@xemahq/authorization-nest 0.4.0 → 0.5.0

package/dist/authorization.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAqBjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CAkBjB"}
+{"version":3,"file":"authorization.module.d.ts","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AA0BjC,qBACa,uBAAuB;WACpB,OAAO,CACnB,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,GAC1C,aAAa;CA+BjB"}

package/dist/authorization.module.js

@@ -12,7 +12,9 @@ const common_1 = require("@nestjs/common");
 const authorization_options_1 = require("./authorization.options");
 const authorize_decorator_1 = require("./authorize.decorator");
 const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
 const policy_decisions_1 = require("./policy-decisions");
+const route_action_evaluator_1 = require("./route-action-evaluator");
 const xema_authz_service_1 = require("./xema-authz.service");
 let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizationModule {
     static forRoot(options) {
@@ -28,9 +30,22 @@ let XemaAuthorizationModule = XemaAuthorizationModule_1 = class XemaAuthorizatio
                 { provide: authzen_transport_1.AUTHZEN_PDP_TRANSPORT, useExisting: authzen_transport_1.HttpAuthzenPdpTransport },
                 xema_authz_service_1.XemaAuthz,
                 policy_decisions_1.XemaPolicyDecisions,
+                grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                {
+                    provide: grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
+                    useExisting: grant_version_reader_1.HttpAuthorizationGrantVersionReader,
+                },
+                route_action_evaluator_1.XemaRouteActionEvaluator,
+                authorize_decorator_1.XemaAuthorizeGuard,
+            ],
+            exports: [
+                xema_authz_service_1.XemaAuthz,
+                policy_decisions_1.XemaPolicyDecisions,
+                route_action_evaluator_1.XemaRouteActionEvaluator,
                 authorize_decorator_1.XemaAuthorizeGuard,
+                authzen_transport_1.AUTHZEN_PDP_TRANSPORT,
+                grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER,
             ],
-            exports: [xema_authz_service_1.XemaAuthz, policy_decisions_1.XemaPolicyDecisions, authorize_decorator_1.XemaAuthorizeGuard, authzen_transport_1.AUTHZEN_PDP_TRANSPORT],
         };
     }
 };

package/dist/authorization.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,yDAAyD;AACzD,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,wCAAkB;aACnB;YACD,OAAO,EAAE,CAAC,8BAAS,EAAE,sCAAmB,EAAE,wCAAkB,EAAE,yCAAqB,CAAC;SACrF,CAAC;IACJ,CAAC;CACF,CAAA;AArBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAqBnC"}
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAE5D,mEAIiC;AACjC,+DAA2D;AAC3D,2DAG6B;AAC7B,iEAGgC;AAChC,yDAAyD;AACzD,qEAAoE;AACpE,6DAAiD;AAe1C,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAC3B,MAAM,CAAC,OAAO,CACnB,OAA2C;QAE3C,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kDAA0B;oBACnC,QAAQ,EAAE,IAAA,uDAA+B,EAAC,OAAO,CAAC;iBACnD;gBACD,2CAAuB;gBACvB,EAAE,OAAO,EAAE,yCAAqB,EAAE,WAAW,EAAE,2CAAuB,EAAE;gBACxE,8BAAS;gBACT,sCAAmB;gBACnB,0DAAmC;gBACnC;oBACE,OAAO,EAAE,yDAAkC;oBAC3C,WAAW,EAAE,0DAAmC;iBACjD;gBACD,iDAAwB;gBACxB,wCAAkB;aACnB;YACD,OAAO,EAAE;gBACP,8BAAS;gBACT,sCAAmB;gBACnB,iDAAwB;gBACxB,wCAAkB;gBAClB,yCAAqB;gBACrB,yDAAkC;aACnC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}

package/dist/grant-version.reader.d.ts

@@ -0,0 +1,19 @@
+import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { type XemaAuthorizationOptions } from './authorization.options';
+export interface AuthorizationGrantVersionReader {
+    read(orgId: string): Promise<number>;
+}
+export declare const AUTHORIZATION_GRANT_VERSION_READER: unique symbol;
+export declare class HttpAuthorizationGrantVersionReader implements AuthorizationGrantVersionReader {
+    private readonly registry;
+    private readonly identityBootstrap;
+    private readonly options;
+    constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
+    read(orgId: string): Promise<number>;
+}
+export declare function assertGrantVersion(orgId: string, body: {
+    readonly orgId?: unknown;
+    readonly grantVersion?: unknown;
+}): number;
+//# sourceMappingURL=grant-version.reader.d.ts.map

