@xemahq/authorization-nest 0.8.0 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/dist/authorization.module.d.ts.map +1 -1
  2. package/dist/authorization.module.js +3 -0
  3. package/dist/authorization.module.js.map +1 -1
  4. package/dist/authzen.transport.d.ts +4 -0
  5. package/dist/authzen.transport.d.ts.map +1 -1
  6. package/dist/authzen.transport.js +20 -11
  7. package/dist/authzen.transport.js.map +1 -1
  8. package/dist/durable-delegation/holder-client.d.ts +2 -2
  9. package/dist/durable-delegation/holder-client.d.ts.map +1 -1
  10. package/dist/durable-delegation/holder-client.js +21 -22
  11. package/dist/durable-delegation/holder-client.js.map +1 -1
  12. package/dist/durable-delegation/holder-lifecycle.d.ts +3 -1
  13. package/dist/durable-delegation/holder-lifecycle.d.ts.map +1 -1
  14. package/dist/durable-delegation/holder-lifecycle.js +10 -2
  15. package/dist/durable-delegation/holder-lifecycle.js.map +1 -1
  16. package/dist/durable-delegation/router-replay.d.ts +21 -0
  17. package/dist/durable-delegation/router-replay.d.ts.map +1 -0
  18. package/dist/durable-delegation/router-replay.js +27 -0
  19. package/dist/durable-delegation/router-replay.js.map +1 -0
  20. package/dist/ephemeral-delegation/ephemeral-delegation.d.ts +10 -5
  21. package/dist/ephemeral-delegation/ephemeral-delegation.d.ts.map +1 -1
  22. package/dist/ephemeral-delegation/ephemeral-delegation.js +11 -3
  23. package/dist/ephemeral-delegation/ephemeral-delegation.js.map +1 -1
  24. package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts +5 -0
  25. package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts.map +1 -0
  26. package/dist/ephemeral-delegation/held-ephemeral-delegation.js +17 -0
  27. package/dist/ephemeral-delegation/held-ephemeral-delegation.js.map +1 -0
  28. package/dist/ephemeral-delegation/issued-ref.d.ts +9 -0
  29. package/dist/ephemeral-delegation/issued-ref.d.ts.map +1 -0
  30. package/dist/ephemeral-delegation/issued-ref.js +14 -0
  31. package/dist/ephemeral-delegation/issued-ref.js.map +1 -0
  32. package/dist/grant-version.reader.d.ts +1 -0
  33. package/dist/grant-version.reader.d.ts.map +1 -1
  34. package/dist/grant-version.reader.js +8 -6
  35. package/dist/grant-version.reader.js.map +1 -1
  36. package/dist/index.d.ts +5 -0
  37. package/dist/index.d.ts.map +1 -1
  38. package/dist/index.js +5 -0
  39. package/dist/index.js.map +1 -1
  40. package/dist/installed-workload-grant-operations.d.ts +3 -0
  41. package/dist/installed-workload-grant-operations.d.ts.map +1 -0
  42. package/dist/installed-workload-grant-operations.js +7 -0
  43. package/dist/installed-workload-grant-operations.js.map +1 -0
  44. package/dist/installed-workload-grant-wire.d.ts +66 -0
  45. package/dist/installed-workload-grant-wire.d.ts.map +1 -0
  46. package/dist/installed-workload-grant-wire.js +49 -0
  47. package/dist/installed-workload-grant-wire.js.map +1 -0
  48. package/dist/installed-workload-grant.resolver.d.ts +20 -0
  49. package/dist/installed-workload-grant.resolver.d.ts.map +1 -0
  50. package/dist/installed-workload-grant.resolver.js +111 -0
  51. package/dist/installed-workload-grant.resolver.js.map +1 -0
  52. package/dist/organization-delegation-admission.d.ts +1 -0
  53. package/dist/organization-delegation-admission.d.ts.map +1 -1
  54. package/dist/organization-delegation-admission.js +8 -0
  55. package/dist/organization-delegation-admission.js.map +1 -1
  56. package/package.json +7 -7
package/dist/ephemeral-delegation/ephemeral-delegation.js CHANGED
@@ -5,7 +5,9 @@ exports.createEphemeralDelegation = createEphemeralDelegation;
5
5
  exports.createEphemeralSubDelegation = createEphemeralSubDelegation;
6
6
  exports.mintEphemeralDelegatedToken = mintEphemeralDelegatedToken;
7
7
  exports.revokeEphemeralDelegation = revokeEphemeralDelegation;
8
+ const caller_context_1 = require("@xemahq/contracts/caller-context");
8
9
  const identity_client_1 = require("@xemahq/identity-client");
10
+ const issued_ref_1 = require("./issued-ref");
9
11
  exports.EPHEMERAL_DELEGATION_MAX_LIFETIME_MS = 10 * 60 * 1000;
10
12
  var EphemeralDelegationOperation;
11
13
  (function (EphemeralDelegationOperation) {
@@ -21,6 +23,8 @@ var EphemeralDelegationRefusal;
21
23
  EphemeralDelegationRefusal["ScopeRequired"] = "scope-required";
22
24
  EphemeralDelegationRefusal["Renewable"] = "renewable";
23
25
  EphemeralDelegationRefusal["LifetimeExceeded"] = "lifetime-exceeded";
26
+ EphemeralDelegationRefusal["NotIssued"] = "not-issued";
27
+ EphemeralDelegationRefusal["AudienceRequired"] = "audience-required";
24
28
  })(EphemeralDelegationRefusal || (exports.EphemeralDelegationRefusal = EphemeralDelegationRefusal = {}));
25
29
  class EphemeralDelegationError extends Error {
26
30
  operation;
@@ -89,11 +93,15 @@ async function createEphemeralSubDelegation(client, input, now = new Date()) {
89
93
  ...(parent.realm === undefined ? {} : { realm: parent.realm }),
90
94
  });
91
95
  }
92
- async function mintEphemeralDelegatedToken(client, ref, options = {}) {
96
+ async function mintEphemeralDelegatedToken(client, ref, options) {
97
+ const audience = options?.audience;
98
+ if (!(0, caller_context_1.isReceiverAudience)(audience)) {
99
+ throw new EphemeralDelegationError(EphemeralDelegationOperation.Mint, ref.organizationId, `A context from ephemeral delegation '${ref.delegationId}' must name the one receiver audience it is for.`, EphemeralDelegationRefusal.AudienceRequired);
100
+ }
93
101
  try {
94
102
  return await client.mintDelegatedContext({
95
103
  delegationId: ref.delegationId,
96
- ...(options.audience === undefined ? {} : { audience: options.audience }),
104
+ audience,
97
105
  ...(ref.realm === undefined ? {} : { realm: ref.realm }),
98
106
  });
99
107
  }
@@ -139,7 +147,7 @@ async function created(client, organizationId, realm, request) {
139
147
  if (record.organizationId !== organizationId) {
140
148
  throw new EphemeralDelegationError(EphemeralDelegationOperation.Create, organizationId, `The boundary returned a delegation for '${String(record.organizationId)}', not '${organizationId}'.`);
