vona-module-a-rbac 5.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016-present Cabloy/Vona/Zova
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/.metadata/index.d.ts

@@ -0,0 +1,110 @@
+/** guard: begin */
+export * from '../bean/guard.rbac.ts';
+import type { IGuardOptionsRbac } from '../bean/guard.rbac.ts';
+import 'vona-module-a-aspect';
+declare module 'vona-module-a-aspect' {
+    interface IGuardRecordLocal {
+        'a-rbac:rbac': IGuardOptionsRbac;
+    }
+}
+declare module 'vona-module-a-rbac' {
+    interface GuardRbac {
+    }
+    interface GuardRbac {
+        get $beanFullName(): 'a-rbac.guard.rbac';
+        get $onionName(): 'a-rbac:rbac';
+        get $onionOptions(): IGuardOptionsRbac;
+    }
+}
+/** guard: end */
+/** bean: begin */
+export * from '../bean/bean.rbacCatalog.ts';
+export * from '../bean/bean.rbacScope.ts';
+import 'vona';
+declare module 'vona' {
+}
+declare module 'vona-module-a-rbac' {
+    interface BeanRbacCatalog {
+    }
+    interface BeanRbacScope {
+    }
+}
+/** bean: end */
+/** bean: begin */
+import type { BeanRbacCatalog } from '../bean/bean.rbacCatalog.ts';
+import type { BeanRbacScope } from '../bean/bean.rbacScope.ts';
+import 'vona';
+declare module 'vona' {
+    interface IBeanRecordGlobal {
+        'rbacCatalog': BeanRbacCatalog;
+        'rbacScope': BeanRbacScope;
+    }
+}
+/** bean: end */
+/** event: begin */
+export * from '../bean/event.policyInvalidated.ts';
+export * from '../bean/event.resolvePolicy.ts';
+import 'vona';
+declare module 'vona' {
+}
+declare module 'vona-module-a-rbac' {
+    interface EventPolicyInvalidated {
+    }
+    interface EventPolicyInvalidated {
+        get $beanFullName(): 'a-rbac.event.policyInvalidated';
+        get $onionName(): 'a-rbac:policyInvalidated';
+    }
+    interface EventResolvePolicy {
+    }
+    interface EventResolvePolicy {
+        get $beanFullName(): 'a-rbac.event.resolvePolicy';
+        get $onionName(): 'a-rbac:resolvePolicy';
+    }
+}
+/** event: end */
+/** event: begin */
+import type { EventPolicyInvalidated } from '../bean/event.policyInvalidated.ts';
+import type { EventResolvePolicy } from '../bean/event.resolvePolicy.ts';
+export interface IModuleEvent {
+    'policyInvalidated': EventPolicyInvalidated;
+    'resolvePolicy': EventResolvePolicy;
+}
+/** event: end */
+/** event: begin */
+import type { TypeEventPolicyInvalidatedData, TypeEventPolicyInvalidatedResult } from '../bean/event.policyInvalidated.ts';
+import type { TypeEventResolvePolicyData, TypeEventResolvePolicyResult } from '../bean/event.resolvePolicy.ts';
+import type { EventOn } from 'vona-module-a-event';
+declare module 'vona-module-a-event' {
+    interface IEventRecord {
+        'a-rbac:policyInvalidated': EventOn<TypeEventPolicyInvalidatedData, TypeEventPolicyInvalidatedResult>;
+        'a-rbac:resolvePolicy': EventOn<TypeEventResolvePolicyData, TypeEventResolvePolicyResult>;
+    }
+}
+/** event: end */
+/** config: begin */
+export * from '../config/config.ts';
+import type { config } from '../config/config.ts';
+/** config: end */
+/** scope: begin */
+import { BeanScopeBase, type BeanScopeUtil, type TypeModuleConfig } from 'vona';
+export declare class ScopeModuleARbac extends BeanScopeBase {
+}
+export interface ScopeModuleARbac {
+    util: BeanScopeUtil;
+    config: TypeModuleConfig<typeof config>;
+    event: IModuleEvent;
+}
+import 'vona';
+declare module 'vona' {
+    interface IBeanScopeRecord {
+        'a-rbac': ScopeModuleARbac;
+    }
+    interface IBeanScopeContainer {
+        rbac: ScopeModuleARbac;
+    }
+    interface IBeanScopeConfig {
+        'a-rbac': ReturnType<typeof config>;
+    }
+}
+/** scope: end */
+//# sourceMappingURL=index.d.ts.map

