{"version":3,"file":"create-role-access-control.cjs","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAAS,EAAmB,EAA8C,CACtE,IAAM,EAAM,IAAI,IAAY,EAAO,aAAe,CAAC,CAAC,EAC9C,EAAQ,EAAO,KAAQ,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAM,KAAQ,EACf,IAAK,IAAM,KAAQ,EAAO,QAAQ,IAAS,CAAC,EACxC,EAAI,IAAI,CAAI,EAGpB,OAAO,CACX,CAwBA,SAAgB,EAAwB,EAAgD,CACpF,IAAM,EAAU,EAAmB,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALI,EAAQ,IAAI,GAAG,GACd,IAAa,IAAA,KACT,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,IACvE,IAAa,IAAA,IAAa,EAAQ,IAAI,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ"}