captify 0.1.18 → 1.1.0

package/dist/permissions/services/policy.service.js

@@ -0,0 +1,426 @@
+/**
+ * Policy Service
+ * CRUD operations for permission policies
+ */
+import { BaseAwsService } from "../../shared/services/base-aws-service";
+import { DynamoDbInstances } from "../../shared/services/dynamodb";
+import { TABLES, TABLE_INDEXES } from "../../shared/shared.constants";
+import { ACTION, DEFAULT_DOMAIN, PERMISSIONS_ERROR_MESSAGES, PERMISSIONS_LIMITS, RESOURCE, getActionsForResource, } from "../permissions.constants";
+import { PolicyNotFoundError, DuplicatePolicyError, SelfLockoutError, InvalidActionError, } from "../permissions.errors";
+import { fromPolicyRecord, formatDomain, generateId, } from "../permissions.utilities";
+import { policyKeys } from "../../db/schemas/policies.schema";
+import { getPermissionsService } from "./permissions.service";
+// ============================================================================
+// Service
+// ============================================================================
+/**
+ * Service for managing permission policies.
+ * Handles CRUD operations for policies stored in DynamoDB.
+ */
+export class PolicyService extends BaseAwsService {
+    constructor(deps = {}) {
+        var _a;
+        super({ logger: deps.logger });
+        this.policiesDb =
+            (_a = deps.policiesDb) !== null && _a !== void 0 ? _a : DynamoDbInstances.getInstance(TABLES.policies);
+    }
+    /**
+     * List policies with filtering, sorting, and pagination
+     */
+    async list(params, options) {
+        const { tenantId, userCredentials } = options;
+        const { resource, subjectType, effect, status, search, sortBy = "createdAt", sortOrder = "desc", page = 1, limit = PERMISSIONS_LIMITS.PAGE_SIZE, } = params;
+        // Build query based on filters
+        let items;
+        if (resource) {
+            // Query by resource using GSI1
+            const result = await this.policiesDb.queryItems({
+                IndexName: TABLE_INDEXES.policies.ByResource,
+                KeyConditionExpression: "GSI1_PK = :pk",
+                ExpressionAttributeValues: {
+                    ":pk": policyKeys.gsi1Pk(tenantId, resource),
+                },
+            }, { userCredentials });
+            items = (result.Items || []);
+        }
+        else {
+            // Query all policies for tenant
+            const result = await this.policiesDb.queryItems({
+                KeyConditionExpression: "PK = :pk",
+                ExpressionAttributeValues: {
+                    ":pk": policyKeys.pk(tenantId),
+                },
+            }, { userCredentials });
+            items = (result.Items || []);
+        }
+        // Apply additional filters
+        let filtered = items.filter((item) => item.ptype === "p"); // Only policy rules, not role assignments
+        if (subjectType) {
+            filtered = filtered.filter((item) => item.subjectType === subjectType);
+        }
+        if (effect) {
+            filtered = filtered.filter((item) => item.effect === effect);
+        }
+        if (status) {
+            filtered = filtered.filter((item) => item.status === status);
+        }
+        if (search) {
+            const searchLower = search.toLowerCase();
+            filtered = filtered.filter((item) => item.subject.toLowerCase().includes(searchLower) ||
+                item.resource.toLowerCase().includes(searchLower));
+        }
+        // Sort
+        filtered.sort((a, b) => {
+            var _a, _b;
+            const aVal = (_a = a[sortBy]) !== null && _a !== void 0 ? _a : "";
+            const bVal = (_b = b[sortBy]) !== null && _b !== void 0 ? _b : "";
+            const comparison = String(aVal).localeCompare(String(bVal));
+            return sortOrder === "desc" ? -comparison : comparison;
+        });
+        // Paginate
+        const totalCount = filtered.length;
+        const totalPages = Math.ceil(totalCount / limit);
+        const startIndex = (page - 1) * limit;
+        const paginatedItems = filtered.slice(startIndex, startIndex + limit);
+        // Convert to Policy objects
+        const policies = paginatedItems.map(fromPolicyRecord);
+        return {
+            policies,
+            totalCount,
+            page,
+            limit,
+            totalPages,
+        };
+    }
+    /**
+     * Get a policy by ID
+     */
+    async get(policyId, options) {
+        const { tenantId, userCredentials } = options;
+        // We need to find the policy by scanning since we don't know the ptype
