vona-module-a-rbac 5.0.1

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/lib/rbac.ts","../src/bean/guard.rbac.ts","../src/bean/bean.rbacCatalog.ts","../src/bean/bean.rbacScope.ts","../src/bean/event.policyInvalidated.ts","../src/bean/event.resolvePolicy.ts","../src/config/config.ts","../src/.metadata/index.ts"],"sourcesContent":[null,null,null,null,null,null,null,null],"names":["SymbolRbacDecision","Symbol","createRbacAllScopeDecision","action","allowed","actionKey","terms","dataScope","createRbacCapability","key","isRbacCapability","value","capability","Object","keys","every","length","hasRbacAllScope","decision","some","term","rbacActionKey","controllerBeanFullName","getRbacDecision","ctx","setRbacDecision","clearRbacDecision","GuardRbac","GuardBase","check","options","bean","rbacCatalog","getAction","route","effectiveAction","rbacScope","isUnrestricted","scope","event","resolvePolicy","emit","policyActionKey","actionInheritKey","undefined","isValidDecision","isValidAction","revision","isValidTerms","descriptor","Array","isArray","isValidTerm","ownerId","isDepartmentDataScope","departmentIds","id","includes","__decorate","Guard","dataScopeField","dataScopeMineField","__z_BeanInfo","module","BeanFullNameGuardRbac","beanFullNameFromOnionName","BeanRbacCatalog","BeanBase","constructor","args","_catalog","getCatalog","get","createCatalog","clear","catalog","Map","routesByController","getCacheControllerRoutes","app","routes","values","meta","set","freeze","resolveActionInherit","actionInherit","routesByAction","map","resolveActionInheritKey","seen","Set","current","Error","targetKey","has","add","target","Bean","BeanRbacScope","_scopeAdapter","scopeAdapter","resolveAction","throw","isDecisionForAction","unrestricted","ownerValues","prepareOwnerValues","createAccess","beanFullName","config","adapter","_getBean","departmentField","ownerField","departmentId","userIdOwner","matches","where","callerWhere","checkEntry","entry","checkEntries","entries","permissionProjection","matcher","mode","rules","flatMap","field","scopeWhere","_and_","_and_0","predicates","termPredicates","_or_","row","String","Boolean","_in_","EventPolicyInvalidated","BeanEventBase","Event","EventResolvePolicy","_app","ScopeModuleARbac","BeanScopeBase","Scope"],"mappings":";;;;;;;MAIaA,kBAAkB,GAAGC,MAAM,CAAC,oBAAoB;AAEvD,SAAUC,0BAA0BA,CACxCC,MAAqC,EAAA;EAErC,OAAO;AAAEC,IAAAA,OAAO,EAAE,IAAI;IAAEC,SAAS,EAAEF,MAAM,CAACE,SAAS;IAAEF,MAAM;AAAEG,IAAAA,KAAK,EAAE,CAAC;AAAEC,MAAAA,SAAS,EAAE;KAAO;GAAG;AAC9F;AAEM,SAAUC,oBAAoBA,CAACC,GAAW,EAAEL,OAAgB,EAAA;EAChE,OAAO;IAAEK,GAAG;AAAEL,IAAAA;GAAS;AACzB;AAEM,SAAUM,gBAAgBA,CAACC,KAAc,EAAA;EAC7C,IAAI,CAACA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK;EACrD,MAAMC,UAAU,GAAGD,KAAiC;AACpD,EAAA,OACEE,MAAM,CAACC,IAAI,CAACF,UAAU,CAAC,CAACG,KAAK,CAACN,GAAG,IAAIA,GAAG,KAAK,KAAK,IAAIA,GAAG,KAAK,SAAS,CAAC,IACxE,OAAOG,UAAU,CAACH,GAAG,KAAK,QAAQ,IAClCG,UAAU,CAACH,GAAG,CAACO,MAAM,GAAG,CAAC,IACzB,OAAOJ,UAAU,CAACR,OAAO,KAAK,SAAS;AAE3C;AAEM,SAAUa,eAAeA,CAACC,QAA6B,EAAA;AAC3D,EAAA,OAAOA,QAAQ,CAACZ,KAAK,EAAEa,IAAI,CAACC,IAAI,IAAIA,IAAI,CAACb,SAAS,KAAK,KAAK,CAAC,KAAK,IAAI;AACxE;AAEM,SAAUc,aAAaA,CAACC,sBAA8B,EAAEnB,MAAc,EAAA;AAC1E,EAAA,OAAO,CAAA,EAAGmB,sBAAsB,CAAA,CAAA,EAAInB,MAAM,CAAA,CAAE;AAC9C;AAEM,SAAUoB,eAAeA,CAACC,GAAgB,EAAA;EAC9C,OAAOA,GAAG,CAACxB,kBAAkB,CAAC;AAChC;AAEM,SAAUyB,eAAeA,CAACD,GAAgB,EAAEN,QAA6B,EAAA;AAC7EM,EAAAA,GAAG,CAACxB,kBAAkB,CAAC,GAAGkB,QAAQ;AACpC;AAEM,SAAUQ,iBAAiBA,CAACF,GAAgB,EAAA;EAChD,OAAOA,GAAG,CAACxB,kBAAkB,CAAC;AAChC;;ACrBO,IAAM2B,SAAS,GAAf,MAAMA,SAAU,SAAQC,SAAS,CAAA;EACtC,MAAMC,KAAKA,CAACC,OAA0B,EAAA;AACpCJ,IAAAA,