package/dist/.metadata/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/.metadata/index.ts"],"names":[],"mappings":"AACA,mBAAmB;AACnB,cAAc,uBAAuB,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,sBAAsB,CAAC;AAC9B,OAAO,QAAQ,sBAAsB,CAAC;IAGtC,UAAiB,iBAAiB;QAChC,aAAa,EAAE,iBAAiB,CAAC;KAClC;CAEA;AACD,OAAO,QAAQ,oBAAoB,CAAC;IAE5B,UAAiB,SAAS;KAGzB;IAEC,UAAiB,SAAS;QACxB,IAAI,aAAa,IAAI,mBAAmB,CAAC;QACzC,IAAI,UAAU,IAAI,aAAa,CAAC;QAChC,IAAI,aAAa,IAAI,iBAAiB,CAAC;KACxC;CACV;AACD,iBAAiB;AACjB,kBAAkB;AAClB,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAE1C,OAAO,MAAM,CAAC;AACd,OAAO,QAAQ,MAAM,CAAC;CAGrB;AACD,OAAO,QAAQ,oBAAoB,CAAC;IAE5B,UAAiB,eAAe;KAG/B;IAED,UAAiB,aAAa;KAG7B;CACR;AACD,gBAAgB;AAChB,kBAAkB;AAClB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,MAAM,CAAC;AACd,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAiB,iBAAiB;QAChC,aAAa,EAAE,eAAe,CAAC;QAC/B,WAAW,EAAE,aAAa,CAAC;KAC5B;CACF;AACD,gBAAgB;AAChB,mBAAmB;AACnB,cAAc,oCAAoC,CAAC;AACnD,cAAc,gCAAgC,CAAC;AAE/C,OAAO,MAAM,CAAC;AACd,OAAO,QAAQ,MAAM,CAAC;CAGrB;AACD,OAAO,QAAQ,oBAAoB,CAAC;IAE5B,UAAiB,sBAAsB;KAGtC;IAEC,UAAiB,sBAAsB;QACrC,IAAI,aAAa,IAAI,gCAAgC,CAAC;QACtD,IAAI,UAAU,IAAI,0BAA0B,CAAC;KAC9C;IAEH,UAAiB,kBAAkB;KAGlC;IAEC,UAAiB,kBAAkB;QACjC,IAAI,aAAa,IAAI,4BAA4B,CAAC;QAClD,IAAI,UAAU,IAAI,sBAAsB,CAAC;KAC1C;CACV;AACD,iBAAiB;AACjB,mBAAmB;AACnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,MAAM,WAAW,YAAY;IAC3B,mBAAmB,EAAE,sBAAsB,CAAC;IAC9C,eAAe,EAAE,kBAAkB,CAAC;CACnC;AACD,iBAAiB;AACjB,mBAAmB;AACnB,OAAO,KAAK,EAAE,8BAA8B,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAC3H,OAAO,KAAK,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC/G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAiB,YAAY;QAC3B,0BAA0B,EAAE,OAAO,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;QAC1G,sBAAsB,EAAE,OAAO,CAAC,0BAA0B,EAAE,4BAA4B,CAAC,CAAC;KACvF;CACF;AACD,iBAAiB;AACjB,oBAAoB;AACpB,cAAc,qBAAqB,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,kBAAkB;AAClB,mBAAmB;AACnB,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAGhF,qBACa,gBAAiB,SAAQ,aAAa;CAAG;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC,OAAO,MAAM,CAAC,CAAC;IACxC,KAAK,EAAE,YAAY,CAAC;CACnB;AAED,OAAO,MAAM,CAAC;AACd,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAiB,gBAAgB;QAC/B,QAAQ,EAAE,gBAAgB,CAAC;KAC5B;IAED,UAAiB,mBAAmB;QAClC,IAAI,EAAE,gBAAgB,CAAC;KACxB;IAED,UAAiB,gBAAgB;QAC/B,QAAQ,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC;KACrC;CAKF;AACD,iBAAiB"}

package/dist/.metadata/this.d.ts

@@ -0,0 +1,3 @@
+export declare const __ThisModule__ = "a-rbac";
+export { ScopeModuleARbac as ScopeModule } from './index.ts';
+//# sourceMappingURL=this.d.ts.map

package/dist/.metadata/this.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"this.d.ts","sourceRoot":"","sources":["../../src/.metadata/this.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/bean/bean.rbacCatalog.d.ts