+        const result = await this.policiesDb.queryItems({
+            KeyConditionExpression: "PK = :pk",
+            FilterExpression: "policyId = :policyId",
+            ExpressionAttributeValues: {
+                ":pk": policyKeys.pk(tenantId),
+                ":policyId": policyId,
+            },
+        }, { userCredentials });
+        const items = (result.Items || []);
+        if (items.length === 0) {
+            throw new PolicyNotFoundError();
+        }
+        return fromPolicyRecord(items[0]);
+    }
+    /**
+     * Create a new policy
+     */
+    async create(data, options) {
+        const { userId, tenantId, userCredentials } = options;
+        const { subject, subjectType, resource, actions, effect } = data;
+        // Validate all actions are valid for resource
+        const validActions = getActionsForResource(resource);
+        for (const action of actions) {
+            if (!validActions.includes(action)) {
+                throw new InvalidActionError(`Action '${action}' is not valid for resource '${resource}'`);
+            }
+        }
+        // Check for duplicate (same subject, resource - regardless of actions)
+        const existing = await this.findPolicy(tenantId, subject, subjectType, resource, userCredentials);
+        if (existing) {
+            throw new DuplicatePolicyError();
+        }
+        const now = Date.now();
+        const policyId = generateId();
+        const domain = formatDomain(tenantId, DEFAULT_DOMAIN);
+        const record = {
+            PK: policyKeys.pk(tenantId),
+            SK: policyKeys.sk("p", policyId),
+            policyId,
+            tenantId,
+            ptype: "p",
+            subject,
+            subjectType,
+            domain,
+            resource: resource,
+            actions: actions,
+            effect,
+            status: "enabled",
+            createdAt: now,
+            updatedAt: now,
+            createdById: userId,
+            v0: subject,
+            v1: domain,
+            v2: resource,
+            v3: actions,
+            v4: effect,
+            GSI1_PK: policyKeys.gsi1Pk(tenantId, resource),
+            GSI1_SK: policyKeys.gsi1Sk("enabled", now),
+            GSI2_PK: policyKeys.gsi2Pk(tenantId, subjectType, subject),
+            GSI2_SK: policyKeys.gsi2Sk(resource),
+        };
+        await this.policiesDb.putItem(record, { userCredentials });
+        // Reload enforcer to pick up new policy
+        await getPermissionsService().reloadEnforcer(tenantId, userCredentials);
+        return fromPolicyRecord(record);
+    }
+    /**
+     * Update an existing policy
+     */
+    async update(policyId, data, options) {
+        const { userId, tenantId, userCredentials } = options;
+        const { actions, effect } = data;
+        // Get existing policy
+        const existing = await this.get(policyId, options);
+        // Validate actions if provided
+        if (actions && actions.length > 0) {
+            const validActions = getActionsForResource(existing.resource);
+            for (const action of actions) {
+                if (!validActions.includes(action)) {
+                    throw new InvalidActionError(`Action '${action}' is not valid for resource '${existing.resource}'`);
+                }
+            }
+        }
+        const now = Date.now();
+        // Build update expression
+        const updateExpressionParts = [
+            "#updatedAt = :updatedAt",
+            "#modifiedById = :modifiedById",
+        ];
+        const expressionAttributeNames = {
+            "#updatedAt": "updatedAt",
+            "#modifiedById": "modifiedById",
+        };
+        const expressionAttributeValues = {
+            ":updatedAt": now,
+            ":modifiedById": userId,
+        };
+        if (actions !== undefined && actions.length > 0) {
+            updateExpressionParts.push("#actions = :actions", "v3 = :v3");
+            expressionAttributeNames["#actions"] = "actions";
+            expressionAttributeValues[":actions"] = actions;
+            expressionAttributeValues[":v3"] = actions;
+        }
+        if (effect !== undefined) {
+            updateExpressionParts.push("#effect = :effect", "v4 = :v4");
+            expressionAttributeNames["#effect"] = "effect";
+            expressionAttributeValues[":effect"] = effect;
+            expressionAttributeValues[":v4"] = effect;
+        }
+        await this.policiesDb.updateItem({
+            PK: policyKeys.pk(tenantId),
+            SK: policyKeys.sk("p", policyId),