iBAAiB,CAAC,IAAI,CAACF,GAAG,CAAC;AAC3B,IAAA,MAAMrB,MAAM,GAAG,IAAI,CAAC4B,IAAI,CAACC,WAAW,CAACC,SAAS,CAAC,IAAI,CAACT,GAAG,CAACU,KAAK,CAAC;AAC9D,IAAA,IAAI,CAAC/B,MAAM,EAAE,OAAO,KAAK;AACzB,IAAA,MAAMgC,eAAe,GAAG;AAAE,MAAA,GAAGhC,MAAM;AAAE2B,MAAAA,OAAO,EAAE;QAAE,GAAG3B,MAAM,CAAC2B,OAAO;QAAE,GAAGA;AAAO;KAAI;IACjF,IAAI,MAAM,IAAI,CAACC,IAAI,CAACK,SAAS,CAACC,cAAc,EAAE,EAAE;MAC9CZ,eAAe,CAAC,IAAI,CAACD,GAAG,EAAEtB,0BAA0B,CAACiC,eAAe,CAAC,CAAC;AACtE,MAAA,OAAO,IAAI;AACb,IAAA;AAEA,IAAA,MAAMjB,QAAQ,GAAG,MAAM,IAAI,CAACoB,KAAK,CAACC,KAAK,CAACC,aAAa,CAACC,IAAI,CACxD;AACEtC,MAAAA,MAAM,EAAEgC,eAAe;AACvBO,MAAAA,eAAe,EAAEvC,MAAM,CAACwC,gBAAgB,IAAIxC,MAAM,CAACE;KACpD,EACD,YAAYuC,SAAS,CACtB;AACD,IAAA,IAAI,CAAC,IAAI,CAACC,eAAe,CAAC3B,QAAQ,EAAEiB,eAAe,CAAC,IAAI,CAACjB,QAAQ,CAACd,OAAO,EAAE,OAAO,KAAK;AACvFqB,IAAAA,eAAe,CAAC,IAAI,CAACD,GAAG,EAAE;AAAE,MAAA,GAAGN,QAAQ;AAAEf,MAAAA,MAAM,EAAEgC;AAAe,KAAE,CAAC;AACnE,IAAA,OAAO,IAAI;AACb,EAAA;AAEQU,EAAAA,eAAeA,CACrB3B,QAAiB,EACjBf,MAA6B,EAAA;IAE7B,IAAI,CAACe,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;IAC3D,MAAMP,KAAK,GAAGO,QAAwC;AACtD,IAAA,IAAI,OAAOP,KAAK,CAACP,OAAO,KAAK,SAAS,IAAIO,KAAK,CAACN,SAAS,KAAKF,MAAM,CAACE,SAAS,EAAE,OAAO,KAAK;AAC5F,IAAA,IAAI,CAAC,IAAI,CAACyC,aAAa,CAACnC,KAAK,CAACR,MAAM,EAAEA,MAAM,CAAC,EAAE,OAAO,KAAK;AAC3D,IAAA,IAAIQ,KAAK,CAACoC,QAAQ,KAAKH,SAAS,IAAI,OAAOjC,KAAK,CAACoC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AACpF,IAAA,IAAIpC,KAAK,CAACL,KAAK,KAAKsC,SAAS,IAAI,CAAC,IAAI,CAACI,YAAY,CAACrC,KAAK,CAACL,KAAK,CAAC,EAAE,OAAO,KAAK;AAC9E,IAAA,OAAO,CAACK,KAAK,CAACP,OAAO,IAAI,CAACD,MAAM,CAAC2B,OAAO,CAACvB,SAAS,IAAI,IAAI,CAACyC,YAAY,CAACrC,KAAK,CAACL,KAAK,CAAC;AACtF,EAAA;AAEQwC,EAAAA,aAAaA,CAACnC,KAAc,EAAER,MAA6B,EAAA;IACjE,IAAI,CAACQ,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK;IACrD,MAAMsC,UAAU,GAAGtC,KAAuC;AAC1D,IAAA,OACEsC,UAAU,CAAC5C,SAAS,KAAKF,MAAM,CAACE,SAAS,IACzC4C,UAAU,CAACN,gBAAgB,KAAKxC,MAAM,CAACwC,gBAAgB,IACvDM,UAAU,CAAC3B,sBAAsB,KAAKnB,MAAM,CAACmB,sBAAsB,IACnE2B,UAAU,CAAC9C,MAAM,KAAKA,MAAM,CAACA,MAAM;AAEvC,EAAA;EAEQ6C,YAAYA,CAACrC,KAAc,EAAA;IACjC,OAAOuC,KAAK,CAACC,OAAO,CAACxC,KAAK,CAAC,IAAIA,KAAK,CAACK,MAAM,GAAG,CAAC,IAAIL,KAAK,CAACI,KAAK,CAACK,IAAI,IAAI,IAAI,CAACgC,WAAW,CAAChC,IAAI,CAAC,CAAC;AAChG,EAAA;EAEQgC,WAAWA,CAACzC,KAAc,EAAA;IAChC,IAAI,CAACA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK;IACrD,MAAMS,IAAI,GAAGT,KAIZ;AACD,IAAA,IAAIS,IAAI,CAACb,SAAS,KAAK,KAAK,EAAE,OAAO,IAAI;AACzC,IAAA,IAAIa,IAAI,CAACb,SAAS,KAAK,MAAM,EAAE;AAC7B,MAAA,OAAO,OAAOa,IAAI,CAACiC,OAAO,KAAK,QAAQ,IAAIjC,IAAI,CAACiC,OAAO,CAACrC,MAAM,GAAG,CAAC;AACpE,IAAA;IACA,IAAI,CAAC,IAAI,CAACsC,qBAAqB,CAAClC,IAAI,CAACb,SAAS,CAAC,EAAE,OAAO,KAAK;AAC7D,IAAA,OACE2C,KAAK,CAACC,OAAO,CAAC/B,IAAI,CAACmC,aAAa,CAAC,IACjCnC,IAAI,CAACmC,aAAa,CAACvC,MAAM,GAAG,CAAC,IAC7BI,IAAI,CAACmC,aAAa,CAACxC,KAAK,CAACyC,EAAE,IAAI,OAAOA,EAAE,KAAK,QAAQ,IAAIA,EAAE,CAACxC,MAAM,GAAG,CAAC,CAAC;AAE3E,EAAA;EAEQsC,qBAAqBA,CAC3B3C,KAAc,EAAA;IAEd,OAAO,CAAC,mBAAmB,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC8C,QAAQ,CACnF9C,KAAmD,CACpD;AACH,EAAA;;AA5EWgB,SAAS,GAAA+B,UAAA,CAAA,CAJrBC,KAAK,CAAoB;AACxBC,EAAAA,cAAc,EAAE,cAAc;AAC9BC,EAAAA,kBAAkB,EAAE;CACrB,CAAC,EAAAC,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACW,EAAApC,SAAS,CA6ErB;;AC1FD,MAAMqC,qBAAqB,GAAGC,yBAAyB,CAAC,aAAa,EAAE,OAAO,CAAC;AAGxE,IAAMC,eAAe,GAArB,MAAMA,eAAgB,SAAQC,QAAQ,CAAA;AAAAC,EAAAA,WAAAA,CAAA,GAAAC,IAAA,EAAA;AAAA,IAAA,KAAA,CAAA,GAAAA,IAAA,CAAA;AAAA,IAAA,IAAA,CACnCC,QAAQ,GAAA,MAAA;AAAA,EAAA;EAEhBrC,SAASA,CAACC,KAAmB,EAAA;AAC3B,IAAA,OAAO,IAAI,CAACqC,UAAU,EAAE,CAACC,GAAG,CAACnD,aAAa,CAACa,KAAK,CAACZ,sBAAsB,EAAEY,KAAK,CAAC/B,MAAM,CAAC,CAAC;AACzF,EAAA;AAEAoE