@schoolai/spicedb-zed-schema-parser/dist/builder/index.d.ts

SpiceDB .zed file format parser and analyzer written in Typescript

import { v1 } from '@authzed/authzed-node';

type SpiceDBClient = v1.ZedPromiseClientInterface;
/**
 * Base interface for all operations
 */
interface Operation<T> {
    execute(client: SpiceDBClient): Promise<T>;
}
/**
 * Helper function to parse resource references
 */
declare function parseReference(ref: string): [string, string];
/**
 * Result types
 */
interface QueryResult {
    type: string;
    id: string;
    relation?: string;
    subjectType?: string;
    subjectId?: string;
    permissionship?: v1.LookupPermissionship;
}
interface LookupResult {
    type: string;
    id: string;
    permissionship?: v1.LookupPermissionship;
}
interface TransactionResult {
    token: string | null;
    succeeded: boolean;
    operationCount: number;
}

/**
 * Operation for checking permissions
 */
declare class CheckOperation implements Operation<boolean> {
    protected permission: string;
    protected subjectRef?: string;
    protected resourceRef?: string;
    protected consistency?: v1.Consistency;
    constructor(permission: string);
    subject(ref: string): this;
    resource(ref: string): this;
    withConsistency(token: string): this;
    execute(client: SpiceDBClient): Promise<boolean>;
    toJSON(): {
        permission: string;
        subject: string | undefined;
        resource: string | undefined;
        consistency: v1.Consistency | undefined;
    };
}
/**
 * Bound version of CheckOperation
 */
declare class BoundCheckOperation extends CheckOperation {
    private client;
    constructor(client: SpiceDBClient, permission: string);
    execute(): Promise<boolean>;
}

/**
 * Operation for deleting relationships
 */
declare class DeleteOperation implements Operation<string | null> {
    protected filter: {
        subjectType?: string;
        subjectId?: string;
        relation?: string;
        resourceType?: string;
        resourceId?: string;
    };
    subject(ref: string): this;
    relation(rel: string): this;
    resource(ref: string): this;
    where(filter: {
        resourceType?: string;
        resourceId?: string;
        relation?: string;
        subjectType?: string;
        subjectId?: string;
    }): this;
    execute(client: SpiceDBClient): Promise<string | null>;
    toJSON(): {
        filter: {
            subjectType?: string;
            subjectId?: string;
            relation?: string;
            resourceType?: string;
            resourceId?: string;
        };
    };
}
/**
 * Bound version of DeleteOperation
 */
declare class BoundDeleteOperation extends DeleteOperation {
    private client;
    constructor(client: SpiceDBClient);
    execute(): Promise<string | null>;
}

/**
 * Lookup operation for finding accessible resources or subjects with permissions
 */
declare class LookupOperation implements Operation<LookupResult[]> {
    protected lookupType?: 'resources' | 'subjects';
    protected resourceFilter?: {
        type: string;
        id?: string;
    };
    protected subjectFilter?: {
        type: string;
        id?: string;
    };
    protected permission?: string;
    protected consistency?: v1.Consistency;
    resourcesAccessibleBy(subjectRef: string): this;
    subjectsWithAccessTo(resourceRef: string): this;
    ofType(type: string): this;
    withPermission(permission: string): this;
    withConsistency(token: string): this;
    execute(client: SpiceDBClient): Promise<LookupResult[]>;
    /**
     * Special helper for looking up subjects with multiple permission levels
     */
    withPermissions(permissions: string[], client?: SpiceDBClient): Promise<Map<string, string>>;
    toJSON(): {
        lookupType: "resources" | "subjects" | undefined;
        resourceFilter: {
            type: string;
            id?: string;
        } | undefined;
        subjectFilter: {
            type: string;
            id?: string;
        } | undefined;
        permission: string | undefined;
        consistency: v1.Consistency | undefined;
    };
}
/**
 * Bound version of LookupOperation
 */
declare class BoundLookupOperation extends LookupOperation {
    private client;
    constructor(client: SpiceDBClient);
    execute(): Promise<LookupResult[]>;
    withPermissions(permissions: string[]): Promise<Map<string, string>>;
}

/**
 * Operation for querying relationships
 */
declare class QueryOperation implements Operation<QueryResult[]> {
    protected filter: {
        subjectType?: string;
        subjectId?: string;
        relation?: string;
        resourceType?: string;
        resourceId?: string;
    };
    protected queryType?: 'subjects' | 'resources';
    protected permission?: string;
    protected consistency?: v1.Consistency;
    subjects(type?: string): this;
    resources(type?: string): this;
    subject(ref: string): this;
    relation(rel: string): this;
    resource(ref: string): this;
    withPermission(permission: string): this;
    withConsistency(token: string): this;
    execute(client: SpiceDBClient): Promise<QueryResult[]>;
    toJSON(): {
        queryType: "resources" | "subjects" | undefined;
        filter: {
            subjectType?: string;
            subjectId?: string;
            relation?: string;
            resourceType?: string;
            resourceId?: string;
        };
        permission: string | undefined;
        consistency: v1.Consistency | undefined;
    };
}
/**
 * Bound version of QueryOperation
 */
declare class BoundQueryOperation extends QueryOperation {
    private client;
    constructor(client: SpiceDBClient);
    execute(): Promise<QueryResult[]>;
}