package/dist/grant-version.reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAUjC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CA4BlD;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}

package/dist/grant-version.reader.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpAuthorizationGrantVersionReader = exports.AUTHORIZATION_GRANT_VERSION_READER = void 0;
+exports.assertGrantVersion = assertGrantVersion;
+const common_1 = require("@nestjs/common");
+const service_registry_1 = require("@xemahq/contracts/service-registry");
+const identity_client_1 = require("@xemahq/identity-client");
+const platform_common_1 = require("@xemahq/platform-common");
+const service_registry_nest_1 = require("@xemahq/service-registry-nest");
+const authorization_options_1 = require("./authorization.options");
+const authzen_transport_1 = require("./authzen.transport");
+exports.AUTHORIZATION_GRANT_VERSION_READER = Symbol('AUTHORIZATION_GRANT_VERSION_READER');
+const GRANT_VERSION_PATH = '/authorization/grant-version/';
+let HttpAuthorizationGrantVersionReader = class HttpAuthorizationGrantVersionReader {
+    registry;
+    identityBootstrap;
+    options;
+    constructor(registry, identityBootstrap, options) {
+        this.registry = registry;
+        this.identityBootstrap = identityBootstrap;
+        this.options = options;
+    }
+    async read(orgId) {
+        const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
+        const path = `${GRANT_VERSION_PATH}${encodeURIComponent(orgId)}`;
+        const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}`,
+                'X-Xema-Org-Id': orgId,
+            },
+            signal: AbortSignal.timeout(this.options.requestTimeoutMs),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new authzen_transport_1.AuthzenPdpError(`authorization-api GET ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, undefined);
+        }
+        const body = (0, platform_common_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api GET ${path}`);
+        return assertGrantVersion(orgId, body);
+    }
+};
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader;
+exports.HttpAuthorizationGrantVersionReader = HttpAuthorizationGrantVersionReader = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
+    __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
+], HttpAuthorizationGrantVersionReader);
+function assertGrantVersion(orgId, body) {
+    const version = body.grantVersion;
+    if (body.orgId !== orgId ||
+        typeof version !== 'number' ||
+        !Number.isSafeInteger(version) ||
+        version < 0) {
+        throw new Error(`authorization-api returned a malformed policy revision for org "${orgId}".`);
+    }
+    return version;
+}
+//# sourceMappingURL=grant-version.reader.js.map

package/dist/grant-version.reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+EA,gDAgBC;AA/FD,2CAAoD;AACpD,yEAG4C;AAC5C,6DAAmE;AACnE,6DAAyE;AACzE,yEAGuC;AAEvC,mEAGiC;AACjC,2DAAsD;AAazC,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE;gBACxE,eAAe,EAAE,KAAK;aACvB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,gDAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAvCY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CAuC/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export * from './authzen.transport';
 export * from './subject-from-context';
 export * from './xema-authz.service';
 export * from './policy-decisions';
+export * from './grant-version.reader';
+export * from './route-action-evaluator';
 export * from './internal-caller-or-member-context.guard';
 export * from './organization-delegation-admission';
 export * from './relayable-caller';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -22,6 +22,8 @@ __exportStar(require("./authzen.transport"), exports);
 __exportStar(require("./subject-from-context"), exports);
 __exportStar(require("./xema-authz.service"), exports);
 __exportStar(require("./policy-decisions"), exports);
+__exportStar(require("./grant-version.reader"), exports);
+__exportStar(require("./route-action-evaluator"), exports);
 __exportStar(require("./internal-caller-or-member-context.guard"), exports);
 __exportStar(require("./organization-delegation-admission"), exports);
 __exportStar(require("./relayable-caller"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC"}

