@xemahq/authorization-nest 0.0.0-stage → 0.2.0

package/dist/authzen.transport.js

@@ -0,0 +1,105 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthzenPdpTransport = exports.AuthzenPdpError = exports.AUTHZEN_PDP_TRANSPORT = void 0;
+const common_1 = require("@nestjs/common");
+const authzen_1 = require("@xemahq/contracts/authzen");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const authorization_options_1 = require("./authorization.options");
+exports.AUTHZEN_PDP_TRANSPORT = Symbol('AUTHZEN_PDP_TRANSPORT');
+class AuthzenPdpError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = AuthzenPdpError.name;
+    }
+}
+exports.AuthzenPdpError = AuthzenPdpError;
+let HttpAuthzenPdpTransport = class HttpAuthzenPdpTransport {
+    registry;
+    identityBootstrap;
+    options;
+    constructor(registry, identityBootstrap, options) {
+        this.registry = registry;
+        this.identityBootstrap = identityBootstrap;
+        this.options = options;
+    }
+    evaluation(orgId, request) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluation, request, authzen_1.AccessEvaluationResponseSchema);
+    }
+    evaluations(orgId, request) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.Evaluations, request, authzen_1.AccessEvaluationsResponseSchema);
+    }
+    searchResource(orgId, request) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchResource, request, authzen_1.ResourceSearchResponseSchema);
+    }
+    searchSubject(orgId, request) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchSubject, request, authzen_1.SubjectSearchResponseSchema);
+    }
+    searchAction(orgId, request) {
+        return this.post(orgId, authzen_1.AuthzenEndpointPath.SearchAction, request, authzen_1.ActionSearchResponseSchema);
+    }
+    async post(orgId, path, body, schema) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const token = await this.identityBootstrap.getAccessToken();
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+                ...(orgId === null ? {} : { 'X-Xema-Org-Id': orgId }),
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+        });
+        const text = await response.text();
+        const parsed = parseJson(text);
+        if (!response.ok) {
+            throw new AuthzenPdpError(`authorization-api POST ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, errorCode(parsed));
+        }
+        const result = schema.safeParse(parsed);
+        if (!result.success) {
+            throw new AuthzenPdpError(`authorization-api POST ${path} returned a body outside the AuthZEN 1.0 shape: ${result.error.message}`, 502, undefined);
+        }
+        return result.data;
+    }
+};
+exports.HttpAuthzenPdpTransport = HttpAuthzenPdpTransport;
+exports.HttpAuthzenPdpTransport = HttpAuthzenPdpTransport = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
+], HttpAuthzenPdpTransport);
+function parseJson(text) {
+    try {
+        return text === '' ? undefined : JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function errorCode(body) {
+    if (typeof body === 'object' && body !== null && 'code' in body) {
+        const code = (body).code;
+        return typeof code === 'string' ? code : undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=authzen.transport.js.map

package/dist/authzen.transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen.transport.js","sourceRoot":"","sources":["../src/authzen.transport.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,uDAiBmC;AACnC,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AAEvC,mEAGiC;AAoCpB,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAGrE,MAAa,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGxC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC;IACnC,CAAC;CACF;AATD,0CASC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAGf;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,UAAU,CACf,KAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,UAAU,EAC9B,OAAO,EACP,wCAA8B,CAC/B,CAAC;IACJ,CAAC;IAEM,WAAW,CAChB,KAAa,EACb,OAAiC;QAEjC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,WAAW,EAC/B,OAAO,EACP,yCAA+B,CAChC,CAAC;IACJ,CAAC;IAEM,cAAc,CACnB,KAAa,EACb,OAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,cAAc,EAClC,OAAO,EACP,sCAA4B,CAC7B,CAAC;IACJ,CAAC;IAEM,aAAa,CAClB,KAAa,EACb,OAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,aAAa,EACjC,OAAO,EACP,qCAA2B,CAC5B,CAAC;IACJ,CAAC;IAEM,YAAY,CACjB,KAAa,EACb,OAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,EACL,6BAAmB,CAAC,YAAY,EAChC,OAAO,EACP,oCAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,KAAoB,EACpB,IAAyB,EACzB,IAAY,EACZ,MAAS;QAET,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAElC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC5F,QAAQ,CAAC,MAAM,EACf,SAAS,CAAC,MAAM,CAAC,CAClB,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,0BAA0B,IAAI,mDAAmD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACvG,GAAG,EACH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF,CAAA;AAhHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,uBAAuB,CAgHnC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from './anchor-predicate';
+export * from './authorization.module';
+export * from './authorization.options';
+export * from './authorize.decorator';
+export * from './authzen.transport';
+export * from './subject-from-context';
+export * from './xema-authz.service';
+export * from './policy-decisions';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./anchor-predicate"), exports);
+__exportStar(require("./authorization.module"), exports);
+__exportStar(require("./authorization.options"), exports);
+__exportStar(require("./authorize.decorator"), exports);
+__exportStar(require("./authzen.transport"), exports);
+__exportStar(require("./subject-from-context"), exports);
+__exportStar(require("./xema-authz.service"), exports);
+__exportStar(require("./policy-decisions"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC"}