@@ -0,0 +1,13 @@
+import type { ContextRoute } from 'vona-module-a-web';
+import { BeanBase } from 'vona';
+import type { IRbacActionDescriptor } from '../types/rbac.ts';
+export declare class BeanRbacCatalog extends BeanBase {
+    private _catalog;
+    getAction(route: ContextRoute): IRbacActionDescriptor | undefined;
+    getCatalog(): ReadonlyMap<string, IRbacActionDescriptor>;
+    clear(): void;
+    private createCatalog;
+    private resolveActionInherit;
+    private resolveActionInheritKey;
+}
+//# sourceMappingURL=bean.rbacCatalog.d.ts.map

package/dist/bean/bean.rbacCatalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bean.rbacCatalog.d.ts","sourceRoot":"","sources":["../../src/bean/bean.rbacCatalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAA6B,QAAQ,EAAE,MAAM,MAAM,CAAC;AAI3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,qBACa,eAAgB,SAAQ,QAAQ;IAC3C,OAAO,CAAC,QAAQ,CAAiD;IAEjE,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,qBAAqB,GAAG,SAAS;IAIjE,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAKxD,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,uBAAuB;CA2BhC"}

package/dist/bean/bean.rbacScope.d.ts

@@ -0,0 +1,19 @@
+import { BeanBase } from 'vona';
+import type { IRbacScopeAccess } from '../types/scope.ts';
+export declare class BeanRbacScope extends BeanBase {
+    private _scopeAdapter;
+    isUnrestricted(): Promise<boolean>;
+    current(actionKey?: string): Promise<IRbacScopeAccess>;
+    private get scopeAdapter();
+    private prepareOwnerValues;
+    private createAccess;
+    private permissionProjection;
+    private where;
+    private scopeWhere;
+    private matches;
+    private resolveAction;
+    private isDecisionForAction;
+    private isValidTerms;
+    private termPredicates;
+}
+//# sourceMappingURL=bean.rbacScope.d.ts.map

package/dist/bean/bean.rbacScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bean.rbacScope.d.ts","sourceRoot":"","sources":["../../src/bean/bean.rbacScope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAA6B,MAAM,MAAM,CAAC;AAI3D,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAI7E,qBACa,aAAc,SAAQ,QAAQ;IACzC,OAAO,CAAC,aAAa,CAAgC;IAE/C,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAIlC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAe5D,OAAO,KAAK,YAAY,GASvB;YAEa,kBAAkB;IAgBhC,OAAO,CAAC,YAAY;IA8BpB,OAAO,CAAC,oBAAoB;IAgC5B,OAAO,CAAC,KAAK;IAab,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,OAAO;IAmBf,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,YAAY;IAiBpB,OAAO,CAAC,cAAc;CAYvB"}

package/dist/bean/event.policyInvalidated.d.ts

@@ -0,0 +1,11 @@
+import { BeanEventBase } from 'vona-module-a-event';
+export type TypeRbacPolicyInvalidationKind = 'policy' | 'role' | 'scopeTopology';
+export interface TypeEventPolicyInvalidatedData {
+    kind: TypeRbacPolicyInvalidationKind;
+    removedRoleIds?: string[];
+    removedScopeIds?: string[];
+}
+export type TypeEventPolicyInvalidatedResult = void;
+export declare class EventPolicyInvalidated extends BeanEventBase<TypeEventPolicyInvalidatedData, TypeEventPolicyInvalidatedResult> {
+}
+//# sourceMappingURL=event.policyInvalidated.d.ts.map

package/dist/bean/event.policyInvalidated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event.policyInvalidated.d.ts","sourceRoot":"","sources":["../../src/bean/event.policyInvalidated.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAS,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,8BAA8B,GAAG,QAAQ,GAAG,MAAM,GAAG,eAAe,CAAC;AAEjF,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,8BAA8B,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAEpD,qBACa,sBAAuB,SAAQ,aAAa,CACvD,8BAA8B,EAC9B,gCAAgC,CACjC;CAAG"}