141
149
  }
142
- return { delegationId: record.id, organizationId, ...(realm === undefined ? {} : { realm }) };
150
+ return (0, issued_ref_1.markIssued)({ delegationId: record.id, organizationId, ...(realm === undefined ? {} : { realm }) });
143
151
  }
144
152
  function refused(organizationId, refusal, message) {
145
153
  return new EphemeralDelegationError(EphemeralDelegationOperation.Create, organizationId, message, refusal);
package/dist/ephemeral-delegation/ephemeral-delegation.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/ephemeral-delegation.ts"],"names":[],"mappings":";;;AA2JA,8DA6BC;AAOD,oEAmCC;AAGD,kEAoBC;AAGD,8DAeC;AAtPD,6DAA0E;AAY7D,QAAA,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4BnE,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAJW,4BAA4B,4CAA5B,4BAA4B,QAIvC;AAGD,IAAY,0BAaX;AAbD,WAAY,0BAA0B;IAEpC,uDAAyB,CAAA;IAEzB,4DAA8B,CAAA;IAE9B,6EAA+C,CAAA;IAE/C,8DAAgC,CAAA;IAEhC,qDAAuB,CAAA;IAEvB,oEAAsC,CAAA;AACxC,CAAC,EAbW,0BAA0B,0CAA1B,0BAA0B,QAarC;AAWD,MAAa,wBAAyB,SAAQ,KAAK;IAI/B;IACA;IAEA;IANF,SAAS,CAAU;IAEnC,YACkB,SAAuC,EACvC,cAAsB,EACtC,OAAe,EACC,OAAoC,EACpD,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QANR,cAAS,GAAT,SAAS,CAA8B;QACvC,mBAAc,GAAd,cAAc,CAAQ;QAEtB,YAAO,GAAP,OAAO,CAA6B;QAIpD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;QAC7B,IAAI,CAAC,SAAS;YACZ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,kCAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,CAAC;IAGD,IAAW,YAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,YAAY,kCAAgB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,CAAC;CACF;AAtBD,4DAsBC;AAyCM,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,KAAqC,EACrC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,cAAc,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE;QAClD,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,SAAS,EAAE,+BAAa,CAAC,YAAY;QACrC,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAChG,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,4BAA4B,CAChD,MAAiC,EACjC,KAAwC,EACxC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,cAAc,KAAK,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,aAAa,EACxC,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE;QACnD,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;QACvC,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,2BAA2B,CAC/C,MAA+D,EAC/D,GAA2B,EAC3B,UAA0C,EAAE;IAE5C,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC;YACvC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,mEAAmE,GAAG,CAAC,YAAY,IAAI,EACvF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,yBAAyB,CAC7C,MAA2D,EAC3D,GAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,GAAG,CAAC,cAAc,EAClB,yBAAyB,GAAG,CAAC,YAAY,yBAAyB,EAClE,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,cAAsB,EACtB,KAIC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,SAAS,EACpC,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,oBAAoB,EAC/C,oDAAoD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,SAAS,aAAa,CAAC,cAAsB,EAAE,SAAe,EAAE,GAAS;IACvE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,4CAAoC,EAAE,CAAC;QACzG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,gBAAgB,EAC3C,4DAA4D,4CAAoC,GAAG,MAAM,8CAA8C,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAAiC,EACjC,cAAsB,EACtB,KAAyB,EACzB,OAAgC;IAEhC,IAAI,MAA+D,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,8DAA8D,cAAc,IAAI,EAChF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAE7C,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,2CAA2C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,cAAc,IAAI,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,OAAO,CACd,cAAsB,EACtB,OAAmC,EACnC,OAAe;IAEf,OAAO,IAAI,wBAAwB,CAAC,4BAA4B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7G,CAAC"}
1
+ {"version":3,"file":"ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/ephemeral-delegation.ts"],"names":[],"mappings":";;;AAoKA,8DA6BC;AAOD,oEAmCC;AAOD,kEA+BC;AAGD,8DAeC;AA9QD,qEAA6F;AAC7F,6DAA0E;AAE1E,6CAA6E;AAYhE,QAAA,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA8BnE,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAJW,4BAA4B,4CAA5B,4BAA4B,QAIvC;AAGD,IAAY,0BAiBX;AAjBD,WAAY,0BAA0B;IAEpC,uDAAyB,CAAA;IAEzB,4DAA8B,CAAA;IAE9B,6EAA+C,CAAA;IAE/C,8DAAgC,CAAA;IAEhC,qDAAuB,CAAA;IAEvB,oEAAsC,CAAA;IAEtC,sDAAwB,CAAA;IAExB,oEAAsC,CAAA;AACxC,CAAC,EAjBW,0BAA0B,0CAA1B,0BAA0B,QAiBrC;AAWD,MAAa,wBAAyB,SAAQ,KAAK;IAI/B;IACA;IAEA;IANF,SAAS,CAAU;IAEnC,YACkB,SAAuC,EACvC,cAAsB,EACtC,OAAe,EACC,OAAoC,EACpD,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QANR,cAAS,GAAT,SAAS,CAA8B;QACvC,mBAAc,GAAd,cAAc,CAAQ;QAEtB,YAAO,GAAP,OAAO,CAA6B;QAIpD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;QAC7B,IAAI,CAAC,SAAS;YACZ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,kCAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,CAAC;IAGD,IAAW,YAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,YAAY,kCAAgB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,CAAC;CACF;AAtBD,4DAsBC;AAyCM,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,KAAqC,EACrC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,cAAc,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE;QAClD,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,SAAS,EAAE,+BAAa,CAAC,YAAY;QACrC,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAChG,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,4BAA4B,CAChD,MAAiC,EACjC,KAAwC,EACxC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,cAAc,KAAK,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,aAAa,EACxC,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE;QACnD,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;QACvC,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,2BAA2B,CAC/C,MAA+D,EAC/D,GAA2B,EAC3B,OAAgD;IAIhD,MAAM,QAAQ,GAAa,OAAuD,EAAE,QAAQ,CAAC;IAC7F,IAAI,CAAC,IAAA,mCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,wCAAwC,GAAG,CAAC,YAAY,kDAAkD,EAC1G,0BAA0B,CAAC,gBAAgB,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC;YACvC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,mEAAmE,GAAG,CAAC,YAAY,IAAI,EACvF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