@auth-gate/rbac 0.8.0 → 0.9.0

package/dist/{chunk-HE57TIQI.mjs → chunk-ZFKXT2MP.mjs}

@@ -14,6 +14,12 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/validator.ts
 var KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -63,15 +69,28 @@ function validateRbacConfig(config) {
         );
       }
     }
-    resourceActions.set(key, new Set(resource.actions));
+    const actionSet = /* @__PURE__ */ new Set();
+    for (const action of resource.actions) {
+      if (actionSet.has(action)) {
+        throw new Error(`Resource "${key}" has duplicate action: "${action}".`);
+      }
+      actionSet.add(action);
+    }
+    resourceActions.set(key, actionSet);
     if (resource.scopes !== void 0) {
       if (!Array.isArray(resource.scopes)) {
         throw new Error(`Resource "${key}".scopes must be an array of strings.`);
       }
+      const scopeSet = /* @__PURE__ */ new Set();
       for (let i = 0; i < resource.scopes.length; i++) {
         if (typeof resource.scopes[i] !== "string") {
           throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
         }
+        const scope = resource.scopes[i];
+        if (scopeSet.has(scope)) {
+          throw new Error(`Resource "${key}" has duplicate scope: "${scope}".`);
+        }
+        scopeSet.add(scope);
       }
     }
   }
@@ -112,14 +131,40 @@ function validateRbacConfig(config) {
           );
         }
         const value = actionsGrant[actionKey];
-        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+        if (value !== true && (typeof value !== "string" || value === "") && !(value && typeof value === "object" && "when" in value && typeof value.when === "string" && value.when !== "")) {
           throw new Error(
-            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a non-empty scope string, or { when: non-empty string }.`
           );
         }
+        if (typeof value === "string" && value !== "") {
+          const resource = resources[resourceKey];
+          if (resource.scopes && Array.isArray(resource.scopes)) {
+            const declaredScopes = new Set(resource.scopes);
+            if (!declaredScopes.has(value)) {
+              throw new Error(
+                `Role "${key}".grants.${resourceKey}.${actionKey} scope "${value}" is not in declared scopes for "${resourceKey}": ${[...declaredScopes].join(", ")}.`
+              );
+            }
+          }
+        }
       }
     }
   }
+  const defaultRoles = [];
+  for (const key of roleKeys) {
+    const role = roles[key];
+    if (role.isDefault !== void 0 && typeof role.isDefault !== "boolean") {
+      throw new Error(`Role "${key}".isDefault must be a boolean.`);
+    }
+    if (role.isDefault === true) {
+      defaultRoles.push(key);
+    }
+  }
+  if (defaultRoles.length > 1) {
+    throw new Error(
+      `Only one role may have isDefault: true. Found ${defaultRoles.length}: ${defaultRoles.join(", ")}.`
+    );
+  }
   for (const key of roleKeys) {
     const role = roles[key];
     if (role.inherits !== void 0) {
@@ -185,6 +230,7 @@ function validateRbacConfig(config) {
       renameTargets.set(role.renamedFrom, key);
     }
   }
+  const conditionKeys = /* @__PURE__ */ new Set();
   if (c.conditions !== void 0) {
     if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
       throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
@@ -196,6 +242,23 @@ function validateRbacConfig(config) {
           `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
         );
       }
+      conditionKeys.add(condKey);
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    const grants = role.grants;
+    for (const [resourceKey, actionGrants] of Object.entries(grants)) {
+      for (const [actionKey, value] of Object.entries(actionGrants)) {
+        if (value && typeof value === "object" && "when" in value) {
+          const whenKey = value.when;
+          if (!conditionKeys.has(whenKey)) {
+            throw new Error(
+              `Role "${key}".grants.${resourceKey}.${actionKey} references condition "${whenKey}" but it is not declared in conditions.` + (conditionKeys.size > 0 ? ` Declared conditions: ${[...conditionKeys].join(", ")}.` : ` No conditions are declared.`)
+            );
+          }
+        }
+      }
     }
   }
   return config;
@@ -234,17 +297,27 @@ Run \`npx @auth-gate/rbac init\` to create one.`
 }
 