package/dist/bean/event.resolvePolicy.d.ts

@@ -0,0 +1,7 @@
+import { BeanEventBase } from 'vona-module-a-event';
+import type { IRbacPolicyDecision, IRbacPolicyRequest } from '../types/rbac.ts';
+export type TypeEventResolvePolicyData = IRbacPolicyRequest;
+export type TypeEventResolvePolicyResult = IRbacPolicyDecision | undefined;
+export declare class EventResolvePolicy extends BeanEventBase<TypeEventResolvePolicyData, TypeEventResolvePolicyResult> {
+}
+//# sourceMappingURL=event.resolvePolicy.d.ts.map

package/dist/bean/event.resolvePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event.resolvePolicy.d.ts","sourceRoot":"","sources":["../../src/bean/event.resolvePolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAS,MAAM,qBAAqB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE5D,MAAM,MAAM,4BAA4B,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAE3E,qBACa,kBAAmB,SAAQ,aAAa,CACnD,0BAA0B,EAC1B,4BAA4B,CAC7B;CAAG"}

package/dist/bean/guard.rbac.d.ts

@@ -0,0 +1,17 @@
+import type { IDecoratorGuardOptions } from 'vona-module-a-aspect';
+import { GuardBase } from 'vona-module-a-aspect';
+export interface IGuardOptionsRbac extends IDecoratorGuardOptions {
+    dataScope?: boolean;
+    dataScopeField?: string;
+    dataScopeMineField?: string;
+    actionInherit?: string;
+}
+export declare class GuardRbac extends GuardBase {
+    check(options: IGuardOptionsRbac): Promise<boolean>;
+    private isValidDecision;
+    private isValidAction;
+    private isValidTerms;
+    private isValidTerm;
+    private isDepartmentDataScope;
+}
+//# sourceMappingURL=guard.rbac.d.ts.map

package/dist/bean/guard.rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.rbac.d.ts","sourceRoot":"","sources":["../../src/bean/guard.rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAS,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAWxD,MAAM,WAAW,iBAAkB,SAAQ,sBAAsB;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAIa,SAAU,SAAQ,SAAS;IAChC,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBzD,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,qBAAqB;CAO9B"}