package/dist/route-action-evaluator.d.ts

@@ -0,0 +1,38 @@
+import { type CapabilityRef } from '@xemahq/contracts/capability';
+import { type AuthorizationGrantVersionReader } from './grant-version.reader';
+import { XemaPolicyDecisions } from './policy-decisions';
+import type { RequestContext } from '@xemahq/platform-common';
+export interface RouteActionCandidate<Action extends string> {
+    readonly key: string;
+    readonly action: Action;
+    readonly capabilityRef: CapabilityRef;
+}
+export type RouteActionScope = {
+    readonly kind: 'org';
+    readonly orgId: string;
+} | {
+    readonly kind: 'project';
+    readonly orgId: string;
+    readonly projectId: string;
+} | {
+    readonly kind: 'platform';
+    readonly orgId: string;
+};
+export interface RouteActionEvaluation<Action extends string> {
+    readonly allowed: ReadonlyMap<string, Action>;
+    readonly policyRevision: number;
+}
+export declare enum RouteActionPolicyErrorCode {
+    CrossOrg = "ROUTE_ACTION_POLICY_CROSS_ORG",
+    CrossProject = "ROUTE_ACTION_POLICY_CROSS_PROJECT",
+    Stale = "ROUTE_ACTION_POLICY_STALE",
+    RequestRejected = "ROUTE_ACTION_POLICY_REQUEST_REJECTED",
+    Unavailable = "ROUTE_ACTION_POLICY_UNAVAILABLE"
+}
+export declare class XemaRouteActionEvaluator {
+    private readonly decisions;
+    private readonly grantVersions;
+    constructor(decisions: XemaPolicyDecisions, grantVersions: AuthorizationGrantVersionReader);
+    evaluate<Action extends string>(context: RequestContext, scope: RouteActionScope, candidates: readonly RouteActionCandidate<Action>[]): Promise<RouteActionEvaluation<Action>>;
+}
+//# sourceMappingURL=route-action-evaluator.d.ts.map

package/dist/route-action-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.d.ts","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA8B,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D,MAAM,WAAW,oBAAoB,CAAC,MAAM,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAGD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAEhF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM;IAE1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,kCAAkC;IAC1C,YAAY,sCAAsC;IAClD,KAAK,8BAA8B;IACnC,eAAe,yCAAyC;IACxD,WAAW,oCAAoC;CAChD;AA6BD,qBACa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,SAAS,EAAE,mBAAmB,EAE9B,aAAa,EAAE,+BAA+B;IAGpD,QAAQ,CAAC,MAAM,SAAS,MAAM,EACzC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,SAAS,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAClD,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;CAsD1C"}