package/dist/policy-decisions.d.ts

@@ -0,0 +1,22 @@
+import { type AccessEvaluationRequest, type AuthzenDecision } from '@xemahq/contracts/authzen';
+import { type PolicyDecision, type PolicyRequest } from '@xemahq/contracts/policy';
+import { type AuthzenPdpTransport } from './authzen.transport';
+export declare const POLICY_DECISIONS_CHUNK = 128;
+export declare class PolicyDecisionRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export declare function composedTypeOfResourceKind(kind: string): string;
+export declare function accessEvaluationOfPolicyRequest(request: PolicyRequest): {
+    readonly orgId: string;
+    readonly evaluation: AccessEvaluationRequest;
+};
+export declare function policyDecisionOfAuthzen(decision: AuthzenDecision): PolicyDecision;
+export declare class XemaPolicyDecisions {
+    private readonly transport;
+    constructor(transport: AuthzenPdpTransport);
+    decide(request: PolicyRequest): Promise<PolicyDecision>;
+    decideAll(requests: readonly PolicyRequest[]): Promise<PolicyDecision[]>;
+}
+//# sourceMappingURL=policy-decisions.d.ts.map

package/dist/policy-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decisions.d.ts","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAO1C,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAGD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D;AAyCD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,GAAG;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;CAC9C,CAiDA;AAiBD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAuBjF;AAUD,qBACa,mBAAmB;IAEG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,mBAAmB;IAGnE,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAKvD,SAAS,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CA+BtF"}

