@aalis/api-authority 0.8.0 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,10 +1,10 @@
1
1
  # @aalis/api-authority
2
2
 
3
- 类型/接口/能力声明包(只导出 `type` 与 `*Capabilities`,不含运行时逻辑)
3
+ 导出服务描述符(运行时值)与类型;不含服务实现
4
4
 
5
5
  ## 角色
6
6
 
7
- 类型/接口/能力声明包(只导出 `type` 与 `*Capabilities`,不含运行时逻辑)
7
+ 导出服务描述符(运行时值)与类型;不含服务实现
8
8
 
9
9
  ## 安装
10
10
 
@@ -15,10 +15,10 @@ pnpm add @aalis/api-authority
15
15
  ## 使用
16
16
 
17
17
  ```ts
18
- import type { /* ... */ } from '@aalis/api-authority';
19
- ```
18
+ import { authority } from '@aalis/api-authority';
20
19
 
21
- 本包为 *-api 类型包;实现见对应的运行时插件。
20
+ // uses: { authority }
21
+ ```
22
22
 
23
23
  ## 许可
24
24
 
package/dist/index.d.ts CHANGED
@@ -3,7 +3,7 @@ export type CapabilityId = string;
3
3
  /**
4
4
  * 能力默认可见性(轴 A · 授权:谁默认能用):
5
5
  * - public:所有人默认拥有(除非被显式 deny),如查天气、查状态。
6
- * - restricted:默认禁止,须被 owner/上层委托授予,如关机、写 users.json。
6
+ * - restricted:门槛较高,无 risk 声明时最低等级为 RESTRICTED_LEVEL,如关机、写 users.json。
7
7
  */
8
8
  export type CapabilityVisibility = 'public' | 'restricted';
9
9
  /**
@@ -63,8 +63,7 @@ export declare function riskDefaults(risk?: CapabilityRisk): {
63
63
  /**
64
64
  * 把 (risk, visibility, confirm) 声明展开为生效的 (visibility, confirm)。纯函数。
65
65
  * 优先级:显式 visibility/confirm > risk 推导 > defaultVisibility。
66
- * @param defaultVisibility 三者皆缺省时的兜底可见性 —— tools/commands 传 'public',
67
- * WebUI actions 传 'restricted'(actions 默认拒,与 tool/command 相反)。
66
+ * @param defaultVisibility 三者皆缺省时的兜底可见性(缺省 'public')。
68
67
  */
69
68
  export declare function resolveCapabilityPolicy(decl: CapabilityPolicyDecl, defaultVisibility?: CapabilityVisibility): {
70
69
  visibility: CapabilityVisibility;
@@ -76,9 +75,9 @@ export interface ExecutionGuardContext {
76
75
  name: string;
77
76
  /** 操作类型 */
78
77
  type: 'command' | 'tool';
79
- /** 操作主能力的生效可见性(轴 A;注册时已由 resolveCapabilityPolicy 展开 risk/默认)。无 risk 时作 minTier 兜底 */
78
+ /** 操作主能力的生效可见性(轴 A;注册时已由 resolveCapabilityPolicy 展开 risk/默认)。无 risk 时据它兜底 minLevel */
80
79
  visibility: CapabilityVisibility;
81
- /** 操作原始风险声明(透传,供 authority 派生 minTier:safe→访客/sensitive→朋友/dangerous→信任);缺省回退 visibility */
80
+ /** 操作原始风险声明(透传,供 authority 派生 minLevel:safe→0 / sensitive→1 / dangerous→2);缺省回退 visibility */
82
81
  risk?: CapabilityRisk;
83
82
  /** 操作的生效确认要求(轴 B,与 visibility/档位 正交、owner 也生效);缺省=不确认 */
84
83
  confirm?: CapabilityConfirm;
@@ -102,8 +101,8 @@ export interface ExecutionGuardContext {
102
101
  /** 操作参数 */
103
102
  args?: Record<string, unknown>;
104
103
  /**
105
- * 系统/受信源(如 scheduler,无人能点交互确认):仍走 authorize 评估调用者能力,
106
- * 仅跳过受限被拒后的交互确认弹窗(requestAccess)。**不**绕过 authorize(防提权)。
104
+ * 系统/受信源(如 scheduler,无人能点交互确认):仍走 authorize 评估调用者能力,**不**绕过它(防提权)。
105
+ * 被拒时不走救援闸(isPreApproved);已授权时跳过非 always 的确认,always 照常确认。
107
106
  */
108
107
  skipConfirm?: boolean;
109
108
  /** 调用方回合的中止信号:守卫把它透传给 requestAccess,中止后不再等确认(见 AccessRequest.signal)。 */
@@ -117,18 +116,20 @@ export type ExecutionGuard = (ctx: ExecutionGuardContext) => Promise<string | nu
117
116
  /**
118
117
  * 能力统一闸请求:一次敏感操作在边界处声明它触达的能力。
119
118
  *
120
- * 任何 surface(tool/command/WebUI action/REST/scheduler)的敏感操作都在操作边界
121
- * 调用 authorize 过同一闸。
119
+ * tools / commands 的执行守卫在操作边界调用 authorize 过这道闸。
122
120
  */
123
121
  export interface AuthorizeRequest {
124
122
  /** 操作主能力(tool:<name> / command:<name>) */
125
123
  capability: CapabilityId;
126
- /** 主能力的默认可见性(操作声明;无 risk 时作 minTier 兜底) */
124
+ /** 主能力的默认可见性(操作声明;无 risk 时据它兜底 minLevel) */
127
125
  visibility: CapabilityVisibility;
128
- /** 操作原始风险(透传,供 minTier 派生;缺省回退 visibility) */
126
+ /** 操作原始风险(透传,供 minLevel 派生;缺省回退 visibility) */
129
127
  risk?: CapabilityRisk;
130
128
  }
131
- /** 用户触达未授予的 restricted 能力时,向 owner/确认回调发起的请求 */
129
+ /**
130
+ * 访问请求:操作已过授权、但声明了 confirm 时,经 requestAccess 发起意图确认;
131
+ * 守卫的救援闸 isPreApproved 也用它描述被 authorize 拒绝的操作。
