@xemahq/contracts 0.76.0 → 0.78.0

package/dist/authorization-module/platform/xema_sharing.fga.yaml

@@ -3,13 +3,25 @@
 name: xema_sharing
 model_file: ./fga.mod
 tuples:
+  # Owners are membership instances (`membership#holder`), never users.
   - user: user:alice
+    relation: holder
+    object: membership:org1|malice
+  - user: membership:org1|malice#holder
     relation: owner
     object: xema_document:org1|d1
+  # Human shares bind to a MEMBERSHIP instance (`membership#holder`), never to
+  # the user: bob and eve hold the memberships the shares are written to.
   - user: user:bob
+    relation: holder
+    object: membership:org1|mbob
+  - user: user:eve
+    relation: holder
+    object: membership:org1|meve
+  - user: membership:org1|mbob#holder
     relation: viewer
     object: xema_document:org1|d1
-  - user: user:eve
+  - user: membership:org1|meve#holder
     relation: editor
     object: xema_document:org1|d1
     condition:
@@ -22,10 +34,13 @@ tuples:
   - user: org:org1#member
     relation: org_viewer
     object: xema_document:org1|d2
-  - user: user:alice
+  - user: membership:org1|malice#holder
     relation: owner
     object: xema_document:org1|d2
   - user: user:olga
+    relation: holder
+    object: membership:org1|molga
+  - user: membership:org1|molga#holder
     relation: owner
     object: xema_output-route:org1|r1
   - user: team:ops#member
@@ -46,6 +61,8 @@ tuples:
   - user: user:stranger
     relation: admin
     object: org:org2
+# Every check on d1 supplies `current_time`: d1 carries an expiring share, and
+# the PDP supplies `current_time` on every decision.
 tests:
   - name: an org admin administers the org's portals through parent, and only that org's
     check:
@@ -69,12 +86,16 @@ tests:
     check:
       - user: user:alice
         object: xema_document:org1|d1
+        context:
+          current_time: "2029-01-01T00:00:00Z"
         assertions:
           can_manage: true
           can_edit: true
           can_view: true
       - user: user:bob
         object: xema_document:org1|d1
+        context:
+          current_time: "2029-01-01T00:00:00Z"
         assertions:
           can_manage: false
           can_edit: false
@@ -83,6 +104,8 @@ tests:
     check:
       - user: user:bob
         object: xema_document:org1|d1
+        context:
+          current_time: "2029-01-01T00:00:00Z"
         assertions:
           xema_read: true
       - user: user:dave
@@ -91,6 +114,8 @@ tests:
           xema_read: true
       - user: user:dave
         object: xema_document:org1|d1
+        context:
+          current_time: "2029-01-01T00:00:00Z"
         assertions:
           xema_read: false
   - name: output routes share through the same ladder, team shares included
@@ -138,5 +163,533 @@ tests:
           can_edit: false
       - user: user:dave
         object: xema_document:org1|d1
+        context:
+          current_time: "2029-01-01T00:00:00Z"
+        assertions:
+          can_view: false
+  - name: document 1 an active membership with a share is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: xema_document:org1|m1
+    check:
+      - user: user:ann
+        object: xema_document:org1|m1
+        assertions:
+          can_view: true
+  - name: document 2 leave deletes the holder tuple — the share yields no access
+    tuples:
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: xema_document:org1|m2
+    check:
+      - user: user:ann
+        object: xema_document:org1|m2
+        assertions:
+          can_view: false
+  - name: document 3 rejoin is a new membership — the share on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann2
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: xema_document:org1|m3
+    check:
+      - user: user:ann
+        object: xema_document:org1|m3
+        assertions:
+          can_view: false
+  - name: document 4 a new share to the new membership is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann2
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: xema_document:org1|m4
+      - user: membership:org1|mann2#holder
+        relation: viewer
+        object: xema_document:org1|m4
+    check:
+      - user: user:ann
+        object: xema_document:org1|m4
+        assertions:
+          can_view: true
+  - name: document 5 a demotion keeps the holder tuple — the share survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+      - user: membership:org1|mann1#holder
+        relation: viewer
+        object: xema_document:org1|m5
+    check:
+      - user: user:ann
+        object: xema_document:org1|m5
+        assertions:
+          can_view: true
+  - name: document 6 a revoked share is refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mann1
+    check:
+      - user: user:ann
+        object: xema_document:org1|m6
+        assertions:
+          can_view: false
+  - name: document (expiring share) 1 an active membership with a share is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|xann1
+      - user: membership:org1|xann1#holder
+        relation: viewer
+        object: xema_document:org1|x1
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+    check:
+      - user: user:ann
+        object: xema_document:org1|x1
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_view: true
+  - name: document (expiring share) 2 leave deletes the holder tuple — the share yields no access
+    tuples:
+      - user: membership:org1|xann1#holder
+        relation: viewer
+        object: xema_document:org1|x2
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+    check:
+      - user: user:ann
+        object: xema_document:org1|x2
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_view: false
+  - name: document (expiring share) 3 rejoin is a new membership — the share on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|xann2
+      - user: membership:org1|xann1#holder
+        relation: viewer
+        object: xema_document:org1|x3
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+    check:
+      - user: user:ann
+        object: xema_document:org1|x3
+        context:
+          current_time: "2029-12-31T23:59:59Z"
         assertions:
           can_view: false
+  - name: document (expiring share) 4 a new share to the new membership is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|xann2
+      - user: membership:org1|xann1#holder
+        relation: viewer
+        object: xema_document:org1|x4
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+      - user: membership:org1|xann2#holder
+        relation: viewer
+        object: xema_document:org1|x4
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+    check:
+      - user: user:ann
+        object: xema_document:org1|x4
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_view: true
+  - name: document (expiring share) 5 a demotion keeps the holder tuple — the share survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|xann1
+      - user: membership:org1|xann1#holder
+        relation: viewer
+        object: xema_document:org1|x5
+        condition:
+          name: xema_share_not_expired
