glasswork 0.5.0 → 0.6.0

package/dist/authorization/ability-middleware.d.ts

@@ -0,0 +1,61 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import type { AbilityConfig, BaseAbility } from './types.js';
+/**
+ * Creates Hono middleware that attaches a CASL ability to the request context.
+ *
+ * This middleware is transparent - it exposes the CASL ability directly in the
+ * Hono context, making it accessible to route handlers. All CASL features
+ * remain available.
+ *
+ * @param config - Ability configuration with factory function
+ * @returns Hono middleware that creates and attaches the ability
+ *
+ * @example
+ * ```typescript
+ * import { createPrismaAbility } from '@casl/prisma';
+ * import { AbilityBuilder } from '@casl/ability';
+ *
+ * const abilityMiddleware = withAbility({
+ *   factory: (c) => {
+ *     const user = c.get('user');
+ *     const { can, build } = new AbilityBuilder(createPrismaAbility);
+ *
+ *     if (user.role === 'admin') {
+ *       can('manage', 'all');
+ *     } else {
+ *       can('read', 'User', { id: user.id });
+ *     }
+ *
+ *     return build();
+ *   }
+ * });
+ *
+ * app.use('*', abilityMiddleware);
+ * ```
+ */
+export declare function withAbility<T extends BaseAbility = BaseAbility>(config: AbilityConfig<T>): MiddlewareHandler;
+/**
+ * Helper to retrieve the ability from Hono context.
+ * This provides type-safe access to the CASL ability stored by `withAbility`.
+ *
+ * @param context - Hono context
+ * @param contextKey - The key used to store the ability (default: 'ability')
+ * @returns The CASL ability instance
+ * @throws Error if ability is not found in context
+ *
+ * @example
+ * ```typescript
+ * router.get('/users', async (c) => {
+ *   const ability = getAbility(c);
+ *
+ *   // Use CASL ability directly
+ *   if (ability.can('read', 'User')) {
+ *     return c.json(users);
+ *   }
+ *
+ *   return c.json({ error: 'Forbidden' }, 403);
+ * });
+ * ```
+ */
+export declare function getAbility<T extends BaseAbility = BaseAbility>(context: Context, contextKey?: string): T;
+//# sourceMappingURL=ability-middleware.d.ts.map

package/dist/authorization/ability-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability-middleware.d.ts","sourceRoot":"","sources":["../../src/authorization/ability-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EAC7D,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GACvB,iBAAiB,CAYnB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EAC5D,OAAO,EAAE,OAAO,EAChB,UAAU,SAAY,GACrB,CAAC,CAUH"}

package/dist/authorization/ability-middleware.js

@@ -0,0 +1,74 @@
+/**
+ * Creates Hono middleware that attaches a CASL ability to the request context.
+ *
+ * This middleware is transparent - it exposes the CASL ability directly in the
+ * Hono context, making it accessible to route handlers. All CASL features
+ * remain available.
+ *
+ * @param config - Ability configuration with factory function
+ * @returns Hono middleware that creates and attaches the ability
+ *
+ * @example
+ * ```typescript
+ * import { createPrismaAbility } from '@casl/prisma';
+ * import { AbilityBuilder } from '@casl/ability';
+ *
+ * const abilityMiddleware = withAbility({
+ *   factory: (c) => {
+ *     const user = c.get('user');
+ *     const { can, build } = new AbilityBuilder(createPrismaAbility);
+ *
+ *     if (user.role === 'admin') {
+ *       can('manage', 'all');
+ *     } else {
+ *       can('read', 'User', { id: user.id });
+ *     }
+ *
+ *     return build();
+ *   }
+ * });
+ *
+ * app.use('*', abilityMiddleware);
+ * ```
+ */
+export function withAbility(config) {
+    const contextKey = config.contextKey || 'ability';
+    return async (c, next) => {
+        // Create ability using factory
+        const ability = await config.factory(c);
+        // Store in Hono context
+        c.set(contextKey, ability);
+        await next();
+    };
+}
+/**
+ * Helper to retrieve the ability from Hono context.
+ * This provides type-safe access to the CASL ability stored by `withAbility`.
+ *
+ * @param context - Hono context
+ * @param contextKey - The key used to store the ability (default: 'ability')
+ * @returns The CASL ability instance
+ * @throws Error if ability is not found in context
+ *
+ * @example
+ * ```typescript
+ * router.get('/users', async (c) => {
+ *   const ability = getAbility(c);
+ *
+ *   // Use CASL ability directly
+ *   if (ability.can('read', 'User')) {
+ *     return c.json(users);
+ *   }
+ *
+ *   return c.json({ error: 'Forbidden' }, 403);
+ * });
+ * ```
+ */
+export function getAbility(context, contextKey = 'ability') {
+    const ability = context.get(contextKey);
+    if (!ability) {
+        throw new Error(`Ability not found in context. Did you forget to use withAbility() middleware?`);
+    }
+    return ability;
+}
+//# sourceMappingURL=ability-middleware.js.map