package/dist/route-action-evaluator.js

@@ -0,0 +1,146 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XemaRouteActionEvaluator = exports.RouteActionPolicyErrorCode = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const execution_context_1 = require("@xemahq/contracts/execution-context");
+const execution_environment_1 = require("@xemahq/contracts/execution-environment");
+const policy_1 = require("@xemahq/contracts/policy");
+const space_1 = require("@xemahq/contracts/space");
+const authzen_transport_1 = require("./authzen.transport");
+const grant_version_reader_1 = require("./grant-version.reader");
+const policy_decisions_1 = require("./policy-decisions");
+const relayable_caller_1 = require("./relayable-caller");
+var RouteActionPolicyErrorCode;
+(function (RouteActionPolicyErrorCode) {
+    RouteActionPolicyErrorCode["CrossOrg"] = "ROUTE_ACTION_POLICY_CROSS_ORG";
+    RouteActionPolicyErrorCode["CrossProject"] = "ROUTE_ACTION_POLICY_CROSS_PROJECT";
+    RouteActionPolicyErrorCode["Stale"] = "ROUTE_ACTION_POLICY_STALE";
+    RouteActionPolicyErrorCode["RequestRejected"] = "ROUTE_ACTION_POLICY_REQUEST_REJECTED";
+    RouteActionPolicyErrorCode["Unavailable"] = "ROUTE_ACTION_POLICY_UNAVAILABLE";
+})(RouteActionPolicyErrorCode || (exports.RouteActionPolicyErrorCode = RouteActionPolicyErrorCode = {}));
+class PolicyRevisionChangedError extends Error {
+    constructor(before, after) {
+        super(`Authorization policy revision changed from ${before} to ${after}.`);
+        this.name = PolicyRevisionChangedError.name;
+    }
+}
+let XemaRouteActionEvaluator = class XemaRouteActionEvaluator {
+    decisions;
+    grantVersions;
+    constructor(decisions, grantVersions) {
+        this.decisions = decisions;
+        this.grantVersions = grantVersions;
+    }
+    async evaluate(context, scope, candidates) {
+        assertScope(context, scope);
+        assertUniqueKeys(candidates);
+        try {
+            const revisionBefore = await this.grantVersions.read(scope.orgId);
+            if (candidates.length === 0) {
+                return { allowed: new Map(), policyRevision: revisionBefore };
+            }
+            const forwardedCaller = (0, relayable_caller_1.relayableCallerContext)(context, scope.orgId);
+            const decisions = await this.decisions.decideAll(candidates.map((candidate) => toPolicyRequest(context, scope, candidate)), forwardedCaller === undefined ? undefined : { forwardedCaller });
+            const revisionAfter = await this.grantVersions.read(scope.orgId);
+            if (revisionAfter !== revisionBefore) {
+                throw new PolicyRevisionChangedError(revisionBefore, revisionAfter);
+            }
+            const allowed = new Map();
+            decisions.forEach((decision, index) => {
+                const candidate = candidates[index];
+                if (decision.kind === policy_1.PolicyDecisionKind.Allow && candidate !== undefined) {
+                    allowed.set(candidate.key, candidate.action);
+                }
+            });
+            return { allowed, policyRevision: revisionAfter };
+        }
+        catch (error) {
+            if (error instanceof PolicyRevisionChangedError) {
+                throw new common_1.ServiceUnavailableException({
+                    code: RouteActionPolicyErrorCode.Stale,
+                    message: 'Authorization policy changed during action evaluation; refresh and retry.',
+                });
+            }
+            const status = error instanceof policy_decisions_1.PolicyDecisionRequestError || error instanceof authzen_transport_1.AuthzenPdpError
+                ? error.status
+                : undefined;
+            if (status !== undefined && status >= 400 && status < 500 && status !== 408 && status !== 429) {
+                throw new common_1.InternalServerErrorException({
+                    code: RouteActionPolicyErrorCode.RequestRejected,
+                    message: `Authorization policy refused this service's evaluation request (HTTP ${status}); ` +
+                        `actions are denied fail-closed. This is a defect in the calling service, not a policy-plane outage: ` +
+                        error.message,
+                });
+            }
+            throw new common_1.ServiceUnavailableException({
+                code: RouteActionPolicyErrorCode.Unavailable,
+                message: 'Authorization policy is unavailable; actions are denied fail-closed.',
+            });
+        }
+    }
+};
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator;
+exports.XemaRouteActionEvaluator = XemaRouteActionEvaluator = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(grant_version_reader_1.AUTHORIZATION_GRANT_VERSION_READER)),
+    __metadata("design:paramtypes", [policy_decisions_1.XemaPolicyDecisions, Object])
+], XemaRouteActionEvaluator);
+function assertScope(context, scope) {
+    if (scope.orgId !== context.orgId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossOrg,
+            message: 'The action resource does not belong to the active organization.',
+        });
+    }
+    if (scope.kind === 'project' && context.projectId !== scope.projectId) {
+        throw new common_1.ForbiddenException({
+            code: RouteActionPolicyErrorCode.CrossProject,
+            message: 'The action resource does not belong to the active project.',
+        });
+    }
+}
+function assertUniqueKeys(candidates) {
+    const keys = new Set();
+    for (const candidate of candidates) {
+        if (candidate.key.length === 0 || keys.has(candidate.key)) {
+            throw new Error('Route action candidates require unique non-empty keys.');
+        }
+        keys.add(candidate.key);
+    }
+}
+function toPolicyRequest(context, scope, candidate) {
+    const environment = scope.kind === 'platform'
+        ? execution_environment_1.ExecutionEnvironmentKind.System
+        : scope.kind === 'project'
+            ? execution_environment_1.ExecutionEnvironmentKind.Project
+            : execution_environment_1.ExecutionEnvironmentKind.Org;
+    return {
+        id: (0, node_crypto_1.randomUUID)(),
+        requestId: context.correlationId,
+        traceId: context.correlationId,
+        subject: { kind: context.subject.kind, id: context.subject.id },
+        caller: { kind: execution_context_1.CallerKind.Web },
+        space: scope.kind === 'platform'
+            ? { tier: space_1.SpaceKind.System, orgId: scope.orgId }
+            : scope.kind === 'project'
+                ? { tier: space_1.SpaceKind.Project, orgId: scope.orgId, projectId: scope.projectId }
+                : { tier: space_1.SpaceKind.Org, orgId: scope.orgId },
+        environment: { id: (0, execution_environment_1.formatEnvironmentRef)(environment), kind: environment },
+        capability: { ref: candidate.capabilityRef },
+        ...(context.delegation === undefined ? {} : { delegation: context.delegation }),
+    };
+}
+//# sourceMappingURL=route-action-evaluator.js.map