+        }, `SET ${updateExpressionParts.join(", ")}`, expressionAttributeNames, expressionAttributeValues, { userCredentials });
+        // Reload enforcer
+        await getPermissionsService().reloadEnforcer(tenantId, userCredentials);
+        // Return updated policy
+        return this.get(policyId, options);
+    }
+    /**
+     * Toggle policy status (enable/disable)
+     */
+    async toggleStatus(policyId, status, options) {
+        const { userId, tenantId, userCredentials } = options;
+        // Get existing policy to verify it exists
+        const existing = await this.get(policyId, options);
+        const now = Date.now();
+        await this.policiesDb.updateItem({
+            PK: policyKeys.pk(tenantId),
+            SK: policyKeys.sk("p", policyId),
+        }, "SET #status = :status, #updatedAt = :updatedAt, #modifiedById = :modifiedById, GSI1_SK = :gsi1sk", {
+            "#status": "status",
+            "#updatedAt": "updatedAt",
+            "#modifiedById": "modifiedById",
+        }, {
+            ":status": status,
+            ":updatedAt": now,
+            ":modifiedById": userId,
+            ":gsi1sk": policyKeys.gsi1Sk(status, existing.createdAt),
+        }, { userCredentials });
+        // Reload enforcer
+        await getPermissionsService().reloadEnforcer(tenantId, userCredentials);
+        // Return updated policy
+        return this.get(policyId, options);
+    }
+    /**
+     * Delete a policy
+     * Includes self-lockout protection for permissions:manage policies
+     */
+    async delete(policyId, options) {
+        const { userId, tenantId, groups = [], userCredentials } = options;
+        // Get existing policy
+        const existing = await this.get(policyId, options);
+        // Self-lockout protection: don't allow deleting a permissions policy
+        // that grants delete access to the current user if no other policy would
+        if (existing.resource === RESOURCE.PERMISSIONS &&
+            (existing.actions.includes(ACTION.DELETE) || existing.actions.includes(ACTION.ALL))) {
+            const isLockoutRisk = await this.checkSelfLockout(userId, tenantId, policyId, existing, groups, userCredentials);
+            if (isLockoutRisk) {
+                throw new SelfLockoutError();
+            }
+        }
+        await this.policiesDb.deleteItem({
+            PK: policyKeys.pk(tenantId),
+            SK: policyKeys.sk("p", policyId),
+        }, { userCredentials });
+        // Reload enforcer
+        await getPermissionsService().reloadEnforcer(tenantId, userCredentials);
+    }
+    /**
+     * Bulk delete multiple policies
+     * Uses batch write for efficient deletion and reloads enforcer once at the end
+     */
+    async bulkDelete(policyIds, options) {
+        const { userId, tenantId, groups = [], userCredentials } = options;
+        const deleted = [];
+        const failed = [];
+        const itemsToDelete = [];
+        // First, validate all policies exist and check for self-lockout
+        for (const policyId of policyIds) {
+            try {
+                const existing = await this.get(policyId, options);
+                // Self-lockout protection for permissions policies
+                if (existing.resource === RESOURCE.PERMISSIONS &&
+                    (existing.actions.includes(ACTION.DELETE) || existing.actions.includes(ACTION.ALL))) {
+                    const isLockoutRisk = await this.checkSelfLockout(userId, tenantId, policyId, existing, groups, userCredentials);
+                    if (isLockoutRisk) {
+                        failed.push({ policyId, error: PERMISSIONS_ERROR_MESSAGES.SELF_LOCKOUT });
+                        continue;
+                    }
+                }
+                itemsToDelete.push({
+                    PK: policyKeys.pk(tenantId),
+                    SK: policyKeys.sk("p", policyId),
+                });
+                deleted.push(policyId);
+            }
+            catch (error) {
+                failed.push({
+                    policyId,
+                    error: error instanceof Error ? error.message : "Policy not found",
+                });
+            }
+        }
+        // Perform batch delete if there are items to delete
+        if (itemsToDelete.length > 0) {
+            try {
+                await this.policiesDb.batchWrite(itemsToDelete, "delete", { userCredentials });
+            }
+            catch (error) {
+                // If batch delete fails, move all to failed
+                const errorMessage = error instanceof Error ? error.message : "Batch delete failed";