,EAAAA,UAAUA,GAAA;AACR,IAAA,IAAI,CAAC,IAAI,CAACD,QAAQ,EAAE,IAAI,CAACA,QAAQ,GAAG,IAAI,CAACG,aAAa,EAAE;IACxD,OAAO,IAAI,CAACH,QAAQ;AACtB,EAAA;AAEAI,EAAAA,KAAKA,GAAA;IACH,IAAI,CAACJ,QAAQ,GAAG1B,SAAS;AAC3B,EAAA;AAEQ6B,EAAAA,aAAaA,GAAA;AACnB,IAAA,MAAME,OAAO,GAAG,IAAIC,GAAG,EAAiC;AACxD,IAAA,MAAMC,kBAAkB,GAAGC,wBAAwB,CAAC,IAAI,CAACC,GAAG,CAAC;IAC7D,KAAK,MAAMC,MAAM,IAAInE,MAAM,CAACoE,MAAM,CAACJ,kBAAkB,CAAC,EAAE;AACtD,MAAA,KAAK,MAAM3C,KAAK,IAAI8C,MAAM,EAAE;QAC1B,MAAMlD,OAAO,GAAGI,KAAK,CAACA,KAAK,CAACgD,IAAI,GAAGlB,qBAAqB,CAAkC;QAC1F,IAAI,CAAClC,OAAO,EAAE;QACd,MAAMzB,SAAS,GAAGgB,aAAa,CAACa,KAAK,CAACZ,sBAAsB,EAAEY,KAAK,CAAC/B,MAAM,CAAC;AAC3EwE,QAAAA,OAAO,CAACQ,GAAG,CAAC9E,SAAS,EAAE;UACrBA,SAAS;UACTiB,sBAAsB,EAAEY,KAAK,CAACZ,sBAAsB;UACpDnB,MAAM,EAAE+B,KAAK,CAAC/B,MAAM;UACpB+B,KAAK;AACLJ,UAAAA,OAAO,EAAEjB,MAAM,CAACuE,MAAM,CAAC;YAAE,GAAGtD;WAAS;AACtC,SAAA,CAAC;AACJ,MAAA;AACF,IAAA;AACA,IAAA,IAAI,CAACuD,oBAAoB,CAACV,OAAO,EAAEE,kBAAkB,CAAC;AACtD,IAAA,OAAOF,OAAO;AAChB,EAAA;AAEQU,EAAAA,oBAAoBA,CAC1BV,OAAmD,EACnDE,kBAAkD,EAAA;IAElD,KAAK,MAAM5B,UAAU,IAAI0B,OAAO,CAACM,MAAM,EAAE,EAAE;AACzC,MAAA,IAAI,CAAChC,UAAU,CAACnB,OAAO,CAACwD,aAAa,EAAE;MACvC,MAAMN,MAAM,GAAGH,kBAAkB,CAAC5B,UAAU,CAAC3B,sBAAsB,CAAC,IAAI,EAAE;AAC1E,MAAA,MAAMiE,cAAc,GAAG,IAAIX,GAAG,CAACI,MAAM,CAACQ,GAAG,CAACtD,KAAK,IAAI,CAACA,KAAK,CAAC/B,MAAM,EAAE+B,KAAK,CAAC,CAAC,CAAC;AAC1Ee,MAAAA,UAAU,CAACN,gBAAgB,GAAG,IAAI,CAAC8C,uBAAuB,CACxDxC,UAAU,EACV0B,OAAO,EACPY,cAAc,CACf;AACH,IAAA;AACF,EAAA;AAEQE,EAAAA,uBAAuBA,CAC7BxC,UAAiC,EACjC0B,OAAmD,EACnDY,cAAiD,EAAA;IAEjD,MAAMG,IAAI,GAAG,IAAIC,GAAG,CAAS,CAAC1C,UAAU,CAAC5C,SAAS,CAAC,CAAC;IACpD,IAAIuF,OAAO,GAAG3C,UAAU;AACxB,IAAA,OAAO2C,OAAO,CAAC9D,OAAO,CAACwD,aAAa,EAAE;AACpC,MAAA,MAAMnF,MAAM,GAAGyF,OAAO,CAAC9D,OAAO,CAACwD,aAAa;AAC5C,MAAA,IAAInF,MAAM,KAAKyF,OAAO,CAACzF,MAAM,EAAE;QAC7B,MAAM,IAAI0F,KAAK,CAAC,CAAA,4CAAA,EAA+CD,OAAO,CAACvF,SAAS,EAAE,CAAC;AACrF,MAAA;AACA,MAAA,MAAM6B,KAAK,GAAGqD,cAAc,CAACf,GAAG,CAACrE,MAAM,CAAC;MACxC,IAAI,CAAC+B,KAAK,EAAE;QACV,MAAM,IAAI2D,KAAK,CAAC,CAAA,qCAAA,EAAwCD,OAAO,CAACvF,SAAS,CAAA,IAAA,EAAOF,MAAM,CAAA,CAAE,CAAC;AAC3F,MAAA;MACA,MAAM2F,SAAS,GAAGzE,aAAa,CAACuE,OAAO,CAACtE,sBAAsB,EAAEnB,MAAM,CAAC;AACvE,MAAA,IAAIuF,IAAI,CAACK,GAAG,CAACD,SAAS,CAAC,EAAE;QACvB,MAAM,IAAID,KAAK,CAAC,CAAA,0BAAA,EAA6B5C,UAAU,CAAC5C,SAAS,EAAE,CAAC;AACtE,MAAA;AACAqF,MAAAA,IAAI,CAACM,GAAG,CAACF,SAAS,CAAC;AACnB,MAAA,MAAMG,MAAM,GAAGtB,OAAO,CAACH,GAAG,CAACsB,SAAS,CAAC;AACrC,MAAA,IAAI,CAACG,MAAM,EAAE,OAAOH,SAAS;AAC7BF,MAAAA,OAAO,GAAGK,MAAM;AAClB,IAAA;IACA,OAAOL,OAAO,CAACvF,SAAS;AAC1B,EAAA;;AA/EW6D,eAAe,GAAAR,UAAA,CAAA,CAD3BwC,IAAI,EAAE,EAAApC,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACM,EAAAG,eAAe,CAgF3B;;AClFM,IAAMiC,aAAa,GAAnB,MAAMA,aAAc,SAAQhC,QAAQ,CAAA;AAAAC,EAAAA,WAAAA,CAAA,GAAAC,IAAA,EAAA;AAAA,IAAA,KAAA,CAAA,GAAAA,IAAA,CAAA;AAAA,IAAA,IAAA,CACjC+B,aAAa,GAAA,MAAA;AAAA,EAAA;EAErB,MAAM/D,cAAcA,GAAA;AAClB,IAAA,OAAO,MAAM,IAAI,CAACgE,YAAY,CAAChE,cAAc,EAAE;AACjD,EAAA;EAEA,MAAMuD,OAAOA,CAACvF,SAAkB,EAAA;AAC9B,IAAA,MAAMF,MAAM,GAAG,IAAI,CAACmG,aAAa,CAACjG,SAAS,CAAC;IAC5C,IAAI,CAACF,MAAM,EAAE,IAAI,CAAC4E,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AAEhC,IAAA,MAAMrF,QAAQ,GAAGK,eAAe,CAAC,IAAI,CAACC,GAAG,CAAC;AAC1C,IAAA,IAAI,CAAC,IAAI,CAACgF,mBAAmB,CAACtF,QAAQ,EAAEf,MAAM,CAAC,EAAE,IAAI,CAAC4E,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AAEpE,IAAA,MAAME,YAAY,GAAGxF,eAAe,CAACC,QAAQ,CAAC;IAC9C,MAAMwF,WAAW,GACfvG,MAAM,CAACA,MAAM,KAAK,QAAQ,GACtB,MAAM,IAAI,CAACwG,kBAAkB,CAACxG,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,CAAC,GAC7D7D,SAAS;IACf,OAAO,IAAI,CAACgE,YAAY,CAACzG,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,EAAEC,WAAW,CAAC