QACX,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,kCAAkC,EAAyC,CAAC;QAE3F,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;oBAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;oBACxC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;iBACe,CAAC;YAClD,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,OAAO;oBACL,GAAG,MAAM;oBACT,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;oBACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;oBACrC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;iBACkB,CAAC;YAClD,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,qEAAqE,MAAM,EAAE;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,qCAAqC,CAAC,IAG5C;QACC,MAAM,EAAE,gBAAgB,GAAG,aAAa,EAAE,cAAc,GAAG,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QACtF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,yBAAyB,CAAC;QAE9D,OAAO;YACL,IAAI,gBAAgB,gBAAgB,cAAc,WAAW;YAC7D,OAAO,gBAAgB,OAAO,WAAW,SAAS,cAAc,WAAW;YAC3E;QACE,gBAAgB;YACZ,gBAAgB,aAAa,UAAU,OAAO,WAAW;YACzD,cAAc;MACpB;SACD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;CACF","sourcesContent":["import { isoTimestamp } from '@venizia/ignis-connectors/postgres';\nimport type { TConstValue } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n  AuthorizationDomainScopes,\n  RoleStatuses,\n  UserStatuses,\n  UserTypes,\n} from '@venizia/ignis-kernel';\nimport type {\n  TAuthorizationDecision,\n  TAuthorizationPolicyVariant,\n  TIdSchemaType,\n  TSubsetGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';\nimport { integer, jsonb, text } from 'drizzle-orm/pg-core';\nimport type { TPermissionCommonColumns, TPermissionOptions } from './permission.model';\nimport type { TPolicyDefinitionOptions } from './policy-definition.model';\n\ntype TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {\n  idType: infer IdType;\n}\n  ? IdType extends 'string'\n    ? TPermissionCommonColumns & {\n        parentId: PgTextBuilderInitial<string, [string, ...string[]]>;\n      }\n    : TPermissionCommonColumns & {\n        parentId: PgIntegerBuilderInitial<string>;\n      }\n  : TPermissionCommonColumns & {\n      parentId: PgIntegerBuilderInitial<string>;\n    };\n\n/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */\ntype TExtraPolicyVariantOf<Opts> = Opts extends {\n  extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;\n}\n  ? ExtraVariant\n  : never;\n\n/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */\nconst buildCommonPolicyDefinitionColumns = <\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n>() => ({\n  metadata: jsonb('metadata').$type<Metadata>(),\n  variant: text('variant').$type<TAuthorizationPolicyVariant | ExtraVariant>().notNull(),\n\n  subjectType: text('subject_type').notNull(),\n  targetType: text('target_type').notNull(),\n\n  // `null` IS `ANY_MEMBER`, not \"unknown\"; the literal is refused by `AuthModelColumns.buildPolicyDefinitionDomainShapeCheck`.\n  domainType: text('domain_type'),\n\n  action: text('action'),\n  effect: text('effect').$type<TAuthorizationDecision>(),\n});\n\nexport type TPolicyDefinitionCommonColumns<\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;\n\ntype TPolicyDefinitionColumnDef<\n  Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n  Metadata extends object = TSubsetGrantMetadata,\n> = Opts extends { idType: 'string' }\n  ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof text>;\n      targetId: ReturnType<typeof text>;\n      domainId: ReturnType<typeof text>;\n    }\n  : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof integer>;\n      targetId: ReturnType<typeof integer>;\n      domainId: ReturnType<typeof integer>;\n    };\n\n/** The Drizzle column sets of the auth tables, spread into a table the application declares (`...AuthModelColumns.buildUser()`). */\nexport class AuthModelColumns {\n  static buildUser(opts?: { idType: TIdSchemaType }) {\n    return {\n      realm: text('realm').default(''),\n      status: text('status')\n        .$type<TConstValue<typeof UserStatuses>>()\n        .notNull()\n        .default(UserStatuses.UNKNOWN),\n      type: text('type').