+                for (const policyId of deleted) {
+                    failed.push({ policyId, error: errorMessage });
+                }
+                deleted.length = 0;
+            }
+        }
+        // Reload enforcer once after all deletions
+        if (deleted.length > 0) {
+            await getPermissionsService().reloadEnforcer(tenantId, userCredentials);
+        }
+        return { deleted, failed };
+    }
+    /**
+     * Find a policy by subject, subjectType, and resource
+     * Returns the first matching policy (duplicate check ignores specific actions)
+     */
+    async findPolicy(tenantId, subject, subjectType, resource, userCredentials) {
+        const result = await this.policiesDb.queryItems({
+            IndexName: TABLE_INDEXES.policies.BySubject,
+            KeyConditionExpression: "GSI2_PK = :pk AND GSI2_SK = :sk",
+            ExpressionAttributeValues: {
+                ":pk": policyKeys.gsi2Pk(tenantId, subjectType, subject),
+                ":sk": policyKeys.gsi2Sk(resource),
+            },
+        }, { userCredentials });
+        const items = (result.Items || []);
+        return items.length > 0 ? items[0] : null;
+    }
+    /**
+     * Check if deleting this policy would lock out the current user from permissions management.
+     *
+     * Returns true (lockout risk) only if:
+     * 1. The policy being deleted grants permissions:delete to the current user
+     * 2. No other policies would grant the user permissions:delete after deletion
+     */
+    async checkSelfLockout(userId, tenantId, policyIdToDelete, policyToDelete, groups = [], userCredentials) {
+        // First, check if this policy even applies to the current user
+        const policyAppliesToUser = this.policyAppliesToUser(policyToDelete, userId, groups);
+        // If the policy doesn't apply to this user, no lockout risk
+        if (!policyAppliesToUser) {
+            return false;
+        }
+        // Get all OTHER policies that grant permissions:delete (excluding the one being deleted)
+        const result = await this.policiesDb.queryItems({
+            IndexName: TABLE_INDEXES.policies.ByResource,
+            KeyConditionExpression: "GSI1_PK = :pk",
+            FilterExpression: "#effect = :effect AND #status = :status AND policyId <> :excludeId",
+            ExpressionAttributeNames: {
+                "#effect": "effect",
+                "#status": "status",
+            },
+            ExpressionAttributeValues: {
+                ":pk": policyKeys.gsi1Pk(tenantId, RESOURCE.PERMISSIONS),
+                ":effect": "allow",
+                ":status": "enabled",
+                ":excludeId": policyIdToDelete,
+            },
+        }, { userCredentials });
+        const otherPolicies = (result.Items || []);
+        // Check if any other policy grants the user permissions:delete
+        const hasOtherDeleteAccess = otherPolicies.some((policy) => {
+            // Check if policy includes delete action
+            const grantsDelete = policy.actions.includes(ACTION.DELETE) || policy.actions.includes(ACTION.ALL);
+            if (!grantsDelete) {
+                return false;
+            }
+            // Check if this other policy applies to the current user
+            return this.policyAppliesToUser(fromPolicyRecord(policy), userId, groups);
+        });
+        // Lockout risk only if no other policies would grant the user delete access
+        return !hasOtherDeleteAccess;
+    }
+    /**
+     * Check if a policy applies to a specific user.
+     *
+     * A policy applies to a user if:
+     * - subjectType is "user" and subject matches the userId
+     * - subjectType is "group" and subject matches one of the user's groups
+     * - subjectType is "role" and the role is assigned to one of the user's groups
+     *   (Note: role resolution requires checking role assignments, which we skip here
+     *   for simplicity - roles are checked via group membership)
+     */
+    policyAppliesToUser(policy, userId, groups) {
+        switch (policy.subjectType) {
+            case "user":
+                return policy.subject === userId;
+            case "group":
+                return groups.includes(policy.subject);
+            case "role":
+                // For role-based policies, we check if any of the user's groups
+                // might have this role assigned. Since role assignments are complex,
+                // we take a conservative approach and assume role-based policies
+                // could apply to the user if they have any groups.