,yBAAyB,CAC7C,MAA2D,EAC3D,GAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,GAAG,CAAC,cAAc,EAClB,yBAAyB,GAAG,CAAC,YAAY,yBAAyB,EAClE,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,cAAsB,EACtB,KAIC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,SAAS,EACpC,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,oBAAoB,EAC/C,oDAAoD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,SAAS,aAAa,CAAC,cAAsB,EAAE,SAAe,EAAE,GAAS;IACvE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,4CAAoC,EAAE,CAAC;QACzG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,gBAAgB,EAC3C,4DAA4D,4CAAoC,GAAG,MAAM,8CAA8C,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAAiC,EACjC,cAAsB,EACtB,KAAyB,EACzB,OAAgC;IAEhC,IAAI,MAA+D,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,8DAA8D,cAAc,IAAI,EAChF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAE7C,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,2CAA2C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,cAAc,IAAI,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,uBAAU,EAAC,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,OAAO,CACd,cAAsB,EACtB,OAAmC,EACnC,OAAe;IAEf,OAAO,IAAI,wBAAwB,CAAC,4BAA4B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7G,CAAC"}
package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts ADDED
@@ -0,0 +1,5 @@
1
+ import { type HeldEphemeralDelegation } from '@xemahq/xema-service-nest';
2
+ import { type IssuedEphemeralDelegationRef } from './issued-ref';
3
+ import type { EphemeralDelegationClient } from './ephemeral-delegation';
4
+ export declare function heldEphemeralDelegation(minter: Pick<EphemeralDelegationClient, 'mintDelegatedContext'>, ref: IssuedEphemeralDelegationRef): HeldEphemeralDelegation;
5
+ //# sourceMappingURL=held-ephemeral-delegation.d.ts.map
package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"held-ephemeral-delegation.d.ts","sourceRoot":"","sources":["../../src/ephemeral-delegation/held-ephemeral-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAQ1G,OAAO,EAAY,KAAK,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAYxE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,EAC/D,GAAG,EAAE,4BAA4B,GAChC,uBAAuB,CAczB"}
package/dist/ephemeral-delegation/held-ephemeral-delegation.js ADDED
@@ -0,0 +1,17 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.heldEphemeralDelegation = heldEphemeralDelegation;
4
+ const xema_service_nest_1 = require("@xemahq/xema-service-nest");
5
+ const ephemeral_delegation_1 = require("./ephemeral-delegation");
6
+ const issued_ref_1 = require("./issued-ref");
7
+ function heldEphemeralDelegation(minter, ref) {
8
+ if (!(0, issued_ref_1.isIssued)(ref)) {
9
+ throw new ephemeral_delegation_1.EphemeralDelegationError(ephemeral_delegation_1.EphemeralDelegationOperation.Mint, ref.organizationId, 'A held ephemeral delegation is produced only from the ref the create call returned in this process.', ephemeral_delegation_1.EphemeralDelegationRefusal.NotIssued);
10
+ }
11
+ return {
12
+ brand: xema_service_nest_1.HELD_EPHEMERAL_DELEGATION_BRAND,
13
+ organizationId: ref.organizationId,
14
+ mintDelegatedContext: ({ audience }) => (0, ephemeral_delegation_1.mintEphemeralDelegatedToken)(minter, ref, { audience }),
15
+ };
16
+ }
17
+ //# sourceMappingURL=held-ephemeral-delegation.js.map
package/dist/ephemeral-delegation/held-ephemeral-delegation.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"held-ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/held-ephemeral-delegation.ts"],"names":[],"mappings":";;AAsBA,0DAiBC;AAvCD,iEAA0G;AAE1G,iEAKgC;AAChC,6CAA2E;AAc3E,SAAgB,uBAAuB,CACrC,MAA+D,EAC/D,GAAiC;IAEjC,IAAI,CAAC,IAAA,qBAAQ,EAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,+CAAwB,CAChC,mDAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,qGAAqG,EACrG,iDAA0B,CAAC,SAAS,CACrC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,mDAA+B;QACtC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAA,kDAA2B,EAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC"}
package/dist/ephemeral-delegation/issued-ref.d.ts ADDED
@@ -0,0 +1,9 @@
1
+ import type { EphemeralDelegationRef } from './ephemeral-delegation';
2
+ declare const ISSUED_BY_AUTHORIZATION_API: unique symbol;
3
+ export interface IssuedEphemeralDelegationRef extends EphemeralDelegationRef {
4
+ readonly [ISSUED_BY_AUTHORIZATION_API]: true;
5
+ }
6
+ export declare function markIssued(ref: EphemeralDelegationRef): IssuedEphemeralDelegationRef;
7
+ export declare function isIssued(ref: EphemeralDelegationRef): boolean;
8
+ export {};
9
+ //# sourceMappingURL=issued-ref.d.ts.map
package/dist/ephemeral-delegation/issued-ref.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"issued-ref.d.ts","sourceRoot":"","sources":["../../src/ephemeral-delegation/issued-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,CAAC,MAAM,2BAA2B,EAAE,OAAO,MAAM,CAAC;AASzD,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC;CAC9C;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,sBAAsB,GAAG,4BAA4B,CAIpF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAE7D"}
package/dist/ephemeral-delegation/issued-ref.js ADDED
@@ -0,0 +1,14 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.markIssued = markIssued;
4
+ exports.isIssued = isIssued;
5
+ const issued = new WeakSet();
6
+ function markIssued(ref) {
7
+ const frozen = Object.freeze({ ...ref });
8
+ issued.add(frozen);
9
+ return frozen;
10
+ }
11
+ function isIssued(ref) {
12
+ return issued.has(ref);
13
+ }
14
+ //# sourceMappingURL=issued-ref.js.map
package/dist/ephemeral-delegation/issued-ref.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"issued-ref.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/issued-ref.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAED,4BAEC;AAXD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AAGrC,SAAgB,UAAU,CAAC,GAA2B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED,SAAgB,QAAQ,CAAC,GAA2B;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}
package/dist/grant-version.reader.d.ts CHANGED
@@ -11,6 +11,7 @@ export declare class HttpAuthorizationGrantVersionReader implements Authorizatio