$type<TConstValue<typeof UserTypes>>().notNull().default(UserTypes.SYSTEM),\n      activatedAt: isoTimestamp('activated_at', { withTimezone: true }),\n      lastLoginAt: isoTimestamp('last_login_at', { withTimezone: true }),\n      parentId: opts?.idType === 'string' ? text('parent_id') : integer('parent_id'),\n    };\n  }\n\n  static buildRole() {\n    return {\n      identifier: text('identifier').unique().notNull(),\n      name: text('name').notNull(),\n      description: text('description'),\n      priority: integer('priority').notNull(),\n      status: text('status')\n        .$type<TConstValue<typeof RoleStatuses>>()\n        .notNull()\n        .default(RoleStatuses.ACTIVATED),\n    };\n  }\n\n  static buildPermission<Opts extends TPermissionOptions | undefined>(\n    opts?: Opts,\n  ): TPermissionColumnDef<Opts> {\n    const { idType = 'number' } = opts ?? {};\n\n    switch (idType) {\n      case 'number': {\n        return {\n          code: text('code').unique().notNull(),\n          name: text('name').notNull(),\n          subject: text('subject').notNull(),\n          method: text('method').notNull(),\n          action: text('action').notNull(),\n          scope: text('scope').notNull(),\n          description: text('description'),\n          parentId: integer('parent_id'),\n        } as TPermissionColumnDef<Opts>;\n      }\n      case 'string': {\n        return {\n          code: text('code').unique().notNull(),\n          name: text('name').notNull(),\n          subject: text('subject').notNull(),\n          method: text('method').notNull(),\n          action: text('action').notNull(),\n          scope: text('scope').notNull(),\n          description: text('description'),\n          parentId: text('parent_id'),\n        } as TPermissionColumnDef<Opts>;\n      }\n      default: {\n        throw getError({\n          message: `[AuthModelColumns.buildPermission] Invalid idType | idType: ${idType}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime\n   * value to infer from, so supplying it means spelling `Opts` too (no partial inference):\n   * `AuthModelColumns.buildPolicyDefinition<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.\n   * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.\n   */\n  static buildPolicyDefinition<\n    const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n    Metadata extends object = TSubsetGrantMetadata,\n  >(opts?: Opts): TPolicyDefinitionColumnDef<Opts, Metadata> {\n    const { idType = 'number' } = opts ?? {};\n\n    const common = buildCommonPolicyDefinitionColumns<TExtraPolicyVariantOf<Opts>, Metadata>();\n\n    switch (idType) {\n      case 'number': {\n        return {\n          ...common,\n          subjectId: integer('subject_id').notNull(),\n          targetId: integer('target_id').notNull(),\n          domainId: integer('domain_id'),\n        } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n      }\n      case 'string': {\n        return {\n          ...common,\n          subjectId: text('subject_id').notNull(),\n          targetId: text('target_id').notNull(),\n          domainId: text('domain_id'),\n        } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n      }\n      default: {\n        throw getError({\n          message: `[AuthModelColumns.buildPolicyDefinition] Invalid idType | idType: ${idType}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,\n   * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a\n   * table-level CHECK rejects.\n   *\n   * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL\n   * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id\n   * with no type passes.\n   */\n  static buildPolicyDefinitionDomainShapeCheck(opts?: {\n    domainTypeColumn?: string;\n    domainIdColumn?: string;\n  }): string {\n    const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};\n    const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;\n\n    return [\n      `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,\n      `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,\n      `OR (\n      ${domainTypeColumn} IS NOT NULL\n      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')\n      AND ${domainIdColumn} IS NOT NULL\n    )`,\n    ].join('\\n');\n  }\n}\n"]}

