{"_id":"@accesscontroll/sdk","_rev":"2-b9dd259fba33a322da1f3852e6601d32","name":"@accesscontroll/sdk","dist-tags":{"latest":"0.0.2"},"versions":{"0.0.1":{"name":"@accesscontroll/sdk","version":"0.0.1","license":"UNLICENSED","_id":"@accesscontroll/sdk@0.0.1","maintainers":[{"name":"mayur.blurbee.io","email":"mayur@blurbee.io"}],"dist":{"shasum":"32f0bf56deece3557e72dc818e8fa84e5134e87a","tarball":"https://registry.npmjs.org/@accesscontroll/sdk/-/sdk-0.0.1.tgz","fileCount":4,"integrity":"sha512-r29bCHD9uZFTKRzFNjxM9JiAJII9jTsgxKjxE3HbO043DS8/2jts409gYdntSWP1TGRIRYESdhTZN5DUmu6J+A==","signatures":[{"sig":"MEUCIC+kQoBkG8GJIIiqDTqRUXyvUqZnzMuQ1h2hXym3CiBVAiEAvu0O6ZZ9fFIalPTUFt6Nh6gKhrDZF9GpGBsL3LfWqrk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":15670},"main":"src/index.js","type":"module","types":"src/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./src/index.d.ts","import":"./src/index.js","default":"./src/index.js"}},"gitHead":"348b98b7a71cbd3d4f2a1358e766c56c075a2d13","_npmUser":{"name":"mayur.blurbee.io","email":"mayur@blurbee.io"},"_npmVersion":"11.0.0","description":"AccessControl PEP SDK — shared PDP URL + per-app applicationId","directories":{},"_nodeVersion":"22.13.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/sdk_0.0.1_1788958282057_0.19335246949908047","host":"s3://npm-registry-packages-npm-production"}},"0.0.2":{"_id":"@accesscontroll/sdk@0.0.2","dist":{"shasum":"27d02d3bfb2c778b7e3d646258651fa7f754dcd5","tarball":"https://registry.npmjs.org/@accesscontroll/sdk/-/sdk-0.0.2.tgz","fileCount":4,"integrity":"sha512-pZofqEfOTGpPBCfMy+CsadfsCDQ91iR8KnPTQY4Bzob5nYwpRHorJiOeB0VU7RvM/fMxMinRWplq/GTqvpQopg==","signatures":[{"sig":"MEQCIDbnYYt++/LToc0nVA2CftYulzB6YrMvMl0bu/tIAE6wAiBcDpQBL46lPEITBIbjaGXrfs633Wb9I0KDewfhHyAqLA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCICEylyKNpFowrAu1sWkG/nLCZKCjnuU8des/03Ch2StmAiEAgE2YS7Ve0XRAhjITh/GjUWozF3QwHvA4CiZ+MP9CeqA="}],"unpackedSize":19595},"main":"src/index.js","name":"@accesscontroll/sdk","type":"module","types":"src/index.d.ts","engines":{"node":">=18"},"exports":{".":{"types":"./src/index.d.ts","import":"./src/index.js","default":"./src/index.js"}},"gitHead":"050119a22af7dc15995c4f951572db6ff036d39b","license":"UNLICENSED","version":"0.0.2","_npmUser":{"name":"mayur.blurbee.io","email":"mayur@blurbee.io"},"_npmVersion":"11.0.0","description":"AccessControl PEP SDK — shared PDP URL + per-app applicationId","directories":{},"maintainers":[{"name":"mayur.blurbee.io","email":"mayur@blurbee.io"}],"_nodeVersion":"22.13.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/sdk_0.0.2_1789122601805_0.5305901065804901"}}},"time":{"created":"2026-09-09T12:51:21.644Z","modified":"2026-09-11T10:30:02.076Z","0.0.1":"2026-09-09T12:51:22.179Z","0.0.2":"2026-09-11T10:30:01.888Z"},"license":"UNLICENSED","description":"AccessControl PEP SDK — shared PDP URL + per-app applicationId","maintainers":[{"name":"mayur.blurbee.io","email":"mayur@blurbee.io"}],"readme":"# @accesscontrol/sdk\r\n\r\nNode PEP: calls a **shared PDP** for decisions and the **PAP API** for user sync.