11
11
  private readonly identityBootstrap;
12
12
  private readonly options;
13
13
  constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
14
+ private readonly own;
14
15
  read(orgId: string, forwardedCaller?: ForwardedCallerContext): Promise<number>;
15
16
  }
16
17
  export declare function assertGrantVersion(orgId: string, body: {
package/dist/grant-version.reader.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAMnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAajC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,IAAI,CACf,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,sBAAsB,GACvC,OAAO,CAAC,MAAM,CAAC;CA+BnB;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}
1
+ {"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAWnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAcjC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAKpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuC;IAE9C,IAAI,CACf,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,sBAAsB,GACvC,OAAO,CAAC,MAAM,CAAC;CAmCnB;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}
package/dist/grant-version.reader.js CHANGED
@@ -15,11 +15,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
15
15
  exports.HttpAuthorizationGrantVersionReader = exports.AUTHORIZATION_GRANT_VERSION_READER = void 0;
16
16
  exports.assertGrantVersion = assertGrantVersion;
17
17
  const common_1 = require("@nestjs/common");
18
- const caller_context_1 = require("@xemahq/contracts/caller-context");
19
18
  const http_1 = require("@xemahq/contracts/http");
20
19
  const service_registry_1 = require("@xemahq/contracts/service-registry");
21
20
  const identity_client_1 = require("@xemahq/identity-client");
22
21
  const service_registry_nest_1 = require("@xemahq/service-registry-nest");
22
+ const xema_service_nest_1 = require("@xemahq/xema-service-nest");
23
23
  const authorization_options_1 = require("./authorization.options");
24
24
  const authzen_transport_1 = require("./authzen.transport");
25
25
  exports.AUTHORIZATION_GRANT_VERSION_READER = Symbol('AUTHORIZATION_GRANT_VERSION_READER');
@@ -32,21 +32,23 @@ let HttpAuthorizationGrantVersionReader = class HttpAuthorizationGrantVersionRea
32
32
  this.registry = registry;
33
33
  this.identityBootstrap = identityBootstrap;
34
34
  this.options = options;
35
+ this.own = (0, xema_service_nest_1.ownTokenSourceFor)(this.identityBootstrap);
35
36
  }
37
+ own;
36
38
  async read(orgId, forwardedCaller) {
37
39
  const path = `${GRANT_VERSION_PATH}${encodeURIComponent(orgId)}`;
38
40
  if (forwardedCaller === undefined) {
39
41
  throw new authzen_transport_1.AuthzenCallerContextRequiredError(path);
40
42
  }
43
+ if (forwardedCaller.orgId !== orgId) {
44
+ throw new authzen_transport_1.AuthzenCallerOrgMismatchError(path);
45
+ }
41
46
  const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
42
- const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, {
47
+ const init = await (0, xema_service_nest_1.peerCallInit)((0, xema_service_nest_1.peerAuthorityForCaller)(forwardedCaller, this.own), service_registry_1.ServiceName.AUTHORIZATION_API, {
43
48
  method: 'GET',
44
- headers: {
45
- ...(await (0, caller_context_1.forwardedCallerHeaders)(forwardedCaller, this.identityBootstrap)),
46
- 'X-Xema-Org-Id': orgId,
47
- },
48
49
  signal: AbortSignal.timeout(this.options.requestTimeoutMs),
49
50
  });
51
+ const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, init);
50
52
  if (!response.ok) {
51
53
  const text = await response.text();
52
54
  throw new authzen_transport_1.AuthzenPdpError(`authorization-api GET ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, undefined);
package/dist/grant-version.reader.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA4FA,gDAgBC;AA5GD,2CAAoD;AACpD,qEAG0C;AAC1C,iDAAwE;AACxE,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AAEvC,mEAGiC;AACjC,2DAG6B;AAahB,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,IAAI,CACf,KAAa,EACb,eAAwC;QAExC,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,qDAAiC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,GAAG,CAAC,MAAM,IAAA,uCAAsB,EAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,eAAe,EAAE,KAAK;aACvB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,qCAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AA7CY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CA6C/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
1
+ {"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAuGA,gDAgBC;AAvHD,2CAAoD;AAEpD,iDAAwE;AACxE,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AACvC,iEAImC;AAEnC,mEAGiC;AACjC,2DAI6B;AAahB,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;QAElD,IAAI,CAAC,GAAG,GAAG,IAAA,qCAAiB,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAEgB,GAAG,CAAuC;IAEpD,KAAK,CAAC,IAAI,CACf,KAAa,EACb,eAAwC;QAExC,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,qDAAiC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,iDAA6B,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAY,EAC7B,IAAA,0CAAsB,EAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,EACjD,8BAAW,CAAC,iBAAiB,EAC7B;YACE,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,qCAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AArDY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CAqD/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
package/dist/index.d.ts CHANGED
@@ -7,6 +7,9 @@ export * from './subject-from-context';
7
7
  export * from './xema-authz.service';
8
8
  export * from './policy-decisions';
9
9
  export * from './grant-version.reader';
10
+ export * from './installed-workload-grant-operations';
11
+ export * from './installed-workload-grant-wire';
12
+ export * from './installed-workload-grant.resolver';
10
13
  export * from './route-action-evaluator';
11
14
  export * from './internal-caller-or-member-context.guard';
12
15
  export * from './organization-delegation-admission';
@@ -18,5 +21,7 @@ export * from './durable-delegation/decision-codes';
18
21
  export * from './durable-delegation/holder-client';
19
22
