odgn-rights 0.2.0 → 0.5.1

package/dist/adapters/index.d.ts

@@ -0,0 +1,11 @@
+export type { BaseAdapterOptions, DatabaseAdapter, RightsRow, RoleInheritanceRow, RoleRightRow, RoleRow, SubjectRightRow, SubjectRoleRow, SubjectRow, TableNames } from './types';
+export { createTableNames, DEFAULT_TABLE_PREFIX, generatePostgresDropSchema, generatePostgresSchema, generateSQLiteDropSchema, generateSQLiteSchema } from './schema';
+export { BaseAdapter } from './base-adapter';
+export { SQLiteAdapter } from './sqlite-adapter';
+export type { SQLiteAdapterOptions } from './sqlite-adapter';
+export { PostgresAdapter } from './postgres-adapter';
+export type { PostgresAdapterOptions } from './postgres-adapter';
+export { RedisAdapter } from './redis-adapter';
+export type { RedisAdapterOptions } from './redis-adapter';
+export { createPostgresRegistry, createPostgresRights, createRedisRegistry, createRedisRights, createSQLiteRegistry, createSQLiteRights } from './factories';
+export type { CreatePostgresRegistryOptions, CreateRedisRightsOptions, CreateSQLiteRightsOptions } from './factories';

package/dist/adapters/index.js

@@ -0,0 +1,12 @@
+// Schema utilities
+export { createTableNames, DEFAULT_TABLE_PREFIX, generatePostgresDropSchema, generatePostgresSchema, generateSQLiteDropSchema, generateSQLiteSchema } from './schema';
+// Base adapter
+export { BaseAdapter } from './base-adapter';
+// SQLite adapter
+export { SQLiteAdapter } from './sqlite-adapter';
+// PostgreSQL adapter
+export { PostgresAdapter } from './postgres-adapter';
+// Redis adapter
+export { RedisAdapter } from './redis-adapter';
+// Factory functions
+export { createPostgresRegistry, createPostgresRights, createRedisRegistry, createRedisRights, createSQLiteRegistry, createSQLiteRights } from './factories';

package/dist/adapters/postgres-adapter.d.ts

@@ -0,0 +1,51 @@
+import { Flags } from '../constants';
+import { Right } from '../right';
+import { Rights } from '../rights';
+import { Role } from '../role';
+import { RoleRegistry } from '../role-registry';
+import { Subject } from '../subject';
+import { BaseAdapter } from './base-adapter';
+import type { BaseAdapterOptions, DatabaseAdapter } from './types';
+export type PostgresAdapterOptions = BaseAdapterOptions & {
+    database?: string;
+    hostname?: string;
+    idleTimeout?: number;
+    max?: number;
+    password?: string;
+    port?: number;
+    ssl?: boolean | object;
+    url?: string;
+    username?: string;
+};
+export declare class PostgresAdapter extends BaseAdapter {
+    private sql;
+    private readonly options;
+    private transactionDepth;
+    constructor(options?: PostgresAdapterOptions);
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    migrate(): Promise<void>;
+    saveRight(right: Right): Promise<number>;
+    saveRights(rights: Rights): Promise<number[]>;
+    loadRight(id: number): Promise<Right | null>;
+    loadRights(): Promise<Rights>;
+    loadRightsByPath(pathPattern: string): Promise<Rights>;
+    deleteRight(id: number): Promise<boolean>;
+    saveRole(role: Role): Promise<number>;
+    loadRole(name: string): Promise<Role | null>;
+    loadRoles(): Promise<Role[]>;
+    deleteRole(name: string): Promise<boolean>;
+    saveRegistry(registry: RoleRegistry): Promise<void>;
+    loadRegistry(): Promise<RoleRegistry>;
+    saveSubject(identifier: string, subject: Subject): Promise<number>;
+    loadSubject(identifier: string): Promise<Subject | null>;
+    deleteSubject(identifier: string): Promise<boolean>;
+    protected getAllSubjectIdentifiers(): Promise<string[]>;
+    /**
+     * Optimized findSubjectsWithAccess using batch loading with JOINs.
+     * Reduces N+1 queries to a constant number of queries regardless of subject count.