;AACvE,EAAA;EAEA,IAAYL,YAAYA,GAAA;AACtB,IAAA,IAAI,CAAC,IAAI,CAACD,aAAa,EAAE;AACvB,MAAA,MAAMS,YAAY,GAAG5C,yBAAyB,CAC5C,IAAI,CAAC3B,KAAK,CAACwE,MAAM,CAACC,OAAO,CAAC3E,SAAS,EACnC,SAAS,CACV;MACD,IAAI,CAACgE,aAAa,GAAG,IAAI,CAACrE,IAAI,CAACiF,QAAQ,CAACH,YAAY,CAAiC;AACvF,IAAA;IACA,OAAO,IAAI,CAACT,aAAa;AAC3B,EAAA;AAEQ,EAAA,MAAMO,kBAAkBA,CAC9BxG,MAA6B,EAC7Be,QAA6B,EAC7BuF,YAAqB,EAAA;AAErB,IAAA,MAAMxB,MAAM,GAAG,MAAM,IAAI,CAACoB,YAAY,CAACK,WAAW,CAACvG,MAAM,EAAEe,QAAQ,CAAC;IACpE,MAAM+F,eAAe,GAAG9G,MAAM,CAAC2B,OAAO,CAAC8B,cAAc,IAAI,cAAc;IACvE,MAAMsD,UAAU,GAAG/G,MAAM,CAAC2B,OAAO,CAAC+B,kBAAkB,IAAI,aAAa;AACrE,IAAA,MAAM6C,WAAW,GAAG;AAClB,MAAA,CAACO,eAAe,GAAGhC,MAAM,CAACkC,YAAY;MACtC,CAACD,UAAU,GAAGjC,MAAM,CAACmC;KACtB;IACD,IAAI,CAAC,IAAI,CAACC,OAAO,CAAClH,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,EAAEC,WAAW,CAAC,EAAE,IAAI,CAAC3B,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AACnF,IAAA,OAAOG,WAAW;AACpB,EAAA;EAEQE,YAAYA,CAClBzG,MAA6B,EAC7Be,QAA6B,EAC7BuF,YAAqB,EACrBC,WAAyE,EAAA;IAEzE,OAAO;MACLvG,MAAM;MACNe,QAAQ;MACRuF,YAAY;MACZC,WAAW,EAAEA,MAAK;AAChB,QAAA,IAAI,CAACA,WAAW,EAAE,IAAI,CAAC3B,GAAG,CAACwB,KAAK,CAAC,GAAG,EAAE,6CAA6C,CAAC;QACpF,OAAO;UAAE,GAAGG;SAAa;MAC3B,CAAC;AACDY,MAAAA,KAAK,EAAGC,WAAiC,IACvC,IAAI,CAACD,KAAK,CAACnH,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,EAAEc,WAAW,CAAC;MACzDC,UAAU,EAAGC,KAAyB,IAAI;AACxC,QAAA,IAAIA,KAAK,KAAK7E,SAAS,IAAI,CAAC,IAAI,CAACyE,OAAO,CAAClH,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,EAAEgB,KAAK,CAAC,EAAE;AAC/E,UAAA,IAAI,CAAC1C,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AACrB,QAAA;MACF,CAAC;MACDmB,YAAY,EAAGC,OAA0B,IAAI;AAC3C,QAAA,KAAK,MAAMF,KAAK,IAAIE,OAAO,EAAE;UAC3B,IAAI,CAAC,IAAI,CAACN,OAAO,CAAClH,MAAM,EAAEe,QAAQ,EAAEuF,YAAY,EAAEgB,KAAK,CAAC,EAAE,IAAI,CAAC1C,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AAC/E,QAAA;MACF,CAAC;MACDqB,oBAAoB,EAAEA,MAAM,IAAI,CAACA,oBAAoB,CAACzH,MAAM,EAAEe,QAAQ,EAAEuF,YAAY;KACrF;AACH,EAAA;AAEQmB,EAAAA,oBAAoBA,CAC1BzH,MAA6B,EAC7Be,QAA6B,EAC7BuF,YAAqB,EAAA;IAErB,MAAMoB,OAAO,GACXpB,YAAY,IAAI,CAACtG,MAAM,CAAC2B,OAAO,CAACvB,SAAS,GACrC;AAAEuH,MAAAA,IAAI,EAAE;AAAc,KAAE,GACxB;AACEA,MAAAA,IAAI,EAAE,KAAc;MACpBC,KAAK,EAAE,CAAC7G,QAAQ,CAACZ,KAAK,IAAI,EAAE,EAAE0H,OAAO,CAAC5G,IAAI,IAAG;AAC3C,QAAA,IAAIA,IAAI,CAACb,SAAS,KAAK,KAAK,EAAE,OAAO,EAAE;AACvC,QAAA,IAAIa,IAAI,CAACb,SAAS,KAAK,MAAM,EAAE;AAC7B,UAAA,OAAO,CACL;AACE0H,YAAAA,KAAK,EAAE9H,MAAM,CAAC2B,OAAO,CAAC+B,kBAAkB,IAAI,aAAa;AACzDoB,YAAAA,MAAM,EAAE,CAAC7D,IAAI,CAACiC,OAAO;AACtB,WAAA,CACF;AACH,QAAA;AACA,QAAA,OAAO,CACL;AACE4E,UAAAA,KAAK,EAAE9H,MAAM,CAAC2B,OAAO,CAAC8B,cAAc,IAAI,cAAc;AACtDqB,UAAAA,MAAM,EAAE,CAAC,GAAG7D,IAAI,CAACmC,aAAa;AAC/B,SAAA,CACF;MACH,CAAC;KACF;IACP,IAAIsE,OAAO,CAACC,IAAI,KAAK,KAAK,IAAID,OAAO,CAACE,KAAK,CAAC/G,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC+D,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;IAC7E,OAAO;MAAE9F,GAAG,EAAEN,MAAM,CAACE,SAAS;MAAED,OAAO,EAAEc,QAAQ,CAACd,OAAO;AAAEyH,MAAAA;KAAS;AACtE,EAAA;EAEQP,KAAKA,CACXnH,MAA6B,EAC7Be,QAA6B,EAC7BuF,YAAqB,EACrBc,WAAiC,EAAA;IAEjC,IAAId,YAAY,EAAE,OAAOc,WAAW;IACpC,MAAMW,UAAU,GAAG,IAAI,CAACA,UAAU,CAAC/H,MAAM,EAAEe,QAAQ,CAAC;IACpD,IAAI,CAACgH,UAAU,EAAE,IAAI,CAACnD,GAAG,CAACwB,KAAK,CAAC,GAAG,CAAC;AACpC,IAAA,IAAI,CAACgB,WAAW,EAAE,OAAOW,UAAU;IACnC,OAAO;AAAEC,MAAAA,KAAK,EAAE;AAAEA,QAAAA,KAAK,EAAEZ,WAAW;AAAEa,QAAAA,MAAM,EAAEF;AAAU;KAA2B;AACrF,EAAA;AAEQA,EAAAA,UAAUA,CAChB/H,MAA6B,EAC7Be,QAA6B,EAAA;IAE7B,MAAMmH,UAAU,GAAG,CAACnH,QAAQ,CAACZ,KAAK,IAAI,EAAE,EAAE0H,OAAO,CAAC5G,IAAI,IAAI,IAAI,CAACkH,cAAc,CAACnI,MAAM,EAAEiB,IAAI,CAAC,CAAC;AAC5F,IAAA,IAAI,CAACiH,UAAU,CAACrH,MAAM,EAAE,OAAO4B,SAAS;IACxC,OAAQyF,UAAU,CAACrH,MAAM,