package/dist/authorization/ability-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability-middleware.js","sourceRoot":"","sources":["../../src/authorization/ability-middleware.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,WAAW,CACzB,MAAwB;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;IAElD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE;QAChC,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAExC,wBAAwB;QACxB,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE3B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CACxB,OAAgB,EAChB,UAAU,GAAG,SAAS;IAEtB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,OAAO,OAAY,CAAC;AACtB,CAAC"}

package/dist/authorization/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Authorization module for integrating CASL with Glasswork.
+ *
+ * This module provides transparent integration with CASL while maintaining framework principles.
+ *
+ * ## Recommended Approach: Service Hooks
+ *
+ * Configure authorization globally using the hooks system:
+ *
+ * ```typescript
+ * import { authorizationHook, defineServiceMetadata, defineAuthorize } from 'glasswork';
+ *
+ * const authServiceMeta = defineServiceMetadata({
+ *   deleteSession: { authorize: defineAuthorize('delete', 'Session') }
+ * });
+ *
+ * bootstrap(AppModule, {
+ *   serviceHooks: [authorizationHook],
+ *   serviceMetadata: { authService: authServiceMeta }
+ * });
+ *
+ * // In routes - authorization happens automatically!
+ * await services.authService.deleteSession(token);
+ * ```
+ *
+ * ## Alternative: Explicit Authorization
+ *
+ * For fine-grained control, use explicit authorize() calls:
+ *
+ * ```typescript
+ * router.delete('/sessions/:id', async (c) => {
+ *   authorize(c, 'delete', 'Session', { id: c.req.param('id') });
+ *   await sessionService.delete(c.req.param('id'));
+ * });
+ * ```
+ *
+ * @module authorization
+ * @see https://casl.js.org/ for CASL documentation
+ * @see HOOKS_SYSTEM.md for hooks documentation
+ */
+export type { PureAbility } from '@casl/ability';
+export { ForbiddenError, subject } from '@casl/ability';
+export { getAbility, withAbility } from './ability-middleware.js';
+export { accessibleWhere, authorize, can, cannot } from './route-helpers.js';
+export type { AbilityConfig, AbilityFactory, BaseAbility } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE7E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/authorization/index.js

@@ -0,0 +1,46 @@
+/**
+ * Authorization module for integrating CASL with Glasswork.
+ *
+ * This module provides transparent integration with CASL while maintaining framework principles.
+ *
+ * ## Recommended Approach: Service Hooks
+ *
+ * Configure authorization globally using the hooks system:
+ *
+ * ```typescript
+ * import { authorizationHook, defineServiceMetadata, defineAuthorize } from 'glasswork';
+ *
+ * const authServiceMeta = defineServiceMetadata({
+ *   deleteSession: { authorize: defineAuthorize('delete', 'Session') }
+ * });
+ *
+ * bootstrap(AppModule, {
+ *   serviceHooks: [authorizationHook],
+ *   serviceMetadata: { authService: authServiceMeta }
+ * });
+ *
+ * // In routes - authorization happens automatically!
+ * await services.authService.deleteSession(token);
+ * ```
+ *
+ * ## Alternative: Explicit Authorization
+ *
+ * For fine-grained control, use explicit authorize() calls:
+ *
+ * ```typescript
+ * router.delete('/sessions/:id', async (c) => {
+ *   authorize(c, 'delete', 'Session', { id: c.req.param('id') });
+ *   await sessionService.delete(c.req.param('id'));
+ * });
+ * ```
+ *
+ * @module authorization
+ * @see https://casl.js.org/ for CASL documentation
+ * @see HOOKS_SYSTEM.md for hooks documentation
+ */
+export { ForbiddenError, subject } from '@casl/ability';
+// Ability middleware (attaches CASL abilities to context)
+export { getAbility, withAbility } from './ability-middleware.js';
+// Route helpers (explicit authorization - recommended for fine-grained control)
+export { accessibleWhere, authorize, can, cannot } from './route-helpers.js';
+//# sourceMappingURL=index.js.map

package/dist/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,0DAA0D;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAClE,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/authorization/route-helpers.d.ts

