@xemahq/authorization-nest 0.0.0-stage → 0.2.0

package/dist/xema-authz.service.js

@@ -0,0 +1,194 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaAuthz = void 0;
+const common_1 = require("@nestjs/common");
+const authzen_1 = require("@xemahq/contracts/authzen");
+const execution_environment_1 = require("@xemahq/contracts/execution-environment");
+const subject_1 = require("@xemahq/contracts/subject");
+const anchor_predicate_1 = require("./anchor-predicate");
+const authzen_transport_1 = require("./authzen.transport");
+const subject_from_context_1 = require("./subject-from-context");
+let XemaAuthz = class XemaAuthz {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async evaluate(ctx, action, resource, options = {}) {
+        const response = await this.transport.evaluation((0, subject_from_context_1.authzOrgOf)(ctx), {
+            subject: this.subject(ctx),
+            action: { name: action },
+            resource: this.resource(ctx, resource),
+            context: (0, subject_from_context_1.authzenContextOf)(ctx, options),
+        });
+        return toDecision(response);
+    }
+    async evaluateCapability(ctx, capabilityRef, environment) {
+        const orgId = (0, subject_from_context_1.authzOrgOf)(ctx);
+        const response = await this.transport.evaluation(orgId, {
+            subject: this.subject(ctx),
+            action: { name: authzen_1.XEMA_CAPABILITY_INVOKE_ACTION },
+            resource: {
+                type: authzen_1.XEMA_CAPABILITY_RESOURCE_TYPE,
+                id: (0, authzen_1.capabilityResourceId)(orgId, capabilityRef, environment),
+            },
+            context: (0, subject_from_context_1.authzenContextOf)(ctx),
+        });
+        return toDecision(response);
+    }
+    async evaluateSystemCapability(serviceSubjectId, capabilityRef) {
+        const response = await this.transport.evaluation(null, {
+            subject: { type: subject_1.SubjectKind.Service, id: serviceSubjectId },
+            action: { name: authzen_1.XEMA_CAPABILITY_INVOKE_ACTION },
+            resource: {
+                type: authzen_1.XEMA_CAPABILITY_RESOURCE_TYPE,
+                id: (0, authzen_1.capabilityResourceId)(null, capabilityRef, execution_environment_1.ExecutionEnvironmentKind.System),
+            },
+        });
+        return toDecision(response);
+    }
+    async assert(ctx, view, action, resource, options = {}) {
+        const actions = view === action ? [view] : [view, action];
+        const [decisions] = await this.allowed(ctx, actions, [resource], options);
+        if (decisions === undefined || decisions[0] !== true) {
+            throw new common_1.NotFoundException({
+                code: 'RESOURCE_NOT_FOUND',
+                message: `${resource.type} "${resource.id}" was not found.`,
+            });
+        }
+        if (decisions[decisions.length - 1] !== true) {
+            throw new common_1.ForbiddenException({
+                code: 'ACTION_NOT_PERMITTED',
+                message: `"${action}" is not permitted on ${resource.type} "${resource.id}".`,
+            });
+        }
+    }
+    async allowed(ctx, actions, resources, options = {}) {
+        if (actions.length === 0 || resources.length === 0) {
+            return resources.map(() => []);
+        }
+        const subject = this.subject(ctx);
+        const context = (0, subject_from_context_1.authzenContextOf)(ctx, options);
+        const evaluations = [];
+        for (const resource of resources) {
+            const qualified = this.resource(ctx, resource);
+            for (const action of actions) {
+                evaluations.push({ action: { name: action }, resource: qualified });
+            }
+        }
+        const response = await this.transport.evaluations((0, subject_from_context_1.authzOrgOf)(ctx), {
+            subject,
+            context,
+            evaluations,
+            options: { evaluations_semantic: authzen_1.AuthzenEvaluationsSemantic.ExecuteAll },
+        });
+        const decisions = response.evaluations;
+        if (decisions === undefined || decisions.length !== evaluations.length) {
+            throw new Error(`authorization-api answered ${decisions?.length ?? 0} of ${evaluations.length} evaluations under execute_all.`);
+        }
+        return resources.map((_, r) => actions.map((__, a) => decisions[r * actions.length + a]?.decision === true));
+    }
+    async searchResources(ctx, type, action, page = {}, options = {}) {
+        const response = await this.transport.searchResource((0, subject_from_context_1.authzOrgOf)(ctx), {
+            subject: this.subject(ctx),
+            action: { name: action },
+            resource: { type },
+            context: (0, subject_from_context_1.authzenContextOf)(ctx, options),
+            ...(page.token === undefined && page.limit === undefined
+                ? {}
+                : { page: { ...page } }),
+        });