+          context:
+            expires_at: "2030-01-01T00:00:00Z"
+    check:
+      - user: user:ann
+        object: xema_document:org1|x5
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_view: true
+  - name: document (expiring share) 6 a revoked share is refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|xann1
+    check:
+      - user: user:ann
+        object: xema_document:org1|x6
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_view: false
+  - name: document (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_document:org1|o1
+    check:
+      - user: user:ann
+        object: xema_document:org1|o1
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: document (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_document:org1|o1
+    check:
+      - user: user:ann
+        object: xema_document:org1|o1
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: document (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_document:org1|o1
+    check:
+      - user: user:ann
+        object: xema_document:org1|o1
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: document (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_document:org1|o1
+    check:
+      - user: user:ann
+        object: xema_document:org1|o1
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: connector-migration (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_connector-migration:org1|o2
+    check:
+      - user: user:ann
+        object: xema_connector-migration:org1|o2
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: connector-migration (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_connector-migration:org1|o2
+    check:
+      - user: user:ann
+        object: xema_connector-migration:org1|o2
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: connector-migration (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_connector-migration:org1|o2
+    check:
+      - user: user:ann
+        object: xema_connector-migration:org1|o2
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: connector-migration (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_connector-migration:org1|o2
+    check:
+      - user: user:ann
+        object: xema_connector-migration:org1|o2
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: biome-lifecycle-approval (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_biome-lifecycle-approval:org1|o3
+    check:
+      - user: user:ann
+        object: xema_biome-lifecycle-approval:org1|o3
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: biome-lifecycle-approval (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_biome-lifecycle-approval:org1|o3
+    check:
+      - user: user:ann
+        object: xema_biome-lifecycle-approval:org1|o3
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: biome-lifecycle-approval (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_biome-lifecycle-approval:org1|o3
+    check:
+      - user: user:ann
+        object: xema_biome-lifecycle-approval:org1|o3
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: biome-lifecycle-approval (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_biome-lifecycle-approval:org1|o3
+    check:
+      - user: user:ann
+        object: xema_biome-lifecycle-approval:org1|o3
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: capability-grant (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_capability-grant:org1|o4
+    check:
+      - user: user:ann
+        object: xema_capability-grant:org1|o4
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: capability-grant (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_capability-grant:org1|o4
+    check:
+      - user: user:ann
+        object: xema_capability-grant:org1|o4
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: capability-grant (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_capability-grant:org1|o4
+    check:
+      - user: user:ann
+        object: xema_capability-grant:org1|o4
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: capability-grant (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_capability-grant:org1|o4
+    check:
+      - user: user:ann
+        object: xema_capability-grant:org1|o4
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: output-route (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_output-route:org1|o5
+    check:
+      - user: user:ann
+        object: xema_output-route:org1|o5
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: output-route (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_output-route:org1|o5
+    check:
+      - user: user:ann
+        object: xema_output-route:org1|o5
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: output-route (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_output-route:org1|o5
+    check:
+      - user: user:ann
+        object: xema_output-route:org1|o5
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: output-route (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_output-route:org1|o5
+    check:
+      - user: user:ann
+        object: xema_output-route:org1|o5
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: mailbox (owner) 1 an active membership owner is allowed
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_mailbox:org1|o6
+    check:
+      - user: user:ann
+        object: xema_mailbox:org1|o6
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: mailbox (owner) 2 leave deletes the holder tuple — the owner tuple is inert
+    tuples:
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_mailbox:org1|o6
+    check:
+      - user: user:ann
+        object: xema_mailbox:org1|o6
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: mailbox (owner) 3 rejoin is a new membership — the owner on the old one stays refused
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown2
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_mailbox:org1|o6
+    check:
+      - user: user:ann
+        object: xema_mailbox:org1|o6
+        assertions:
+          can_manage: false
+          can_view: false
+  - name: mailbox (owner) 4 a demotion keeps the holder tuple — the owner survives (no org admin tuple needed)
+    tuples:
+      - user: user:ann
+        relation: holder
+        object: membership:org1|mown1
+      - user: membership:org1|mown1#holder
+        relation: owner
+        object: xema_mailbox:org1|o6
+    check:
+      - user: user:ann
+        object: xema_mailbox:org1|o6
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: mailbox (personal) a personal mailbox keeps a user owner
+    tuples:
+      - user: user:ann
+        relation: owner
+        object: xema_mailbox:org1|op
+    check:
+      - user: user:ann
+        object: xema_mailbox:org1|op
+        assertions:
+          can_manage: true
+          can_view: true
+  - name: mailbox (personal) another user is not the owner
+    tuples:
+      - user: user:ann
+        relation: owner
+        object: xema_mailbox:org1|op
+    check:
+      - user: user:bob
+        object: xema_mailbox:org1|op
+        assertions:
+          can_manage: false
+          can_view: false

