import{createFactory as t,$eq as s,$ne as i,$lt as e,$lte as n,$gt as r,$gte as o,$in as h,$nin as c,$all as u,$size as a,$regex as l,$options as f,$elemMatch as d,$exists as p,eq as g,ne as y,lt as w,lte as b,gt as $,gte as m,within as v,nin as x,all as M,size as E,regex as j,elemMatch as _,exists as F}from"@ucast/mongo2js";function A(t){return Array.isArray(t)?t:[t]}const O="__caslSubjectType__";function C(t,s){if(s)if(s.hasOwnProperty(O)){if(t!==s[O])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${s[O]}`)}else Object.defineProperty(s,O,{value:t});return s}function R(t){if(!t)return"all";if("string"==typeof t)return t;if(t.hasOwnProperty(O))return t[O];const s="function"==typeof t?t:t.constructor;return s.modelName||s.name}const z=t=>t;function T(t){return"production"!==process.env.NODE_ENV&&function(t){if(t.manage)throw new Error('Cannot add alias for "manage" action because it is reserved');Object.keys(t).forEach(s=>{if(s===t[s]||Array.isArray(t[s])&&(-1!==t[s].indexOf(s)||-1!==t[s].indexOf("manage")))throw new Error(`Attempt to alias action to itself: ${s} -> ${t[s]}`)})}(t),s=>function(t,s){let i=A(s),e=0;for(;e<i.length;){const s=i[e++];t.hasOwnProperty(s)&&(i=i.concat(t[s]))}return i}(t,s)}function q(t,s,i){for(let e=i;e<s.length;e++)t.push(s[e])}function S(t,s){if(!t||!t.length)return s||[];if(!s||!s.length)return t||[];let i=0,e=0;const n=[];for(;i<t.length&&e<s.length;)t[i].priority<s[e].priority?(n.push(t[i]),i++):(n.push(s[e]),e++);return q(n,t,i),q(n,s,e),n}function Y(t,s,i){let e=t.get(s);return e||(e=i(),t.set(s,e)),e}class D{constructor(t,s,i=0){this.__matchConditions=void 0,this.__matchField=void 0,function(t,s){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!s.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!s.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}(t,s),this.action=s.resolveAction(t.action),this.subject=t.subject,this.inverted=!!t.inverted,this.conditions=t.conditions,this.reason=t.reason,this.fields=t.fields?A(t.fields):void 0,this.priority=i,this.t=s}get s(){return this.conditions&&!this.__matchConditions&&(this.__matchConditions=this.t.conditionsMatcher(this.conditions)),this.__matchConditions}get i(){return this.fields&&!this.__matchField&&(this.__matchField=this.t.fieldMatcher(this.fields)),this.__matchField}get ast(){return this.s?this.s.ast:void 0}matchesConditions(t){return!this.s||(t&&"string"!=typeof t&&"function"!=typeof t?this.s(t):!this.inverted)}matchesField(t){return!this.i||(t?this.i(t):!this.inverted)}}class I{constructor(t,s=null){this.next=null,this.value=t,this.prev=s,s&&(s.next=this)}destroy(){const{next:t,prev:s}=this;t&&(t.prev=s),s&&(s.next=t),this.next=this.prev=null}}const L=()=>({rules:[],merged:!1}),U=()=>new Map,k=()=>({emits:!1,last:null,destroy:null});class B extends class{constructor(t=[],s={}){this.o=!1,this.h=new Map,this.u={conditionsMatcher:s.conditionsMatcher,fieldMatcher:s.fieldMatcher,resolveAction:s.resolveAction||z},this.detectSubjectType=s.detectSubjectType||R,this.l=t,this.p=this.g(t)}get rules(){return this.l}update(t){const s={rules:t,ability:this,target:this};return this.$("update",s),this.l=t,this.p=this.g(t),this.$("updated",s),this}g(t){const s=new Map;for(let i=t.length-1;i>=0;i--){const e=t.length-i-1,n=new D(t[i],this.u,e),r=A(n.action),o=A(n.subject);this.m(n);for(let t=0;t<o.length;t++){const i=Y(s,this.detectSubjectType(o[t]),U);for(let t=0;t<r.length;t++)Y(i,r[t],L).rules.push(n)}}return s}m(t){!this.o&&t.fields&&(this.o=!0)}possibleRulesFor(...[t,s]){const i=this.detectSubjectType(s),e=Y(this.p,i,U),n=Y(e,t,L);if(n.merged)return n.rules;const r="manage"!