KAAK,CAAC,GAAGqH,UAAU,CAAC,CAAC,CAAC,GAAG;AAAEE,MAAAA,IAAI,EAAEF;KAAY;AACxE,EAAA;EAEQhB,OAAOA,CACblH,MAA6B,EAC7Be,QAA6B,EAC7BuF,YAAqB,EACrB+B,GAAW,EAAA;IAEX,MAAMvD,MAAM,GAAGuD,GAA8B;IAC7C,IAAI/B,YAAY,EAAE,OAAO,IAAI;IAC7B,OAAO,CAACvF,QAAQ,CAACZ,KAAK,IAAI,EAAE,EAAEa,IAAI,CAACC,IAAI,IAAG;AACxC,MAAA,IAAIA,IAAI,CAACb,SAAS,KAAK,KAAK,EAAE,OAAO,IAAI;AACzC,MAAA,IAAIa,IAAI,CAACb,SAAS,KAAK,MAAM,EAAE;QAC7B,MAAM0H,KAAK,GAAG9H,MAAM,CAAC2B,OAAO,CAAC+B,kBAAkB,IAAI,aAAa;AAChE,QAAA,OAAO4E,MAAM,CAACxD,MAAM,CAACgD,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK7G,IAAI,CAACiC,OAAO;AACrD,MAAA;MACA,MAAM4E,KAAK,GAAG9H,MAAM,CAAC2B,OAAO,CAAC8B,cAAc,IAAI,cAAc;AAC7D,MAAA,OAAOxC,IAAI,CAACmC,aAAa,CAACE,QAAQ,CAACgF,MAAM,CAACxD,MAAM,CAACgD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,IAAA,CAAC,CAAC;AACJ,EAAA;EAEQ3B,aAAaA,CAACjG,SAAkB,EAAA;IACtC,MAAMsE,OAAO,GAAG,IAAI,CAAC5C,IAAI,CAACC,WAAW,CAACuC,UAAU,EAAE;IAClD,IAAIlE,SAAS,EAAE,OAAOsE,OAAO,CAACH,GAAG,CAACnE,SAAS,CAAC;AAC5C,IAAA,MAAM6B,KAAK,GAAG,IAAI,CAACV,GAAG,CAACU,KAAK;AAC5B,IAAA,OAAOA,KAAK,GACRyC,OAAO,CAACH,GAAG,CAACnD,aAAa,CAACa,KAAK,CAACZ,sBAAsB,EAAEY,KAAK,CAAC/B,MAAM,CAAC,CAAC,GACtEyC,SAAS;AACf,EAAA;AAEQ4D,EAAAA,mBAAmBA,CACzBtF,QAAyC,EACzCf,MAA6B,EAAA;AAE7B,IAAA,OAAOuI,OAAO,CACZxH,QAAQ,EAAEd,OAAO,IACjBc,QAAQ,CAACb,SAAS,KAAKF,MAAM,CAACE,SAAS,IACvCa,QAAQ,CAACf,MAAM,CAACE,SAAS,KAAKF,MAAM,CAACE,SAAS,IAC9Ca,QAAQ,CAACf,MAAM,CAACwC,gBAAgB,KAAKxC,MAAM,CAACwC,gBAAgB,IAC5DzB,QAAQ,CAACf,MAAM,CAACmB,sBAAsB,KAAKnB,MAAM,CAACmB,sBAAsB,IACxEJ,QAAQ,CAACf,MAAM,CAACA,MAAM,KAAKA,MAAM,CAACA,MAAM,IACxC,IAAI,CAAC6C,YAAY,CAAC9B,QAAQ,CAACZ,KAAK,CAAC,CAClC;AACH,EAAA;EAEQ0C,YAAYA,CAAC1C,KAAmC,EAAA;AACtD,IAAA,IAAI,CAACA,KAAK,EAAEU,MAAM,EAAE,OAAO,KAAK;AAChC,IAAA,OAAOV,KAAK,CAACS,KAAK,CAACK,IAAI,IAAG;AACxB,MAAA,IAAIA,IAAI,CAACb,SAAS,KAAK,KAAK,EAAE,OAAO,IAAI;MACzC,IAAIa,IAAI,CAACb,SAAS,KAAK,MAAM,EAC3B,OAAO,OAAOa,IAAI,CAACiC,OAAO,KAAK,QAAQ,IAAIjC,IAAI,CAACiC,OAAO,CAACrC,MAAM,GAAG,CAAC;MACpE,OACE,CAAC,mBAAmB,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAACyC,QAAQ,CAC5ErC,IAAI,CAACb,SAAS,CACf,IACD2C,KAAK,CAACC,OAAO,CAAC/B,IAAI,CAACmC,aAAa,CAAC,IACjCnC,IAAI,CAACmC,aAAa,CAACvC,MAAM,GAAG,CAAC,IAC7BI,IAAI,CAACmC,aAAa,CAACxC,KAAK,CAACyC,EAAE,IAAI,OAAOA,EAAE,KAAK,QAAQ,IAAIA,EAAE,CAACxC,MAAM,GAAG,CAAC,CAAC;AAE3E,IAAA,CAAC,CAAC;AACJ,EAAA;AAEQsH,EAAAA,cAAcA,CACpBnI,MAA6B,EAC7BiB,IAAoB,EAAA;IAEpB,IAAIA,IAAI,CAACb,SAAS,KAAK,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACzC,IAAA,IAAIa,IAAI,CAACb,SAAS,KAAK,MAAM,EAAE;MAC7B,MAAM0H,KAAK,GAAG9H,MAAM,CAAC2B,OAAO,CAAC+B,kBAAkB,IAAI,aAAa;AAChE,MAAA,OAAO,CAAC;QAAE,CAACoE,KAAK,GAAG7G,IAAI,CAACiC;AAAO,OAAE,CAAC;AACpC,IAAA;IACA,MAAM4E,KAAK,GAAG9H,MAAM,CAAC2B,OAAO,CAAC8B,cAAc,IAAI,cAAc;AAC7D,IAAA,OAAO,CAAC;AAAE,MAAA,CAACqE,KAAK,GAAG;QAAEU,IAAI,EAAEvH,IAAI,CAACmC;AAAa;AAAE,KAAE,CAAC;AACpD,EAAA;;AA5MW4C,aAAa,GAAAzC,UAAA,CAAA,CADzBwC,IAAI,EAAE,EAAApC,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACM,EAAAoC,aAAa,CA6MzB;;AC5MM,IAAMyC,sBAAsB,GAA5B,MAAMA,sBAAuB,SAAQC,aAG3C,CAAA;AAHYD,sBAAsB,GAAAlF,UAAA,CAAA,CADlCoF,KAAK,EAAE,EAAAhF,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACK,EAAA6E,sBAAsB,CAG/B;;ACPG,IAAMG,kBAAkB,GAAxB,MAAMA,kBAAmB,SAAQF,aAGvC,CAAA;AAHYE,kBAAkB,GAAArF,UAAA,CAAA,CAD9BoF,KAAK,EAAE,EAAAhF,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACK,EAAAgF,kBAAkB,CAG3B;;ACTE,SAAUjC,MAAMA,CAACkC,IAAqB,EAAA;EAC1C,OAAO;AACLjC,IAAAA,OAAO,EAAE;AACP3E,MAAAA,SAAS,EAAE;AACZ;GACF;AACH;;AC+GO,IAAM6G,gBAAgB,GAAtB,MAAMA,gBAAiB,SAAQC,aAAa,CAAA;AAAtCD,gBAAgB,GAAAvF,UAAA,CAAA,CAD5ByF,KAAK,EAAE,EAAArF,QAAA,CAAA;EAAAC,MAAA,EAAA;AAAA,CAAA,CAAA,CACK,EAAAkF,gBAAgB,CAAyB;AA0BtD;;;;"}