package/dist/esm/components/auth/models/entities/index.d.ts

@@ -1,5 +1,4 @@
+export * from './columns.js';
 export * from './permission.model.js';
 export * from './policy-definition.model.js';
-export * from './role.model.js';
-export * from './user.model.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/models/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/esm/components/auth/models/entities/index.js

@@ -1,5 +1,4 @@
+export * from './columns.js';
 export * from './permission.model.js';
 export * from './policy-definition.model.js';
-export * from './role.model.js';
-export * from './user.model.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/components/auth/models/entities/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC","sourcesContent":["export * from './permission.model';\nexport * from './policy-definition.model';\nexport * from './role.model';\nexport * from './user.model';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC","sourcesContent":["export * from './columns';\nexport * from './permission.model';\nexport * from './policy-definition.model';\n"]}

package/dist/esm/components/auth/models/entities/permission.model.d.ts

@@ -1,6 +1,6 @@
 import type { TIdSchemaType } from '@venizia/ignis-kernel';
 import type { NotNull } from 'drizzle-orm';
-import type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';
+import type { PgTextBuilderInitial } from 'drizzle-orm/pg-core';
 export type TPermissionOptions = {
     idType?: TIdSchemaType;
 };
@@ -13,15 +13,4 @@ export type TPermissionCommonColumns = {
     scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;
     description: PgTextBuilderInitial<string, [string, ...string[]]>;
 };
-type TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {
-    idType: infer IdType;
-} ? IdType extends 'string' ? TPermissionCommonColumns & {
-    parentId: PgTextBuilderInitial<string, [string, ...string[]]>;
-} : TPermissionCommonColumns & {
-    parentId: PgIntegerBuilderInitial<string>;
-} : TPermissionCommonColumns & {
-    parentId: PgIntegerBuilderInitial<string>;
-};
-export declare const extraPermissionColumns: <Opts extends TPermissionOptions | undefined>(opts?: Opts) => TPermissionColumnDef<Opts>;
-export {};
 //# sourceMappingURL=permission.model.d.ts.map

package/dist/esm/components/auth/models/entities/permission.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGzF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,KAAK,oBAAoB,CAAC,IAAI,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS;IAChG,MAAM,EAAE,MAAM,MAAM,CAAC;CACtB,GACG,MAAM,SAAS,QAAQ,GACrB,wBAAwB,GAAG;IACzB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAC/D,GACD,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,GACH,wBAAwB,GAAG;IACzB,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;AAEN,eAAO,MAAM,sBAAsB,GAAI,IAAI,SAAS,kBAAkB,GAAG,SAAS,EAChF,OAAO,IAAI,KACV,oBAAoB,CAAC,IAAI,CAkC3B,CAAC"}
+{"version":3,"file":"permission.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,WAAW,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE,CAAC"}

package/dist/esm/components/auth/models/entities/permission.model.js

@@ -1,37 +1,2 @@
-import { getError } from '@venizia/ignis-helpers/core';
-import { integer, text } from 'drizzle-orm/pg-core';
-export const extraPermissionColumns = (opts) => {
-    const { idType = 'number' } = opts ?? {};
-    switch (idType) {
-        case 'number': {
-            return {
-                code: text('code').unique().notNull(),
-                name: text('name').notNull(),
-                subject: text('subject').notNull(),
-                method: text('method').notNull(),
-                action: text('action').notNull(),
-                scope: text('scope').notNull(),
-                description: text('description'),
-                parentId: integer('parent_id'),
-            };
-        }
-        case 'string': {
-            return {
-                code: text('code').unique().notNull(),
-                name: text('name').notNull(),
-                subject: text('subject').notNull(),
-                method: text('method').notNull(),
-                action: text('action').notNull(),
-                scope: text('scope').notNull(),
-                description: text('description'),
-                parentId: text('parent_id'),
-            };
-        }
-        default: {
-            throw getError({
-                message: `[extraPermissionColumns] Invalid idType | idType: ${idType}`,
-            });
-        }
-    }
-};
+export {};
 //# sourceMappingURL=permission.model.js.map