package/dist/bean/index.d.ts

@@ -0,0 +1,6 @@
+export * from './bean.rbacCatalog.ts';
+export * from './bean.rbacScope.ts';
+export * from './event.policyInvalidated.ts';
+export * from './event.resolvePolicy.ts';
+export * from './guard.rbac.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/bean/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bean/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -0,0 +1,8 @@
+import type { VonaApplication } from 'vona';
+import type { IServiceRecord } from 'vona-module-a-bean';
+export declare function config(_app: VonaApplication): {
+    adapter: {
+        rbacScope: keyof IServiceRecord;
+    };
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,wBAAgB,MAAM,CAAC,IAAI,EAAE,eAAe;;mBAGM,MAAM,cAAc;;EAGrE"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './lib/index.ts';
+export * from './types/index.ts';
+export * from './.metadata/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,365 @@
+import { BeanInfo, beanFullNameFromOnionName, BeanBase, BeanScopeBase } from 'vona';
+import { __decorate } from 'tslib';
+import { Guard, GuardBase } from 'vona-module-a-aspect';
+import { Bean, Scope } from 'vona-module-a-bean';
+import { getCacheControllerRoutes } from 'vona-module-a-web';
+import { Event, BeanEventBase } from 'vona-module-a-event';
+
+const SymbolRbacDecision = Symbol('SymbolRbacDecision');
+function createRbacAllScopeDecision(action) {
+  return {
+    allowed: true,
+    actionKey: action.actionKey,
+    action,
+    terms: [{
+      dataScope: 'all'
+    }]
+  };
+}
+function createRbacCapability(key, allowed) {
+  return {
+    key,
+    allowed
+  };
+}
+function isRbacCapability(value) {
+  if (!value || typeof value !== 'object') return false;
+  const capability = value;
+  return Object.keys(capability).every(key => key === 'key' || key === 'allowed') && typeof capability.key === 'string' && capability.key.length > 0 && typeof capability.allowed === 'boolean';
+}
+function hasRbacAllScope(decision) {
+  return decision.terms?.some(term => term.dataScope === 'all') === true;
+}
+function rbacActionKey(controllerBeanFullName, action) {
+  return `${controllerBeanFullName}#${action}`;
+}
+function getRbacDecision(ctx) {
+  return ctx[SymbolRbacDecision];
+}
+function setRbacDecision(ctx, decision) {
+  ctx[SymbolRbacDecision] = decision;
+}
+function clearRbacDecision(ctx) {
+  delete ctx[SymbolRbacDecision];
+}
+
+let GuardRbac = class GuardRbac extends GuardBase {
+  async check(options) {
+    clearRbacDecision(this.ctx);
+    const action = this.bean.rbacCatalog.getAction(this.ctx.route);
+    if (!action) return false;
+    const effectiveAction = {
+      ...action,
+      options: {
+        ...action.options,
+        ...options
+      }
+    };
+    if (await this.bean.rbacScope.isUnrestricted()) {
+      setRbacDecision(this.ctx, createRbacAllScopeDecision(effectiveAction));
+      return true;
+    }
+    const decision = await this.scope.event.resolvePolicy.emit({
+      action: effectiveAction,
+      policyActionKey: action.actionInheritKey ?? action.actionKey
+    }, async () => undefined);
+    if (!this.isValidDecision(decision, effectiveAction) || !decision.allowed) return false;
+    setRbacDecision(this.ctx, {
+      ...decision,
+      action: effectiveAction
+    });
+    return true;
+  }
+  isValidDecision(decision, action) {
+    if (!decision || typeof decision !== 'object') return false;
+    const value = decision;
+    if (typeof value.allowed !== 'boolean' || value.actionKey !== action.actionKey) return false;
+    if (!this.isValidAction(value.action, action)) return false;
+    if (value.revision !== undefined && typeof value.revision !== 'string') return false;
+    if (value.terms !== undefined && !this.isValidTerms(value.terms)) return false;
+    return !value.allowed || !action.options.dataScope || this.isValidTerms(value.terms);
+  }
+  isValidAction(value, action) {
+    if (!value || typeof value !== 'object') return false;
+    const descriptor = value;
+    return descriptor.actionKey === action.actionKey && descriptor.actionInheritKey === action.actionInheritKey && descriptor.controllerBeanFullName === action.controllerBeanFullName && descriptor.action === action.action;
+  }
+  isValidTerms(value) {
+    return Array.isArray(value) && value.length > 0 && value.every(term => this.isValidTerm(term));
+  }
+  isValidTerm(value) {
+    if (!value || typeof value !== 'object') return false;
+    const term = value;
+    if (term.dataScope === 'all') return true;
+    if (term.dataScope === 'mine') {
+      return typeof term.ownerId === 'string' && term.ownerId.length > 0;
+    }
+    if (!this.isDepartmentDataScope(term.dataScope)) return false;
+    return Array.isArray(term.departmentIds) && term.departmentIds.length > 0 && term.departmentIds.every(id => typeof id === 'string' && id.length > 0);
+  }
+  isDepartmentDataScope(value) {
+    return ['customDepartments', 'ownDepartment', 'ownDepartmentAndDescendants'].includes(value);