package/dist/policy-decisions.js

@@ -0,0 +1,163 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaPolicyDecisions = exports.PolicyDecisionRequestError = exports.POLICY_DECISIONS_CHUNK = void 0;
+exports.composedTypeOfResourceKind = composedTypeOfResourceKind;
+exports.accessEvaluationOfPolicyRequest = accessEvaluationOfPolicyRequest;
+exports.policyDecisionOfAuthzen = policyDecisionOfAuthzen;
+const common_1 = require("@nestjs/common");
+const authorization_module_1 = require("@xemahq/contracts/authorization-module");
+const authzen_1 = require("@xemahq/contracts/authzen");
+const policy_1 = require("@xemahq/contracts/policy");
+const resource_1 = require("@xemahq/contracts/resource");
+const zod_1 = require("zod");
+const authzen_transport_1 = require("./authzen.transport");
+exports.POLICY_DECISIONS_CHUNK = 128;
+class PolicyDecisionRequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = PolicyDecisionRequestError.name;
+    }
+}
+exports.PolicyDecisionRequestError = PolicyDecisionRequestError;
+function composedTypeOfResourceKind(kind) {
+    return (0, authorization_module_1.namespaceOfAuthorizationName)(kind) === null
+        ? `${authorization_module_1.XEMA_PLATFORM_NAMESPACE}_${kind}`
+        : kind;
+}
+function invocationOfPolicyRequest(request, instance) {
+    return {
+        caller: request.caller,
+        ...(request.space.projectId === undefined ? {} : { projectId: request.space.projectId }),
+        ...(request.biome === undefined ? {} : { biome: request.biome }),
+        ...(request.actingAgent === undefined ? {} : { actingAgent: request.actingAgent }),
+        ...(request.aperture === undefined ? {} : { aperture: request.aperture }),
+        ...(request.constraints === undefined ? {} : { constraints: request.constraints }),
+        ...(instance && request.resource?.classification !== undefined
+            ? { resourceClassification: request.resource.classification }
+            : {}),
+    };
+}
+function accessEvaluationOfPolicyRequest(request) {
+    const orgId = request.space.orgId;
+    if (orgId === undefined || orgId === '') {
+        throw new Error(`policy request ${request.id} names no org; a Xema decision is always made in an org.`);
+    }
+    const subject = { type: request.subject.kind, id: request.subject.id };
+    const delegation = request.delegation === undefined ? {} : { delegation: request.delegation };
+    if (request.resource === undefined) {
+        return {
+            orgId,
+            evaluation: {
+                subject,
+                action: { name: authzen_1.XEMA_CAPABILITY_INVOKE_ACTION },
+                resource: {
+                    type: authzen_1.XEMA_CAPABILITY_RESOURCE_TYPE,
+                    id: (0, authzen_1.capabilityResourceId)(orgId, request.capability.ref, request.environment.kind),
+                },
+                context: { orgId, ...delegation, invocation: invocationOfPolicyRequest(request, false) },
+            },
+        };
+    }
+    let parts;
+    try {
+        parts = (0, resource_1.parseResourceRef)(request.resource.ref);
+    }
+    catch (cause) {
+        throw new PolicyDecisionRequestError(400, 'resource_ref_malformed', `policy request ${request.id} names a resource that is not \`resource:<type>:<id>\`: ${String(cause)}`);
+    }
+    const { type, id } = parts;
+    return {
+        orgId,
+        evaluation: {
+            subject,
+            action: { name: authorization_module_1.XEMA_READ_RELATION },
+            resource: { type: composedTypeOfResourceKind(type), id: (0, authzen_1.qualifyResourceId)(orgId, id) },
+            context: {
+                orgId,
+                capability: request.capability.ref,
+                environment: request.environment.kind,
+                ...delegation,
+                invocation: invocationOfPolicyRequest(request, true),
+            },
+        },
+    };
+}
+const VerbDecisionSchema = zod_1.z.object({ kind: policy_1.PolicyDecisionKindSchema }).passthrough();
+function policyDecisionOfAuthzen(decision) {
+    const context = decision.context ?? {};
+    const error = context['error'];
+    if (error !== undefined) {
+        throw new PolicyDecisionRequestError(error.status ?? 400, error.code ?? 'authzen_item_error', error.message ?? 'the PDP refused the evaluation item.');
+    }
+    const verb = context['capability_decision'];
+    if (verb !== undefined) {
+        const parsed = VerbDecisionSchema.parse(verb);
+        return decision.decision || parsed.kind !== policy_1.PolicyDecisionKind.Allow
+            ? parsed
+            : { kind: policy_1.PolicyDecisionKind.Deny, reason: String(context['reason_code'] ?? 'relation_not_held') };
+    }
+    if (decision.decision) {
+        return { kind: policy_1.PolicyDecisionKind.Allow };
+    }
+    return { kind: policy_1.PolicyDecisionKind.Deny, reason: String(context['reason_code'] ?? 'denied') };
+}
+let XemaPolicyDecisions = class XemaPolicyDecisions {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async decide(request) {
+        const [decision] = await this.decideAll([request]);
+        return decision;
+    }
+    async decideAll(requests) {
+        const out = new Array(requests.length);
+        const byOrg = new Map();
+        requests.forEach((request, index) => {
+            const { orgId, evaluation } = accessEvaluationOfPolicyRequest(request);
+            const group = byOrg.get(orgId) ?? [];
+            group.push({ index, evaluation });
+            byOrg.set(orgId, group);
+        });
+        for (const [orgId, group] of byOrg) {
+            for (let start = 0; start < group.length; start += exports.POLICY_DECISIONS_CHUNK) {
+                const chunk = group.slice(start, start + exports.POLICY_DECISIONS_CHUNK);
+                const response = await this.transport.evaluations(orgId, {
+                    evaluations: chunk.map((c) => ({ ...c.evaluation })),
+                    options: { evaluations_semantic: authzen_1.AuthzenEvaluationsSemantic.ExecuteAll },
+                });
+                const decisions = response.evaluations;
+                if (decisions === undefined || decisions.length !== chunk.length) {
+                    throw new authzen_transport_1.AuthzenPdpError(`authorization-api answered ${decisions?.length ?? 0} of ${chunk.length} evaluations under execute_all.`, 502, undefined);
+                }
+                chunk.forEach((c, i) => {
+                    out[c.index] = policyDecisionOfAuthzen(decisions[i]);
+                });
+            }
+        }
+        return out;
+    }
+};
+exports.XemaPolicyDecisions = XemaPolicyDecisions;
+exports.XemaPolicyDecisions = XemaPolicyDecisions = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(authzen_transport_1.AUTHZEN_PDP_TRANSPORT)),
+    __metadata("design:paramtypes", [Object])
+], XemaPolicyDecisions);
+//# sourceMappingURL=policy-decisions.js.map