\r\n\r\n```text\r\nDecisions:  App → POST /v1/decide → ALLOW / DENY\r\nUser sync:  App → POST /api/sdk/users/register|remove → PAP PortalUsers\r\n```\r\n\r\n## Usage\r\n\r\n```js\r\nimport { create } from \"@accesscontrol/sdk\";\r\n\r\nconst ac = create({\r\n  pdpUrl: process.env.AC_PDP_URL || \"http://127.0.0.1:8181\",\r\n  papUrl: process.env.AC_PAP_URL || \"http://127.0.0.1:8081\",\r\n  applicationId: process.env.AC_APPLICATION_ID,\r\n  applicationSecret: process.env.AC_APPLICATION_SECRET,\r\n  // optional: default for check / checkMany / getPermissions\r\n  // includeAbac: true, // or set AC_INCLUDE_ABAC=true\r\n});\r\n\r\n// Authorization check (PDP) — pass role keys, not GUIDs\r\nconst { allowed } = await ac.check({\r\n  user: { roles: [\"user\"], attributes: { department: \"Wealth\" } },\r\n  resource: \"boxfiles\",\r\n  action: \"read\",\r\n});\r\n\r\n// Resource-set conditions may need resource attributes\r\nawait ac.check({\r\n  user: { roles: [\"user\"], attributes: { department: \"Wealth\" } },\r\n  resource: { key: \"boxfiles\", attributes: { ownerId: \"u-1\" } },\r\n  action: \"read\",\r\n  includeAbac: true,\r\n});\r\n\r\n// UI permission map — role matrix by default; opt into ABAC\r\nconst { permissions } = await ac.getPermissions(\r\n  { roles: [\"user\"], attributes: { department: \"Wealth\" } },\r\n  { includeAbac: true }\r\n);\r\n\r\n// Sync user on portal signup (PAP) — role key → group membership\r\nawait ac.registerUser({\r\n  name: \"Jane Doe\",\r\n  email: \"jane@example.com\",\r\n  externalId: \"portal-user-uuid\",\r\n  role: \"user\",\r\n  // optional: PAP UI / Access Testing only — live PDP still needs attributes on check()\r\n  attributeValues: { department: \"Wealth\" },\r\n});\r\n\r\n// Remove user on portal delete (PAP)\r\nawait ac.removeUser({ email: \"jane@example.com\" });\r\n```\r\n\r\n## Environment\r\n\r\n| Variable | Purpose |\r\n|----------|---------|\r\n| `AC_PDP_URL` | Decision service base URL |\r\n| `AC_PAP_URL` | Policy admin API base URL |\r\n| `AC_APPLICATION_ID` | Application UUID (from PAP URL) |\r\n| `AC_APPLICATION_SECRET` | App secret from PAP credentials page |\r\n| `AC_INCLUDE_ABAC` | Default for `check` / `checkMany` / `getPermissions` (`true`/`false`) |\r\n\r\n## Methods\r\n\r\n| Method | Target | Description |\r\n|--------|--------|-------------|\r\n| `check` | PDP | Allow/deny decision (`includeAbac` optional) |\r\n| `assert` | PDP | Throws if denied |\r\n| `checkMany` | PDP | Batch decisions; third arg `{ includeAbac }` |\r\n| `getPermissions` | PDP | Grant map for UI; default role-only |\r\n| `decide` | PDP | Raw decide response |\r\n| `status` | PDP | Bundle sync status |\r\n| `register` | PDP | Register app for polling |\r\n| `registerUser` | PAP | Create or update portal user (idempotent by email) |\r\n| `removeUser` | PAP | Delete user by id, email, or externalId |\r\n\r\n## ABAC notes\r\n\r\n- User sets and resource sets are **dynamic** (condition `when` trees). There is no “add user to set.”\r\n- Live decisions use `user.attributes` (and optional `resource.attributes`) on each `check` / `getPermissions`. PAP Custom Attribute Values are for admin testing / optional sync — the PDP does **not** read them at decide time.\r\n- `decide` defaults to ABAC on when `includeAbac` is omitted. `getPermissions` stays role-only unless you pass `includeAbac: true` or `AC_INCLUDE_ABAC=true`. Keep middleware and UI map on the same mode.\r\n\r\n## registerUser\r\n\r\nCreates a user in the RBAC system when a user is created in your portal. If the email already exists for the application, updates the record instead.\r\n\r\nPass `role` (PAP role key, e.g. `\"user\"`). PAP finds the group linked to that role and sets exclusive membership (one group per user). Do not pass group IDs from portal apps.\r\n\r\n## removeUser\r\n\r\nRemoves a user from the RBAC system when deleted in your portal. Provide one of: `id`, `email`, or `externalId`.\r\n","readmeFilename":"README.md"}