@voltro/plugin-rbac 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,109 +1,73 @@
-import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./permission-DhL6E-Nc.js";
-import { Effect as p } from "effect";
-import { ADMIN_SCOPE as m, ScopeError as h, ScopeError as g, definePlugin as _, pluginInstanceName as v, setResourceScopeResolver as y } from "@voltro/protocol";
-import { createLogger as b } from "@voltro/logger";
-import { and as x, boolean as S, eq as C, id as w, json as T, or as E, reference as D, requireTenants as O, table as k, text as A } from "@voltro/database";
-//#region src/tables.ts
-var j = "_voltro_rbac_roles", M = "_voltro_rbac_user_roles", N = k(j, {
-	id: w({ prefix: "role" }),
-	slug: A().unique(),
-	name: A(),
-	permissions: T(),
-	isDefault: S().default(!1)
-}).index("_voltro_rbac_roles_by_slug", ["slug"]), P = (e = {}) => k(M, {
-	id: w({ prefix: "urole" }),
-	userId: A(),
-	tenantId: e.multitenant ? D(O(), { index: !1 }).nullable() : A().nullable(),
-	roleSlug: A()
-}).index("_voltro_rbac_user_roles_by_user_tenant", ["userId", "tenantId"]).index("_voltro_rbac_user_roles_by_role_slug", ["roleSlug"]), F = P(), I = (e = {}) => [N, P(e)], L = (e, t) => e.query({
-	table: M,
-	predicate: t,
-	order: [{
-		column: "id",
-		direction: "asc"
-	}],
-	take: void 0,
-	skip: void 0,
-	projection: void 0
-}), R = (e) => {
-	let t = (t, n, r) => L(e, x(C("userId", t), C("roleSlug", n), C("tenantId", r)));
-	return {
-		assign: async (n, r, i = null) => {
-			(await t(n, r, i)).length > 0 || await e.insert(M, {
-				userId: n,
-				roleSlug: r,
-				tenantId: i
-			});
-		},
-		revoke: async (n, r, i = null) => {
-			let a = await t(n, r, i);
-			for (let t of a) await e.delete(M, String(t.id));
-		},
-		rolesOf: async (t, n) => {
-			let r = (n === void 0 ? await L(e, C("userId", t)) : await L(e, x(C("userId", t), z(n)))).map((e) => String(e.roleSlug));
-			return [...new Set(r)];
-		}
-	};
-}, z = (e) => e === null ? C("tenantId", null) : E(C("tenantId", e), C("tenantId", null)), B = (e) => (t, n) => {
-	let r = ("tenantId" in t ? t.tenantId : void 0) ?? null, i = ("id" in t ? t.id : void 0) ?? null;
-	if (!i) return [];
-	let a = e ?? (n?.store === void 0 ? void 0 : R(n.store));
-	return a === void 0 ? [] : a.rolesOf(i, r);
-}, V = b({ scope: "@voltro/plugin-rbac" }), H = (e) => p.suspend(() => {
+import { WILDCARD_PERMISSION as e, compileRoles as t, declaredScopesOf as n, rolesFromMap as r } from "./roles.js";
+import { mergeResolvedScopes as i, metadataRoleResolver as a, resolvedRoles as o, resolvedScopes as s, setResolvedScopes as c } from "./resolve.js";
+import { anyPermission as l, assertPermission as u, can as d, permission as f } from "./permission.js";
+import { ROLES_TABLE as p, USER_ROLES_TABLE as m, buildUserRolesTable as h, rbacTables as g, rolesTable as _, userRolesTable as v } from "./tables.js";
+import { dataStoreRoleResolver as y, userRoleStore as b } from "./userRoleStore.js";
+import { Effect as x } from "effect";
+import { ADMIN_SCOPE as S, ScopeError as C, ScopeError as w, definePlugin as T, pluginInstanceName as E, setEffectiveScopesRefresher as D, setResourceScopeResolver as O } from "@voltro/protocol";
+import { createLogger as k } from "@voltro/logger";
+//#region src/index.ts
+var A = k({ scope: "@voltro/plugin-rbac" }), j = (e) => x.suspend(() => {
 	let t = e();
-	return t instanceof Promise ? p.promise(() => t) : p.succeed(t);
-}), U = "@voltro/plugin-rbac", W = (t) => {
-	let i = t.resolveRoles ?? s, o = t.resolvePermissions, c = t.tables !== void 0 && t.tables !== !1, l = typeof t.tables == "object" ? t.tables : {};
-	if (t.resolveResourceRoles) {
-		let e = t.resolveResourceRoles;
-		y(({ subject: r, scope: i, resource: a }) => H(() => e(r, a)).pipe(p.map((e) => {
-			let r = n(e, t.roles);
-			return r.includes(m) || r.includes(i);
-		}), p.catchCause((e) => (V.warn("resolveResourceRoles failed; denying (fail-closed)", {
+	return t instanceof Promise ? x.promise(() => t) : x.succeed(t);