  export * from './durable-delegation/holder-errors';
20
23
  export * from './durable-delegation/holder-lifecycle';
24
+ export * from './durable-delegation/router-replay';
21
25
  export * from './ephemeral-delegation/ephemeral-delegation';
26
+ export * from './ephemeral-delegation/held-ephemeral-delegation';
22
27
  //# sourceMappingURL=index.d.ts.map
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC"}
package/dist/index.js CHANGED
@@ -23,6 +23,9 @@ __exportStar(require("./subject-from-context"), exports);
23
23
  __exportStar(require("./xema-authz.service"), exports);
24
24
  __exportStar(require("./policy-decisions"), exports);
25
25
  __exportStar(require("./grant-version.reader"), exports);
26
+ __exportStar(require("./installed-workload-grant-operations"), exports);
27
+ __exportStar(require("./installed-workload-grant-wire"), exports);
28
+ __exportStar(require("./installed-workload-grant.resolver"), exports);
26
29
  __exportStar(require("./route-action-evaluator"), exports);
27
30
  __exportStar(require("./internal-caller-or-member-context.guard"), exports);
28
31
  __exportStar(require("./organization-delegation-admission"), exports);
@@ -34,5 +37,7 @@ __exportStar(require("./durable-delegation/decision-codes"), exports);
34
37
  __exportStar(require("./durable-delegation/holder-client"), exports);
35
38
  __exportStar(require("./durable-delegation/holder-errors"), exports);
36
39
  __exportStar(require("./durable-delegation/holder-lifecycle"), exports);
40
+ __exportStar(require("./durable-delegation/router-replay"), exports);
37
41
  __exportStar(require("./ephemeral-delegation/ephemeral-delegation"), exports);
42
+ __exportStar(require("./ephemeral-delegation/held-ephemeral-delegation"), exports);
38
43
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,8EAA4D"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,wEAAsD;AACtD,kEAAgD;AAChD,sEAAoD;AACpD,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,qEAAmD;AACnD,8EAA4D;AAC5D,mFAAiE"}
package/dist/installed-workload-grant-operations.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ export declare const INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION: string & import("zod").$brand<"OperationId">;
2
+ export declare const INSTALLED_WORKLOAD_GRANT_CHECK_PATH = "/internal/installed-workload-grants/check";
3
+ //# sourceMappingURL=installed-workload-grant-operations.d.ts.map
package/dist/installed-workload-grant-operations.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant-operations.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant-operations.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,wCAAwC,8CAEpD,CAAC;AAGF,eAAO,MAAM,mCAAmC,8CAA8C,CAAC"}
package/dist/installed-workload-grant-operations.js ADDED
@@ -0,0 +1,7 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.INSTALLED_WORKLOAD_GRANT_CHECK_PATH = exports.INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION = void 0;
4
+ const deployment_1 = require("@xemahq/contracts/deployment");
5
+ exports.INSTALLED_WORKLOAD_GRANT_CHECK_OPERATION = deployment_1.OperationIdSchema.parse('authorization:installed-workload-grants.check@1');
6
+ exports.INSTALLED_WORKLOAD_GRANT_CHECK_PATH = '/internal/installed-workload-grants/check';
7
+ //# sourceMappingURL=installed-workload-grant-operations.js.map
package/dist/installed-workload-grant-operations.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant-operations.js","sourceRoot":"","sources":["../src/installed-workload-grant-operations.ts"],"names":[],"mappings":";;;AAAA,6DAAiE;AAQpD,QAAA,wCAAwC,GAAG,8BAAiB,CAAC,KAAK,CAC7E,iDAAiD,CAClD,CAAC;AAGW,QAAA,mCAAmC,GAAG,2CAA2C,CAAC"}
package/dist/installed-workload-grant-wire.d.ts ADDED
@@ -0,0 +1,66 @@
1
+ import { z } from 'zod';
2
+ export declare enum InstalledWorkloadGrantRefusalCode {
3
+ NotGranted = "not-granted",
4
+ Revoked = "revoked",
5
+ TargetOutsideOrg = "target-outside-org",
6
+ OwnerNarrowerThanOrg = "owner-narrower-than-org",
7
+ OwnerNotGrantable = "owner-not-grantable"
8
+ }
9
+ export declare const InstalledWorkloadGrantCheckRequestSchema: z.ZodObject<{
10
+ orgId: z.ZodString;
11
+ workload: z.ZodString;
12
+ operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
13
+ targetSpaceUri: z.ZodOptional<z.ZodString>;
14
+ }, z.core.$strict>;
15
+ export type InstalledWorkloadGrantCheckRequest = z.infer<typeof InstalledWorkloadGrantCheckRequestSchema>;
16
+ export declare const InstalledWorkloadGrantCheckResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
17
+ admitted: z.ZodLiteral<true>;
18
+ installationId: z.ZodString;
19
+ biome: z.ZodString;
20
+ component: z.ZodString;
21
+ receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
22
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
23
+ biome: z.ZodString;
24
+ }, z.core.$strict>, z.ZodObject<{
25
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
26
+ service: z.ZodString;
27
+ }, z.core.$strict>], "kind">;
28
+ ownerSpaceUri: z.ZodString;
29
+ }, z.core.$strict>, z.ZodObject<{
30
+ admitted: z.ZodLiteral<false>;
31
+ code: z.ZodEnum<typeof InstalledWorkloadGrantRefusalCode>;
32
+ }, z.core.$strict>], "admitted">;
33
+ export type InstalledWorkloadGrantCheckResult = z.infer<typeof InstalledWorkloadGrantCheckResultSchema>;
34
+ export declare const HeldInstalledWorkloadGrantSchema: z.ZodObject<{
35
+ installationId: z.ZodString;
36
+ biome: z.ZodString;
37
+ component: z.ZodString;
38
+ operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
39
+ receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
40
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
41
+ biome: z.ZodString;
42
+ }, z.core.$strict>, z.ZodObject<{
43
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
44
+ service: z.ZodString;
45
+ }, z.core.$strict>], "kind">;
46
+ ownerSpaceUri: z.ZodString;
47
+ }, z.core.$strict>;
48
+ export type HeldInstalledWorkloadGrantWire = z.infer<typeof HeldInstalledWorkloadGrantSchema>;
49
+ export declare const ListHeldInstalledWorkloadGrantsResultSchema: z.ZodObject<{
50
+ grants: z.ZodArray<z.ZodObject<{
51
+ installationId: z.ZodString;
52
+ biome: z.ZodString;