package/dist/policy-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-decisions.js","sourceRoot":"","sources":["../src/policy-decisions.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAsDA,gEAIC;AAyCD,0EAoDC;AAiBD,0DAuBC;AA/LD,2CAAoD;AACpD,iFAIgD;AAChD,uDASmC;AACnC,qDAKkC;AAClC,yDAA8D;AAC9D,6BAAwB;AAExB,2DAI6B;AAMhB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAO1C,MAAa,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AATD,gEASC;AAGD,SAAgB,0BAA0B,CAAC,IAAY;IACrD,OAAO,IAAA,mDAA4B,EAAC,IAAI,CAAC,KAAK,IAAI;QAChD,CAAC,CAAC,GAAG,8CAAuB,IAAI,IAAI,EAAE;QACtC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AASD,SAAS,yBAAyB,CAChC,OAAsB,EACtB,QAAiB;IAEjB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAiBD,SAAgB,+BAA+B,CAAC,OAAsB;IAIpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,CAAC,EAAE,0DAA0D,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9F,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,KAAK;YACL,UAAU,EAAE;gBACV,OAAO;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;gBAC/C,QAAQ,EAAE;oBACR,IAAI,EAAE,uCAA6B;oBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;iBAClF;gBACD,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;aACzF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,GAAG,EACH,wBAAwB,EACxB,kBAAkB,OAAO,CAAC,EAAE,2DAA2D,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAC3B,OAAO;QACL,KAAK;QACL,UAAU,EAAE;YACV,OAAO;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,yCAAkB,EAAE;YACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE;YACtF,OAAO,EAAE;gBACP,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBACrC,GAAG,UAAU;gBACb,UAAU,EAAE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC;aACrD;SACF;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iCAAwB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAStF,SAAgB,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAqE,CAAC;IACnG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAClC,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,KAAK,CAAC,IAAI,IAAI,oBAAoB,EAClC,KAAK,CAAC,OAAO,IAAI,sCAAsC,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAGhE,OAAO,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK;YAClE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,2BAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC/F,CAAC;AAWM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEoB;IADlD,YACkD,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAC7E,CAAC;IAEG,KAAK,CAAC,MAAM,CAAC,OAAsB;QACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,QAA0B,CAAC;IACpC,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,QAAkC;QACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoE,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,8BAAsB,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,8BAAsB,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE;oBACvD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;oBACpD,OAAO,EAAE,EAAE,oBAAoB,EAAE,oCAA0B,CAAC,UAAU,EAAE;iBACzE,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;gBACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjE,MAAM,IAAI,mCAAe,CACvB,8BAA8B,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,iCAAiC,EACxG,GAAG,EACH,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACrB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAoB,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAzCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,yCAAqB,CAAC,CAAA;;GAFrB,mBAAmB,CAyC/B"}

package/dist/subject-from-context.d.ts

@@ -0,0 +1,28 @@
+import { type XemaAuthzenContext, type XemaAuthzenSubject } from '@xemahq/contracts/authzen';
+import { type RequestContext } from '@xemahq/platform-common';
+export declare class UnevaluableSubjectError extends Error {
+    constructor(kind: string);
+}
+export declare function authzenSubjectFromContext(ctx: RequestContext): XemaAuthzenSubject;
+export declare function authzenContextFromRequest(ctx: RequestContext, extra?: {
+    readonly capability?: string;
+    readonly environment?: string;
+}): XemaAuthzenContext;
+export interface AuthzPrincipal {
+    readonly kind: 'principal';
+    readonly orgId: string;
+    readonly subject: {
+        readonly kind: string;
+        readonly id: string;
+    };
+    readonly delegation?: XemaAuthzenContext['delegation'];
+}
+export type AuthzCaller = RequestContext | AuthzPrincipal;
+export declare function isAuthzPrincipal(caller: AuthzCaller): caller is AuthzPrincipal;
+export declare function authzenSubjectOf(caller: AuthzCaller): XemaAuthzenSubject;
+export declare function authzenContextOf(caller: AuthzCaller, extra?: {
+    readonly capability?: string;
+    readonly environment?: string;
+}): XemaAuthzenContext;
+export declare function authzOrgOf(caller: AuthzCaller): string;
+//# sourceMappingURL=subject-from-context.d.ts.map