+}), M = "@voltro/plugin-rbac", N = (e) => {
+	let r = e.resolveRoles ?? a, o = e.resolvePermissions, s = e.tables !== void 0 && e.tables !== !1, l = typeof e.tables == "object" ? e.tables : {};
+	if (e.resolveResourceRoles) {
+		let n = e.resolveResourceRoles;
+		O(({ subject: r, scope: i, resource: a }) => j(() => n(r, a)).pipe(x.map((n) => {
+			let r = t(n, e.roles);
+			return r.includes(S) || r.includes(i);
+		}), x.catchCause((e) => (A.warn("resolveResourceRoles failed; denying (fail-closed)", {
 			scope: i,
 			resource: a,
 			cause: String(e)
-		}), p.succeed(!1)))));
+		}), x.succeed(!1)))));
 	}
-	let u, d = (n, r) => p.gen(function* () {
-		let s = yield* H(() => i(r.subject, { ...u === void 0 ? {} : { store: u } })).pipe(p.catchCause((e) => (V.warn("resolveRoles failed; falling back to raw subject scopes", {
-			tag: r.tag,
-			traceId: r.traceId,
+	let u, d = (t, n, a) => x.gen(function* () {
+		let s = yield* j(() => r(t, { ...u === void 0 ? {} : { store: u } })).pipe(x.catchCause((e) => (A.warn("resolveRoles failed; falling back to raw subject scopes", {
+			tag: n,
+			traceId: a,
 			cause: String(e)
-		}), p.succeed([])))), c = o ? yield* H(() => o(r.subject)).pipe(p.catchCause(() => p.succeed([]))) : [], l = e(r.subject, s, t.roles, c);
-		return a(r.subject, l, s), yield* n;
-	}), f = [
+		}), x.succeed([])))), l = o ? yield* j(() => o(t)).pipe(x.catchCause(() => x.succeed([]))) : [], d = i(t, s, e.roles, l);
+		c(t, d, s);
+	}), f = (e) => {
+		D(e.subject, (t) => x.runPromise(d(t, e.tag, e.traceId)));
+	}, p = (e, t) => x.gen(function* () {
+		return yield* d(t.subject, t.tag, t.traceId), f(t), yield* e;
+	}), m = [
+		"rpc:authority:replay",
 		"rpc:intercept:mutation",
 		"rpc:intercept:query",
 		"rpc:intercept:action",
 		"rpc:intercept:workflow",
-		...c ? ["store:write"] : []
-	], h = o === void 0 ? r(t.roles) : void 0;
-	return _({
-		name: v({
-			base: U,
-			alias: t.alias
+		...s ? ["store:write"] : []
+	], h = o === void 0 ? n(e.roles) : void 0;
+	return T({
+		name: E({
+			base: M,
+			alias: e.alias
 		}),
-		baseName: U,
+		baseName: M,
 		...h === void 0 ? {} : { declaredScopes: h },
 		description: "Role-based access control — roles compile to scopes on top of the protocol scope system. Ships the permission() handler guard + a role→scope interceptor + a resource-aware guard resolver, failing with protocol's typed ScopeError (one denial tag framework-wide).",
-		permissions: f,
+		permissions: m,
 		bindDataStore: (e) => {
 			u = e;
 		},
-		interceptMutation: d,
-		interceptQuery: d,
-		interceptAction: d,
-		interceptWorkflow: d,
+		bindReplayAuthority: f,
+		interceptMutation: p,
+		interceptQuery: p,
+		interceptAction: p,
+		interceptWorkflow: p,
 		errorSchemas: [{
-			schema: g,
+			schema: w,
 			import: {
 				module: "@voltro/protocol",
 				name: "ScopeError"
 			}
 		}],
-		...c ? { extendSchema: { tables: [...I(l)] } } : {}
+		...s ? { extendSchema: { tables: [...g(l)] } } : {}
 	});
 };
 //#endregion
-export { j as ROLES_TABLE, h as ScopeError, M as USER_ROLES_TABLE, f as WILDCARD_PERMISSION, d as anyPermission, o as assertPermission, P as buildUserRolesTable, l as can, n as compileRoles, B as dataStoreRoleResolver, e as mergeResolvedScopes, s as metadataRoleResolver, i as permission, W as rbacPlugin, I as rbacTables, u as resolvedRoles, t as resolvedScopes, c as rolesFromMap, N as rolesTable, a as setResolvedScopes, R as userRoleStore, F as userRolesTable };
+export { p as ROLES_TABLE, C as ScopeError, m as USER_ROLES_TABLE, e as WILDCARD_PERMISSION, l as anyPermission, u as assertPermission, h as buildUserRolesTable, d as can, t as compileRoles, y as dataStoreRoleResolver, i as mergeResolvedScopes, a as metadataRoleResolver, f as permission, N as rbacPlugin, g as rbacTables, o as resolvedRoles, s as resolvedScopes, r as rolesFromMap, _ as rolesTable, c as setResolvedScopes, b as userRoleStore, v as userRolesTable };