+     */
+    findSubjectsWithAccess(pathPattern: string, flags: Flags): Promise<string[]>;
+    clear(): Promise<void>;
+    transaction<T>(fn: (adapter: DatabaseAdapter) => Promise<T>): Promise<T>;
+}

package/dist/adapters/postgres-adapter.js

@@ -0,0 +1,471 @@
+import { SQL } from 'bun';
+import { Flags } from '../constants';
+import { Right } from '../right';
+import { Rights } from '../rights';
+import { Role } from '../role';
+import { RoleRegistry } from '../role-registry';
+import { Subject } from '../subject';
+import { BaseAdapter } from './base-adapter';
+import { generatePostgresSchema } from './schema';
+export class PostgresAdapter extends BaseAdapter {
+    constructor(options = {}) {
+        super(options);
+        this.sql = null;
+        this.transactionDepth = 0;
+        this.options = options;
+    }
+    async connect() {
+        this.sql = this.options.url
+            ? new SQL({
+                idleTimeout: this.options.idleTimeout ?? 30,
+                max: this.options.max ?? 1,
+                ssl: this.options.ssl,
+                url: this.options.url
+            })
+            : new SQL({
+                database: this.options.database,
+                hostname: this.options.hostname ?? 'localhost',
+                idleTimeout: this.options.idleTimeout ?? 30,
+                max: this.options.max ?? 1,
+                password: this.options.password,
+                port: this.options.port ?? 5432,
+                ssl: this.options.ssl,
+                username: this.options.username
+            });
+    }
+    async disconnect() {
+        if (this.sql) {
+            await this.sql.end();
+            this.sql = null;
+        }
+    }
+    async migrate() {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        await this.sql.unsafe(generatePostgresSchema(this.tables));
+    }
+    // ===========================================================================
+    // Rights Operations
+    // ===========================================================================
+    async saveRight(right) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const row = this.rightToRow(right);
+        const { rights: rightsTable } = this.tables;
+        const [result] = await this.sql.unsafe(`
+      INSERT INTO ${rightsTable} (path, allow_mask, deny_mask, priority, description, tags, valid_from, valid_until)
+      VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+      ON CONFLICT (path, allow_mask, deny_mask, priority, valid_from, valid_until)
+      DO UPDATE SET updated_at = NOW()
+      RETURNING id
+    `, [
+            row.path,
+            row.allow_mask,
+            row.deny_mask,
+            row.priority,
+            row.description,
+            row.tags,
+            row.valid_from,
+            row.valid_until
+        ]);
+        right._setDbId(result.id);
+        return result.id;
+    }
+    async saveRights(rights) {
+        const ids = [];
+        await this.transaction(async () => {
+            for (const right of rights.allRights()) {
+                const id = await this.saveRight(right);
+                ids.push(id);
+            }
+        });
+        return ids;
+    }
+    async loadRight(id) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights: rightsTable } = this.tables;
+        const [row] = await this.sql.unsafe(`SELECT * FROM ${rightsTable} WHERE id = $1`, [id]);
+        if (!row) {
+            return null;
+        }
+        return this.rowToRight(row);
+    }
+    async loadRights() {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights: rightsTable } = this.tables;
+        const rows = await this.sql.unsafe(`SELECT * FROM ${rightsTable} ORDER BY id`);
+        const loadedRights = new Rights();
+        for (const row of rows) {
+            loadedRights.add(this.rowToRight(row));
+        }
+        return loadedRights;
+    }
+    async loadRightsByPath(pathPattern) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights: rightsTable } = this.tables;
+        const pattern = pathPattern.replaceAll('*', '%').replaceAll('?', '_');
+        const rows = await this.sql.unsafe(`SELECT * FROM ${rightsTable} WHERE path LIKE $1 ORDER BY id`, [pattern]);
+        const loadedRights = new Rights();
+        for (const row of rows) {
+            loadedRights.add(this.rowToRight(row));
+        }
+        return loadedRights;
+    }
+    async deleteRight(id) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights: rightsTable } = this.tables;