package/dist/subject-from-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-from-context.d.ts","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAOjC,qBAAa,uBAAwB,SAAQ,KAAK;gBAC7B,IAAI,EAAE,MAAM;CAOhC;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,GAClB,kBAAkB,CAgBpB;AAGD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAYpB;AAWD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACxD;AAGD,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAE1D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,IAAI,cAAc,CAE9E;AAGD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,kBAAkB,CAQxE;AAGD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAapB;AAGD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAMtD"}

package/dist/subject-from-context.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnevaluableSubjectError = void 0;
+exports.authzenSubjectFromContext = authzenSubjectFromContext;
+exports.authzenContextFromRequest = authzenContextFromRequest;
+exports.isAuthzPrincipal = isAuthzPrincipal;
+exports.authzenSubjectOf = authzenSubjectOf;
+exports.authzenContextOf = authzenContextOf;
+exports.authzOrgOf = authzOrgOf;
+const authzen_1 = require("@xemahq/contracts/authzen");
+const subject_1 = require("@xemahq/contracts/subject");
+const platform_common_1 = require("@xemahq/platform-common");
+class UnevaluableSubjectError extends Error {
+    constructor(kind) {
+        super(`The request's subject kind "${kind}" is not an AuthZEN subject the Xema PDP evaluates ` +
+            '(user, agent, service, external-subject).');
+        this.name = UnevaluableSubjectError.name;
+    }
+}
+exports.UnevaluableSubjectError = UnevaluableSubjectError;
+const EVALUABLE_KINDS = new Set(authzen_1.XEMA_AUTHZEN_SUBJECT_KINDS);
+function authzenSubjectFromContext(ctx) {
+    const { kind, id } = ctx.subject;
+    if (!EVALUABLE_KINDS.has(kind)) {
+        throw new UnevaluableSubjectError(kind);
+    }
+    const instrument = kind === subject_1.SubjectKind.User
+        ? (0, platform_common_1.resolveOrgAuthorityInstrument)(ctx, platform_common_1.OrgRole.Admin)
+        : undefined;
+    return authzen_1.XemaAuthzenSubjectSchema.parse({
+        type: kind,
+        id,
+        ...(instrument === undefined
+            ? {}
+            : { properties: { orgAuthority: instrument } }),
+    });
+}
+function authzenContextFromRequest(ctx, extra = {}) {
+    if (!ctx.orgId) {
+        throw new Error('An AuthZEN decision is made in an org: the verified request context carries none.');
+    }
+    return {
+        orgId: ctx.orgId,
+        ...(extra.capability === undefined ? {} : { capability: extra.capability }),
+        ...(extra.environment === undefined ? {} : { environment: extra.environment }),
+        ...(ctx.delegation === undefined ? {} : { delegation: ctx.delegation }),
+    };
+}
+function isAuthzPrincipal(caller) {
+    return caller.kind === 'principal';
+}
+function authzenSubjectOf(caller) {
+    if (!isAuthzPrincipal(caller)) {
+        return authzenSubjectFromContext(caller);
+    }
+    if (!EVALUABLE_KINDS.has(caller.subject.kind)) {
+        throw new UnevaluableSubjectError(caller.subject.kind);
+    }
+    return authzen_1.XemaAuthzenSubjectSchema.parse({ type: caller.subject.kind, id: caller.subject.id });
+}
+function authzenContextOf(caller, extra = {}) {
+    if (!isAuthzPrincipal(caller)) {
+        return authzenContextFromRequest(caller, extra);
+    }
+    if (!caller.orgId) {
+        throw new Error('An AuthZEN decision is made in an org: the principal carries none.');
+    }
+    return {
+        orgId: caller.orgId,
+        ...(extra.capability === undefined ? {} : { capability: extra.capability }),
+        ...(extra.environment === undefined ? {} : { environment: extra.environment }),
+        ...(caller.delegation === undefined ? {} : { delegation: caller.delegation }),
+    };
+}
+function authzOrgOf(caller) {
+    const orgId = caller.orgId;
+    if (!orgId) {
+        throw new Error('An AuthZEN decision is made in an org: the caller carries none.');
+    }
+    return orgId;
+}
+//# sourceMappingURL=subject-from-context.js.map