package/dist/esm/components/auth/models/entities/permission.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAIvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AA8BpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,IAAW,EACiB,EAAE;IAC9B,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAEzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;gBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;gBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;gBAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;aACD,CAAC;QAClC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;gBACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;gBAC9B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;aACE,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,qDAAqD,MAAM,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport type { TIdSchemaType } from '@venizia/ignis-kernel';\nimport type { NotNull } from 'drizzle-orm';\nimport type { PgIntegerBuilderInitial, PgTextBuilderInitial } from 'drizzle-orm/pg-core';\nimport { integer, text } from 'drizzle-orm/pg-core';\n\nexport type TPermissionOptions = {\n  idType?: TIdSchemaType;\n};\n\nexport type TPermissionCommonColumns = {\n  code: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  name: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  method: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  subject: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  action: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  description: PgTextBuilderInitial<string, [string, ...string[]]>;\n};\n\ntype TPermissionColumnDef<Opts extends TPermissionOptions | undefined = undefined> = Opts extends {\n  idType: infer IdType;\n}\n  ? IdType extends 'string'\n    ? TPermissionCommonColumns & {\n        parentId: PgTextBuilderInitial<string, [string, ...string[]]>;\n      }\n    : TPermissionCommonColumns & {\n        parentId: PgIntegerBuilderInitial<string>;\n      }\n  : TPermissionCommonColumns & {\n      parentId: PgIntegerBuilderInitial<string>;\n    };\n\nexport const extraPermissionColumns = <Opts extends TPermissionOptions | undefined>(\n  opts?: Opts,\n): TPermissionColumnDef<Opts> => {\n  const { idType = 'number' } = opts ?? {};\n\n  switch (idType) {\n    case 'number': {\n      return {\n        code: text('code').unique().notNull(),\n        name: text('name').notNull(),\n        subject: text('subject').notNull(),\n        method: text('method').notNull(),\n        action: text('action').notNull(),\n        scope: text('scope').notNull(),\n        description: text('description'),\n        parentId: integer('parent_id'),\n      } as TPermissionColumnDef<Opts>;\n    }\n    case 'string': {\n      return {\n        code: text('code').unique().notNull(),\n        name: text('name').notNull(),\n        subject: text('subject').notNull(),\n        method: text('method').notNull(),\n        action: text('action').notNull(),\n        scope: text('scope').notNull(),\n        description: text('description'),\n        parentId: text('parent_id'),\n      } as TPermissionColumnDef<Opts>;\n    }\n    default: {\n      throw getError({\n        message: `[extraPermissionColumns] Invalid idType | idType: ${idType}`,\n      });\n    }\n  }\n};\n"]}
+{"version":3,"file":"permission.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/permission.model.ts"],"names":[],"mappings":"","sourcesContent":["import type { TIdSchemaType } from '@venizia/ignis-kernel';\nimport type { NotNull } from 'drizzle-orm';\nimport type { PgTextBuilderInitial } from 'drizzle-orm/pg-core';\n\nexport type TPermissionOptions = {\n  idType?: TIdSchemaType;\n};\n\nexport type TPermissionCommonColumns = {\n  code: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  name: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  method: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  subject: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  action: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  scope: NotNull<PgTextBuilderInitial<string, [string, ...string[]]>>;\n  description: PgTextBuilderInitial<string, [string, ...string[]]>;\n};\n"]}

package/dist/esm/components/auth/models/entities/policy-definition.model.d.ts

@@ -1,5 +1,4 @@
-import type { TAuthorizationDecision, TIdSchemaType, TSubsetGrantMetadata } from '@venizia/ignis-kernel';
-import { integer, text } from 'drizzle-orm/pg-core';
+import type { TIdSchemaType } from '@venizia/ignis-kernel';
 export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
     idType?: TIdSchemaType;
     /**
@@ -10,51 +9,4 @@ export type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {
      */
     extraVariants?: ReadonlyArray<ExtraVariant>;
 };
-/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */
-type TExtraPolicyVariantOf<Opts> = Opts extends {
-    extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;
-} ? ExtraVariant : never;
-/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
-declare const buildCommonPolicyDefinitionColumns: <ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata>() => {
-    metadata: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgJsonbBuilderInitial<"metadata">, Metadata>;
-    variant: import("drizzle-orm").NotNull<import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"variant", [string, ...string[]]>, "join_domain" | "assign_role" | "grant" | "role_inherits" | "domain_inherits" | "resource_inherits" | "action_inherits" | ExtraVariant>>;
-    subjectType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"subject_type", [string, ...string[]]>>;
-    targetType: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"target_type", [string, ...string[]]>>;
-    domainType: import("drizzle-orm/pg-core").PgTextBuilderInitial<"domain_type", [string, ...string[]]>;
-    action: import("drizzle-orm/pg-core").PgTextBuilderInitial<"action", [string, ...string[]]>;
-    effect: import("drizzle-orm").$Type<import("drizzle-orm/pg-core").PgTextBuilderInitial<"effect", [string, ...string[]]>, TAuthorizationDecision>;
-};
-export type TPolicyDefinitionCommonColumns<ExtraVariant extends string = never, Metadata extends object = TSubsetGrantMetadata> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;
-type TPolicyDefinitionColumnDef<Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata> = Opts extends {
-    idType: 'string';
-} ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
-    subjectId: ReturnType<typeof text>;
-    targetId: ReturnType<typeof text>;
-    domainId: ReturnType<typeof text>;
-} : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {
-    subjectId: ReturnType<typeof integer>;
-    targetId: ReturnType<typeof integer>;
-    domainId: ReturnType<typeof integer>;
-};
-/**
- * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
- * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
- * `extraPolicyDefinitionColumns<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
- * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
- */
-export declare const extraPolicyDefinitionColumns: <const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined, Metadata extends object = TSubsetGrantMetadata>(opts?: Opts) => TPolicyDefinitionColumnDef<Opts, Metadata>;
-/**
- * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
- * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
- * table-level CHECK rejects.
- *
- * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
- * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
- * with no type passes.
- */
-export declare const policyDefinitionDomainShapeCheck: (opts?: {
-    domainTypeColumn?: string;
-    domainIdColumn?: string;
-}) => string;
-export {};
 //# sourceMappingURL=policy-definition.model.d.ts.map

