{"version":3,"file":"HeadlessRBACClient.mjs","sources":["../../../../../../../core/src/HeadlessClients/HeadlessRBACClient.ts"],"sourcesContent":["import { ConsumerPermissionsMap, IHeadlessRBACClient } from '../public/rbac';\nimport { StytchProjectConfigurationInput } from '../public/typeConfig';\nimport { RBACPolicy, RBACPolicyRaw } from '../rbac';\nimport { IConsumerSubscriptionService } from '../SubscriptionService';\nimport { logger } from '../utils';\n\ntype CachedConfig = {\n  rbacPolicy: RBACPolicyRaw | null;\n};\n\ntype DynamicConfig = Promise<CachedConfig>;\n\nexport class HeadlessRBACClient<TProjectConfiguration extends StytchProjectConfigurationInput>\n  implements IHeadlessRBACClient\n{\n  private cachedPolicy: RBACPolicy | null;\n  private policyPromise: Promise<RBACPolicy>;\n  constructor(\n    cachedConfig: CachedConfig,\n    dynamicConfig: DynamicConfig,\n    private _subscriptionService: IConsumerSubscriptionService<TProjectConfiguration>,\n  ) {\n    this.cachedPolicy = cachedConfig.rbacPolicy ? RBACPolicy.fromJSON(cachedConfig.rbacPolicy) : null;\n    this.policyPromise = dynamicConfig.then((data) => {\n      if (!data.rbacPolicy) {\n        logger.error('Unable to retrieve RBAC policy from servers. Assuming caller has no permissions.');\n        return new RBACPolicy([], []);\n      }\n      // Update the existing policy too, so isAuthorizedSync will be up-to-date\n      this.cachedPolicy = RBACPolicy.fromJSON(data.rbacPolicy);\n      return this.cachedPolicy;\n    });\n  }\n\n  allPermissions<Permissions extends Record<string, string>>() {\n    return this.policyPromise.then(\n      (policy) => policy.allPermissionsForCaller(this.roleIds()) as ConsumerPermissionsMap<Permissions>,\n    );\n  }\n\n  isAuthorizedSync: IHeadlessRBACClient['isAuthorizedSync'] = (resourceId, action) => {\n    return !!this.cachedPolicy?.callerIsAuthorized(this.roleIds(), resourceId as string, action as unknown as string);\n  };\n\n  isAuthorized: IHeadlessRBACClient['isAuthorized'] = (resourceId, action) => {\n    return this.policyPromise.then((policy) =>\n      policy.callerIsAuthorized(this.roleIds(), resourceId as string, action as unknown as string),\n    );\n  };\n\n  private roleIds() {\n    const user = this._subscriptionService.getUser();\n\n    if (!user) {\n      return [];\n    }\n\n    // Although user.roles is guaranteed to exist for fresh data, there is a chance\n    // that the user stored in localstorage clientside comes from before roles were added to\n    // the API response - in which case user.roles will be undefined and this will crash\n    // TODO: [AUTH-2294] We can safely remove this ~3mos after RBAC is released\n    return user.roles ?? [];\n  }\n}\n"],"names":["HeadlessRBACClient","cachedPolicy","policyPromise","cachedConfig","dynamicConfig","_subscriptionService","rbacPolicy","RBACPolicy","fromJSON","then","data","logger","error","allPermissions","policy","allPermissionsForCaller","roleIds","isAuthorizedSync","resourceId","action","callerIsAuthorized","isAuthorized","user","getUser","roles"],"mappings":";;;AAYO,MAAMA,kBAAAA,CAAAA;;IAGHC,YAAAA;IACAC,aAAAA;AACR,IAAA,WAAA,CACEC,YAA0B,EAC1BC,aAA4B,EACpBC,oBAAyE,CACjF;aADQA,oBAAAA,GAAAA,oBAAAA;QAER,IAAI,CAACJ,YAAY,GAAGE,YAAAA,CAAaG,UAAU,GAAGC,UAAAA,CAAWC,QAAQ,CAACL,YAAAA,CAAaG,UAAU,CAAA,GAAI,IAAA;AAC7F,QAAA,IAAI,CAACJ,aAAa,GAAGE,aAAAA,CAAcK,IAAI,CAAC,CAACC,IAAAA,GAAAA;YACvC,IAAI,CAACA,IAAAA,CAAKJ,UAAU,EAAE;AACpBK,gBAAAA,MAAAA,CAAOC,KAAK,CAAC,kFAAA,CAAA;AACb,gBAAA,OAAO,IAAIL,UAAAA,CAAW,EAAE,EAAE,EAAE,CAAA;AAC9B,YAAA;;AAEA,YAAA,IAAI,CAACN,YAAY,GAAGM,WAAWC,QAAQ,CAACE,KAAKJ,UAAU,CAAA;YACvD,OAAO,IAAI,CAACL,YAAY;AAC1B,QAAA,CAAA,CAAA;AACF,IAAA;IAEAY,cAAAA,GAA6D;AAC3D,QAAA,OAAO,IAAI,CAACX,aAAa,CAACO,IAAI,CAC5B,CAACK,MAAAA,GAAWA,MAAAA,CAAOC,uBAAuB,CAAC,IAAI,CAACC,OAAO,EAAA,CAAA,CAAA;AAE3D,IAAA;AAEAC,IAAAA,gBAAAA,GAA4D,CAACC,UAAAA,EAAYC,MAAAA,GAAAA;QACvE,OAAO,CAAC,CAAC,IAAI,CAAClB,YAAY,EAAEmB,kBAAAA,CAAmB,IAAI,CAACJ,OAAO,EAAA,EAAIE,UAAAA,EAAsBC,MAAAA,CAAAA;IACvF,CAAA;AAEAE,IAAAA,YAAAA,GAAoD,CAACH,UAAAA,EAAYC,MAAAA,GAAAA;AAC/D,QAAA,OAAO,IAAI,CAACjB,aAAa,CAACO,IAAI,CAAC,CAACK,MAAAA,GAC9BA,MAAAA,CAAOM,kBAAkB,CAAC,IAAI,CAACJ,OAAO,IAAIE,UAAAA,EAAsBC,MAAAA,CAAAA,CAAAA;IAEpE,CAAA;IAEQH,OAAAA,GAAU;AAChB,QAAA,MAAMM,IAAAA,GAAO,IAAI,CAACjB,oBAAoB,CAACkB,OAAO,EAAA;AAE9C,QAAA,IAAI,CAACD,IAAAA,EAAM;AACT,YAAA,OAAO,EAAE;AACX,QAAA;;;;;QAMA,OAAOA,IAAAA,CAAKE,KAAK,IAAI,EAAE;AACzB,IAAA;AACF;;;;"}