@@ -0,0 +1,106 @@
+import type { Context } from 'hono';
+import type { BaseAbility } from './types.js';
+/**
+ * Authorizes an action on a subject using the CASL ability from context.
+ * Throws ForbiddenError if the action is not permitted.
+ *
+ * This is a thin wrapper around CASL's authorize functionality, exposing
+ * the native CASL API while providing convenient access to the ability
+ * stored in Hono context.
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action (e.g., 'create', 'read', 'update', 'delete')
+ * @param subjectType - Subject type string (e.g., 'User', 'Post')
+ * @param subjectData - Optional subject instance data
+ * @throws ForbiddenError from CASL if action is not permitted
+ *
+ * @example
+ * ```typescript
+ * router.delete('/sessions/:id', async (c) => {
+ *   const sessionId = c.req.param('id');
+ *   const user = c.get('user');
+ *
+ *   // Explicit authorization - clear and obvious
+ *   authorize(c, 'delete', 'Session', { userId: user.id, sessionId });
+ *
+ *   await sessionService.delete(sessionId);
+ *   return c.json({ success: true });
+ * });
+ * ```
+ */
+export declare function authorize<T extends BaseAbility = BaseAbility>(context: Context, action: string, subjectType: string, subjectData?: object): void;
+/**
+ * Checks if an action is permitted without throwing an error.
+ * Returns boolean indicating if the action is allowed.
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action
+ * @param subjectType - Subject type string
+ * @param subjectData - Optional subject instance data
+ * @returns True if action is permitted, false otherwise
+ *
+ * @example
+ * ```typescript
+ * router.get('/users', async (c) => {
+ *   if (!can(c, 'read', 'User')) {
+ *     return c.json({ error: 'Forbidden' }, 403);
+ *   }
+ *
+ *   const users = await userService.findAll();
+ *   return c.json(users);
+ * });
+ * ```
+ */
+export declare function can<T extends BaseAbility = BaseAbility>(context: Context, action: string, subjectType: string, subjectData?: object): boolean;
+/**
+ * Checks if an action is forbidden (opposite of can).
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action
+ * @param subjectType - Subject type string
+ * @param subjectData - Optional subject instance data
+ * @returns True if action is forbidden, false if permitted
+ *
+ * @example
+ * ```typescript
+ * router.post('/admin/users', async (c) => {
+ *   if (cannot(c, 'create', 'User')) {
+ *     return c.json({ error: 'Forbidden' }, 403);
+ *   }
+ *
+ *   // ... create user
+ * });
+ * ```
+ */
+export declare function cannot<T extends BaseAbility = BaseAbility>(context: Context, action: string, subjectType: string, subjectData?: object): boolean;
+/**
+ * Creates a Prisma where clause using CASL's accessibleBy helper.
+ * This is a transparent wrapper that exposes @casl/prisma functionality.
+ *
+ * Requires @casl/prisma to be installed as a peer dependency.
+ *
+ * @param context - Hono context containing the ability
+ * @param subjectType - Prisma model name (e.g., 'User', 'Post')
+ * @param additionalWhere - Optional additional where conditions to combine
+ * @returns Prisma where clause that filters by ability permissions
+ *
+ * @example
+ * ```typescript
+ * import { accessibleBy } from '@casl/prisma';
+ *
+ * router.get('/posts', async (c) => {
+ *   const ability = getAbility(c);
+ *
+ *   // Use CASL Prisma integration directly
+ *   const posts = await prisma.post.findMany({
+ *     where: accessibleBy(ability).Post
+ *   });
+ *
+ *   return c.json(posts);
+ * });
+ * ```
+ *
+ * @see https://casl.js.org/v6/en/package/casl-prisma
+ */
+export declare function accessibleWhere<T extends BaseAbility = BaseAbility>(context: Context, subjectType: string, additionalWhere?: object): object;
+//# sourceMappingURL=route-helpers.d.ts.map

package/dist/authorization/route-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../src/authorization/route-helpers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EAC3D,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CAUN;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EACrD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAKT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,MAAM,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EACxD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EACjE,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAuBR"}