package/dist/authorization-module/server/authorization-interface-conformance.d.ts

@@ -10,5 +10,6 @@ export declare function interfaceConformanceViolations(input: {
     readonly iface: XemaAuthorizationInterface;
     readonly definition: FgaTypeDefinition | undefined;
     readonly writableRelations: readonly string[];
+    readonly types: ReadonlyMap<string, FgaTypeDefinition>;
 }): readonly InterfaceConformanceViolation[];
 //# sourceMappingURL=authorization-interface-conformance.d.ts.map

package/dist/authorization-module/server/authorization-interface-conformance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-interface-conformance.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-interface-conformance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,IAAI,IAAI,EAAE,MAAM,wCAAwC,CAAC;AAKvG,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EACT,IAAI,CAAC,uBAAuB,GAC5B,IAAI,CAAC,yBAAyB,GAC9B,IAAI,CAAC,4BAA4B,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAmBD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C,GAAG,SAAS,6BAA6B,EAAE,CAmD3C"}
+{"version":3,"file":"authorization-interface-conformance.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-interface-conformance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,IAAI,IAAI,EAAE,MAAM,wCAAwC,CAAC;AAKvG,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EACT,IAAI,CAAC,uBAAuB,GAC5B,IAAI,CAAC,yBAAyB,GAC9B,IAAI,CAAC,4BAA4B,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAqBD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CACxD,GAAG,SAAS,6BAA6B,EAAE,CA8D3C"}

package/dist/authorization-module/server/authorization-interface-conformance.js

@@ -5,8 +5,9 @@ const authorization_composition_error_1 = require("../lib/authorization-composit
 const authorization_interface_requirements_1 = require("../lib/authorization-interface-requirements");
 const platform_authorization_modules_1 = require("../lib/platform-authorization-modules");
 const authorization_model_json_1 = require("./authorization-model-json");
+const userset_subject_types_1 = require("./userset-subject-types");
 function interfaceConformanceViolations(input) {
-    const { type, iface, definition, writableRelations } = input;
+    const { type, iface, definition, writableRelations, types } = input;
     const requirements = platform_authorization_modules_1.XEMA_AUTHORIZATION_INTERFACE_RELATIONS[iface];
     const violations = [];
     const missing = Object.keys(requirements).filter((relation) => definition?.relations?.[relation] === undefined);
@@ -53,6 +54,17 @@ function interfaceConformanceViolations(input) {
                 }
                 break;
             }
+            case authorization_interface_requirements_1.XemaInterfaceRelationKind.Checkable: {
+                const reachable = (0, userset_subject_types_1.resolvableSubjectTypes)(types, type, relation);
+                const unreachable = requirement.subjects.filter((subject) => !reachable.has(subject));
+                if (direct.length > 0 || unreachable.length > 0) {
+                    violations.push({
+                        code: authorization_composition_error_1.AuthorizationCompositionViolationCode.InterfaceRelationMistyped,
+                        message: `${where} must be computed (no direct subject) and checkable for [${sorted(requirement.subjects).join(', ')}]; it resolves to [${sorted([...reachable]).join(', ')}]${direct.length > 0 ? ' with a direct subject' : ''}.`,
+                    });
+                }
+                break;
+            }
         }
     }
     return violations;