+                // This ensures we don't accidentally allow deletion of a policy
+                // that grants access through a role the user has.
+                return groups.length > 0;
+            default:
+                return false;
+        }
+    }
+}
+// ============================================================================
+// Singleton Instance
+// ============================================================================
+let policyServiceInstance = null;
+/**
+ * Get the singleton PolicyService instance
+ */
+export function getPolicyService() {
+    if (!policyServiceInstance) {
+        policyServiceInstance = new PolicyService();
+    }
+    return policyServiceInstance;
+}
+//# sourceMappingURL=policy.service.js.map

package/dist/permissions/services/policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.service.js","sourceRoot":"","sources":["../../../lib/permissions/services/policy.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,MAAM,EACN,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,QAAQ,EACR,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,UAAU,GACX,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAWvF,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAG/C,YAAY,OAA0B,EAAE;;QACtC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YACb,MAAA,IAAI,CAAC,UAAU,mCAAI,iBAAiB,CAAC,WAAW,CAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAC9C,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,GAAG,WAAW,EACpB,SAAS,GAAG,MAAM,EAClB,IAAI,GAAG,CAAC,EACR,KAAK,GAAG,kBAAkB,CAAC,SAAS,GACrC,GAAG,MAAM,CAAC;QAEX,+BAA+B;QAC/B,IAAI,KAAqB,CAAC;QAE1B,IAAI,QAAQ,EAAE,CAAC;YACb,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC7C;gBACE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU;gBAC5C,sBAAsB,EAAE,eAAe;gBACvC,yBAAyB,EAAE;oBACzB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC;iBAC7C;aACF,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;YACF,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAmB,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC7C;gBACE,sBAAsB,EAAE,UAAU;gBAClC,yBAAyB,EAAE;oBACzB,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;iBAC/B;aACF,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;YACF,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAmB,CAAC;QACjD,CAAC;QAED,2BAA2B;QAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,0CAA0C;QAErG,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CACxB,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAChD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CACpD,CAAC;QACJ,CAAC;QAED,OAAO;QACP,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;;YACrB,MAAM,IAAI,GAAG,MAAA,CAAC,CAAC,MAA4B,CAAC,mCAAI,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAA,CAAC,CAAC,MAA4B,CAAC,mCAAI,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,WAAW;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACtC,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC;QAEtE,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEtD,OAAO;YACL,QAAQ;YACR,UAAU;YACV,IAAI;YACJ,KAAK;YACL,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,OAA6B;QACvD,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAE9C,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC7C;YACE,sBAAsB,EAAE,UAAU;YAClC,gBAAgB,EAAE,sBAAsB;YACxC,yBAAyB,EAAE;gBACzB,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;gBAC9B,WAAW,EAAE,QAAQ;aACtB;SACF,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAmB,CAAC;QAErD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QAED,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,IAAyB,EAAE,OAA6B;QACnE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEjE,8CAA8C;QAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAwB,CAAC,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAoB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,kBAAkB,CAAC,WAAW,MAAM,gCAAgC,QAAQ,GAAG,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CACpC,QAAQ,EACR,OAAO,EACP,WAAW,EACX,QAAQ,EACR,eAAe,CAChB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAiB;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,KAAK,EAAE,GAAG;YACV,OAAO;YACP,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,QAAwB;YAClC,OAAO,EAAE,OAAuB;YAChC,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,MAAM;YACnB,EAAE,EAAE,OAAO;YACX,EAAE,EAAE,MAAM;YACV,EAAE,EAAE,QAAQ;YACZ,EAAE,EAAE,OAAO;YACX,EAAE,EAAE,MAAM;YACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC9C,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;YAC1C,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;YAC1D,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAE3D,wCAAwC;QACxC,MAAM,qBAAqB,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAExE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,IAAyB,EACzB,OAA6B;QAE7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEjC,sBAAsB;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnD,+BAA+B;QAC/B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,kBAAkB,CAC1B,WAAW,MAAM,gCAAgC,QAAQ,CAAC,QAAQ,GAAG,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,0BAA0B;QAC1B,MAAM,qBAAqB,GAAa;YACtC,yBAAyB;YACzB,+BAA+B;SAChC,CAAC;QACF,MAAM,wBAAwB,GAA2B;YACvD,YAAY,EAAE,WAAW;YACzB,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,yBAAyB,GAA4B;YACzD,YAAY,EAAE,GAAG;YACjB,eAAe,EAAE,MAAM;SACxB,CAAC;QAEF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;YAC9D,wBAAwB,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;YAChD,yBAAyB,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;QAC7C,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YAC5D,wBAAwB,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;YAC/C,yBAAyB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;YAC9C,yBAAyB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QAC5C,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC9B;YACE