@azmr/policycore

pnpm add @azmr/policycore

import { createPolicyEngine } from "@azmr/policycore";
import { createAccessControl } from "@azmr/security";

const engine = createPolicyEngine({
  accessControl: createAccessControl({ policy: { admin: [{ resource: "reports", action: "read" }] } }),
  policies: {
    "reports:read": {
      rateLimit: { options: { maxRequests: 100, windowMs: 60_000 } },
      auth: { resource: "reports", action: "read" },
      cors: { allowedOrigins: ["https://app.azmara.io"] },
    },
  },
});

const result = await engine.evaluate("reports:read", {
  subject: { id: "u1", roles: ["admin"] },
  origin: "https://app.azmara.io",
});
// result.allowed, result.rateLimit, result.auth, result.cors

import { createRequestSigner } from "@azmr/policycore";

const signer = createRequestSigner(process.env.REQUEST_SIGNING_SECRET!);

const header = signer.sign({ method: "POST", path: "/webhooks/ingest", body: rawBody });
// -> "t=<unix>,n=<hex>,v1=<hex>", send as a header alongside the request

signer.verify({ method: "POST", path: "/webhooks/ingest", body: rawBody, header });
// throws on any mismatch, expiry, or replay

import { createLocalEnvSecretsAdapter, createSecretsManager } from "@azmr/policycore";

const secrets = createSecretsManager({
  adapter: createLocalEnvSecretsAdapter(),
  cacheTtlMs: 60_000,
});

const apiKey = await secrets.get("STRIPE_API_KEY");

import { createApiKeyManager } from "@azmr/policycore";

const manager = createApiKeyManager();

const issued = manager.issue("CI pipeline");
// issued.rawKey — store this now, it's never retrievable again

const result = manager.verify(issued.rawKey);
// { valid: true, keyId, label }