package/dist/esm/components/auth/models/entities/policy-definition.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,aAAa,EAEb,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAS,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC;AAEF,gGAAgG;AAChG,KAAK,qBAAqB,CAAC,IAAI,IAAI,IAAI,SAAS;IAC9C,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,YAAY,SAAS,MAAM,CAAC,CAAC;CAClE,GACG,YAAY,GACZ,KAAK,CAAC;AAEV,iHAAiH;AACjH,QAAA,MAAM,kCAAkC,GACtC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB;;;;;;;;CAa9C,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,YAAY,SAAS,MAAM,GAAG,KAAK,EACnC,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,UAAU,CAAC,OAAO,kCAAkC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,KAAK,0BAA0B,CAC7B,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACrE,QAAQ,SAAS,MAAM,GAAG,oBAAoB,IAC5C,IAAI,SAAS;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACjC,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,QAAQ,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;CACnC,GACD,8BAA8B,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG;IACtE,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;CACtC,CAAC;AAEN;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,KAAK,CAAC,IAAI,SAAS,wBAAwB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,MAAM,GAAG,oBAAoB,EAE9C,OAAO,IAAI,KACV,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CA4B3C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAAI,OAAO;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,KAAG,MAaH,CAAC"}
+{"version":3,"file":"policy-definition.model.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,MAAM,wBAAwB,CAAC,YAAY,SAAS,MAAM,GAAG,KAAK,IAAI;IAC1E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CAC7C,CAAC"}

package/dist/esm/components/auth/models/entities/policy-definition.model.js

@@ -1,70 +1,2 @@
-import { getError } from '@venizia/ignis-helpers/core';
-import { AuthorizationDomainScopes } from '@venizia/ignis-kernel';
-import { integer, jsonb, text } from 'drizzle-orm/pg-core';
-/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */
-const buildCommonPolicyDefinitionColumns = () => ({
-    metadata: jsonb('metadata').$type(),
-    variant: text('variant').$type().notNull(),
-    subjectType: text('subject_type').notNull(),
-    targetType: text('target_type').notNull(),
-    // `null` IS `ANY_MEMBER`, not "unknown"; the literal is refused by `policyDefinitionDomainShapeCheck`.
-    domainType: text('domain_type'),
-    action: text('action'),
-    effect: text('effect').$type(),
-});
-/**
- * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime
- * value to infer from, so supplying it means spelling `Opts` too (no partial inference):
- * `extraPolicyDefinitionColumns<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.
- * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.
- */
-export const extraPolicyDefinitionColumns = (opts) => {
-    const { idType = 'number' } = opts ?? {};
-    const common = buildCommonPolicyDefinitionColumns();
-    switch (idType) {
-        case 'number': {
-            return {
-                ...common,
-                subjectId: integer('subject_id').notNull(),
-                targetId: integer('target_id').notNull(),
-                domainId: integer('domain_id'),
-            };
-        }
-        case 'string': {
-            return {
-                ...common,
-                subjectId: text('subject_id').notNull(),
-                targetId: text('target_id').notNull(),
-                domainId: text('domain_id'),
-            };
-        }
-        default: {
-            throw getError({
-                message: `[extraPolicyDefinitionColumns] Invalid idType | idType: ${idType}`,
-            });
-        }
-    }
-};
-/**
- * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,
- * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a
- * table-level CHECK rejects.
- *
- * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL
- * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id
- * with no type passes.
- */
-export const policyDefinitionDomainShapeCheck = (opts) => {
-    const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};
-    const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;
-    return [
-        `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,
-        `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,
-        `OR (
-      ${domainTypeColumn} IS NOT NULL
-      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')
-      AND ${domainIdColumn} IS NOT NULL
-    )`,
-    ].join('\n');
-};
+export {};
 //# sourceMappingURL=policy-definition.model.js.map