132
+ */
132
133
  export interface AccessRequest {
133
134
  /** 操作名称 */
134
135
  name: string;
@@ -141,10 +142,9 @@ export interface AccessRequest {
141
142
  platform: string;
142
143
  userId?: string;
143
144
  /**
144
- * 请求性质:
145
- * - 'grant'(缺省):非 owner 触达未授予的 restricted 能力,确认=授予。
146
- * - 'confirm':调用者已有权限(含 owner),仅因能力标了 confirm 轴需「意图确认」。
147
- * confirm='always' 时不接受会话记忆(每次都问)。
145
+ * 操作的生效确认要求(见 CapabilityConfirm):
146
+ * - 'session':可按会话记住,白名单与本会话已有的授予可免问。
147
+ * - 'always':每次都问,不接受白名单与会话记忆。
148
148
  */
149
149
  confirm?: CapabilityConfirm;
150
150
  /**
@@ -201,7 +201,7 @@ export interface AuthorityService {
201
201
  /** 是否为 owner(owners 配置命中 → 拥有 `*`) */
202
202
  isOwner(platform: string, userId?: string): boolean;
203
203
  /**
204
- * 统一权限闸 —— 任何 surface 的敏感操作在边界调用本方法。
204
+ * 统一权限闸 —— tools / commands 的执行守卫在操作边界调用本方法。
205
205
  * 数字等级裁决:deniedCapabilities(全局硬禁) > owner(∞) > 用户 level >= 操作 minLevel;
206
206
  * minLevel 由 request.risk/visibility/config.authorityOverrides 派生。
207
207
  * @returns null 放行;string 为拒绝原因(可直接展示)
@@ -222,7 +222,7 @@ export interface AuthorityService {
222
222
  * 且不触犯硬禁 / 资源保护。**绝不询问发起者本人**(杜绝自我确认提权)。守卫 authorize 拒绝后调本方法。
223
223
  */
224
224
  isPreApproved(request: AccessRequest): boolean;
225
- /** 用户触达未授予的 restricted 能力时,过临时委托流程(白名单策略 → 会话临时授予 → 确认回调) */
225
+ /** 意图确认:操作已过授权、但声明了 confirm 时调用(白名单策略 → 会话临时授予 → 确认回调;confirm='always' 只走确认回调) */
226
226
  requestAccess(request: AccessRequest): Promise<boolean>;
227
227
  listTemporaryGrants(): TemporaryGrant[];
228
228
  /** 撤销某能力上所有未过期的会话授予(操作门槛变更时调用),返回撤销条数 */
@@ -236,7 +236,7 @@ export interface AuthorityService {
236
236
  save(): void;
237
237
  listUsers(): AuthorityUserEntry[];
238
238
  }
239
- declare module '@aalis/core' {
239
+ declare module '@aalis/api-host-config' {
240
240
  interface AalisConfig {
241
241
  /** owner 列表(owner = `*`,拥有一切) */
242
242
  owners?: UserIdentity[];
@@ -280,9 +280,5 @@ declare module '@aalis/core' {
280
280
  };
281
281
  }
282
282
  }
283
- declare module '@aalis/core' {
284
- interface ServiceTypeMap {
285
- authority: AuthorityService;
286
- }
287
- }
283
+ export declare const authority: import("@aalis/core").ServiceDescriptor<AuthorityService, import("@aalis/core").ServiceRef<AuthorityService>>;
288
284
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;AAEhE,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAQD,oBAAoB;AACpB,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,MAAM,CAK7G;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG;IACnD,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B,CAEA;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,oBAAoB,EAC1B,iBAAiB,GAAE,oBAA+B,GACjD;IACD,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B,CAMA;AAMD,gCAAgC;AAChC,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW;IACX,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,qFAAqF;IACrF,UAAU,EAAE,oBAAoB,CAAC;IACjC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,yDAAyD;IACzD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,YAAY;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAMpF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,UAAU,EAAE,YAAY,CAAC;IACzB,2CAA2C;IAC3C,UAAU,EAAE,oBAAoB,CAAC;IACjC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAMD,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW;IACX,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,gBAAgB;IAChB,UAAU,EAAE,YAAY,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,mBAAmB;AACnB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,YAAY,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;AAMjG,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAwB;AACxB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAEpD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;IAEpH