package/dist/route-action-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-action-evaluator.js","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAyC;AAEzC,2CAMwB;AAExB,2EAAiE;AACjE,mFAGiD;AACjD,qDAAkF;AAClF,mDAAoD;AAEpD,2DAAsD;AACtD,iEAGgC;AAChC,yDAAqF;AACrF,yDAA4D;AA0B5D,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,wEAA0C,CAAA;IAC1C,gFAAkD,CAAA;IAClD,iEAAmC,CAAA;IACnC,sFAAwD,CAAA;IACxD,6EAA+C,CAAA;AACjD,CAAC,EANW,0BAA0B,0CAA1B,0BAA0B,QAMrC;AAED,MAAM,0BAA2B,SAAQ,KAAK;IAC5C,YAAmB,MAAc,EAAE,KAAa;QAC9C,KAAK,CAAC,8CAA8C,MAAM,OAAO,KAAK,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC;IAC9C,CAAC;CACF;AAuBM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAEhB;IAEA;IAHnB,YACmB,SAA8B,EAE9B,aAA8C;QAF9C,cAAS,GAAT,SAAS,CAAqB;QAE9B,kBAAa,GAAb,aAAa,CAAiC;IAC9D,CAAC;IAEG,KAAK,CAAC,QAAQ,CACnB,OAAuB,EACvB,KAAuB,EACvB,UAAmD;QAEnD,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,yCAAsB,EAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,EACzE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAChE,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAAkB,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC1E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,IAAI,oCAA2B,CAAC;oBACpC,IAAI,EAAE,0BAA0B,CAAC,KAAK;oBACtC,OAAO,EAAE,2EAA2E;iBACrF,CAAC,CAAC;YACL,CAAC;YAID,MAAM,MAAM,GACV,KAAK,YAAY,6CAA0B,IAAI,KAAK,YAAY,mCAAe;gBAC7E,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9F,MAAM,IAAI,qCAA4B,CAAC;oBACrC,IAAI,EAAE,0BAA0B,CAAC,eAAe;oBAChD,OAAO,EACL,wEAAwE,MAAM,KAAK;wBACnF,sGAAsG;wBACrG,KAAe,CAAC,OAAO;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oCAA2B,CAAC;gBACpC,IAAI,EAAE,0BAA0B,CAAC,WAAW;gBAC5C,OAAO,EAAE,sEAAsE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,eAAM,EAAC,yDAAkC,CAAC,CAAA;qCADf,sCAAmB;GAFtC,wBAAwB,CAiEpC;AAED,SAAS,WAAW,CAAC,OAAuB,EAAE,KAAuB;IACnE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,QAAQ;YACzC,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B,CAAC,YAAY;YAC7C,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAmD;IAEnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAAuB,EACvB,KAAuB,EACvB,SAAuC;IAEvC,MAAM,WAAW,GACf,KAAK,CAAC,IAAI,KAAK,UAAU;QACvB,CAAC,CAAC,gDAAwB,CAAC,MAAM;QACjC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,gDAAwB,CAAC,OAAO;YAClC,CAAC,CAAC,gDAAwB,CAAC,GAAG,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,IAAA,wBAAU,GAAE;QAChB,SAAS,EAAE,OAAO,CAAC,aAAa;QAChC,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,8BAAU,CAAC,GAAG,EAAE;QAChC,KAAK,EACH,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QACnD,WAAW,EAAE,EAAE,EAAE,EAAE,IAAA,4CAAoB,EAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;QACzE,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE;QAC5C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-nest",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -26,8 +26,8 @@
     "@nestjs/testing": "11.1.18",
     "@xemahq/contracts": ">=0.50.0",
     "@xemahq/eslint-config": "^0.5.0",
-    "@xemahq/identity-client": "^0.15.5",
-    "@xemahq/platform-common": "^0.59.0",
+    "@xemahq/identity-client": "^0.16.0",
+    "@xemahq/platform-common": "^0.60.0",
     "@xemahq/service-registry-nest": "^0.19.0",
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",