53
+ component: z.ZodString;
54
+ operation: z.core.$ZodBranded<z.ZodString, "OperationId", "out">;
55
+ receiver: z.ZodDiscriminatedUnion<[z.ZodObject<{
56
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.Biome>;
57
+ biome: z.ZodString;
58
+ }, z.core.$strict>, z.ZodObject<{
59
+ kind: z.ZodLiteral<import("@xemahq/contracts/deployment").OperationGrantReceiverKind.PlatformService>;
60
+ service: z.ZodString;
61
+ }, z.core.$strict>], "kind">;
62
+ ownerSpaceUri: z.ZodString;
63
+ }, z.core.$strict>>;
64
+ }, z.core.$strict>;
65
+ export type ListHeldInstalledWorkloadGrantsResultWire = z.infer<typeof ListHeldInstalledWorkloadGrantsResultSchema>;
66
+ //# sourceMappingURL=installed-workload-grant-wire.d.ts.map
package/dist/installed-workload-grant-wire.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant-wire.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant-wire.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,oBAAY,iCAAiC;IAE3C,UAAU,gBAAgB;IAE1B,OAAO,YAAY;IAEnB,gBAAgB,uBAAuB;IAEvC,oBAAoB,4BAA4B;IAEhD,iBAAiB,wBAAwB;CAC1C;AAGD,eAAO,MAAM,wCAAwC;;;;;kBAQ1C,CAAC;AACZ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;gCAalD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAGxG,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;kBASlC,CAAC;AACZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAG9F,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;kBAE7C,CAAC;AACZ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}
package/dist/installed-workload-grant-wire.js ADDED
@@ -0,0 +1,49 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.ListHeldInstalledWorkloadGrantsResultSchema = exports.HeldInstalledWorkloadGrantSchema = exports.InstalledWorkloadGrantCheckResultSchema = exports.InstalledWorkloadGrantCheckRequestSchema = exports.InstalledWorkloadGrantRefusalCode = void 0;
4
+ const deployment_1 = require("@xemahq/contracts/deployment");
5
+ const zod_1 = require("zod");
6
+ const OperationGrantReceiverSchema = deployment_1.OperationGrantSchema.shape.receiver;
7
+ var InstalledWorkloadGrantRefusalCode;
8
+ (function (InstalledWorkloadGrantRefusalCode) {
9
+ InstalledWorkloadGrantRefusalCode["NotGranted"] = "not-granted";
10
+ InstalledWorkloadGrantRefusalCode["Revoked"] = "revoked";
11
+ InstalledWorkloadGrantRefusalCode["TargetOutsideOrg"] = "target-outside-org";
12
+ InstalledWorkloadGrantRefusalCode["OwnerNarrowerThanOrg"] = "owner-narrower-than-org";
13
+ InstalledWorkloadGrantRefusalCode["OwnerNotGrantable"] = "owner-not-grantable";
14
+ })(InstalledWorkloadGrantRefusalCode || (exports.InstalledWorkloadGrantRefusalCode = InstalledWorkloadGrantRefusalCode = {}));
15
+ exports.InstalledWorkloadGrantCheckRequestSchema = zod_1.z
16
+ .object({
17
+ orgId: zod_1.z.string().min(1),
18
+ workload: zod_1.z.string().min(1),
19
+ operation: deployment_1.OperationIdSchema,
20
+ targetSpaceUri: zod_1.z.string().min(1).optional(),
21
+ })
22
+ .strict();
23
+ exports.InstalledWorkloadGrantCheckResultSchema = zod_1.z.discriminatedUnion('admitted', [
24
+ zod_1.z
25
+ .object({
26
+ admitted: zod_1.z.literal(true),
27
+ installationId: zod_1.z.string().min(1),
28
+ biome: zod_1.z.string().min(1),
29
+ component: zod_1.z.string().min(1),
30
+ receiver: OperationGrantReceiverSchema,
31
+ ownerSpaceUri: zod_1.z.string().min(1),
32
+ })
33
+ .strict(),
34
+ zod_1.z.object({ admitted: zod_1.z.literal(false), code: zod_1.z.nativeEnum(InstalledWorkloadGrantRefusalCode) }).strict(),
35
+ ]);
36
+ exports.HeldInstalledWorkloadGrantSchema = zod_1.z
37
+ .object({
38
+ installationId: zod_1.z.string().min(1),
39
+ biome: zod_1.z.string().min(1),
40
+ component: zod_1.z.string().min(1),
41
+ operation: deployment_1.OperationIdSchema,
42
+ receiver: OperationGrantReceiverSchema,
43
+ ownerSpaceUri: zod_1.z.string().min(1),
44
+ })
45
+ .strict();
46
+ exports.ListHeldInstalledWorkloadGrantsResultSchema = zod_1.z
47
+ .object({ grants: zod_1.z.array(exports.HeldInstalledWorkloadGrantSchema) })
48
+ .strict();
49
+ //# sourceMappingURL=installed-workload-grant-wire.js.map
package/dist/installed-workload-grant-wire.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant-wire.js","sourceRoot":"","sources":["../src/installed-workload-grant-wire.ts"],"names":[],"mappings":";;;AAAA,6DAAuF;AACvF,6BAAwB;AAGxB,MAAM,4BAA4B,GAAG,iCAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;AAGzE,IAAY,iCAWX;AAXD,WAAY,iCAAiC;IAE3C,+DAA0B,CAAA;IAE1B,wDAAmB,CAAA;IAEnB,4EAAuC,CAAA;IAEvC,qFAAgD,CAAA;IAEhD,8EAAyC,CAAA;AAC3C,CAAC,EAXW,iCAAiC,iDAAjC,iCAAiC,QAW5C;AAGY,QAAA,wCAAwC,GAAG,OAAC;KACtD,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,8BAAiB;IAE5B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAGC,QAAA,uCAAuC,GAAG,OAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,OAAC;SACE,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,4BAA4B;QAEtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzG,CAAC,CAAC;AAIU,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,8BAAiB;IAC5B,QAAQ,EAAE,4BAA4B;IACtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,2CAA2C,GAAG,OAAC;KACzD,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,EAAE,CAAC;KAC7D,MAAM,EAAE,CAAC"}
package/dist/installed-workload-grant.resolver.d.ts ADDED
@@ -0,0 +1,20 @@
1
+ import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
2
+ import { IdentityBootstrapService } from '@xemahq/identity-client';
3
+ import { type WorkloadGrantQuestion, type WorkloadGrantResolver, type WorkloadGrantVerdict } from '@xemahq/platform-common';
4
+ import { type XemaAuthorizationOptions } from './authorization.options';
5
+ export declare enum InstalledWorkloadGrantResolverRefusalCode {
6
+ UnknownKind = "installed-workload-unknown-kind",
7
+ OrgNotNamed = "installed-workload-org-not-named",
8
+ NotAdmitted = "installed-workload-not-admitted",
9
+ OwnerMismatch = "installed-workload-owner-mismatch",
10
+ OwnerNarrowerThanOrg = "installed-workload-owner-narrower-than-org"
11
+ }
12
+ export declare class InstalledWorkloadGrantResolver implements WorkloadGrantResolver {
13
+ private readonly registry;
14
+ private readonly identityBootstrap;