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAExD,4BAA4B;IAC5B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAGnD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAC/C,6DAA6D;IAC7D,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,mBAAmB,IAAI,cAAc,EAAE,CAAC;IACxC,yCAAyC;IACzC,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACrD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAE/E,IAAI,IAAI,IAAI,CAAC;IACb,SAAS,IAAI,kBAAkB,EAAE,CAAC;CACnC;AAQD,OAAO,QAAQ,aAAa,CAAC;IAC3B,UAAU,WAAW;QACnB,iCAAiC;QACjC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;QACxB,gDAAgD;QAChD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,KAAK,CAAC,CAAC;QAC7D;;;;WAIG;QACH,gBAAgB,CAAC,EAAE;YACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;QACF;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,OAAO,CAAC,EAAE;YACR,iCAAiC;YACjC,YAAY,CAAC,EAAE,OAAO,CAAC;YACvB,2CAA2C;YAC3C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;YACrB,mCAAmC;YACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;SACzB,CAAC;KACH;CACF;AAGD,OAAO,QAAQ,aAAa,CAAC;IAC3B,UAAU,cAAc;QACtB,SAAS,EAAE,gBAAgB,CAAC;KAC7B;CACF"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAeA,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;AAEhE,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAQD,oBAAoB;AACpB,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,MAAM,CAK7G;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG;IACnD,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B,CAEA;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,oBAAoB,EAC1B,iBAAiB,GAAE,oBAA+B,GACjD;IACD,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B,CAMA;AAMD,gCAAgC;AAChC,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW;IACX,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,sFAAsF;IACtF,UAAU,EAAE,oBAAoB,CAAC;IACjC,8FAA8F;IAC9F,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,yDAAyD;IACzD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,YAAY;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAMpF;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,UAAU,EAAE,YAAY,CAAC;IACzB,4CAA4C;IAC5C,UAAU,EAAE,oBAAoB,CAAC;IACjC,+CAA+C;IAC/C,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW;IACX,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,gBAAgB;IAChB,UAAU,EAAE,YAAY,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,mBAAmB;AACnB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,YAAY,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;AAMjG,gBAAgB;AAChB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAwB;AACxB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAEpD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;IAEpH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAExD,4BAA4B;IAC5B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAGnD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAC/C,kFAAkF;IAClF,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,mBAAmB,IAAI,cAAc,EAAE,CAAC;IACxC,yCAAyC;IACzC,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACrD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAE/E,IAAI,IAAI,IAAI,CAAC;IACb,SAAS,IAAI,kBAAkB,EAAE,CAAC;CACnC;AAQD,OAAO,QAAQ,wBAAwB,CAAC;IACtC,UAAU,WAAW;QACnB,iCAAiC;QACjC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;QACxB,gDAAgD;QAChD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,KAAK,CAAC,CAAC;QAC7D;;;;WAIG;QACH,gBAAgB,CAAC,EAAE;YACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;QACF;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B;;;WAGG;QACH,OAAO,CAAC,EAAE;YACR,iCAAiC;YACjC,YAAY,CAAC,EAAE,OAAO,CAAC;YACvB,2CAA2C;YAC3C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;YACrB,mCAAmC;YACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;SACzB,CAAC;KACH;CACF;AAGD,eAAO,MAAM,SAAS,+GAA+C,CAAC"}
package/dist/index.js CHANGED
@@ -1,14 +1,4 @@
1