+  }
+};
+GuardRbac = __decorate([Guard({
+  dataScopeField: 'departmentId',
+  dataScopeMineField: 'userIdOwner'
+}), BeanInfo({
+  module: "a-rbac"
+})], GuardRbac);
+
+const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+let BeanRbacCatalog = class BeanRbacCatalog extends BeanBase {
+  constructor(...args) {
+    super(...args);
+    this._catalog = void 0;
+  }
+  getAction(route) {
+    return this.getCatalog().get(rbacActionKey(route.controllerBeanFullName, route.action));
+  }
+  getCatalog() {
+    if (!this._catalog) this._catalog = this.createCatalog();
+    return this._catalog;
+  }
+  clear() {
+    this._catalog = undefined;
+  }
+  createCatalog() {
+    const catalog = new Map();
+    const routesByController = getCacheControllerRoutes(this.app);
+    for (const routes of Object.values(routesByController)) {
+      for (const route of routes) {
+        const options = route.route.meta?.[BeanFullNameGuardRbac];
+        if (!options) continue;
+        const actionKey = rbacActionKey(route.controllerBeanFullName, route.action);
+        catalog.set(actionKey, {
+          actionKey,
+          controllerBeanFullName: route.controllerBeanFullName,
+          action: route.action,
+          route,
+          options: Object.freeze({
+            ...options
+          })
+        });
+      }
+    }
+    this.resolveActionInherit(catalog, routesByController);
+    return catalog;
+  }
+  resolveActionInherit(catalog, routesByController) {
+    for (const descriptor of catalog.values()) {
+      if (!descriptor.options.actionInherit) continue;
+      const routes = routesByController[descriptor.controllerBeanFullName] ?? [];
+      const routesByAction = new Map(routes.map(route => [route.action, route]));
+      descriptor.actionInheritKey = this.resolveActionInheritKey(descriptor, catalog, routesByAction);
+    }
+  }
+  resolveActionInheritKey(descriptor, catalog, routesByAction) {
+    const seen = new Set([descriptor.actionKey]);
+    let current = descriptor;
+    while (current.options.actionInherit) {
+      const action = current.options.actionInherit;
+      if (action === current.action) {
+        throw new Error(`RBAC actionInherit cannot reference itself: ${current.actionKey}`);
+      }
+      const route = routesByAction.get(action);
+      if (!route) {
+        throw new Error(`RBAC actionInherit target not found: ${current.actionKey} -> ${action}`);
+      }
+      const targetKey = rbacActionKey(current.controllerBeanFullName, action);
+      if (seen.has(targetKey)) {
+        throw new Error(`RBAC actionInherit cycle: ${descriptor.actionKey}`);
+      }
+      seen.add(targetKey);
+      const target = catalog.get(targetKey);
+      if (!target) return targetKey;
+      current = target;
+    }
+    return current.actionKey;
+  }
+};
+BeanRbacCatalog = __decorate([Bean(), BeanInfo({
+  module: "a-rbac"
+})], BeanRbacCatalog);
+
+let BeanRbacScope = class BeanRbacScope extends BeanBase {
+  constructor(...args) {
+    super(...args);
+    this._scopeAdapter = void 0;
+  }
+  async isUnrestricted() {
+    return await this.scopeAdapter.isUnrestricted();
+  }
+  async current(actionKey) {
+    const action = this.resolveAction(actionKey);
+    if (!action) this.app.throw(403);
+    const decision = getRbacDecision(this.ctx);
+    if (!this.isDecisionForAction(decision, action)) this.app.throw(403);
+    const unrestricted = hasRbacAllScope(decision);
+    const ownerValues = action.action === 'create' ? await this.prepareOwnerValues(action, decision, unrestricted) : undefined;
+    return this.createAccess(action, decision, unrestricted, ownerValues);
+  }
+  get scopeAdapter() {
+    if (!this._scopeAdapter) {
+      const beanFullName = beanFullNameFromOnionName(this.scope.config.adapter.rbacScope, 'service');
+      this._scopeAdapter = this.bean._getBean(beanFullName);
+    }
+    return this._scopeAdapter;
+  }
+  async prepareOwnerValues(action, decision, unrestricted) {
+    const values = await this.scopeAdapter.ownerValues(action, decision);
+    const departmentField = action.options.dataScopeField ?? 'departmentId';
+    const ownerField = action.options.dataScopeMineField ?? 'userIdOwner';
+    const ownerValues = {
+      [departmentField]: values.departmentId,
+      [ownerField]: values.userIdOwner
+    };
+    if (!this.matches(action, decision, unrestricted, ownerValues)) this.app.throw(403);
+    return ownerValues;
+  }
+  createAccess(action, decision, unrestricted, ownerValues) {
+    return {
+      action,
+      decision,
+      unrestricted,
+      ownerValues: () => {
+        if (!ownerValues) this.app.throw(500, 'RBAC scope owner values are not initialized');
+        return {
+          ...ownerValues
+        };
+      },
+      where: callerWhere => this.where(action, decision, unrestricted, callerWhere),
+      checkEntry: entry => {
+        if (entry !== undefined && !this.matches(action, decision, unrestricted, entry)) {