/**
 * Transaction for batching multiple operations
 */
declare class Transaction implements Operation<TransactionResult> {
    protected operations: (() => v1.RelationshipUpdate)[];
    grant(relation: string): TransactionWriteOperation<Transaction>;
    revoke(relation: string): TransactionWriteOperation<Transaction>;
    add(operation: () => v1.RelationshipUpdate): this;
    execute(client: SpiceDBClient): Promise<TransactionResult>;
    toJSON(): {
        operationCount: number;
    };
}
/**
 * Bound version of Transaction
 */
declare class BoundTransaction extends Transaction {
    private client;
    constructor(client: SpiceDBClient);
    grant(relation: string): TransactionWriteOperation<BoundTransaction>;
    revoke(relation: string): TransactionWriteOperation<BoundTransaction>;
    execute(): Promise<TransactionResult>;
    commit(): Promise<TransactionResult>;
}
/**
 * Write operation within a transaction
 */
declare class TransactionWriteOperation<T extends Transaction> {
    private transaction;
    private operation;
    private relation;
    private subjects;
    private resources;
    constructor(transaction: T, operation: 'grant' | 'revoke', relation: string);
    subject(ref: string | string[]): this;
    resource(ref: string | string[]): this;
    and(): T;
}

/**
 * Base class for operations that write relationships
 */
declare class WriteOperation implements Operation<string | null> {
    protected operation: 'grant' | 'revoke';
    protected relation: string;
    protected subjects: string[];
    protected resources: string[];
    protected consistency?: v1.Consistency;
    constructor(operation: 'grant' | 'revoke', relation: string);
    subject(ref: string | string[]): this;
    resource(ref: string | string[]): this;
    withConsistency(token: string): this;
    execute(client: SpiceDBClient): Promise<string | null>;
    /**
     * Convert to a plain object for serialization
     */
    toJSON(): {
        operation: "grant" | "revoke";
        relation: string;
        subjects: string[];
        resources: string[];
        consistency: v1.Consistency | undefined;
    };
}
/**
 * Bound version of WriteOperation with immediate execute
 */
declare class BoundWriteOperation extends WriteOperation {
    private client;
    constructor(client: SpiceDBClient, operation: 'grant' | 'revoke', relation: string);
    execute(): Promise<string | null>;
}

/**
 * Static builders for creating pure operations without a client
 */
declare class PermissionOperations {
    /**
     * Create a grant operation
     */
    static grant(relation: string): WriteOperation;
    /**
     * Create a revoke operation
     */
    static revoke(relation: string): WriteOperation;
    /**
     * Create a check operation
     */
    static check(permission: string): CheckOperation;
    /**
     * Create a find/query operation
     */
    static find(): QueryOperation;
    /**
     * Create a delete operation
     */
    static delete(): DeleteOperation;
    /**
     * Create a batch transaction
     */
    static batch(): Transaction;
    /**
     * Create a lookup operation
     */
    static lookup(): LookupOperation;
}
/**
 * Main entry point for the permissions DSL with bound client
 */
declare class Permissions {
    private client;
    constructor(client: SpiceDBClient);
    /**
     * Grant a relation between subjects and resources
     */
    grant(relation: string): BoundWriteOperation;
    /**
     * Revoke a relation between subjects and resources
     */
    revoke(relation: string): BoundWriteOperation;
    /**
     * Check if a subject has a permission on a resource
     */
    check(permission: string): BoundCheckOperation;
    /**
     * Find subjects or resources matching criteria
     */
    find(): BoundQueryOperation;
    /**
     * Delete relationships matching a filter
     */
    delete(): BoundDeleteOperation;
    /**
     * Create a batch transaction
     */
    batch(): BoundTransaction;
    /**
     * Lookup resources accessible to a subject
     */
    lookup(): BoundLookupOperation;
    /**
     * Execute a pure operation with this instance's client
     */
    execute<T>(operation: Operation<T>): Promise<T>;
}
/**
 * Create a permissions instance with bound client
 */
declare function createPermissions(client: SpiceDBClient): Permissions;
/**
 * Export the static builders for convenience
 */
declare const Operations: typeof PermissionOperations;

export { BoundCheckOperation, BoundDeleteOperation, BoundLookupOperation, BoundQueryOperation, BoundTransaction, BoundWriteOperation, CheckOperation, DeleteOperation, LookupOperation, type LookupResult, type Operation, Operations, PermissionOperations, Permissions, QueryOperation, type QueryResult, type SpiceDBClient, Transaction, type TransactionResult, TransactionWriteOperation, WriteOperation, createPermissions, parseReference };