package/dist/authorization-module/server/authorization-interface-conformance.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-interface-conformance.js","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-interface-conformance.ts"],"names":[],"mappings":";;AA2CA,wEAwDC;AAnGD,4FAAuG;AACvG,sGAGqD;AACrD,0FAG+C;AAE/C,yEAKoC;AA4BpC,SAAgB,8BAA8B,CAAC,KAK9C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IAC7D,MAAM,YAAY,GAAG,uEAAsC,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAC9C,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,KAAK,SAAS,CAC9D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,uEAAI,CAAC,uBAAuB;YAClC,OAAO,EAAE,IAAI,IAAI,cAAc,KAAK,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8DAA8D;SAC9I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,QAAQ,MAAM,KAAK,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,IAAA,+CAAoB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,kDAAuB,CAAC,CAAC;QACvF,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,gEAAyB,CAAC,OAAO;gBACpC,MAAM;YACR,KAAK,gEAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC1C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,yBAAyB;wBACpC,OAAO,EAAE,GAAG,KAAK,qBAAqB,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,GAAG;qBACxM,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,4BAA4B;wBACvC,OAAO,EAAE,GAAG,KAAK,uDAAuD,IAAI,uCAAuC;qBACpH,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,gEAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,qEAA8B,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,yBAAyB;wBACpC,OAAO,EAAE,GAAG,KAAK,sBAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B;qBACjG,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,OAAmB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;AACzE,CAAC;AAOD,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,IAAA,qEAA8B,EAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IACnC,IAAI,GAAG,EAAE,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,IAAA,qEAA8B,EAAC;YACpC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,QAAQ;YACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,MAAyB,EAAE,QAA2B;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"authorization-interface-conformance.js","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-interface-conformance.ts"],"names":[],"mappings":";;AA8CA,wEAqEC;AAnHD,4FAAuG;AACvG,sGAGqD;AACrD,0FAG+C;AAE/C,yEAKoC;AACpC,mEAAiE;AA8BjE,SAAgB,8BAA8B,CAAC,KAO9C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpE,MAAM,YAAY,GAAG,uEAAsC,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAC9C,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,KAAK,SAAS,CAC9D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,uEAAI,CAAC,uBAAuB;YAClC,OAAO,EAAE,IAAI,IAAI,cAAc,KAAK,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8DAA8D;SAC9I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,QAAQ,MAAM,KAAK,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,IAAA,+CAAoB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,kDAAuB,CAAC,CAAC;QACvF,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,gEAAyB,CAAC,OAAO;gBACpC,MAAM;YACR,KAAK,gEAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC1C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,yBAAyB;wBACpC,OAAO,EAAE,GAAG,KAAK,qBAAqB,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,GAAG;qBACxM,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,4BAA4B;wBACvC,OAAO,EAAE,GAAG,KAAK,uDAAuD,IAAI,uCAAuC;qBACpH,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,gEAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,qEAA8B,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,yBAAyB;wBACpC,OAAO,EAAE,GAAG,KAAK,sBAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B;qBACjG,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,gEAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAA,8CAAsB,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChD,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,uEAAI,CAAC,yBAAyB;wBACpC,OAAO,EAAE,GAAG,KAAK,4DAA4D,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,GAAG;qBACpO,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,OAAmB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;AACzE,CAAC;AAOD,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,IAAA,qEAA8B,EAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IACnC,IAAI,GAAG,EAAE,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvF,OAAO,IAAA,qEAA8B,EAAC;YACpC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,QAAQ;YACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,MAAyB,EAAE,QAA2B;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/authorization-module/server/compose-authorization-base.d.ts

@@ -1,3 +1,4 @@
+import { type BiomeOrigin } from '../../biome';
 import { type AssignableSurfaceChange, type AuthorizationForwardMigrationHook } from './authorization-compatibility';
 import { type FgaAuthorizationModel } from './authorization-model-json';
 import { type PlatformAuthorizationModuleFiles } from './platform-module-files';
@@ -32,6 +33,7 @@ export interface AuthorizationCompositionGovernance {
 export declare const DEFAULT_AUTHORIZATION_COMPOSITION_GOVERNANCE: AuthorizationCompositionGovernance;
 export interface ComposeAuthorizationBaseInput {
     readonly modules: readonly AuthorizationModuleInput[];
+    readonly biomeOrigins: ReadonlyMap<string, BiomeOrigin>;
     readonly currentPlatformGeneration?: number;
     readonly adopted?: AdoptedAuthorizationBase;
     readonly governance?: AuthorizationCompositionGovernance;