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;SACjC,EACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACzC,wBAAwB,EACxB,yBAAyB,EACzB,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,kBAAkB;QAClB,MAAM,qBAAqB,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAExE,wBAAwB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,MAAoB,EACpB,OAA6B;QAE7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAEtD,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC9B;YACE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;SACjC,EACD,kGAAkG,EAClG;YACE,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,eAAe,EAAE,cAAc;SAChC,EACD;YACE,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,GAAG;YACjB,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;SACzD,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,kBAAkB;QAClB,MAAM,qBAAqB,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAExE,wBAAwB;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA6B;QAC1D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAEnE,sBAAsB;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnD,qEAAqE;QACrE,yEAAyE;QACzE,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW;YAC1C,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACnF,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC/C,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,eAAe,CAChB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC9B;YACE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;YAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;SACjC,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,kBAAkB;QAClB,MAAM,qBAAqB,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,SAAmB,EACnB,OAA6B;QAE7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAEnE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA0C,EAAE,CAAC;QACzD,MAAM,aAAa,GAAsC,EAAE,CAAC;QAE5D,gEAAgE;QAChE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAEnD,mDAAmD;gBACnD,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW;oBAC1C,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACnF,CAAC;oBACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC/C,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,eAAe,CAChB,CAAC;oBACF,IAAI,aAAa,EAAE,CAAC;wBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,CAAC,YAAY,EAAE,CAAC,CAAC;wBAC1E,SAAS;oBACX,CAAC;gBACH,CAAC;gBAED,aAAa,CAAC,IAAI,CAAC;oBACjB,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;oBAC3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;iBACjC,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ;oBACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4CAA4C;gBAC5C,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACpF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,qBAAqB,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CACtB,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,QAAgB,EAChB,eAAoC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC7C;YACE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS;YAC3C,sBAAsB,EAAE,iCAAiC;YACzD,yBAAyB,EAAE;gBACzB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;gBACxD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;aACnC;SACF,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAmB,CAAC;QACrD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAAc,EACd,QAAgB,EAChB,gBAAwB,EACxB,cAAsB,EACtB,SAAmB,EAAE,EACrB,eAAoC;QAEpC,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAErF,4DAA4D;QAC5D,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yFAAyF;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAC7C;YACE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU;YAC5C,sBAAsB,EAAE,eAAe;YACvC,gBAAgB,EAAE,oEAAoE;YACtF,wBAAwB,EAAE;gBACxB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,QAAQ;aACpB;YACD,yBAAyB,EAAE;gBACzB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;gBACxD,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,SAAS;gBACpB,YAAY,EAAE,gBAAgB;aAC/B;SACF,EACD,EAAE,eAAe,EAAE,CACpB,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAmB,CAAC;QAE7D,+DAA+D;QAC/D,MAAM,oBAAoB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACzD,yCAAyC;YACzC,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,yDAAyD;YACzD,OAAO,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,OAAO,CAAC,oBAAoB,CAAC;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACK,mBAAmB,CAAC,MAAc,EAAE,MAAc,EAAE,MAAgB;QAC1E,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;YAC3B,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC;YACnC,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,KAAK,MAAM;gBACT,gEAAgE;gBAChE,qEAAqE;gBACrE,iEAAiE;gBACjE,mDAAmD;gBACnD,gEAAgE;gBAChE,kDAAkD;gBAClD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3B;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,IAAI,qBAAqB,GAAyB,IAAI,CAAC;AAEvD;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/dist/permissions/services/role-assignment.service.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Role Assignment Service
+ * CRUD operations for role-to-group mappings
+ */
+import type { RolesTableSchema } from "../../db/schemas/roles.schema";
+import type { RoleAssignmentsTableSchema } from "../../db/schemas/role-assignments.schema";
+import type { Role, RoleAssignment } from "../permissions.schemas";
+import type { CreateRoleRequest, UpdateRoleRequest, CreateRoleAssignmentRequest, RoleAssignmentServiceOptions } from "../permissions.interfaces";
+import type { DynamoDbService } from "../../shared/services/dynamodb";
+import type { Logger } from "../../shared/services/logger";
+import { BaseAwsService } from "../../shared/services/base-aws-service";
+export interface RoleAssignmentServiceDeps {
+    logger?: Logger;
+    rolesDb?: DynamoDbService<RolesTableSchema>;
+    assignmentsDb?: DynamoDbService<RoleAssignmentsTableSchema>;
+}
+/**
+ * Service for managing roles and role-to-group assignments.