+          this.app.throw(403);
+        }
+      },
+      checkEntries: entries => {
+        for (const entry of entries) {
+          if (!this.matches(action, decision, unrestricted, entry)) this.app.throw(403);
+        }
+      },
+      permissionProjection: () => this.permissionProjection(action, decision, unrestricted)
+    };
+  }
+  permissionProjection(action, decision, unrestricted) {
+    const matcher = unrestricted || !action.options.dataScope ? {
+      mode: 'all'
+    } : {
+      mode: 'any',
+      rules: (decision.terms ?? []).flatMap(term => {
+        if (term.dataScope === 'all') return [];
+        if (term.dataScope === 'mine') {
+          return [{
+            field: action.options.dataScopeMineField ?? 'userIdOwner',
+            values: [term.ownerId]
+          }];
+        }
+        return [{
+          field: action.options.dataScopeField ?? 'departmentId',
+          values: [...term.departmentIds]
+        }];
+      })
+    };
+    if (matcher.mode === 'any' && matcher.rules.length === 0) this.app.throw(403);
+    return {
+      key: action.actionKey,
+      allowed: decision.allowed,
+      matcher
+    };
+  }
+  where(action, decision, unrestricted, callerWhere) {
+    if (unrestricted) return callerWhere;
+    const scopeWhere = this.scopeWhere(action, decision);
+    if (!scopeWhere) this.app.throw(403);
+    if (!callerWhere) return scopeWhere;
+    return {
+      _and_: {
+        _and_: callerWhere,
+        _and_0: scopeWhere
+      }
+    };
+  }
+  scopeWhere(action, decision) {
+    const predicates = (decision.terms ?? []).flatMap(term => this.termPredicates(action, term));
+    if (!predicates.length) return undefined;
+    return predicates.length === 1 ? predicates[0] : {
+      _or_: predicates
+    };
+  }
+  matches(action, decision, unrestricted, row) {
+    const values = row;
+    if (unrestricted) return true;
+    return (decision.terms ?? []).some(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine') {
+        const field = action.options.dataScopeMineField ?? 'userIdOwner';
+        return String(values[field] ?? '') === term.ownerId;
+      }
+      const field = action.options.dataScopeField ?? 'departmentId';
+      return term.departmentIds.includes(String(values[field] ?? ''));
+    });
+  }
+  resolveAction(actionKey) {
+    const catalog = this.bean.rbacCatalog.getCatalog();
+    if (actionKey) return catalog.get(actionKey);
+    const route = this.ctx.route;
+    return route ? catalog.get(rbacActionKey(route.controllerBeanFullName, route.action)) : undefined;
+  }
+  isDecisionForAction(decision, action) {
+    return Boolean(decision?.allowed && decision.actionKey === action.actionKey && decision.action.actionKey === action.actionKey && decision.action.actionInheritKey === action.actionInheritKey && decision.action.controllerBeanFullName === action.controllerBeanFullName && decision.action.action === action.action && this.isValidTerms(decision.terms));
+  }
+  isValidTerms(terms) {
+    if (!terms?.length) return false;
+    return terms.every(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine') return typeof term.ownerId === 'string' && term.ownerId.length > 0;
+      return ['customDepartments', 'ownDepartment', 'ownDepartmentAndDescendants'].includes(term.dataScope) && Array.isArray(term.departmentIds) && term.departmentIds.length > 0 && term.departmentIds.every(id => typeof id === 'string' && id.length > 0);
+    });
+  }
+  termPredicates(action, term) {
+    if (term.dataScope === 'all') return [{}];
+    if (term.dataScope === 'mine') {
+      const field = action.options.dataScopeMineField ?? 'userIdOwner';
+      return [{
+        [field]: term.ownerId
+      }];
+    }
+    const field = action.options.dataScopeField ?? 'departmentId';
+    return [{
+      [field]: {
+        _in_: term.departmentIds
+      }
+    }];
+  }
+};
+BeanRbacScope = __decorate([Bean(), BeanInfo({
+  module: "a-rbac"
+})], BeanRbacScope);
+
+let EventPolicyInvalidated = class EventPolicyInvalidated extends BeanEventBase {};
+EventPolicyInvalidated = __decorate([Event(), BeanInfo({
+  module: "a-rbac"
+})], EventPolicyInvalidated);
+
+let EventResolvePolicy = class EventResolvePolicy extends BeanEventBase {};
+EventResolvePolicy = __decorate([Event(), BeanInfo({
+  module: "a-rbac"
+})], EventResolvePolicy);
+
+function config(_app) {
+  return {
+    adapter: {
+      rbacScope: 'admin-rbac:rbacScopeAdapter'
+    }
+  };
+}
+
+let ScopeModuleARbac = class ScopeModuleARbac extends BeanScopeBase {};
+ScopeModuleARbac = __decorate([Scope(), BeanInfo({
+  module: "a-rbac"
+})], ScopeModuleARbac);
+/** scope: end */
+
+export { BeanRbacCatalog, BeanRbacScope, EventPolicyInvalidated, EventResolvePolicy, GuardRbac, ScopeModuleARbac, SymbolRbacDecision, clearRbacDecision, config, createRbacAllScopeDecision, createRbacCapability, getRbacDecision, hasRbacAllScope, isRbacCapability, rbacActionKey, setRbacDecision };
+//# sourceMappingURL=index.js.map