15
+ private readonly options;
16
+ constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
17
+ admitWorkload(question: WorkloadGrantQuestion): Promise<WorkloadGrantVerdict>;
18
+ private check;
19
+ }
20
+ //# sourceMappingURL=installed-workload-grant.resolver.d.ts.map
package/dist/installed-workload-grant.resolver.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant.resolver.d.ts","sourceRoot":"","sources":["../src/installed-workload-grant.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAUjC,oBAAY,yCAAyC;IACnD,WAAW,oCAAoC;IAC/C,WAAW,qCAAqC;IAChD,WAAW,oCAAoC;IAE/C,aAAa,sCAAsC;IAEnD,oBAAoB,+CAA+C;CACpE;AAgBD,qBACa,8BAA+B,YAAW,qBAAqB;IAGxE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAGvC,aAAa,CACxB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC;YA0ClB,KAAK;CAkCpB"}
package/dist/installed-workload-grant.resolver.js ADDED
@@ -0,0 +1,111 @@
1
+ "use strict";
2
+ var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
3
+ var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
4
+ if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
5
+ else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
6
+ return c > 3 && r && Object.defineProperty(target, key, r), r;
7
+ };
8
+ var __metadata = (this && this.__metadata) || function (k, v) {
9
+ if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
10
+ };
11
+ var __param = (this && this.__param) || function (paramIndex, decorator) {
12
+ return function (target, key) { decorator(target, key, paramIndex); }
13
+ };
14
+ Object.defineProperty(exports, "__esModule", { value: true });
15
+ exports.InstalledWorkloadGrantResolver = exports.InstalledWorkloadGrantResolverRefusalCode = void 0;
16
+ const common_1 = require("@nestjs/common");
17
+ const http_1 = require("@xemahq/contracts/http");
18
+ const service_registry_1 = require("@xemahq/contracts/service-registry");
19
+ const space_1 = require("@xemahq/contracts/space");
20
+ const identity_client_1 = require("@xemahq/identity-client");
21
+ const platform_common_1 = require("@xemahq/platform-common");
22
+ const service_registry_nest_1 = require("@xemahq/service-registry-nest");
23
+ const authorization_options_1 = require("./authorization.options");
24
+ const installed_workload_grant_operations_1 = require("./installed-workload-grant-operations");
25
+ const installed_workload_grant_wire_1 = require("./installed-workload-grant-wire");
26
+ const SOURCE = 'installed-workload-grant-resolver';
27
+ var InstalledWorkloadGrantResolverRefusalCode;
28
+ (function (InstalledWorkloadGrantResolverRefusalCode) {
29
+ InstalledWorkloadGrantResolverRefusalCode["UnknownKind"] = "installed-workload-unknown-kind";
30
+ InstalledWorkloadGrantResolverRefusalCode["OrgNotNamed"] = "installed-workload-org-not-named";
31
+ InstalledWorkloadGrantResolverRefusalCode["NotAdmitted"] = "installed-workload-not-admitted";
32
+ InstalledWorkloadGrantResolverRefusalCode["OwnerMismatch"] = "installed-workload-owner-mismatch";
33
+ InstalledWorkloadGrantResolverRefusalCode["OwnerNarrowerThanOrg"] = "installed-workload-owner-narrower-than-org";
34
+ })(InstalledWorkloadGrantResolverRefusalCode || (exports.InstalledWorkloadGrantResolverRefusalCode = InstalledWorkloadGrantResolverRefusalCode = {}));
35
+ let InstalledWorkloadGrantResolver = class InstalledWorkloadGrantResolver {
36
+ registry;
37
+ identityBootstrap;
38
+ options;
39
+ constructor(registry, identityBootstrap, options) {
40
+ this.registry = registry;
41
+ this.identityBootstrap = identityBootstrap;
42
+ this.options = options;
43
+ }
44
+ async admitWorkload(question) {
45
+ if (question.kind !== platform_common_1.INSTALLED_WORKLOAD_GRANT_KIND) {
46
+ return refuse(InstalledWorkloadGrantResolverRefusalCode.UnknownKind, 'This resolver decides only installed workload grants.');
47
+ }
48
+ const { orgId } = question;
49
+ if (orgId === undefined || orgId === '') {
50
+ return refuse(InstalledWorkloadGrantResolverRefusalCode.OrgNotNamed, 'An installed workload grant is decided for a named organization.');
51
+ }
52
+ const check = await this.check({
53
+ orgId,
54
+ workload: question.callerService,
55
+ operation: question.operation,
56
+ ...(question.targetSpace === undefined ? {} : { targetSpaceUri: (0, space_1.formatSpaceRef)(question.targetSpace) }),
57
+ });
58
+ if (!check.admitted) {
59
+ return refuse(InstalledWorkloadGrantResolverRefusalCode.NotAdmitted, `The workload holds no installed grant for the operation (${check.code}).`);
60
+ }
61
+ if (!ownerInOrganization(orgId, check.ownerSpaceUri)) {
62
+ return refuse(InstalledWorkloadGrantResolverRefusalCode.OwnerMismatch, 'The admitting grant is owned by a Space outside the organization the workload was proven for.');
63
+ }
64
+ if (question.targetSpace === undefined && check.ownerSpaceUri !== (0, space_1.formatSpaceRef)({ tier: space_1.SpaceKind.Org, orgId })) {
65
+ return refuse(InstalledWorkloadGrantResolverRefusalCode.OwnerNarrowerThanOrg, 'No target Space was named, and the admitting grant is owned by a Space narrower than the organization.');
66
+ }
67
+ return { admitted: true };
68
+ }
69
+ async check(request) {
70
+ try {
71
+ const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
72
+ const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH}`, {
73
+ method: 'POST',
74
+ headers: {
75
+ Authorization: `Bearer ${await this.identityBootstrap.getAccessToken()}`,
76
+ 'Content-Type': 'application/json',
77
+ 'X-Xema-Org-Id': request.orgId,
78
+ },
79
+ body: JSON.stringify(request),
80
+ signal: AbortSignal.timeout(this.options.requestTimeoutMs),
81
+ });
82
+ if (!response.ok) {
83
+ throw new Error(`authorization-api POST ${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH} failed with HTTP ${response.status}`);
84
+ }
85
+ return installed_workload_grant_wire_1.InstalledWorkloadGrantCheckResultSchema.parse((0, http_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api POST ${installed_workload_grant_operations_1.INSTALLED_WORKLOAD_GRANT_CHECK_PATH}`));
86
+ }
87
+ catch (cause) {
88
+ throw new platform_common_1.WorkloadGrantResolverUnavailableError(SOURCE, cause);
