refactor: identity -> iam

modules/iam/client.ts

@@ -0,0 +1,163 @@
+import { CheckResourcesResponse } from "@cerbos/core";
+import { HttpAdapter, makeClient } from "@platform/relay";
+
+import { config } from "./config.ts";
+import checkResource from "./routes/access/check-resource/spec.ts";
+import checkResources from "./routes/access/check-resources/spec.ts";
+import isAllowed from "./routes/access/is-allowed/spec.ts";
+import getById from "./routes/identities/get/spec.ts";
+import loginByPassword from "./routes/login/code/spec.ts";
+import loginByEmail from "./routes/login/email/spec.ts";
+import loginByCode from "./routes/login/password/spec.ts";
+import me from "./routes/me/spec.ts";
+
+const adapter = new HttpAdapter({
+  url: config.url,
+});
+
+const access = makeClient(
+  {
+    adapter,
+  },
+  {
+    isAllowed,
+    checkResource,
+    checkResources,
+  },
+);
+
+export const identity = makeClient(
+  {
+    adapter,
+  },
+  {
+    /**
+     * TODO ...
+     */
+    getById,
+
+    /**
+     * TODO ...
+     */
+    me,
+
+    /**
+     * TODO ...
+     */
+    login: {
+      /**
+       * TODO ...
+       */
+      email: loginByEmail,
+
+      /**
+       * TODO ...
+       */
+      password: loginByPassword,
+
+      /**
+       * TODO ...
+       */
+      code: loginByCode,
+    },
+
+    access: {
+      /**
+       * Check if a principal is allowed to perform an action on a resource.
+       *
+       * @param resource - Resource which we are validating.
+       * @param action   - Action which we are validating.
+       *
+       * @example
+       *
+       * await access.isAllowed(
+       *   {
+       *     kind: "document",
+       *     id: "1",
+       *     attr: { owner: "user@example.com" },
+       *   },
+       *   "view"
+       * ); // => true
+       */
+      isAllowed: async (resource: Resource, action: string) => {
+        const response = await access.isAllowed({ body: { resource, action } });
+        if ("error" in response) {
+          throw response.error;
+        }
+        return response.data;
+      },
+
+      /**
+       * Check a principal's permissions on a resource.
+       *
+       * @param resource - Resource which we are validating.
+       * @param actions  - Actions which we are validating.
+       *
+       * @example
+       *
+       * const decision = await access.checkResource(
+       *   {
+       *     kind: "document",
+       *     id: "1",
+       *     attr: { owner: "user@example.com" },
+       *   },
+       *   ["view", "edit"],
+       * );
+       *
+       * decision.isAllowed("view"); // => true
+       */
+      checkResource: async (resource: Resource, actions: string[]) => {
+        const response = await access.checkResource({ body: { resource, actions } });
+        if ("error" in response) {
+          throw response.error;
+        }
+        return new CheckResourcesResponse(response.data);
+      },
+
+      /**
+       * Check a principal's permissions on a set of resources.
+       *
+       * @param resources - Resources which we are validating.
+       *
+       * @example
+       *
+       * const decision = await access.checkResources([
+       *   {
+       *     resource: {
+       *       kind: "document",
+       *       id: "1",
+       *       attr: { owner: "user@example.com" },
+       *     },
+       *     actions: ["view", "edit"],
+       *   },
+       *   {
+       *     resource: {
+       *       kind: "image",
+       *       id: "1",
+       *       attr: { owner: "user@example.com" },
+       *     },
+       *     actions: ["delete"],
+       *   },
+       * ]);
+       *
+       * decision.isAllowed({
+       *   resource: { kind: "document", id: "1" },
+       *   action: "view",
+       * }); // => true
+       */
+      checkResources: async (resources: { resource: Resource; actions: string[] }[]) => {
+        const response = await access.checkResources({ body: resources });
+        if ("error" in response) {
+          throw response.error;
+        }
+        return new CheckResourcesResponse(response.data);
+      },
+    },
+  },
+);
+
+type Resource = {
+  kind: string;
+  id: string;
+  attr: Record<string, any>;
+};