- // ----- 权限服务接口 + 执行守卫契约(数字等级模型)-----
2
- //
3
- // 模型:操作能力(capability)+ 用户数字等级(level,整数,越大越高)+ 操作最低等级(minLevel)。
4
- // - owner = ∞,可执行任意能力、可管理所有人的权限(不入等级表)。
5
- // - 裁决:deniedCapabilities(全局硬禁)> owner(∞) > 用户 level >= 操作 minLevel;
6
- // minLevel 由操作的 risk / visibility / config.authorityOverrides 派生。
7
- // - restricted:门槛较高的能力;未授权时可经「临时能力委托」(owner 白名单 / 会话短时授予)放行。
8
- // - 单 owner 终态:等级只由 owner 管理(无委托树 / 子委托)。
9
- //
10
- // 任何需要「执行前权限校验」的服务(plugin-tools / plugin-commands 等)从本包导入
11
- // ExecutionGuard / ExecutionGuardContext;消费权限服务的插件导入 AuthorityService。
1
+ import { defineService } from '@aalis/core';
12
2
  const RISK_DEFAULTS = {
13
3
  safe: { visibility: 'public' },
14
4
  sensitive: { visibility: 'restricted' },
@@ -50,8 +40,7 @@ export function riskDefaults(risk) {
50
40
  /**
51
41
  * 把 (risk, visibility, confirm) 声明展开为生效的 (visibility, confirm)。纯函数。
52
42
  * 优先级:显式 visibility/confirm > risk 推导 > defaultVisibility。
53
- * @param defaultVisibility 三者皆缺省时的兜底可见性 —— tools/commands 传 'public',
54
- * WebUI actions 传 'restricted'(actions 默认拒,与 tool/command 相反)。
43
+ * @param defaultVisibility 三者皆缺省时的兜底可见性(缺省 'public')。
55
44
  */
56
45
  export function resolveCapabilityPolicy(decl, defaultVisibility = 'public') {
57
46
  const base = riskDefaults(decl.risk);
@@ -60,4 +49,6 @@ export function resolveCapabilityPolicy(decl, defaultVisibility = 'public') {
60
49
  confirm: decl.confirm ?? base.confirm,
61
50
  };
62
51
  }
52
+ // ----- 服务描述符(按激活绑定;调用型:绑定接口是 ServiceRef)-----
53
+ export const authority = defineService('authority');
63
54
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,gEAAgE;AAChE,0CAA0C;AAC1C,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,4CAA4C;AAC5C,EAAE;AACF,0DAA0D;AAC1D,uEAAuE;AA0CvE,MAAM,aAAa,GAA8F;IAC/G,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC9B,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;IACvC,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;CAC5D,CAAC;AAEF,oBAAoB;AACpB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkE;IACnG,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACnD,OAAO,IAAI,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAIhD,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA0B,EAC1B,oBAA0C,QAAQ;IAKlD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,iBAAiB;QACnE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;KACtC,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqD5C,MAAM,aAAa,GAA8F;IAC/G,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC9B,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;IACvC,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;CAC5D,CAAC;AAEF,oBAAoB;AACpB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkE;IACnG,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACnD,OAAO,IAAI,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAIhD,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA0B,EAC1B,oBAA0C,QAAQ;IAKlD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,iBAAiB;QACnE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;KACtC,CAAC;AACJ,CAAC;AA2PD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAmB,WAAW,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@aalis/api-authority",
3
- "version": "0.8.0",
3
+ "version": "0.10.0",
4
4
  "license": "MIT",
5
5
  "repository": {
6
6
  "type": "git",
@@ -18,16 +18,16 @@
18
18
  "files": [
19
19
  "dist"
20
20
  ],
21
+ "dependencies": {
22
+ "@aalis/api-host-config": ">=0.1.0 <1.0.0"
23
+ },
21
24
  "devDependencies": {
22
25
  "@types/node": "^22.0.0",
23
26
  "typescript": "^5.7.0",
24
- "@aalis/core": "0.12.1"
25
- },
26
- "aalis": {
27
- "types": true
27
+ "@aalis/core": "0.18.0"
28
28
  },
29
29
  "peerDependencies": {
30
- "@aalis/core": ">=0.2.0 <1.0.0"
30
+ "@aalis/core": ">=0.18.0 <1.0.0"
31
31
  },
32
32
  "keywords": [
33
33
  "aalis",