package/dist/lib/index.d.ts

@@ -0,0 +1,2 @@
+export * from './rbac.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/lib/rbac.d.ts

@@ -0,0 +1,12 @@
+import type { VonaContext } from 'vona';
+import type { IRbacCapability, IRbacPolicyDecision } from '../types/rbac.ts';
+export declare const SymbolRbacDecision: unique symbol;
+export declare function createRbacAllScopeDecision(action: IRbacPolicyDecision['action']): IRbacPolicyDecision;
+export declare function createRbacCapability(key: string, allowed: boolean): IRbacCapability;
+export declare function isRbacCapability(value: unknown): value is IRbacCapability;
+export declare function hasRbacAllScope(decision: IRbacPolicyDecision): boolean;
+export declare function rbacActionKey(controllerBeanFullName: string, action: string): string;
+export declare function getRbacDecision(ctx: VonaContext): IRbacPolicyDecision | undefined;
+export declare function setRbacDecision(ctx: VonaContext, decision: IRbacPolicyDecision): void;
+export declare function clearRbacDecision(ctx: VonaContext): void;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/lib/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/lib/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,GACpC,mBAAmB,CAErB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,CAEnF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CASzE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAEtE;AAED,wBAAgB,aAAa,CAAC,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB,GAAG,SAAS,CAEjF;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAErF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAExD"}

package/dist/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './rbac.ts';
+export * from './scope.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/types/rbac.d.ts

@@ -0,0 +1,37 @@
+import type { ContextRoute } from 'vona-module-a-web';
+import type { IGuardOptionsRbac } from '../bean/guard.rbac.ts';
+export type TypeRbacDataScope = 'all' | 'customDepartments' | 'ownDepartment' | 'ownDepartmentAndDescendants' | 'mine';
+export interface IRbacActionDescriptor {
+    actionKey: string;
+    controllerBeanFullName: string;
+    action: string;
+    actionInheritKey?: string;
+    route: ContextRoute;
+    options: IGuardOptionsRbac;
+}
+export interface IRbacPolicyRequest {
+    action: IRbacActionDescriptor;
+    policyActionKey: string;
+}
+export type IRbacScopeTerm = {
+    dataScope: 'all';
+} | {
+    dataScope: 'customDepartments' | 'ownDepartment' | 'ownDepartmentAndDescendants';
+    departmentIds: string[];
+} | {
+    dataScope: 'mine';
+    ownerId: string;
+};
+export interface IRbacPolicyDecision {
+    allowed: boolean;
+    actionKey: string;
+    action: IRbacActionDescriptor;
+    terms?: IRbacScopeTerm[];
+    revision?: string;
+}
+/** A server-derived UX hint; it never grants backend authority. */
+export interface IRbacCapability {
+    key: string;
+    allowed: boolean;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/types/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/types/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GACzB,KAAK,GACL,mBAAmB,GACnB,eAAe,GACf,6BAA6B,GAC7B,MAAM,CAAC;AAEX,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,GACpB;IACE,SAAS,EAAE,mBAAmB,GAAG,eAAe,GAAG,6BAA6B,CAAC;IACjF,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB"}

package/dist/types/scope.d.ts

@@ -0,0 +1,21 @@
+import type { TableIdentity } from 'table-identity';
+import type { IOpenapiPermissionActionRbac } from 'vona-module-a-openapi';
+import type { TypeModelWhere } from 'vona-module-a-orm';
+import type { IRbacActionDescriptor, IRbacPolicyDecision } from './rbac.ts';
+export type IRbacScopeOwnerValues = Record<string, TableIdentity | null | undefined>;
+export interface IRbacScopeAdapter {
+    isUnrestricted(): Promise<boolean>;
+    ownerValues(action: IRbacActionDescriptor, decision: IRbacPolicyDecision): Promise<IRbacScopeOwnerValues>;
+}
+export interface IRbacScopeAccess {
+    action: IRbacActionDescriptor;
+    decision: IRbacPolicyDecision;
+    unrestricted: boolean;
+    ownerValues(): Record<string, TableIdentity | null | undefined>;
+    where(callerWhere?: TypeModelWhere<any>): TypeModelWhere<any> | undefined;
+    checkEntry(entry: object | undefined): void;
+    checkEntries(entries: readonly object[]): void;
+    /** A safe permission projection for Resource permission consumers. */
+    permissionProjection(): IOpenapiPermissionActionRbac;
+}
+//# sourceMappingURL=scope.d.ts.map

package/dist/types/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/types/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAErF,MAAM,WAAW,iBAAiB;IAChC,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,WAAW,CACT,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChE,KAAK,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAC1E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC5C,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,sEAAsE;IACtE,oBAAoB,IAAI,4BAA4B,CAAC;CACtD"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "vona-module-a-rbac",
+  "version": "5.0.1",
+  "description": "",
+  "keywords": [
+    "Vona Module"
+  ],
+  "author": "",
+  "files": [
+    "assets",
+    "dist",
+    "src"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": [
+        "./src/index.ts",
+        "./dist/index.d.ts"
+      ],
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "clean": "rimraf dist tsconfig.build.tsbuildinfo",
+    "tsc:publish": "npm run clean && node ../../../../../packages-cli/cli/src/bin/vona.ts :bin:buildModule --sourcemap && tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run tsc:publish",
+    "prepack": "clean-package",
+    "postpack": "clean-package restore"
+  },
+  "dependencies": {
+    "vona-module-a-aspect": "^5.1.13",
+    "vona-module-a-openapi": "^5.1.23",
+    "vona-module-a-orm": "^5.1.30",
+    "vona-module-a-user": "^5.1.23",
+    "vona-module-a-web": "^5.1.22"
+  },
+  "title": "a-rbac",
+  "vonaModule": {
+    "dependencies": {
+      "a-vona": "5.0.0"
+    }
+  },
+  "gitHead": "eb85d771ef75776a439e56df3af8be6a3a36c1c2"
+}