package/dist/subject-from-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-from-context.js","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":";;;AA6CA,8DAkBC;AAGD,8DAeC;AAqBD,4CAEC;AAGD,4CAQC;AAGD,4CAgBC;AAGD,gCAMC;AA/ID,uDAKmC;AACnC,uDAAwD;AACxD,6DAIiC;AAOjC,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAmB,IAAY;QAC7B,KAAK,CACH,+BAA+B,IAAI,qDAAqD;YACtF,2CAA2C,CAC9C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,CAAC;CACF;AARD,0DAQC;AAGD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,oCAA0B,CAAC,CAAC;AAgBjF,SAAgB,yBAAyB,CACvC,GAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,UAAU,GACd,IAAI,KAAK,qBAAW,CAAC,IAAI;QACvB,CAAC,CAAC,IAAA,+CAA6B,EAAC,GAAG,EAAE,yBAAO,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,kCAAwB,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,IAAI;QACV,EAAE;QACF,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,yBAAyB,CACvC,GAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAqBD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,OAAQ,MAAkC,CAAC,IAAI,KAAK,WAAW,CAAC;AAClE,CAAC;AAGD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,kCAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAGD,SAAgB,gBAAgB,CAC9B,MAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAGD,SAAgB,UAAU,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/xema-authz.service.d.ts

@@ -0,0 +1,43 @@
+import { type AuthzenSubject } from '@xemahq/contracts/authzen';
+import { ExecutionEnvironmentKind } from '@xemahq/contracts/execution-environment';
+import { type XemaAnchorSearchContext } from './anchor-predicate';
+import { type AuthzenPdpTransport } from './authzen.transport';
+import { type AuthzCaller } from './subject-from-context';
+export interface AuthzResourceRef {
+    readonly type: string;
+    readonly id: string;
+}
+export interface AuthzCheckOptions {
+    readonly capability?: string;
+    readonly environment?: ExecutionEnvironmentKind;
+}
+export interface AuthzDecision {
+    readonly allowed: boolean;
+    readonly reasonCode: string | undefined;
+    readonly context: Readonly<Record<string, unknown>> | undefined;
+}
+export interface AuthzResourcePage {
+    readonly ids: readonly string[];
+    readonly anchor: XemaAnchorSearchContext | undefined;
+    readonly nextToken: string;
+    readonly snapshot: string | undefined;
+}
+export declare class XemaAuthz {
+    private readonly transport;
+    constructor(transport: AuthzenPdpTransport);
+    evaluate(ctx: AuthzCaller, action: string, resource: AuthzResourceRef, options?: AuthzCheckOptions): Promise<AuthzDecision>;
+    evaluateCapability(ctx: AuthzCaller, capabilityRef: string, environment: ExecutionEnvironmentKind): Promise<AuthzDecision>;
+    evaluateSystemCapability(serviceSubjectId: string, capabilityRef: string): Promise<AuthzDecision>;
+    assert(ctx: AuthzCaller, view: string, action: string, resource: AuthzResourceRef, options?: AuthzCheckOptions): Promise<void>;
+    allowed(ctx: AuthzCaller, actions: readonly string[], resources: readonly AuthzResourceRef[], options?: AuthzCheckOptions): Promise<boolean[][]>;
+    searchResources(ctx: AuthzCaller, type: string, action: string, page?: {
+        readonly token?: string;
+        readonly limit?: number;
+    }, options?: AuthzCheckOptions): Promise<AuthzResourcePage>;
+    searchAllResourceIds(ctx: AuthzCaller, type: string, action: string, options?: AuthzCheckOptions): Promise<string[]>;
+    searchSubjects(ctx: AuthzCaller, subjectType: string, action: string, resource: AuthzResourceRef): Promise<AuthzenSubject[]>;
+    searchActions(ctx: AuthzCaller, resource: AuthzResourceRef): Promise<string[]>;
+    private subject;
+    private resource;
+}
+//# sourceMappingURL=xema-authz.service.d.ts.map

package/dist/xema-authz.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-authz.service.d.ts","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAWL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAGnF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACjE;AAGD,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAKhC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAErD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAYD,qBACa,SAAS;IAGlB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,mBAAmB;IAIpC,QAAQ,CACnB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAqBZ,kBAAkB,CAC7B,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,MAAM,EAErB,WAAW,EAAE,wBAAwB,GACpC,OAAO,CAAC,aAAa,CAAC;IAwBZ,wBAAwB,CAEnC,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAkBZ,MAAM,CACjB,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAqBH,OAAO,CAClB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAoCV,eAAe,CAC1B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,EAC/D,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAiChB,oBAAoB,CAC/B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;IAuBP,cAAc,CACzB,GAAG,EAAE,WAAW,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,cAAc,EAAE,CAAC;IAmBf,aAAa,CACxB,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,CAAC;IASpB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;CAGjB"}