+        const result = await this.sql.unsafe(`DELETE FROM ${rightsTable} WHERE id = $1`, [id]);
+        return result.count > 0;
+    }
+    // ===========================================================================
+    // Role Operations
+    // ===========================================================================
+    async saveRole(role) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { roleInheritance, roleRights, roles } = this.tables;
+        return this.transaction(async () => {
+            const [roleResult] = await this.sql.unsafe(`
+        INSERT INTO ${roles} (name)
+        VALUES ($1)
+        ON CONFLICT (name) DO UPDATE SET updated_at = NOW()
+        RETURNING id
+      `, [role.name]);
+            const roleId = roleResult.id;
+            await this.sql.unsafe(`DELETE FROM ${roleRights} WHERE role_id = $1`, [
+                roleId
+            ]);
+            await this.sql.unsafe(`DELETE FROM ${roleInheritance} WHERE child_role_id = $1`, [roleId]);
+            for (const right of role.rights.allRights()) {
+                const rightId = await this.saveRight(right);
+                await this.sql.unsafe(`INSERT INTO ${roleRights} (role_id, right_id) VALUES ($1, $2)`, [roleId, rightId]);
+            }
+            for (const parent of role.parents) {
+                const parentId = await this.saveRole(parent);
+                await this.sql.unsafe(`INSERT INTO ${roleInheritance} (child_role_id, parent_role_id) VALUES ($1, $2)`, [roleId, parentId]);
+            }
+            return roleId;
+        });
+    }
+    async loadRole(name) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { roleRights, roles } = this.tables;
+        const [roleRow] = await this.sql.unsafe(`SELECT * FROM ${roles} WHERE name = $1`, [name]);
+        if (!roleRow) {
+            return null;
+        }
+        const rights = new Rights();
+        const roleRightRows = await this.sql.unsafe(`SELECT right_id FROM ${roleRights} WHERE role_id = $1`, [roleRow.id]);
+        for (const rr of roleRightRows) {
+            const right = await this.loadRight(rr.right_id);
+            if (right) {
+                rights.add(right);
+            }
+        }
+        return new Role(name, rights);
+    }
+    async loadRoles() {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { roles: rolesTable } = this.tables;
+        const roleRows = await this.sql.unsafe(`SELECT * FROM ${rolesTable} ORDER BY id`);
+        const loadedRoles = [];
+        for (const row of roleRows) {
+            const role = await this.loadRole(row.name);
+            if (role) {
+                loadedRoles.push(role);
+            }
+        }
+        return loadedRoles;
+    }
+    async deleteRole(name) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { roles } = this.tables;
+        const result = await this.sql.unsafe(`DELETE FROM ${roles} WHERE name = $1`, [name]);
+        return result.count > 0;
+    }
+    // ===========================================================================
+    // RoleRegistry Operations
+    // ===========================================================================
+    async saveRegistry(registry) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        await this.transaction(async () => {
+            const rolesToSave = new Map();
+            const collectRoles = (role) => {
+                if (!rolesToSave.has(role.name)) {
+                    rolesToSave.set(role.name, role);
+                    for (const parent of role.parents) {
+                        collectRoles(parent);
+                    }
+                }
+            };
+            registry.toJSON().forEach(roleJson => {
+                const role = registry.get(roleJson.name);
+                if (role) {
+                    collectRoles(role);
+                }
+            });
+            for (const role of rolesToSave.values()) {
+                await this.saveRole(role);
+            }
+        });
+    }
+    async loadRegistry() {
+        const registry = new RoleRegistry();
+        const roles = await this.loadRoles();
+        const roleMap = new Map();
+        for (const role of roles) {
+            // Define the role in the registry and get the registered role back
+            const registeredRole = registry.define(role.name, role.rights);
+            const { roles: rolesTable } = this.tables;
+            const [roleRow] = await this.sql.unsafe(`SELECT id FROM ${rolesTable} WHERE name = $1`, [role.name]);