package/dist/authorization/route-helpers.js

@@ -0,0 +1,136 @@
+import { ForbiddenError, subject } from '@casl/ability';
+import { getAbility } from './ability-middleware.js';
+/**
+ * Authorizes an action on a subject using the CASL ability from context.
+ * Throws ForbiddenError if the action is not permitted.
+ *
+ * This is a thin wrapper around CASL's authorize functionality, exposing
+ * the native CASL API while providing convenient access to the ability
+ * stored in Hono context.
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action (e.g., 'create', 'read', 'update', 'delete')
+ * @param subjectType - Subject type string (e.g., 'User', 'Post')
+ * @param subjectData - Optional subject instance data
+ * @throws ForbiddenError from CASL if action is not permitted
+ *
+ * @example
+ * ```typescript
+ * router.delete('/sessions/:id', async (c) => {
+ *   const sessionId = c.req.param('id');
+ *   const user = c.get('user');
+ *
+ *   // Explicit authorization - clear and obvious
+ *   authorize(c, 'delete', 'Session', { userId: user.id, sessionId });
+ *
+ *   await sessionService.delete(sessionId);
+ *   return c.json({ success: true });
+ * });
+ * ```
+ */
+export function authorize(context, action, subjectType, subjectData) {
+    const ability = getAbility(context);
+    // Use CASL's native ForbiddenError.from() pattern
+    // This exposes CASL API directly - no wrapper
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    ForbiddenError.from(ability).throwUnlessCan(action, subject(subjectType, subjectData || {}));
+}
+/**
+ * Checks if an action is permitted without throwing an error.
+ * Returns boolean indicating if the action is allowed.
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action
+ * @param subjectType - Subject type string
+ * @param subjectData - Optional subject instance data
+ * @returns True if action is permitted, false otherwise
+ *
+ * @example
+ * ```typescript
+ * router.get('/users', async (c) => {
+ *   if (!can(c, 'read', 'User')) {
+ *     return c.json({ error: 'Forbidden' }, 403);
+ *   }
+ *
+ *   const users = await userService.findAll();
+ *   return c.json(users);
+ * });
+ * ```
+ */
+export function can(context, action, subjectType, subjectData) {
+    const ability = getAbility(context);
+    // Use CASL's native can() method directly
+    return ability.can(action, subject(subjectType, subjectData || {}));
+}
+/**
+ * Checks if an action is forbidden (opposite of can).
+ *
+ * @param context - Hono context containing the ability
+ * @param action - CASL action
+ * @param subjectType - Subject type string
+ * @param subjectData - Optional subject instance data
+ * @returns True if action is forbidden, false if permitted
+ *
+ * @example
+ * ```typescript
+ * router.post('/admin/users', async (c) => {
+ *   if (cannot(c, 'create', 'User')) {
+ *     return c.json({ error: 'Forbidden' }, 403);
+ *   }
+ *
+ *   // ... create user
+ * });
+ * ```
+ */
+export function cannot(context, action, subjectType, subjectData) {
+    return !can(context, action, subjectType, subjectData);
+}
+/**
+ * Creates a Prisma where clause using CASL's accessibleBy helper.
+ * This is a transparent wrapper that exposes @casl/prisma functionality.
+ *
+ * Requires @casl/prisma to be installed as a peer dependency.
+ *
+ * @param context - Hono context containing the ability
+ * @param subjectType - Prisma model name (e.g., 'User', 'Post')
+ * @param additionalWhere - Optional additional where conditions to combine
+ * @returns Prisma where clause that filters by ability permissions
+ *
+ * @example
+ * ```typescript
+ * import { accessibleBy } from '@casl/prisma';
+ *
+ * router.get('/posts', async (c) => {
+ *   const ability = getAbility(c);
+ *
+ *   // Use CASL Prisma integration directly
+ *   const posts = await prisma.post.findMany({
+ *     where: accessibleBy(ability).Post
+ *   });
+ *
+ *   return c.json(posts);
+ * });
+ * ```
+ *
+ * @see https://casl.js.org/v6/en/package/casl-prisma
+ */
+export function accessibleWhere(context, subjectType, additionalWhere) {
+    const ability = getAbility(context);
+    // Use CASL Prisma's accessibleBy directly
+    // Import is done dynamically to avoid hard dependency
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { accessibleBy } = require('@casl/prisma');
+        const abilityWhere = accessibleBy(ability)[subjectType];
+        if (additionalWhere) {
+            return {
+                AND: [abilityWhere, additionalWhere].filter(Boolean),
+            };
+        }
+        return abilityWhere;
+    }
+    catch {
+        throw new Error('@casl/prisma is required for accessibleWhere(). Install it with: npm install @casl/prisma');
+    }
+}
+//# sourceMappingURL=route-helpers.js.map