package/dist/esm/components/auth/models/entities/policy-definition.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-definition.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAOvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAoB3D,iHAAiH;AACjH,MAAM,kCAAkC,GAAG,GAGvC,EAAE,CAAC,CAAC;IACN,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAY;IAC7C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAA8C,CAAC,OAAO,EAAE;IAEtF,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAEzC,uGAAuG;IACvG,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAA0B;CACvD,CAAC,CAAC;AAsBH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAI1C,IAAW,EACiC,EAAE;IAC9C,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,kCAAkC,EAAyC,CAAC;IAE3F,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;gBACxC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;aACe,CAAC;QAClD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;gBACrC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;aACkB,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,2DAA2D,MAAM,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAGhD,EAAU,EAAE;IACX,MAAM,EAAE,gBAAgB,GAAG,aAAa,EAAE,cAAc,GAAG,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IACtF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,yBAAyB,CAAC;IAE9D,OAAO;QACL,IAAI,gBAAgB,gBAAgB,cAAc,WAAW;QAC7D,OAAO,gBAAgB,OAAO,WAAW,SAAS,cAAc,WAAW;QAC3E;QACI,gBAAgB;YACZ,gBAAgB,aAAa,UAAU,OAAO,WAAW;YACzD,cAAc;MACpB;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport type {\n  TAuthorizationDecision,\n  TIdSchemaType,\n  TAuthorizationPolicyVariant,\n  TSubsetGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { AuthorizationDomainScopes } from '@venizia/ignis-kernel';\nimport { integer, jsonb, text } from 'drizzle-orm/pg-core';\n\nexport type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {\n  idType?: TIdSchemaType;\n  /**\n   * App-only edge kinds stored in this same table alongside IGNIS's seven (e.g. `merchant_role`).\n   * `ScopedCasbinAdapter` never selects an undeclared variant - it is purely the consumer's data.\n   * Pass as an inline array literal; the `const` type parameter below infers the literal union\n   * from it without needing `as const`.\n   */\n  extraVariants?: ReadonlyArray<ExtraVariant>;\n};\n\n/** Extracts the app-declared extra variants from `Opts`, or `never` when none were declared. */\ntype TExtraPolicyVariantOf<Opts> = Opts extends {\n  extraVariants?: ReadonlyArray<infer ExtraVariant extends string>;\n}\n  ? ExtraVariant\n  : never;\n\n/** Column shape is inferred, never hand-declared, so it can never drift from the `$type<>()` narrowing below. */\nconst buildCommonPolicyDefinitionColumns = <\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n>() => ({\n  metadata: jsonb('metadata').$type<Metadata>(),\n  variant: text('variant').$type<TAuthorizationPolicyVariant | ExtraVariant>().notNull(),\n\n  subjectType: text('subject_type').notNull(),\n  targetType: text('target_type').notNull(),\n\n  // `null` IS `ANY_MEMBER`, not \"unknown\"; the literal is refused by `policyDefinitionDomainShapeCheck`.\n  domainType: text('domain_type'),\n\n  action: text('action'),\n  effect: text('effect').