+        const anchor = response.context?.['anchor'] === undefined
+            ? undefined
+            : anchor_predicate_1.XemaAnchorSearchContextSchema.parse(response.context['anchor']);
+        const parsedContext = authzen_1.XemaAuthzenDecisionContextSchema.safeParse(response.context ?? {});
+        return {
+            ids: response.results.map((r) => {
+                if (r.type !== type) {
+                    throw new Error(`Resource Search for "${type}" returned a "${r.type}" result (AuthZEN §8.3).`);
+                }
+                return localIdOf(r.id);
+            }),
+            anchor,
+            nextToken: response.page?.next_token ?? authzen_1.AUTHZEN_LAST_PAGE_TOKEN,
+            snapshot: parsedContext.success ? parsedContext.data.snapshot : undefined,
+        };
+    }
+    async searchAllResourceIds(ctx, type, action, options = {}) {
+        const ids = [];
+        let token;
+        do {
+            const page = await this.searchResources(ctx, type, action, token === undefined ? {} : { token }, options);
+            if (page.anchor !== undefined) {
+                throw new Error(`Resource type "${type}" lists through an anchor; use searchResources and run the predicate.`);
+            }
+            ids.push(...page.ids);
+            token = page.nextToken === authzen_1.AUTHZEN_LAST_PAGE_TOKEN ? undefined : page.nextToken;
+        } while (token !== undefined);
+        return ids;
+    }
+    async searchSubjects(ctx, subjectType, action, resource) {
+        const subjects = [];
+        let token;
+        do {
+            const response = await this.transport.searchSubject((0, subject_from_context_1.authzOrgOf)(ctx), {
+                subject: { type: subjectType },
+                action: { name: action },
+                resource: this.resource(ctx, resource),
+                context: (0, subject_from_context_1.authzenContextOf)(ctx),
+                ...(token === undefined ? {} : { page: { token } }),
+            });
+            subjects.push(...response.results);
+            const next = response.page?.next_token ?? authzen_1.AUTHZEN_LAST_PAGE_TOKEN;
+            token = next === authzen_1.AUTHZEN_LAST_PAGE_TOKEN ? undefined : next;
+        } while (token !== undefined);
+        return subjects;
+    }
+    async searchActions(ctx, resource) {
+        const response = await this.transport.searchAction((0, subject_from_context_1.authzOrgOf)(ctx), {
+            subject: this.subject(ctx),
+            resource: this.resource(ctx, resource),
+            context: (0, subject_from_context_1.authzenContextOf)(ctx),
+        });
+        return response.results.map((action) => action.name);
+    }
+    subject(ctx) {
+        return (0, subject_from_context_1.authzenSubjectOf)(ctx);
+    }
+    resource(ctx, ref) {
+        return { type: ref.type, id: (0, authzen_1.qualifyResourceId)((0, subject_from_context_1.authzOrgOf)(ctx), ref.id) };
+    }
+};
+exports.XemaAuthz = XemaAuthz;
+exports.XemaAuthz = XemaAuthz = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(authzen_transport_1.AUTHZEN_PDP_TRANSPORT)),
+    __metadata("design:paramtypes", [Object])
+], XemaAuthz);
+function toDecision(response) {
+    const parsed = authzen_1.XemaAuthzenDecisionContextSchema.safeParse(response.context ?? {});
+    return {
+        allowed: response.decision === true,
+        reasonCode: parsed.success ? parsed.data.reason_code : undefined,
+        context: response.context,
+    };
+}
+function localIdOf(qualified) {
+    const index = qualified.indexOf('|');
+    if (index <= 0) {
+        throw new Error(`Resource Search returned an unqualified id "${qualified}".`);
+    }
+    return qualified.slice(index + 1);
+}
+//# sourceMappingURL=xema-authz.service.js.map

package/dist/xema-authz.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-authz.service.js","sourceRoot":"","sources":["../src/xema-authz.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uDAYmC;AACnC,mFAAmF;AACnF,uDAAwD;AAExD,yDAG4B;AAC5B,2DAG6B;AAC7B,iEAKgC;AAkDzB,IAAM,SAAS,GAAf,MAAM,SAAS;IAGD;IAFnB,YAEmB,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAC9C,CAAC;IAGG,KAAK,CAAC,QAAQ,CACnB,GAAgB,EAChB,MAAc,EACd,QAA0B,EAC1B,UAA6B,EAAE;QAE/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;YACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAaM,KAAK,CAAC,kBAAkB,CAC7B,GAAgB,EAChB,aAAqB,EAErB,WAAqC;QAErC,MAAM,KAAK,GAAG,IAAA,iCAAU,EAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;YAC/C,QAAQ,EAAE;gBACR,IAAI,EAAE,uCAA6B;gBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC;aAC5D;YACD,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAYM,KAAK,CAAC,wBAAwB,CAEnC,gBAAwB,EACxB,aAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE;YACrD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE;YAC5D,MAAM,EAAE,EAAE,IAAI,EAAE,uCAA6B,EAAE;YAC/C,QAAQ,EAAE;gBACR,IAAI,EAAE,uCAA6B;gBACnC,EAAE,EAAE,IAAA,8BAAoB,EAAC,IAAI,EAAE,aAAa,EAAE,gDAAwB,CAAC,MAAM,CAAC;aAC/E;SACF,