package/dist/authorization/route-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-helpers.js","sourceRoot":"","sources":["../../src/authorization/route-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,SAAS,CACvB,OAAgB,EAChB,MAAc,EACd,WAAmB,EACnB,WAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,CAAI,OAAO,CAAC,CAAC;IAEvC,kDAAkD;IAClD,8CAA8C;IAC9C,8DAA8D;IAC7D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAS,CAAC,cAAc,CAClD,MAAM,EACN,OAAO,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,GAAG,CACjB,OAAgB,EAChB,MAAc,EACd,WAAmB,EACnB,WAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,CAAI,OAAO,CAAC,CAAC;IAEvC,0CAA0C;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,MAAM,CACpB,OAAgB,EAChB,MAAc,EACd,WAAmB,EACnB,WAAoB;IAEpB,OAAO,CAAC,GAAG,CAAI,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,WAAmB,EACnB,eAAwB;IAExB,MAAM,OAAO,GAAG,UAAU,CAAI,OAAO,CAAC,CAAC;IAEvC,0CAA0C;IAC1C,sDAAsD;IACtD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,GAAG,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aACrD,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/authorization/service-proxy.d.ts

@@ -0,0 +1,59 @@
+import type { AuthorizedServiceOptions, BaseAbility, ServiceAuthMetadata } from './types.js';
+/**
+ * Creates a transparent proxy around a service that automatically
+ * checks CASL permissions before executing methods.
+ *
+ * **⚠️ DEPRECATED: Use the hooks system instead!**
+ *
+ * This function is deprecated in favor of the more flexible hooks system.
+ * Instead of manually wrapping services, configure authorization globally:
+ *
+ * ```typescript
+ * // NEW APPROACH (Recommended):
+ * import { authorizationHook, defineServiceMetadata, defineAuthorize } from 'glasswork';
+ *
+ * const authServiceMeta = defineServiceMetadata({
+ *   deleteSession: {
+ *     authorize: defineAuthorize('delete', 'Session')
+ *   }
+ * });
+ *
+ * bootstrap(AppModule, {
+ *   serviceHooks: [authorizationHook],
+ *   serviceMetadata: { authService: authServiceMeta }
+ * });
+ *
+ * // In routes - services are automatically authorized!
+ * await services.authService.deleteSession(token);
+ * ```
+ *
+ * @deprecated Use hooks system with authorizationHook instead
+ * @see {@link https://github.com/rolandboon/glasswork/blob/main/HOOKS_SYSTEM.md}
+ *
+ * @param service - The service instance to wrap
+ * @param options - Authorization configuration
+ * @returns Proxied service with automatic authorization
+ */
+export declare function withAuthorization<T extends object>(service: T, options: AuthorizedServiceOptions): T;
+/**
+ * Helper to define service authorization metadata.
+ *
+ * **⚠️ DEPRECATED: Use `defineServiceMetadata` and `defineAuthorize` from hooks system instead!**
+ *
+ * @deprecated Use `defineServiceMetadata` with `defineAuthorize` from hooks module
+ * @param metadata - Service authorization metadata
+ * @returns The same metadata (identity function)
+ */
+export declare function defineServiceAuth(metadata: ServiceAuthMetadata): ServiceAuthMetadata;
+/**
+ * Creates a factory function that wraps services with authorization.
+ *
+ * **⚠️ DEPRECATED: Use hooks system configured in bootstrap instead!**
+ *
+ * @deprecated Configure authorization globally with serviceHooks in bootstrap
+ * @param ability - The CASL ability to use
+ * @param metadataMap - Map of service names to their authorization metadata
+ * @returns Function that wraps services with authorization
+ */
+export declare function createServiceWrapper<T extends BaseAbility = BaseAbility>(ability: T, metadataMap: Record<string, ServiceAuthMetadata>): <S extends object>(serviceName: string, service: S) => S;
+//# sourceMappingURL=service-proxy.d.ts.map