89
+ }
90
+ }
91
+ };
92
+ exports.InstalledWorkloadGrantResolver = InstalledWorkloadGrantResolver;
93
+ exports.InstalledWorkloadGrantResolver = InstalledWorkloadGrantResolver = __decorate([
94
+ (0, common_1.Injectable)(),
95
+ __param(0, (0, common_1.Inject)(service_registry_nest_1.SERVICE_REGISTRY_TOKEN)),
96
+ __param(2, (0, common_1.Inject)(authorization_options_1.XEMA_AUTHORIZATION_OPTIONS)),
97
+ __metadata("design:paramtypes", [Object, identity_client_1.IdentityBootstrapService, Object])
98
+ ], InstalledWorkloadGrantResolver);
99
+ function ownerInOrganization(orgId, ownerSpaceUri) {
100
+ try {
101
+ (0, space_1.parseOwnerSpaceRef)({ fence: space_1.OwnerSpaceFence.Tenant, orgId, space: (0, space_1.parseSpaceRef)(ownerSpaceUri) });
102
+ return true;
103
+ }
104
+ catch {
105
+ return false;
106
+ }
107
+ }
108
+ function refuse(code, message) {
109
+ return { admitted: false, code, message };
110
+ }
111
+ //# sourceMappingURL=installed-workload-grant.resolver.js.map
package/dist/installed-workload-grant.resolver.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"installed-workload-grant.resolver.js","sourceRoot":"","sources":["../src/installed-workload-grant.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,iDAAwE;AACxE,yEAG4C;AAC5C,mDAAwH;AACxH,6DAAmE;AACnE,6DAMiC;AACjC,yEAGuC;AAEvC,mEAGiC;AACjC,+FAA4F;AAC5F,mFAGyC;AAEzC,MAAM,MAAM,GAAG,mCAAmC,CAAC;AAGnD,IAAY,yCAQX;AARD,WAAY,yCAAyC;IACnD,4FAA+C,CAAA;IAC/C,6FAAgD,CAAA;IAChD,4FAA+C,CAAA;IAE/C,gGAAmD,CAAA;IAEnD,gHAAmE,CAAA;AACrE,CAAC,EARW,yCAAyC,yDAAzC,yCAAyC,QAQpD;AAiBM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAGtB;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,KAAK,CAAC,aAAa,CACxB,QAA+B;QAE/B,IAAI,QAAQ,CAAC,IAAI,KAAK,+CAA6B,EAAE,CAAC;YACpD,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAC7B,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,aAAa;YAChC,SAAS,EAAE,QAAQ,CAAC,SAA4D;YAEhF,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,sBAAc,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,MAAM,CACX,yCAAyC,CAAC,WAAW,EACrD,4DAA4D,KAAK,CAAC,IAAI,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,MAAM,CACX,yCAAyC,CAAC,aAAa,EACvD,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,IAAA,sBAAc,EAAC,EAAE,IAAI,EAAE,iBAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjH,OAAO,MAAM,CACX,yCAAyC,CAAC,oBAAoB,EAC9D,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAA2C;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,yEAAmC,EAAE,EACtE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE;oBACxE,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,OAAO,CAAC,KAAK;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC3D,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,yEAAmC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,uEAAuC,CAAC,KAAK,CAClD,IAAA,qCAA8B,EAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,EACrB,0BAA0B,yEAAmC,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uDAAqC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF,CAAA;AAvFY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GAJnD,8BAA8B,CAuF1C;AAGD,SAAS,mBAAmB,CAAC,KAAa,EAAE,aAAqB;IAC/D,IAAI,CAAC;QACH,IAAA,0BAAkB,EAAC,EAAE,KAAK,EAAE,uBAAe,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAA,qBAAa,EAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,IAA+C,EAC/C,OAAe;IAEf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}
package/dist/organization-delegation-admission.d.ts CHANGED
@@ -7,4 +7,5 @@ export declare enum OrganizationDelegationRefusalCode {
7
7
  }
8
8
  export declare function AcceptOrganizationDelegationFor(capability: string): MethodDecorator & ClassDecorator;
9
9
  export declare function assertOrganizationDelegationAdmitted(ctx: RequestContext, operation: string | undefined): void;
10
+ export declare function admitsAsOrganizationDelegate(ctx: RequestContext, operation: string): boolean;
10
11
  //# sourceMappingURL=organization-delegation-admission.d.ts.map
package/dist/organization-delegation-admission.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"organization-delegation-admission.d.ts","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAQ1C,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAG5F,oBAAY,iCAAiC;IAE3C,WAAW,yCAAyC;IAEpD,kBAAkB,iDAAiD;IAEnE,gBAAgB,+CAA+C;CAChE;AAOD,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAKpG;AAiBD,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAgCN"}
1
+ {"version":3,"file":"organization-delegation-admission.d.ts","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAQ1C,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAG5F,oBAAY,iCAAiC;IAE3C,WAAW,yCAAyC;IAEpD,kBAAkB,iDAAiD;IAEnE,gBAAgB,+CAA+C;CAChE;AAOD,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAKpG;AAiBD,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAgCN;AAUD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAM5F"}
package/dist/organization-delegation-admission.js CHANGED
@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.OrganizationDelegationRefusalCode = exports.ACCEPT_ORGANIZATION_DELEGATION_FOR = void 0;
4
4
  exports.AcceptOrganizationDelegationFor = AcceptOrganizationDelegationFor;
5
5
  exports.assertOrganizationDelegationAdmitted = assertOrganizationDelegationAdmitted;
6
+ exports.admitsAsOrganizationDelegate = admitsAsOrganizationDelegate;
6
7
  const common_1 = require("@nestjs/common");
7
8
  const caller_context_1 = require("@xemahq/contracts/caller-context");
8
9
  const subject_1 = require("@xemahq/contracts/subject");
@@ -41,6 +42,13 @@ function assertOrganizationDelegationAdmitted(ctx, operation) {
41
42
  throw refusal(OrganizationDelegationRefusalCode.OperationNotLent, `The organization's delegation does not lend ${operation}.`);
42
43
  }
43
44
  }
45
+ function admitsAsOrganizationDelegate(ctx, operation) {
46
+ if (ctx.subject.kind !== subject_1.SubjectKind.Organization) {
47
+ return false;
48
+ }
49
+ assertOrganizationDelegationAdmitted(ctx, operation);
50
+ return true;
51
+ }
44
52
  function refusal(code, message) {
45
53
  return new common_1.ForbiddenException({ code, message });
46
54
  }