package/dist/permission.js

@@ -1,2 +1,33 @@
-import { i as e, n as t, r as n, t as r } from "./permission-DhL6E-Nc.js";
-export { r as anyPermission, t as assertPermission, n as can, e as permission };
+import { resolvedScopes as e } from "./resolve.js";
+import { Effect as t } from "effect";
+import { ADMIN_SCOPE as n, ScopeError as r } from "@voltro/protocol";
+//#region src/permission.ts
+var i = (t, r) => {
+	let i = e(t);
+	return i.includes(n) || i.includes(r);
+}, a = (e) => typeof e == "string" ? [e] : e, o = (e, t) => {
+	for (let n of t) if (!i(e, n)) return n;
+	return null;
+}, s = (e, n) => {
+	let i = a(n), s = o(e.request.subject, i);
+	return s === null ? t.void : t.fail(new r({
+		required: s,
+		message: `missing required permission '${s}'`
+	}));
+}, c = (e, n) => {
+	let a = e.request.subject;
+	if (n.length === 0) return t.void;
+	for (let e of n) if (i(a, e)) return t.void;
+	return t.fail(new r({
+		required: n[0],
+		message: `missing all of required permissions [${n.join(", ")}]`
+	}));
+}, l = (e, t) => {
+	let n = o(e.request.subject, a(t));
+	if (n !== null) throw new r({
+		required: n,
+		message: `missing required permission '${n}'`
+	});
+}, u = (e, t) => o(e.request.subject, a(t)) === null;
+//#endregion
+export { c as anyPermission, l as assertPermission, u as can, s as permission };

