@voltro/plugin-rbac 0.32.0 → 0.34.0

package/dist/index.d.ts

@@ -117,6 +117,13 @@ export declare interface RbacContext {
 export declare const rbacPlugin: (options: RbacPluginOptions) => VoltroPlugin;
 
 export declare interface RbacPluginOptions {
+    /**
+     * Namespace for this plugin's inspect surface + any rpc tags it contributes. Default `rbac`.
+     *
+     * Set it when your app already publishes under that name — an exact tag
+     * collision is fatal at codegen, and this is the way out.
+     */
+    readonly alias?: string;
     /**
      * Declarative role → permission map. Each role lists the permission
      * strings (== scope strings) it grants. `'*'` in any role's list

package/dist/index.js

@@ -1,22 +1,22 @@
 import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./permission-DhL6E-Nc.js";
 import { Effect as p } from "effect";
-import { ADMIN_SCOPE as m, ScopeError as h, ScopeError as g, definePlugin as _, setResourceScopeResolver as v } from "@voltro/protocol";
-import { createLogger as y } from "@voltro/logger";
-import { and as b, boolean as x, eq as S, id as C, json as w, or as T, reference as E, requireTenants as D, table as O, text as k } from "@voltro/database";
+import { ADMIN_SCOPE as m, ScopeError as h, ScopeError as g, definePlugin as _, pluginInstanceName as v, setResourceScopeResolver as y } from "@voltro/protocol";
+import { createLogger as b } from "@voltro/logger";
+import { and as x, boolean as S, eq as C, id as w, json as T, or as E, reference as D, requireTenants as O, table as k, text as A } from "@voltro/database";
 //#region src/tables.ts
-var A = "_voltro_rbac_roles", j = "_voltro_rbac_user_roles", M = O(A, {
-	id: C({ prefix: "role" }),
-	slug: k().unique(),
-	name: k(),
-	permissions: w(),
-	isDefault: x().default(!1)
-}).index("byRolesSlug", ["slug"]), N = (e = {}) => O(j, {
-	id: C({ prefix: "urole" }),
-	userId: k(),
-	tenantId: e.multitenant ? E(D(), { index: !1 }).nullable() : k().nullable(),
-	roleSlug: k()
-}).index("byUserTenant", ["userId", "tenantId"]).index("byRoleSlug", ["roleSlug"]), P = N(), F = (e = {}) => [M, N(e)], I = (e, t) => e.query({
-	table: j,
+var j = "_voltro_rbac_roles", M = "_voltro_rbac_user_roles", N = k(j, {
+	id: w({ prefix: "role" }),
+	slug: A().unique(),
+	name: A(),
+	permissions: T(),
+	isDefault: S().default(!1)
+}).index("byRolesSlug", ["slug"]), P = (e = {}) => k(M, {
+	id: w({ prefix: "urole" }),
+	userId: A(),
+	tenantId: e.multitenant ? D(O(), { index: !1 }).nullable() : A().nullable(),
+	roleSlug: A()
+}).index("byUserTenant", ["userId", "tenantId"]).index("byRoleSlug", ["roleSlug"]), F = P(), I = (e = {}) => [N, P(e)], L = (e, t) => e.query({
+	table: M,
 	predicate: t,
 	order: [{
 		column: "id",
@@ -25,11 +25,11 @@ var A = "_voltro_rbac_roles", j = "_voltro_rbac_user_roles", M = O(A, {
 	take: void 0,
 	skip: void 0,
 	projection: void 0
-}), L = (e) => {
-	let t = (t, n, r) => I(e, b(S("userId", t), S("roleSlug", n), S("tenantId", r)));
+}), R = (e) => {
+	let t = (t, n, r) => L(e, x(C("userId", t), C("roleSlug", n), C("tenantId", r)));
 	return {
 		assign: async (n, r, i = null) => {
-			(await t(n, r, i)).length > 0 || await e.insert(j, {
+			(await t(n, r, i)).length > 0 || await e.insert(M, {
 				userId: n,
 				roleSlug: r,
 				tenantId: i
@@ -37,38 +37,38 @@ var A = "_voltro_rbac_roles", j = "_voltro_rbac_user_roles", M = O(A, {
 		},
 		revoke: async (n, r, i = null) => {
 			let a = await t(n, r, i);
-			for (let t of a) await e.delete(j, String(t.id));
+			for (let t of a) await e.delete(M, String(t.id));
 		},
 		rolesOf: async (t, n) => {
-			let r = (n === void 0 ? await I(e, S("userId", t)) : await I(e, b(S("userId", t), R(n)))).map((e) => String(e.roleSlug));
+			let r = (n === void 0 ? await L(e, C("userId", t)) : await L(e, x(C("userId", t), z(n)))).map((e) => String(e.roleSlug));
 			return [...new Set(r)];
 		}
 	};
-}, R = (e) => e === null ? S("tenantId", null) : T(S("tenantId", e), S("tenantId", null)), z = (e) => (t) => {
+}, z = (e) => e === null ? C("tenantId", null) : E(C("tenantId", e), C("tenantId", null)), B = (e) => (t) => {
 	let n = ("tenantId" in t ? t.tenantId : void 0) ?? null, r = ("id" in t ? t.id : void 0) ?? null;
 	return r ? e.rolesOf(r, n) : [];
-}, B = y({ scope: "@voltro/plugin-rbac" }), V = (e) => p.suspend(() => {
+}, V = b({ scope: "@voltro/plugin-rbac" }), H = (e) => p.suspend(() => {
 	let t = e();