$type<TAuthorizationDecision>(),\n});\n\nexport type TPolicyDefinitionCommonColumns<\n  ExtraVariant extends string = never,\n  Metadata extends object = TSubsetGrantMetadata,\n> = ReturnType<typeof buildCommonPolicyDefinitionColumns<ExtraVariant, Metadata>>;\n\ntype TPolicyDefinitionColumnDef<\n  Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n  Metadata extends object = TSubsetGrantMetadata,\n> = Opts extends { idType: 'string' }\n  ? TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof text>;\n      targetId: ReturnType<typeof text>;\n      domainId: ReturnType<typeof text>;\n    }\n  : TPolicyDefinitionCommonColumns<TExtraPolicyVariantOf<Opts>, Metadata> & {\n      subjectId: ReturnType<typeof integer>;\n      targetId: ReturnType<typeof integer>;\n      domainId: ReturnType<typeof integer>;\n    };\n\n/**\n * `Metadata` is a type parameter, not an `opts` field: unlike `extraVariants` there is no runtime\n * value to infer from, so supplying it means spelling `Opts` too (no partial inference):\n * `extraPolicyDefinitionColumns<{ idType: 'string' }, IMyMetadata>({ idType: 'string' })`.\n * Keep `ops` in a custom shape if the app also issues subset grants - `customGrant` writes it.\n */\nexport const extraPolicyDefinitionColumns = <\n  const Opts extends TPolicyDefinitionOptions<string> | undefined = undefined,\n  Metadata extends object = TSubsetGrantMetadata,\n>(\n  opts?: Opts,\n): TPolicyDefinitionColumnDef<Opts, Metadata> => {\n  const { idType = 'number' } = opts ?? {};\n\n  const common = buildCommonPolicyDefinitionColumns<TExtraPolicyVariantOf<Opts>, Metadata>();\n\n  switch (idType) {\n    case 'number': {\n      return {\n        ...common,\n        subjectId: integer('subject_id').notNull(),\n        targetId: integer('target_id').notNull(),\n        domainId: integer('domain_id'),\n      } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n    }\n    case 'string': {\n      return {\n        ...common,\n        subjectId: text('subject_id').notNull(),\n        targetId: text('target_id').notNull(),\n        domainId: text('domain_id'),\n      } as TPolicyDefinitionColumnDef<Opts, Metadata>;\n    }\n    default: {\n      throw getError({\n        message: `[extraPolicyDefinitionColumns] Invalid idType | idType: ${idType}`,\n      });\n    }\n  }\n};\n\n/**\n * The three legal `(domain_type, domain_id)` pairs, as CHECK predicate TEXT for a migration - text,\n * not a Drizzle `SQL`, because a column ref in a `sql` template renders schema-qualified, which a\n * table-level CHECK rejects.\n *\n * The `IS NOT NULL` guard on the last branch looks redundant next to `NOT IN` and is not: a NULL\n * `domain_type` makes `NOT IN` evaluate to NULL, and a CHECK rejects only on FALSE - without it an id\n * with no type passes.\n */\nexport const policyDefinitionDomainShapeCheck = (opts?: {\n  domainTypeColumn?: string;\n  domainIdColumn?: string;\n}): string => {\n  const { domainTypeColumn = 'domain_type', domainIdColumn = 'domain_id' } = opts ?? {};\n  const { ANY_MEMBER, SYSTEM_WIDE } = AuthorizationDomainScopes;\n\n  return [\n    `(${domainTypeColumn} IS NULL AND ${domainIdColumn} IS NULL)`,\n    `OR (${domainTypeColumn} = '${SYSTEM_WIDE}' AND ${domainIdColumn} IS NULL)`,\n    `OR (\n      ${domainTypeColumn} IS NOT NULL\n      AND ${domainTypeColumn} NOT IN ('${ANY_MEMBER}', '${SYSTEM_WIDE}')\n      AND ${domainIdColumn} IS NOT NULL\n    )`,\n  ].join('\\n');\n};\n"]}
+{"version":3,"file":"policy-definition.model.js","sourceRoot":"","sources":["../../../../../../src/components/auth/models/entities/policy-definition.model.ts"],"names":[],"mappings":"","sourcesContent":["import type { TIdSchemaType } from '@venizia/ignis-kernel';\n\nexport type TPolicyDefinitionOptions<ExtraVariant extends string = never> = {\n  idType?: TIdSchemaType;\n  /**\n   * App-only edge kinds stored in this same table alongside IGNIS's seven (e.g. `merchant_role`).\n   * `ScopedCasbinAdapter` never selects an undeclared variant - it is purely the consumer's data.\n   * Pass as an inline array literal; the `const` type parameter below infers the literal union\n   * from it without needing `as const`.\n   */\n  extraVariants?: ReadonlyArray<ExtraVariant>;\n};\n"]}