+            if (roleRow) {
+                // Store the registered role, not the original loaded role
+                roleMap.set(role.name, { id: roleRow.id, role: registeredRole });
+            }
+        }
+        const { roleInheritance } = this.tables;
+        const inheritRows = await this.sql.unsafe(`SELECT child_role_id, parent_role_id FROM ${roleInheritance}`);
+        for (const ir of inheritRows) {
+            const inheritanceRow = ir;
+            let childRole;
+            let parentRole;
+            for (const [, data] of roleMap.entries()) {
+                if (data.id === inheritanceRow.child_role_id) {
+                    childRole = data.role;
+                }
+                if (data.id === inheritanceRow.parent_role_id) {
+                    parentRole = data.role;
+                }
+            }
+            if (childRole && parentRole) {
+                childRole.inheritsFrom(parentRole);
+            }
+        }
+        return registry;
+    }
+    // ===========================================================================
+    // Subject Operations
+    // ===========================================================================
+    async saveSubject(identifier, subject) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { subjectRights, subjectRoles, subjects } = this.tables;
+        return this.transaction(async () => {
+            const [subjectResult] = await this.sql.unsafe(`
+        INSERT INTO ${subjects} (identifier)
+        VALUES ($1)
+        ON CONFLICT (identifier) DO UPDATE SET updated_at = NOW()
+        RETURNING id
+      `, [identifier]);
+            const subjectId = subjectResult.id;
+            await this.sql.unsafe(`DELETE FROM ${subjectRoles} WHERE subject_id = $1`, [subjectId]);
+            await this.sql.unsafe(`DELETE FROM ${subjectRights} WHERE subject_id = $1`, [subjectId]);
+            for (const role of subject.roles) {
+                const roleId = await this.saveRole(role);
+                await this.sql.unsafe(`INSERT INTO ${subjectRoles} (subject_id, role_id) VALUES ($1, $2)`, [subjectId, roleId]);
+            }
+            for (const right of subject.rights.allRights()) {
+                const rightId = await this.saveRight(right);
+                await this.sql.unsafe(`INSERT INTO ${subjectRights} (subject_id, right_id) VALUES ($1, $2)`, [subjectId, rightId]);
+            }
+            return subjectId;
+        });
+    }
+    async loadSubject(identifier) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { roles, subjectRights, subjectRoles, subjects } = this.tables;
+        const [subjectRow] = await this.sql.unsafe(`SELECT * FROM ${subjects} WHERE identifier = $1`, [identifier]);
+        if (!subjectRow) {
+            return null;
+        }
+        const subject = new Subject();
+        const subjectRoleRows = await this.sql.unsafe(`SELECT role_id FROM ${subjectRoles} WHERE subject_id = $1`, [subjectRow.id]);
+        for (const sr of subjectRoleRows) {
+            const subjectRoleRow = sr;
+            const [roleName] = await this.sql.unsafe(`SELECT name FROM ${roles} WHERE id = $1`, [subjectRoleRow.role_id]);
+            if (roleName) {
+                const role = await this.loadRole(roleName.name);
+                if (role) {
+                    subject.memberOf(role);
+                }
+            }
+        }
+        const subjectRightRows = await this.sql.unsafe(`SELECT right_id FROM ${subjectRights} WHERE subject_id = $1`, [subjectRow.id]);
+        for (const sr of subjectRightRows) {
+            const subjectRightRow = sr;
+            const right = await this.loadRight(subjectRightRow.right_id);
+            if (right) {
+                subject.rights.add(right);
+            }
+        }
+        return subject;
+    }
+    async deleteSubject(identifier) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { subjects } = this.tables;
+        const result = await this.sql.unsafe(`DELETE FROM ${subjects} WHERE identifier = $1`, [identifier]);
+        return result.count > 0;
+    }
+    async getAllSubjectIdentifiers() {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { subjects } = this.tables;
+        const rows = (await this.sql.unsafe(`SELECT identifier FROM ${subjects}`));
+        return rows.map(row => row.identifier);
+    }
+    /**
+     * Optimized findSubjectsWithAccess using batch loading with JOINs.
+     * Reduces N+1 queries to a constant number of queries regardless of subject count.