package/src/.metadata/index.ts

@@ -0,0 +1,147 @@
+// eslint-disable
+/** guard: begin */
+export * from '../bean/guard.rbac.ts';
+import type { IGuardOptionsRbac } from '../bean/guard.rbac.ts';
+import 'vona-module-a-aspect';
+declare module 'vona-module-a-aspect' {
+
+
+export interface IGuardRecordLocal {
+  'a-rbac:rbac': IGuardOptionsRbac;
+}
+
+}
+declare module 'vona-module-a-rbac' {
+
+        export interface GuardRbac {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+
+          export interface GuardRbac {
+            get $beanFullName(): 'a-rbac.guard.rbac';
+            get $onionName(): 'a-rbac:rbac';
+            get $onionOptions(): IGuardOptionsRbac;
+          }
+}
+/** guard: end */
+/** bean: begin */
+export * from '../bean/bean.rbacCatalog.ts';
+export * from '../bean/bean.rbacScope.ts';
+
+import 'vona';
+declare module 'vona' {
+
+
+}
+declare module 'vona-module-a-rbac' {
+
+        export interface BeanRbacCatalog {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+
+        export interface BeanRbacScope {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+}
+/** bean: end */
+/** bean: begin */
+import type { BeanRbacCatalog } from '../bean/bean.rbacCatalog.ts';
+import type { BeanRbacScope } from '../bean/bean.rbacScope.ts';
+import 'vona';
+declare module 'vona' {
+  export interface IBeanRecordGlobal {
+    'rbacCatalog': BeanRbacCatalog;
+    'rbacScope': BeanRbacScope;
+  }
+}
+/** bean: end */
+/** event: begin */
+export * from '../bean/event.policyInvalidated.ts';
+export * from '../bean/event.resolvePolicy.ts';
+
+import 'vona';
+declare module 'vona' {
+
+
+}
+declare module 'vona-module-a-rbac' {
+
+        export interface EventPolicyInvalidated {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+
+          export interface EventPolicyInvalidated {
+            get $beanFullName(): 'a-rbac.event.policyInvalidated';
+            get $onionName(): 'a-rbac:policyInvalidated';
+          }
+
+        export interface EventResolvePolicy {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+
+          export interface EventResolvePolicy {
+            get $beanFullName(): 'a-rbac.event.resolvePolicy';
+            get $onionName(): 'a-rbac:resolvePolicy';
+          }
+}
+/** event: end */
+/** event: begin */
+import type { EventPolicyInvalidated } from '../bean/event.policyInvalidated.ts';
+import type { EventResolvePolicy } from '../bean/event.resolvePolicy.ts';
+export interface IModuleEvent {
+  'policyInvalidated': EventPolicyInvalidated;
+'resolvePolicy': EventResolvePolicy;
+}
+/** event: end */
+/** event: begin */
+import type { TypeEventPolicyInvalidatedData, TypeEventPolicyInvalidatedResult } from '../bean/event.policyInvalidated.ts';
+import type { TypeEventResolvePolicyData, TypeEventResolvePolicyResult } from '../bean/event.resolvePolicy.ts';
+import type { EventOn } from 'vona-module-a-event';
+declare module 'vona-module-a-event' {
+  export interface IEventRecord {
+    'a-rbac:policyInvalidated': EventOn<TypeEventPolicyInvalidatedData, TypeEventPolicyInvalidatedResult>;
+'a-rbac:resolvePolicy': EventOn<TypeEventResolvePolicyData, TypeEventResolvePolicyResult>;
+  }
+}
+/** event: end */
+/** config: begin */
+export * from '../config/config.ts';
+import type { config } from '../config/config.ts';
+/** config: end */
+/** scope: begin */
+import { BeanScopeBase, type BeanScopeUtil, type TypeModuleConfig } from 'vona';
+import { Scope } from 'vona-module-a-bean';
+
+@Scope()
+export class ScopeModuleARbac extends BeanScopeBase {}
+
+export interface ScopeModuleARbac {
+  util: BeanScopeUtil;
+config: TypeModuleConfig<typeof config>;
+event: IModuleEvent;
+}
+
+import 'vona';
+declare module 'vona' {
+  export interface IBeanScopeRecord {
+    'a-rbac': ScopeModuleARbac;
+  }
+
+  export interface IBeanScopeContainer {
+    rbac: ScopeModuleARbac;
+  }
+
+  export interface IBeanScopeConfig {
+    'a-rbac': ReturnType<typeof config>;
+  }
+
+
+
+
+}
+/** scope: end */

package/src/.metadata/this.ts

@@ -0,0 +1,2 @@
+export const __ThisModule__ = 'a-rbac';
+export { ScopeModuleARbac as ScopeModule } from './index.ts';

package/src/bean/bean.rbacCatalog.ts

@@ -0,0 +1,95 @@
+import type { ContextRoute } from 'vona-module-a-web';
+
+import { beanFullNameFromOnionName, BeanBase } from 'vona';
+import { Bean } from 'vona-module-a-bean';
+import { getCacheControllerRoutes } from 'vona-module-a-web';
+
+import type { IRbacActionDescriptor } from '../types/rbac.ts';
+import type { IGuardOptionsRbac } from './guard.rbac.ts';
+
+import { rbacActionKey } from '../lib/rbac.ts';
+
+const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+
+@Bean()
+export class BeanRbacCatalog extends BeanBase {
+  private _catalog: Map<string, IRbacActionDescriptor> | undefined;
+
+  getAction(route: ContextRoute): IRbacActionDescriptor | undefined {
+    return this.getCatalog().get(rbacActionKey(route.controllerBeanFullName, route.action));
+  }
+
+  getCatalog(): ReadonlyMap<string, IRbacActionDescriptor> {
+    if (!this._catalog) this._catalog = this.createCatalog();
+    return this._catalog;
+  }
+
+  clear(): void {
+    this._catalog = undefined;
+  }
+
+  private createCatalog(): Map<string, IRbacActionDescriptor> {
+    const catalog = new Map<string, IRbacActionDescriptor>();
+    const routesByController = getCacheControllerRoutes(this.app);
+    for (const routes of Object.values(routesByController)) {
+      for (const route of routes) {
+        const options = route.route.meta?.[BeanFullNameGuardRbac] as IGuardOptionsRbac | undefined;
+        if (!options) continue;
+        const actionKey = rbacActionKey(route.controllerBeanFullName, route.action);
+        catalog.set(actionKey, {
+          actionKey,
+          controllerBeanFullName: route.controllerBeanFullName,
+          action: route.action,
+          route,
+          options: Object.freeze({ ...options }),
+        });
+      }
+    }
+    this.resolveActionInherit(catalog, routesByController);
+    return catalog;
+  }
+
+  private resolveActionInherit(
+    catalog: ReadonlyMap<string, IRbacActionDescriptor>,
+    routesByController: Record<string, ContextRoute[]>,
+  ): void {
+    for (const descriptor of catalog.values()) {
+      if (!descriptor.options.actionInherit) continue;
+      const routes = routesByController[descriptor.controllerBeanFullName] ?? [];
+      const routesByAction = new Map(routes.map(route => [route.action, route]));
+      descriptor.actionInheritKey = this.resolveActionInheritKey(
+        descriptor,
+        catalog,
+        routesByAction,
+      );
+    }
+  }
+
+  private resolveActionInheritKey(
+    descriptor: IRbacActionDescriptor,
+    catalog: ReadonlyMap<string, IRbacActionDescriptor>,
+    routesByAction: ReadonlyMap<string, ContextRoute>,
+  ): string {
+    const seen = new Set<string>([descriptor.actionKey]);
+    let current = descriptor;
+    while (current.options.actionInherit) {
+      const action = current.options.actionInherit;
+      if (action === current.action) {
+        throw new Error(`RBAC actionInherit cannot reference itself: ${current.actionKey}`);
+      }
+      const route = routesByAction.get(action);
+      if (!route) {
+        throw new Error(`RBAC actionInherit target not found: ${current.actionKey} -> ${action}`);
+      }
+      const targetKey = rbacActionKey(current.controllerBeanFullName, action);
+      if (seen.has(targetKey)) {
+        throw new Error(`RBAC actionInherit cycle: ${descriptor.actionKey}`);
+      }
+      seen.add(targetKey);
+      const target = catalog.get(targetKey);
+      if (!target) return targetKey;
+      current = target;
+    }
+    return current.actionKey;
+  }
+}