 	return t instanceof Promise ? p.promise(() => t) : p.succeed(t);
-}), H = (t) => {
+}), U = "@voltro/plugin-rbac", W = (t) => {
 	let i = t.resolveRoles ?? s, o = t.resolvePermissions, c = t.tables !== void 0 && t.tables !== !1, l = typeof t.tables == "object" ? t.tables : {};
 	if (t.resolveResourceRoles) {
 		let e = t.resolveResourceRoles;
-		v(({ subject: r, scope: i, resource: a }) => V(() => e(r, a)).pipe(p.map((e) => {
+		y(({ subject: r, scope: i, resource: a }) => H(() => e(r, a)).pipe(p.map((e) => {
 			let r = n(e, t.roles);
 			return r.includes(m) || r.includes(i);
-		}), p.catchAllCause((e) => (B.warn("resolveResourceRoles failed; denying (fail-closed)", {
+		}), p.catchAllCause((e) => (V.warn("resolveResourceRoles failed; denying (fail-closed)", {
 			scope: i,
 			resource: a,
 			cause: String(e)
 		}), p.succeed(!1)))));
 	}
 	let u = (n, r) => p.gen(function* () {
-		let s = yield* V(() => i(r.subject)).pipe(p.catchAllCause((e) => (B.warn("resolveRoles failed; falling back to raw subject scopes", {
+		let s = yield* H(() => i(r.subject)).pipe(p.catchAllCause((e) => (V.warn("resolveRoles failed; falling back to raw subject scopes", {
 			tag: r.tag,
 			traceId: r.traceId,
 			cause: String(e)
-		}), p.succeed([])))), c = o ? yield* V(() => o(r.subject)).pipe(p.catchAllCause(() => p.succeed([]))) : [], l = e(r.subject, s, t.roles, c);
+		}), p.succeed([])))), c = o ? yield* H(() => o(r.subject)).pipe(p.catchAllCause(() => p.succeed([]))) : [], l = e(r.subject, s, t.roles, c);
 		return a(r.subject, l, s), yield* n;
 	}), d = [
 		"rpc:intercept:mutation",
@@ -77,7 +77,11 @@ var A = "_voltro_rbac_roles", j = "_voltro_rbac_user_roles", M = O(A, {
 		...c ? ["store:write"] : []
 	], f = o === void 0 ? r(t.roles) : void 0;
 	return _({
-		name: "@voltro/plugin-rbac",
+		name: v({
+			base: U,
+			alias: t.alias
+		}),
+		baseName: U,
 		...f === void 0 ? {} : { declaredScopes: f },
 		description: "Role-based access control — roles compile to scopes on top of the protocol scope system. Ships the permission() handler guard + a role→scope interceptor + a resource-aware guard resolver, failing with protocol's typed ScopeError (one denial tag framework-wide).",
 		permissions: d,
@@ -91,8 +95,8 @@ var A = "_voltro_rbac_roles", j = "_voltro_rbac_user_roles", M = O(A, {
 				name: "ScopeError"
 			}
 		}],
-		...c ? { extendSchema: { tables: [...F(l)] } } : {}
+		...c ? { extendSchema: { tables: [...I(l)] } } : {}
 	});
 };
 //#endregion
-export { A as ROLES_TABLE, h as ScopeError, j as USER_ROLES_TABLE, f as WILDCARD_PERMISSION, d as anyPermission, o as assertPermission, N as buildUserRolesTable, l as can, n as compileRoles, z as dataStoreRoleResolver, e as mergeResolvedScopes, s as metadataRoleResolver, i as permission, H as rbacPlugin, F as rbacTables, u as resolvedRoles, t as resolvedScopes, c as rolesFromMap, M as rolesTable, a as setResolvedScopes, L as userRoleStore, P as userRolesTable };
+export { j as ROLES_TABLE, h as ScopeError, M as USER_ROLES_TABLE, f as WILDCARD_PERMISSION, d as anyPermission, o as assertPermission, P as buildUserRolesTable, l as can, n as compileRoles, B as dataStoreRoleResolver, e as mergeResolvedScopes, s as metadataRoleResolver, i as permission, W as rbacPlugin, I as rbacTables, u as resolvedRoles, t as resolvedScopes, c as rolesFromMap, N as rolesTable, a as setResolvedScopes, R as userRoleStore, F as userRolesTable };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-rbac",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Role-based access control — roles compile to scopes on top of @voltro/protocol's scope system. Ships rbacPlugin() (role→scope interceptor + resource-aware guard resolver, failing with protocol's typed ScopeError), the permission()/assertPermission()/anyPermission() handler guards, the compileRoles() pure compiler, cross-dialect roles + userRoles tables. The UI gate lives in @voltro/client (useCan / useCanAny) — scopes are a framework concept, so gating a button must not require this plugin.",
   "keywords": [
     "voltro",
@@ -22,7 +22,8 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -32,9 +33,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.32.0",
-    "@voltro/logger": "0.32.0",
-    "@voltro/protocol": "0.32.0"
+    "@voltro/database": "0.34.0",
+    "@voltro/logger": "0.34.0",
+    "@voltro/protocol": "0.34.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0",