+     */
+    async findSubjectsWithAccess(pathPattern, flags) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights, roleRights, roles, subjectRights, subjectRoles, subjects } = this.tables;
+        // Load all subjects with their data in batch queries
+        const subjectRows = await this.sql.unsafe(`SELECT id, identifier FROM ${subjects}`);
+        if (subjectRows.length === 0) {
+            return [];
+        }
+        // Create a map of subject id -> identifier for quick lookup
+        const subjectIdToIdentifier = new Map();
+        for (const row of subjectRows) {
+            const { id, identifier } = row;
+            subjectIdToIdentifier.set(id, identifier);
+        }
+        // Batch load all subject-role mappings with role names
+        const subjectRoleRows = await this.sql.unsafe(`SELECT sr.subject_id, r.name as role_name
+       FROM ${subjectRoles} sr
+       JOIN ${roles} r ON sr.role_id = r.id`);
+        // Batch load all subject direct rights
+        const subjectRightRows = await this.sql.unsafe(`SELECT sr.subject_id, rt.*
+       FROM ${subjectRights} sr
+       JOIN ${rights} rt ON sr.right_id = rt.id`);
+        // Batch load all role rights
+        const roleRightRows = await this.sql.unsafe(`SELECT r.name as role_name, rt.*
+       FROM ${roleRights} rr
+       JOIN ${roles} r ON rr.role_id = r.id
+       JOIN ${rights} rt ON rr.right_id = rt.id`);
+        // Build role -> rights mapping
+        const roleRightsMap = new Map();
+        for (const row of roleRightRows) {
+            const { role_name, ...rightData } = row;
+            if (!roleRightsMap.has(role_name)) {
+                roleRightsMap.set(role_name, new Rights());
+            }
+            roleRightsMap
+                .get(role_name)
+                .add(this.rowToRight(rightData));
+        }
+        // Build subject -> roles mapping
+        const subjectRolesMap = new Map();
+        for (const row of subjectRoleRows) {
+            const { role_name, subject_id } = row;
+            if (!subjectRolesMap.has(subject_id)) {
+                subjectRolesMap.set(subject_id, []);
+            }
+            subjectRolesMap.get(subject_id).push(role_name);
+        }
+        // Build subject -> direct rights mapping
+        const subjectDirectRightsMap = new Map();
+        for (const row of subjectRightRows) {
+            const { subject_id, ...rightData } = row;
+            if (!subjectDirectRightsMap.has(subject_id)) {
+                subjectDirectRightsMap.set(subject_id, new Rights());
+            }
+            subjectDirectRightsMap
+                .get(subject_id)
+                .add(this.rowToRight(rightData));
+        }
+        // Now construct Subject objects and check access
+        const matchingSubjects = [];
+        for (const [subjectId, identifier] of subjectIdToIdentifier) {
+            const subject = new Subject();
+            // Add roles with their rights
+            const roleNames = subjectRolesMap.get(subjectId) ?? [];
+            for (const roleName of roleNames) {
+                const roleRights = roleRightsMap.get(roleName) ?? new Rights();
+                const role = new Role(roleName, roleRights);
+                subject.memberOf(role);
+            }
+            // Add direct rights
+            const directRights = subjectDirectRightsMap.get(subjectId);
+            if (directRights) {
+                for (const right of directRights.allRights()) {
+                    subject.rights.add(right);
+                }
+            }
+            // Check if subject has the requested access
+            if (subject.has(pathPattern, flags)) {
+                matchingSubjects.push(identifier);
+            }
+        }
+        return matchingSubjects;
+    }
+    // ===========================================================================
+    // Utility
+    // ===========================================================================
+    async clear() {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const { rights, roleInheritance, roleRights, roles, subjectRights, subjectRoles, subjects } = this.tables;
+        await this.sql.unsafe(`DELETE FROM ${subjectRights}`);
+        await this.sql.unsafe(`DELETE FROM ${subjectRoles}`);
+        await this.sql.unsafe(`DELETE FROM ${subjects}`);
+        await this.sql.unsafe(`DELETE FROM ${roleInheritance}`);