+ */
+export declare class RoleAssignmentService extends BaseAwsService {
+    private rolesDb;
+    private assignmentsDb;
+    constructor(deps?: RoleAssignmentServiceDeps);
+    /**
+     * List all roles for a tenant
+     */
+    listRoles(options: RoleAssignmentServiceOptions): Promise<Role[]>;
+    /**
+     * Get a role by ID
+     */
+    getRole(roleId: string, options: RoleAssignmentServiceOptions): Promise<Role>;
+    /**
+     * Get a role by name
+     */
+    getRoleByName(roleName: string, options: RoleAssignmentServiceOptions): Promise<Role | null>;
+    /**
+     * Create a new role
+     */
+    createRole(data: CreateRoleRequest, options: RoleAssignmentServiceOptions): Promise<Role>;
+    /**
+     * Update a role
+     */
+    updateRole(roleId: string, data: UpdateRoleRequest, options: RoleAssignmentServiceOptions): Promise<Role>;
+    /**
+     * Delete a role
+     */
+    deleteRole(roleId: string, options: RoleAssignmentServiceOptions): Promise<void>;
+    /**
+     * Initialize system roles for a tenant
+     */
+    initializeSystemRoles(options: RoleAssignmentServiceOptions): Promise<void>;
+    /**
+     * List all assignments for a role
+     */
+    listAssignmentsByRole(roleId: string, options: RoleAssignmentServiceOptions): Promise<RoleAssignment[]>;
+    /**
+     * List all assignments for a group
+     */
+    listAssignmentsByGroup(groupId: string, options: RoleAssignmentServiceOptions): Promise<RoleAssignment[]>;
+    /**
+     * Create a role-to-group assignment
+     */
+    createAssignment(roleId: string, data: CreateRoleAssignmentRequest, groupName: string, options: RoleAssignmentServiceOptions): Promise<RoleAssignment>;
+    /**
+     * Delete a role-to-group assignment
+     */
+    deleteAssignment(roleId: string, assignmentId: string, options: RoleAssignmentServiceOptions): Promise<void>;
+    /**
+     * Find an assignment by domain, role, and group
+     */
+    private findAssignment;
+}
+/**
+ * Get the singleton RoleAssignmentService instance
+ */
+export declare function getRoleAssignmentService(): RoleAssignmentService;
+//# sourceMappingURL=role-assignment.service.d.ts.map

package/dist/permissions/services/role-assignment.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-assignment.service.d.ts","sourceRoot":"","sources":["../../../lib/permissions/services/role-assignment.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAGV,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAyBxE,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC5C,aAAa,CAAC,EAAE,eAAe,CAAC,0BAA0B,CAAC,CAAC;CAC7D;AAMD;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;IACvD,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,aAAa,CAA8C;gBAEvD,IAAI,GAAE,yBAA8B;IAYhD;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAiBvE;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBnF;;OAEG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwBvB;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC/F;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC;IAmChB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BtF;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjF;;OAEG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,cAAc,EAAE,CAAC;IAkB5B;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,cAAc,EAAE,CAAC;IAkB5B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,EACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,cAAc,CAAC;IA0C1B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC;IAuBhB;;OAEG;YACW,cAAc;CAiB7B;AAQD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,qBAAqB,CAKhE"}