package/dist/authorization/service-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-proxy.d.ts","sourceRoot":"","sources":["../../src/authorization/service-proxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,OAAO,EAAE,CAAC,EACV,OAAO,EAAE,wBAAwB,GAChC,CAAC,CAmDH;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,mBAAmB,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EACtE,OAAO,EAAE,CAAC,EACV,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC/C,CAAC,CAAC,SAAS,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAW1D"}

package/dist/authorization/service-proxy.js

@@ -0,0 +1,110 @@
+import { ForbiddenError, subject } from '@casl/ability';
+/**
+ * Creates a transparent proxy around a service that automatically
+ * checks CASL permissions before executing methods.
+ *
+ * **⚠️ DEPRECATED: Use the hooks system instead!**
+ *
+ * This function is deprecated in favor of the more flexible hooks system.
+ * Instead of manually wrapping services, configure authorization globally:
+ *
+ * ```typescript
+ * // NEW APPROACH (Recommended):
+ * import { authorizationHook, defineServiceMetadata, defineAuthorize } from 'glasswork';
+ *
+ * const authServiceMeta = defineServiceMetadata({
+ *   deleteSession: {
+ *     authorize: defineAuthorize('delete', 'Session')
+ *   }
+ * });
+ *
+ * bootstrap(AppModule, {
+ *   serviceHooks: [authorizationHook],
+ *   serviceMetadata: { authService: authServiceMeta }
+ * });
+ *
+ * // In routes - services are automatically authorized!
+ * await services.authService.deleteSession(token);
+ * ```
+ *
+ * @deprecated Use hooks system with authorizationHook instead
+ * @see {@link https://github.com/rolandboon/glasswork/blob/main/HOOKS_SYSTEM.md}
+ *
+ * @param service - The service instance to wrap
+ * @param options - Authorization configuration
+ * @returns Proxied service with automatic authorization
+ */
+export function withAuthorization(service, options) {
+    const { ability, metadata, onUnauthorized } = options;
+    return new Proxy(service, {
+        get(target, prop) {
+            // Only intercept function calls
+            if (typeof prop !== 'string') {
+                return Reflect.get(target, prop);
+            }
+            const originalMethod = Reflect.get(target, prop);
+            // If it's not a function, return as-is
+            if (typeof originalMethod !== 'function') {
+                return originalMethod;
+            }
+            // Check if this method has authorization metadata
+            const authMeta = metadata[prop];
+            // If no metadata, return original method (no authorization)
+            if (!authMeta) {
+                return originalMethod.bind(target);
+            }
+            // Return wrapped method with authorization
+            return function (...args) {
+                const { action, subject: subjectType, getSubject } = authMeta;
+                // Get subject data if extractor provided
+                const subjectData = getSubject ? getSubject(...args) : undefined;
+                // Check authorization using CASL
+                try {
+                    ForbiddenError.from(ability).throwUnlessCan(action, subject(subjectType, subjectData || {}));
+                }
+                catch (error) {
+                    if (onUnauthorized) {
+                        onUnauthorized(prop, args);
+                        throw error; // Still throw after custom handler
+                    }
+                    throw error;
+                }
+                // Authorization passed - execute original method
+                return originalMethod.apply(target, args);
+            };
+        },
+    });
+}
+/**
+ * Helper to define service authorization metadata.
+ *
+ * **⚠️ DEPRECATED: Use `defineServiceMetadata` and `defineAuthorize` from hooks system instead!**
+ *
+ * @deprecated Use `defineServiceMetadata` with `defineAuthorize` from hooks module
+ * @param metadata - Service authorization metadata
+ * @returns The same metadata (identity function)
+ */
+export function defineServiceAuth(metadata) {
+    return metadata;
+}
+/**
+ * Creates a factory function that wraps services with authorization.
+ *
+ * **⚠️ DEPRECATED: Use hooks system configured in bootstrap instead!**
+ *
+ * @deprecated Configure authorization globally with serviceHooks in bootstrap
+ * @param ability - The CASL ability to use
+ * @param metadataMap - Map of service names to their authorization metadata
+ * @returns Function that wraps services with authorization
+ */
+export function createServiceWrapper(ability, metadataMap) {
+    return (serviceName, service) => {
+        const metadata = metadataMap[serviceName];
+        if (!metadata) {
+            // No metadata, return unwrapped service
+            return service;
+        }
+        return withAuthorization(service, { ability, metadata });
+    };
+}
+//# sourceMappingURL=service-proxy.js.map