package/src/bean/bean.rbacScope.ts

@@ -0,0 +1,218 @@
+import type { TableIdentity } from 'table-identity';
+import type { TypeModelWhere } from 'vona-module-a-orm';
+
+import { BeanBase, beanFullNameFromOnionName } from 'vona';
+import { Bean } from 'vona-module-a-bean';
+
+import type { IRbacActionDescriptor, IRbacPolicyDecision, IRbacScopeTerm } from '../types/rbac.ts';
+import type { IRbacScopeAccess, IRbacScopeAdapter } from '../types/scope.ts';
+
+import { getRbacDecision, hasRbacAllScope, rbacActionKey } from '../lib/rbac.ts';
+
+@Bean()
+export class BeanRbacScope extends BeanBase {
+  private _scopeAdapter: IRbacScopeAdapter | undefined;
+
+  async isUnrestricted(): Promise<boolean> {
+    return await this.scopeAdapter.isUnrestricted();
+  }
+
+  async current(actionKey?: string): Promise<IRbacScopeAccess> {
+    const action = this.resolveAction(actionKey);
+    if (!action) this.app.throw(403);
+
+    const decision = getRbacDecision(this.ctx);
+    if (!this.isDecisionForAction(decision, action)) this.app.throw(403);
+
+    const unrestricted = hasRbacAllScope(decision);
+    const ownerValues =
+      action.action === 'create'
+        ? await this.prepareOwnerValues(action, decision, unrestricted)
+        : undefined;
+    return this.createAccess(action, decision, unrestricted, ownerValues);
+  }
+
+  private get scopeAdapter(): IRbacScopeAdapter {
+    if (!this._scopeAdapter) {
+      const beanFullName = beanFullNameFromOnionName(
+        this.scope.config.adapter.rbacScope,
+        'service',
+      );
+      this._scopeAdapter = this.bean._getBean(beanFullName) as unknown as IRbacScopeAdapter;
+    }
+    return this._scopeAdapter;
+  }
+
+  private async prepareOwnerValues(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+  ): Promise<Record<string, TableIdentity | null | undefined>> {
+    const values = await this.scopeAdapter.ownerValues(action, decision);
+    const departmentField = action.options.dataScopeField ?? 'departmentId';
+    const ownerField = action.options.dataScopeMineField ?? 'userIdOwner';
+    const ownerValues = {
+      [departmentField]: values.departmentId,
+      [ownerField]: values.userIdOwner,
+    };
+    if (!this.matches(action, decision, unrestricted, ownerValues)) this.app.throw(403);
+    return ownerValues;
+  }
+
+  private createAccess(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    ownerValues: Record<string, TableIdentity | null | undefined> | undefined,
+  ): IRbacScopeAccess {
+    return {
+      action,
+      decision,
+      unrestricted,
+      ownerValues: () => {
+        if (!ownerValues) this.app.throw(500, 'RBAC scope owner values are not initialized');
+        return { ...ownerValues };
+      },
+      where: (callerWhere?: TypeModelWhere<any>) =>
+        this.where(action, decision, unrestricted, callerWhere),
+      checkEntry: (entry: object | undefined) => {
+        if (entry !== undefined && !this.matches(action, decision, unrestricted, entry)) {
+          this.app.throw(403);
+        }
+      },
+      checkEntries: (entries: readonly object[]) => {
+        for (const entry of entries) {
+          if (!this.matches(action, decision, unrestricted, entry)) this.app.throw(403);
+        }
+      },
+      permissionProjection: () => this.permissionProjection(action, decision, unrestricted),
+    };
+  }
+
+  private permissionProjection(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+  ) {
+    const matcher =
+      unrestricted || !action.options.dataScope
+        ? { mode: 'all' as const }
+        : {
+            mode: 'any' as const,
+            rules: (decision.terms ?? []).flatMap(term => {
+              if (term.dataScope === 'all') return [];
+              if (term.dataScope === 'mine') {
+                return [
+                  {
+                    field: action.options.dataScopeMineField ?? 'userIdOwner',
+                    values: [term.ownerId],
+                  },
+                ];
+              }
+              return [
+                {
+                  field: action.options.dataScopeField ?? 'departmentId',
+                  values: [...term.departmentIds],
+                },
+              ];
+            }),
+          };
+    if (matcher.mode === 'any' && matcher.rules.length === 0) this.app.throw(403);
+    return { key: action.actionKey, allowed: decision.allowed, matcher };
+  }
+
+  private where(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    callerWhere?: TypeModelWhere<any>,
+  ): TypeModelWhere<any> | undefined {
+    if (unrestricted) return callerWhere;
+    const scopeWhere = this.scopeWhere(action, decision);
+    if (!scopeWhere) this.app.throw(403);
+    if (!callerWhere) return scopeWhere;
+    return { _and_: { _and_: callerWhere, _and_0: scopeWhere } } as TypeModelWhere<any>;
+  }
+
+  private scopeWhere(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+  ): TypeModelWhere<any> | undefined {
+    const predicates = (decision.terms ?? []).flatMap(term => this.termPredicates(action, term));
+    if (!predicates.length) return undefined;
+    return (predicates.length === 1 ? predicates[0] : { _or_: predicates }) as TypeModelWhere<any>;
+  }
+
+  private matches(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    row: object,
+  ): boolean {
+    const values = row as Record<string, unknown>;
+    if (unrestricted) return true;
+    return (decision.terms ?? []).some(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine') {
+        const field = action.options.dataScopeMineField ?? 'userIdOwner';
+        return String(values[field] ?? '') === term.ownerId;
+      }
+      const field = action.options.dataScopeField ?? 'departmentId';
+      return term.departmentIds.includes(String(values[field] ?? ''));
+    });
+  }
+
+  private resolveAction(actionKey?: string): IRbacActionDescriptor | undefined {
+    const catalog = this.bean.rbacCatalog.getCatalog();
+    if (actionKey) return catalog.get(actionKey);
+    const route = this.ctx.route;
+    return route
+      ? catalog.get(rbacActionKey(route.controllerBeanFullName, route.action))
+      : undefined;
+  }
+
+  private isDecisionForAction(
+    decision: IRbacPolicyDecision | undefined,
+    action: IRbacActionDescriptor,
+  ): decision is IRbacPolicyDecision {
+    return Boolean(
+      decision?.allowed &&
+      decision.actionKey === action.actionKey &&
+      decision.action.actionKey === action.actionKey &&
+      decision.action.actionInheritKey === action.actionInheritKey &&
+      decision.action.controllerBeanFullName === action.controllerBeanFullName &&
+      decision.action.action === action.action &&
+      this.isValidTerms(decision.terms),
+    );
+  }
+
+  private isValidTerms(terms: IRbacScopeTerm[] | undefined): boolean {
+    if (!terms?.length) return false;
+    return terms.every(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine')
+        return typeof term.ownerId === 'string' && term.ownerId.length > 0;
+      return (
+        ['customDepartments', 'ownDepartment', 'ownDepartmentAndDescendants'].includes(
+          term.dataScope,
+        ) &&
+        Array.isArray(term.departmentIds) &&
+        term.departmentIds.length > 0 &&
+        term.departmentIds.every(id => typeof id === 'string' && id.length > 0)
+      );
+    });
+  }
+
+  private termPredicates(
+    action: IRbacActionDescriptor,
+    term: IRbacScopeTerm,
+  ): Record<string, unknown>[] {
+    if (term.dataScope === 'all') return [{}];
+    if (term.dataScope === 'mine') {
+      const field = action.options.dataScopeMineField ?? 'userIdOwner';
+      return [{ [field]: term.ownerId }];
+    }
+    const field = action.options.dataScopeField ?? 'departmentId';
+    return [{ [field]: { _in_: term.departmentIds } }];
+  }
+}