==t&&e.has("manage")?e.get("manage").rules:void 0;let o=S(n.rules,r);return"all"!==i&&(o=S(o,this.possibleRulesFor(t,"all"))),n.rules=o,n.merged=!0,o}rulesFor(t,s,i){const e=this.possibleRulesFor(t,s);if(i&&"string"!=typeof i)throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.o?e.filter(t=>t.matchesField(i)):e}on(t,s){const i=Y(this.h,t,k),e=new I(s,i.last);i.last=e;const n=()=>{if(i.emits)return i.destroy=i.destroy||[],void i.destroy.push(n);e.next||e.prev||i.last!==e?e.destroy():i.last=null};return n}$(t,s){const i=this.h.get(t);if(i)try{i.emits=!0;let t=i.last;for(;null!==t;)t.value(s),t=t.prev}finally{i.emits=!1,i.destroy&&i.destroy.forEach(t=>t())}}}{can(...t){const s=this.relevantRuleFor(...t);return!!s&&!s.inverted}relevantRuleFor(...t){const s=this.rulesFor(...t),i=t[1];for(let t=0;t<s.length;t++)if(s[t].matchesConditions(i))return s[t];return null}cannot(...t){return!this.can(...t)}}const G={$eq:s,$ne:i,$lt:e,$lte:n,$gt:r,$gte:o,$in:h,$nin:c,$all:u,$size:a,$regex:l,$options:f,$elemMatch:d,$exists:p},H={eq:g,ne:y,lt:w,lte:b,gt:$,gte:m,in:v,nin:x,all:M,size:E,regex:j,elemMatch:_,exists:F},J=(s,i,e)=>t(Object.assign({},G,s),Object.assign({},H,i),e),K=t(G,H),N=/[-/\\^$+?.()|[\]{}]/g,P=/\.?\*+\.?/g,Q=/\*+/,V=/\./g;function W(t,s,i){const e="*"===i[0]||"."===t[0]&&"."===t[t.length-1]?"+":"*",n=-1===t.indexOf("**")?"[^.]":".",r=t.replace(V,"\\$&").replace(Q,n+e);return s+t.length===i.length?`(?:${r})?`:r}function X(t,s,i){return"."!==t||"*"!==i[s-1]&&"*"!==i[s+1]?"\\"+t:t}const Z=t=>{let s;return i=>(void 0===s&&(s=-1===t.join("").indexOf("*")?null:function(t){const s=t.map(t=>t.replace(N,X).replace(P,W)),i=s.length>1?`(?:${s.join("|")})`:s[0];return new RegExp(`^${i}$`)}(t)),null===s||-1!==i.indexOf("*")?-1!==t.indexOf(i):s.test(i))};class tt extends B{constructor(t,s){super(t,Object.assign({conditionsMatcher:K,fieldMatcher:Z},s))}}class st{constructor(t){this.v=t}because(t){return this.v.reason=t,this}}class it{constructor(t){this.rules=[],this.M=t;this.can=this.can.bind(this),this.cannot=this.cannot.bind(this),this.build=this.build.bind(this)}can(t,s,i,e){const n={action:t};return s&&(n.subject=s,Array.isArray(i)||"string"==typeof i?n.fields=i:void 0!==i&&(n.conditions=i),void 0!==e&&(n.conditions=e)),this.rules.push(n),new st(n)}cannot(t,s,i,e){const n=this.can(t,s,i,e);return n.v.inverted=!0,n}build(t){return new this.M(this.rules,t)}}function et(t,s){const i=new it(tt),e=t(i.can,i.cannot);return e&&"function"==typeof e.then?e.then(()=>i.build(s)):i.build(s)}const nt=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,rt=function(t){this.message=t};rt.prototype=Object.create(Error.prototype);class ot extends rt{static setDefaultMessage(t){this.j="string"==typeof t?()=>t:t}static from(t){return new this(t)}constructor(t){super(""),this.field=void 0,this.ability=t,"function"==typeof Error.captureStackTrace&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(t){return this.message=t,this}throwUnlessCan(...t){const s=this.ability.relevantRuleFor(...t);if(s&&!s.inverted)return;this.action=t[0],this.subject=t[1],this.subjectType=this.ability.detectSubjectType(t[1]),this.field=t[2];const i=s?s.reason:"";throw this.message=this.message||i||this.constructor.j(this),this}}ot.j=nt;export{tt as Ability,it as AbilityBuilder,ot as ForbiddenError,B as PureAbility,J as buildMongoQueryMatcher,T as createAliasResolver,et as defineAbility,R as detectSubjectType,Z as fieldPatternMatcher,nt as getDefaultErrorMessage,K as mongoQueryMatcher,C as subject,A as wrapArray};
//# sourceMappingURL=index.mjs.map