+        await this.sql.unsafe(`DELETE FROM ${roleRights}`);
+        await this.sql.unsafe(`DELETE FROM ${roles}`);
+        await this.sql.unsafe(`DELETE FROM ${rights}`);
+    }
+    async transaction(fn) {
+        if (!this.sql) {
+            throw new Error('Not connected');
+        }
+        const isNested = this.transactionDepth > 0;
+        if (!isNested) {
+            await this.sql.unsafe('BEGIN');
+        }
+        this.transactionDepth++;
+        try {
+            const result = await fn(this);
+            this.transactionDepth--;
+            if (!isNested) {
+                await this.sql.unsafe('COMMIT');
+            }
+            return result;
+        }
+        catch (error) {
+            this.transactionDepth--;
+            if (!isNested) {
+                await this.sql.unsafe('ROLLBACK');
+            }
+            throw error;
+        }
+    }
+}

package/dist/adapters/redis-adapter.d.ts

@@ -0,0 +1,84 @@
+import { Flags } from '../constants';
+import { Right } from '../right';
+import { Rights } from '../rights';
+import { Role } from '../role';
+import { RoleRegistry } from '../role-registry';
+import { Subject } from '../subject';
+import { BaseAdapter } from './base-adapter';
+import type { BaseAdapterOptions, DatabaseAdapter } from './types';
+export type RedisAdapterOptions = BaseAdapterOptions & {
+    db?: number;
+    host?: string;
+    keyPrefix?: string;
+    lazyConnect?: boolean;
+    password?: string;
+    port?: number;
+    tls?: object;
+    url?: string;
+};
+/**
+ * Redis key structure:
+ *
+ * Rights:
+ *   {prefix}rights:{id}           → Hash { path, allow_mask, deny_mask, description, tags, valid_from, valid_until, created_at, updated_at }
+ *   {prefix}rights:_seq           → String (auto-increment counter)
+ *   {prefix}rights:_all           → Set of all right IDs
+ *   {prefix}rights:_unique:{hash} → String (right ID for unique constraint lookup)
+ *
+ * Roles:
+ *   {prefix}roles:{name}          → Hash { name, created_at, updated_at }
+ *   {prefix}roles:_all            → Set of all role names
+ *   {prefix}roles:{name}:rights   → Set of right IDs
+ *   {prefix}roles:{name}:parents  → Set of parent role names
+ *
+ * Subjects:
+ *   {prefix}subjects:{identifier}         → Hash { identifier, id, created_at, updated_at }
+ *   {prefix}subjects:_all                 → Set of all subject identifiers
+ *   {prefix}subjects:_seq                 → String (auto-increment counter for subject IDs)
+ *   {prefix}subjects:{identifier}:roles   → Set of role names
+ *   {prefix}subjects:{identifier}:rights  → Set of right IDs
+ */
+export declare class RedisAdapter extends BaseAdapter {
+    private redis;
+    private readonly options;
+    private transactionDepth;
+    constructor(options?: RedisAdapterOptions);
+    /**
+     * Generate a Redis key with the configured prefix
+     */
+    private key;
+    /**
+     * Generate a unique hash for a right's unique constraint fields
+     */
+    private rightUniqueHash;
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    migrate(): Promise<void>;
+    saveRight(right: Right): Promise<number>;
+    saveRights(rights: Rights): Promise<number[]>;
+    loadRight(id: number): Promise<Right | null>;
+    loadRights(): Promise<Rights>;
+    loadRightsByPath(pathPattern: string): Promise<Rights>;
+    deleteRight(id: number): Promise<boolean>;
+    saveRole(role: Role): Promise<number>;
+    loadRole(name: string): Promise<Role | null>;
+    loadRoles(): Promise<Role[]>;
+    deleteRole(name: string): Promise<boolean>;
+    saveRegistry(registry: RoleRegistry): Promise<void>;
+    loadRegistry(): Promise<RoleRegistry>;
+    saveSubject(identifier: string, subject: Subject): Promise<number>;
+    loadSubject(identifier: string): Promise<Subject | null>;
+    deleteSubject(identifier: string): Promise<boolean>;
+    protected getAllSubjectIdentifiers(): Promise<string[]>;
+    /**
+     * Optimized findSubjectsWithAccess using batch loading with Redis pipeline.
+     * Reduces N+1 queries to a constant number of Redis operations regardless of subject count.
+     */
+    findSubjectsWithAccess(pathPattern: string, flags: Flags): Promise<string[]>;
+    clear(): Promise<void>;
+    transaction<T>(fn: (adapter: DatabaseAdapter) => Promise<T>): Promise<T>;
+    /**
+     * Convert Redis hash data to a RightsRow
+     */
+    private hashToRightsRow;
+}