Class RbacPolicyEngine

constructor

• new RbacPolicyEngine(
      rolesConfig?: RoleDefinition[],
      tarpitManager?: TarpitManager,
  ): RbacPolicyEngine

  Parameters

  • rolesConfig: RoleDefinition[] = []
  • OptionaltarpitManager: TarpitManager

  Returns RbacPolicyEngine

ReadonlytarpitManager

canAccessRoute

• canAccessRoute(
      user: RbacUserContext,
      uri: string,
      actionOrMethod?: string,
  ): boolean

  Fast boolean check for route access.

  Parameters

  • user: RbacUserContext
  • uri: string
  • actionOrMethod: string = 'READ'

  Returns boolean

evaluateRoute

• evaluateRoute(
      user: RbacUserContext,
      uri: string,
      actionOrMethod?: string,
  ): RouteEvaluationResult

  Evaluates route access for a user context against a target URI and semantic action (or HTTP method).

  Parameters

  • user: RbacUserContext

    Authenticated user context.

  • uri: string

    Requested URI path.

  • actionOrMethod: string = 'READ'

    Semantic action ('READ', 'WRITE', 'UPDATE', 'DELETE') or HTTP method ("GET", "POST"...).

  Returns RouteEvaluationResult

  Detailed evaluation result including allow/deny decision and tarpit latency.

getFieldAccess

• getFieldAccess(
      user: RbacUserContext,
      entity: string,
      property: string,
  ): FieldAccessMode

  Computes the effective Field Access Mode ('hidden' | 'readonly' | 'readwrite') for a specific entity property across all assigned roles.

  Precedence: 'readwrite' (2) > 'readonly' (1) > 'hidden' (0).

  Parameters

  • user: RbacUserContext

    Authenticated user context.

  • entity: string

    Entity name (e.g. "okf-document").

  • property: string

    Property/field name (e.g. "soa", "internalNotes").

  Returns FieldAccessMode

  FieldAccessMode.

registerRole

• registerRole(role: RoleDefinition): void

  Registers a new role definition into the engine.

  Parameters

  • role: RoleDefinition

    The role definition to add.

  Returns void

resolveRoles

• resolveRoles(roleIds: string[], visited?: Set<string>): RoleDefinition[]

  Resolves the full list of inherited and direct roles for a given set of role IDs.

  Parameters

  • roleIds: string[]

    Assigned role identifiers.

  • visited: Set<string> = ...

    Cycle detection tracker.

  Returns RoleDefinition[]

  Array of all active RoleDefinition instances.

sanitizePayload

• sanitizePayload<T extends Record<string, any>>(
      user: RbacUserContext,
      entity: string,
      payload: T,
      operation: "read" | "write",
  ): Partial<T>

  Generic sanitization helper for either 'read' or 'write' operations.

  Type Parameters

  • T extends Record<string, any>

  Parameters

  • user: RbacUserContext
  • entity: string
  • payload: T
  • operation: "read" | "write"

  Returns Partial<T>

sanitizeRead

• sanitizeRead<T extends Record<string, any>>(
      user: RbacUserContext,
      entity: string,
      payload: T,
  ): Partial<T>

  Sanitizes an outgoing read payload by removing all properties marked as 'hidden'.

  Type Parameters

  • T extends Record<string, any>

  Parameters

  • user: RbacUserContext

    Authenticated user context.

  • entity: string

    Entity name.

  • payload: T

    Data object to sanitize.

  Returns Partial<T>

  Filtered object.

sanitizeWrite

• sanitizeWrite<T extends Record<string, any>>(
      user: RbacUserContext,
      entity: string,
      payload: T,
  ): Partial<T>

  Sanitizes an incoming write payload by stripping any properties marked as 'hidden' or 'readonly'. Only properties explicitly in 'readwrite' mode are preserved.

  Type Parameters

  • T extends Record<string, any>

  Parameters

  • user: RbacUserContext

    Authenticated user context.

  • entity: string

    Entity name.

  • payload: T

    Incoming update data.

  Returns Partial<T>

  Safe object containing only writable fields.