package/dist/resolve.js

@@ -0,0 +1,20 @@
+import { compileRoles as e } from "./roles.js";
+import { currentSubjectAuthority as t, effectiveScopes as n, setEffectiveScopes as r, subjectScopes as i } from "@voltro/protocol";
+//#region src/resolve.ts
+var a = /* @__PURE__ */ new WeakMap(), o = (e, t, n) => {
+	r(e, t), n !== void 0 && a.set(e, n);
+}, s = (e) => n(e), c = (e) => a.get(t(e)) ?? [], l = (e) => {
+	if (!("metadata" in e) || e.metadata === void 0) return [];
+	let t = e.metadata.roles;
+	return Array.isArray(t) ? t.filter((e) => typeof e == "string") : [];
+}, u = (t, n, r, a = []) => {
+	let o = e(n, r), s = [], c = /* @__PURE__ */ new Set();
+	for (let e of [
+		...i(t),
+		...o,
+		...a
+	]) c.has(e) || (c.add(e), s.push(e));
+	return s;
+};
+//#endregion
+export { u as mergeResolvedScopes, l as metadataRoleResolver, c as resolvedRoles, s as resolvedScopes, o as setResolvedScopes };

package/dist/roles.js

@@ -0,0 +1,22 @@
+import { ADMIN_SCOPE as e } from "@voltro/protocol";
+//#region src/roles.ts
+var t = "*", n = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of Object.values(e)) for (let e of n) e !== "*" && t.add(e);
+	return [...t].sort();
+}, r = (t, n) => {
+	let r = [], i = /* @__PURE__ */ new Set();
+	for (let a of t) {
+		let t = n[a];
+		if (t !== void 0) for (let n of t) {
+			if (n === "*") return [e];
+			i.has(n) || (i.add(n), r.push(n));
+		}
+	}
+	return r;
+}, i = (e) => Object.entries(e).map(([e, t]) => ({
+	slug: e,
+	permissions: t
+}));
+//#endregion
+export { t as WILDCARD_PERMISSION, r as compileRoles, n as declaredScopesOf, i as rolesFromMap };

package/dist/tables.js

@@ -0,0 +1,16 @@
+import { boolean as e, id as t, json as n, reference as r, requireTenants as i, table as a, text as o } from "@voltro/database";
+//#region src/tables.ts
+var s = "_voltro_rbac_roles", c = "_voltro_rbac_user_roles", l = a(s, {
+	id: t({ prefix: "role" }),
+	slug: o().unique(),
+	name: o(),
+	permissions: n(),
+	isDefault: e().default(!1)
+}).index("_voltro_rbac_roles_by_slug", ["slug"]), u = (e = {}) => a(c, {
+	id: t({ prefix: "urole" }),
+	userId: o(),
+	tenantId: e.multitenant ? r(i(), { index: !1 }).nullable() : o().nullable(),
+	roleSlug: o()
+}).index("_voltro_rbac_user_roles_by_user_tenant", ["userId", "tenantId"]).index("_voltro_rbac_user_roles_by_role_slug", ["roleSlug"]), d = u(), f = (e = {}) => [l, u(e)];
+//#endregion
+export { s as ROLES_TABLE, c as USER_ROLES_TABLE, u as buildUserRolesTable, f as rbacTables, l as rolesTable, d as userRolesTable };

package/dist/userRoleStore.js

@@ -0,0 +1,40 @@
+import { USER_ROLES_TABLE as e } from "./tables.js";
+import { and as t, eq as n, or as r } from "@voltro/database";
+//#region src/userRoleStore.ts
+var i = (t, n) => t.query({
+	table: e,
+	predicate: n,
+	order: [{
+		column: "id",
+		direction: "asc"
+	}],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), a = (r) => {
+	let a = (e, a, o) => i(r, t(n("userId", e), n("roleSlug", a), n("tenantId", o)));
+	return {
+		assign: async (t, n, i = null) => {
+			(await a(t, n, i)).length > 0 || await r.insert(e, {
+				userId: t,
+				roleSlug: n,
+				tenantId: i
+			});
+		},
+		revoke: async (t, n, i = null) => {
+			let o = await a(t, n, i);
+			for (let t of o) await r.delete(e, String(t.id));
+		},
+		rolesOf: async (e, a) => {
+			let s = (a === void 0 ? await i(r, n("userId", e)) : await i(r, t(n("userId", e), o(a)))).map((e) => String(e.roleSlug));
+			return [...new Set(s)];
+		}
+	};
+}, o = (e) => e === null ? n("tenantId", null) : r(n("tenantId", e), n("tenantId", null)), s = (e) => (t, n) => {
+	let r = ("tenantId" in t ? t.tenantId : void 0) ?? null, i = ("id" in t ? t.id : void 0) ?? null;
+	if (!i) return [];
+	let o = e ?? (n?.store === void 0 ? void 0 : a(n.store));
+	return o === void 0 ? [] : o.rolesOf(i, r);
+};
+//#endregion
+export { s as dataStoreRoleResolver, a as userRoleStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-rbac",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "Role-based access control — roles compile to scopes on top of @voltro/protocol's scope system. Ships rbacPlugin() (role→scope interceptor + resource-aware guard resolver, failing with protocol's typed ScopeError), the permission()/assertPermission()/anyPermission() handler guards, the compileRoles() pure compiler, cross-dialect roles + userRoles tables. The UI gate lives in @voltro/client (useCan / useCanAny) — scopes are a framework concept, so gating a button must not require this plugin.",
   "keywords": [
     "voltro",
@@ -33,9 +33,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.85.0",
-    "@voltro/logger": "0.85.0",
-    "@voltro/protocol": "0.85.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/logger": "0.87.0",
+    "@voltro/protocol": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1",