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAQM,KAAK,CAAC,MAAM,CACjB,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,QAA0B,EAC1B,UAA6B,EAAE;QAE/B,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAiB,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,kBAAkB;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,IAAI,MAAM,yBAAyB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAMM,KAAK,CAAC,OAAO,CAClB,GAAgB,EAChB,OAA0B,EAC1B,SAAsC,EACtC,UAA6B,EAAE;QAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,WAAW,GAA2D,EAAE,CAAC;QAC/E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YACjE,OAAO;YACP,OAAO;YACP,WAAW;YACX,OAAO,EAAE,EAAE,oBAAoB,EAAE,oCAA0B,CAAC,UAAU,EAAE;SACzE,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,8BAA8B,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,iCAAiC,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC,CAC7E,CAAC;IACJ,CAAC;IAQM,KAAK,CAAC,eAAe,CAC1B,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,OAA6D,EAAE,EAC/D,UAA6B,EAAE;QAE/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YACpE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACxB,QAAQ,EAAE,EAAE,IAAI,EAAE;YAClB,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,EAAE,OAAO,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBACtD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GACV,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gDAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,0CAAgC,CAAC,SAAS,CAC9D,QAAQ,CAAC,OAAO,IAAI,EAAE,CACvB,CAAC;QACF,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,iBAAiB,CAAC,CAAC,IAAI,0BAA0B,CAC9E,CAAC;gBACJ,CAAC;gBACD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,iCAAuB;YAC/D,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAGM,KAAK,CAAC,oBAAoB,CAC/B,GAAgB,EAChB,IAAY,EACZ,MAAc,EACd,UAA6B,EAAE;QAE/B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CACrC,GAAG,EACH,IAAI,EACJ,MAAM,EACN,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACpC,OAAO,CACR,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,uEAAuE,CAC9F,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,iCAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAClF,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAE;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAGM,KAAK,CAAC,cAAc,CACzB,GAAgB,EAChB,WAAmB,EACnB,MAAc,EACd,QAA0B;QAE1B,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;gBACnE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;gBAC9B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,iCAAuB,CAAC;YAClE,KAAK,GAAG,IAAI,KAAK,iCAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAE;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGM,KAAK,CAAC,aAAa,CACxB,GAAgB,EAChB,QAA0B;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE;YAClE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;YACtC,OAAO,EAAE,IAAA,uCAAgB,EAAC,GAAG,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAEO,OAAO,CAAC,GAAgB;QAC9B,OAAO,IAAA,uCAAgB,EAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,QAAQ,CAAC,GAAgB,EAAE,GAAqB;QACtD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,IAAA,2BAAiB,EAAC,IAAA,iCAAU,EAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;CACF,CAAA;AAtQY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,yCAAqB,CAAC,CAAA;;GAFrB,SAAS,CAsQrB;AAED,SAAS,UAAU,CAAC,QAAyB;IAC3C,MAAM,MAAM,GAAG,0CAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChE,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAGD,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,SAAS,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@nestjs/common": ">=11.0.0",
+    "@nestjs/core": ">=11.0.0",
+    "@xemahq/contracts": ">=0.36.1",
+    "@xemahq/identity-client": ">=0.9.0",
+    "@xemahq/platform-common": ">=0.43.0",
+    "@xemahq/service-registry-nest": ">=0.8.0",
+    "zod": ">=4.0.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "11.1.18",
+    "@nestjs/core": "11.1.18",
+    "@nestjs/testing": "11.1.18",
+    "@xemahq/contracts": ">=0.41.0",
+    "@xemahq/eslint-config": "^0.5.0",
+    "@xemahq/identity-client": "^0.14.0",
+    "@xemahq/platform-common": "^0.48.1",
+    "@xemahq/service-registry-nest": "^0.19.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "25.2.3",
+    "eslint": "^9.39.4",
+    "jest": "^30.3.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
+    "ts-jest": "^29.4.9",
+    "typescript": "5.9.3",
+    "zod": "^4.3.6"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "xema-source": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "license": "LicenseRef-Xema-BSL-1.1",
+  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
+  "homepage": "https://xema.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xema-dev/xema-base.git",
+    "directory": "packages/sdks/authorization-nest"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.build.json",
+    "lint": "eslint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "jest --config jest.config.ts"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.