package/dist/permission-DhL6E-Nc.js

@@ -1,63 +0,0 @@
-import { Effect as e } from "effect";
-import { ADMIN_SCOPE as t, ScopeError as n, effectiveScopes as r, setEffectiveScopes as i, subjectScopes as a } from "@voltro/protocol";
-//#region src/roles.ts
-var o = "*", s = (e) => {
-	let t = /* @__PURE__ */ new Set();
-	for (let n of Object.values(e)) for (let e of n) e !== "*" && t.add(e);
-	return [...t].sort();
-}, c = (e, n) => {
-	let r = [], i = /* @__PURE__ */ new Set();
-	for (let a of e) {
-		let e = n[a];
-		if (e !== void 0) for (let n of e) {
-			if (n === "*") return [t];
-			i.has(n) || (i.add(n), r.push(n));
-		}
-	}
-	return r;
-}, l = (e) => Object.entries(e).map(([e, t]) => ({
-	slug: e,
-	permissions: t
-})), u = /* @__PURE__ */ new WeakMap(), d = (e, t, n) => {
-	i(e, t), n !== void 0 && u.set(e, n);
-}, f = (e) => r(e), p = (e) => u.get(e) ?? [], m = (e) => {
-	if (!("metadata" in e) || e.metadata === void 0) return [];
-	let t = e.metadata.roles;
-	return Array.isArray(t) ? t.filter((e) => typeof e == "string") : [];
-}, h = (e, t, n, r = []) => {
-	let i = c(t, n), o = [], s = /* @__PURE__ */ new Set();
-	for (let t of [
-		...a(e),
-		...i,
-		...r
-	]) s.has(t) || (s.add(t), o.push(t));
-	return o;
-}, g = (e, n) => {
-	let r = f(e);
-	return r.includes(t) || r.includes(n);
-}, _ = (e) => typeof e == "string" ? [e] : e, v = (e, t) => {
-	for (let n of t) if (!g(e, n)) return n;
-	return null;
-}, y = (t, r) => {
-	let i = _(r), a = v(t.request.subject, i);
-	return a === null ? e.void : e.fail(new n({
-		required: a,
-		message: `missing required permission '${a}'`
-	}));
-}, b = (t, r) => {
-	let i = t.request.subject;
-	if (r.length === 0) return e.void;
-	for (let t of r) if (g(i, t)) return e.void;
-	return e.fail(new n({
-		required: r[0],
-		message: `missing all of required permissions [${r.join(", ")}]`
-	}));
-}, x = (e, t) => {
-	let r = v(e.request.subject, _(t));
-	if (r !== null) throw new n({
-		required: r,
-		message: `missing required permission '${r}'`
-	});
-}, S = (e, t) => v(e.request.subject, _(t)) === null;
-//#endregion
-export { h as a, f as c, c as d, s as f, y as i, d as l, x as n, m as o, l as p, S as r, p as s, b as t, o as u };