 // src/diff.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key, i) => key === keysB[i] && deepEqual(a[key], b[key])
+  );
+}
 function hashConditionSource(fn) {
-  const src = fn.toString();
-  let hash = 0;
-  for (let i = 0; i < src.length; i++) {
-    const ch = src.charCodeAt(i);
-    hash = (hash << 5) - hash + ch | 0;
-  }
-  return hash.toString(36);
+  const { createHash } = __require("crypto");
+  return createHash("sha256").update(fn.toString()).digest("hex").slice(0, 16);
 }
 function computeRbacDiff(config, server, memberCounts) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n;
   const resourceOps = [];
   const roleOps = [];
   const conditionOps = [];
@@ -303,7 +376,7 @@ function computeRbacDiff(config, server, memberCounts) {
     if (!existing && role.renamedFrom) {
       existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
       if (existing) {
-        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        const members = (_e = memberCounts[existing.configKey]) != null ? _e : 0;
         roleOps.push({
           type: "rename",
           key,
@@ -327,16 +400,19 @@ function computeRbacDiff(config, server, memberCounts) {
       if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
         changes.push("description changed");
       }
-      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
-      const configGrants = JSON.stringify(role.grants);
-      if (existingGrants !== configGrants) {
+      if (!deepEqual((_h = existing.grants) != null ? _h : null, (_i = role.grants) != null ? _i : null)) {
         changes.push("grants changed");
       }
-      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
-      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      const existingInherits = [...(_j = existing.inherits) != null ? _j : []].sort().join(",");
+      const configInherits = [...(_k = role.inherits) != null ? _k : []].sort().join(",");
       if (existingInherits !== configInherits) {
         changes.push("inherits changed");
       }
+      const existingDefault = (_l = existing.isDefault) != null ? _l : false;
+      const configDefault = (_m = role.isDefault) != null ? _m : false;
+      if (existingDefault !== configDefault) {
+        changes.push(`isDefault: ${existingDefault} -> ${configDefault}`);
+      }
       if (changes.length > 0) {
         roleOps.push({ type: "update", key, role, existing, changes });
       }
@@ -346,7 +422,7 @@ function computeRbacDiff(config, server, memberCounts) {
   for (const [key, role] of serverRoleByKey) {
     if (renameMap.has(key)) continue;
     if (role.isActive) {
-      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      const members = (_n = memberCounts[role.configKey]) != null ? _n : 0;
       if (members > 0) hasDestructive = true;
       roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
     }
@@ -433,6 +509,9 @@ function formatRbacDiff(diff, dryRun) {
             chalk.dim(`    inherits: [${[...op.role.inherits].join(", ")}]`)
           );
         }
+        if (op.role.isDefault) {
+          lines.push(chalk.dim(`    isDefault: true`));
+        }
       } else if (op.type === "update") {
         lines.push(chalk.yellow(`  ~ UPDATE role "${op.key}"`));
         for (const change of op.changes) {
@@ -508,6 +587,11 @@ var RbacSyncClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    if (!this.baseUrl.startsWith("https://") && !this.baseUrl.startsWith("http://localhost") && !this.baseUrl.startsWith("http://127.0.0.1")) {
+      console.warn(
+        "WARNING: AUTHGATE_BASE_URL does not use HTTPS. API key may be transmitted insecurely."
+      );
+    }
   }
   async request(method, path, body) {
     var _a, _b;
@@ -526,9 +610,12 @@ var RbacSyncClient = class {
       let message;
       try {
         const json = JSON.parse(text);
-        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : "Unknown error";
       } catch (e) {
-        message = text;
+        message = text.length > 500 ? text.slice(0, 500) + "..." : text;
+      }
+      if (this.apiKey) {
+        message = message.replaceAll(this.apiKey, "[REDACTED]");
       }
       throw new Error(`API error (${res.status}): ${message}`);
     }
@@ -548,7 +635,10 @@ var RbacSyncClient = class {
       resources: config.resources,
       roles: config.roles,
       conditions: config.conditions ? Object.fromEntries(
-        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+        Object.entries(config.conditions).map(([k, fn]) => [
+          k,
+          { key: k, sourceHash: hashConditionSource(fn) }
+        ])
       ) : void 0,
       force
     });

package/dist/cli.cjs

@@ -89,15 +89,28 @@ function validateRbacConfig(config) {
         );
       }
     }
-    resourceActions.set(key, new Set(resource.actions));
+    const actionSet = /* @__PURE__ */ new Set();
+    for (const action of resource.actions) {
+      if (actionSet.has(action)) {
+        throw new Error(`Resource "${key}" has duplicate action: "${action}".`);
+      }
+      actionSet.add(action);
+    }
+    resourceActions.set(key, actionSet);
     if (resource.scopes !== void 0) {
       if (!Array.isArray(resource.scopes)) {
         throw new Error(`Resource "${key}".scopes must be an array of strings.`);
       }
+      const scopeSet = /* @__PURE__ */ new Set();
       for (let i = 0; i < resource.scopes.length; i++) {
         if (typeof resource.scopes[i] !== "string") {
           throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
         }
+        const scope = resource.scopes[i];
+        if (scopeSet.has(scope)) {
+          throw new Error(`Resource "${key}" has duplicate scope: "${scope}".`);
+        }
+        scopeSet.add(scope);
       }
     }
   }
@@ -138,14 +151,40 @@ function validateRbacConfig(config) {
           );
         }
         const value = actionsGrant[actionKey];
-        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+        if (value !== true && (typeof value !== "string" || value === "") && !(value && typeof value === "object" && "when" in value && typeof value.when === "string" && value.when !== "")) {
           throw new Error(
-            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a non-empty scope string, or { when: non-empty string }.`
           );
         }
+        if (typeof value === "string" && value !== "") {
+          const resource = resources[resourceKey];
+          if (resource.scopes && Array.isArray(resource.scopes)) {
+            const declaredScopes = new Set(resource.scopes);
+            if (!declaredScopes.has(value)) {
+              throw new Error(
+                `Role "${key}".grants.${resourceKey}.${actionKey} scope "${value}" is not in declared scopes for "${resourceKey}": ${[...declaredScopes].join(", ")}.`
+              );
+            }
+          }
+        }
       }
     }
   }
+  const defaultRoles = [];
+  for (const key of roleKeys) {
+    const role = roles[key];
+    if (role.isDefault !== void 0 && typeof role.isDefault !== "boolean") {
+      throw new Error(`Role "${key}".isDefault must be a boolean.`);
+    }
+    if (role.isDefault === true) {
+      defaultRoles.push(key);
+    }
+  }
+  if (defaultRoles.length > 1) {
+    throw new Error(
+      `Only one role may have isDefault: true. Found ${defaultRoles.length}: ${defaultRoles.join(", ")}.`
+    );
+  }
   for (const key of roleKeys) {
     const role = roles[key];
     if (role.inherits !== void 0) {
@@ -211,6 +250,7 @@ function validateRbacConfig(config) {
       renameTargets.set(role.renamedFrom, key);
     }
   }
+  const conditionKeys = /* @__PURE__ */ new Set();
   if (c.conditions !== void 0) {
     if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
       throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
@@ -222,6 +262,23 @@ function validateRbacConfig(config) {
           `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
         );
       }
+      conditionKeys.add(condKey);
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    const grants = role.grants;
+    for (const [resourceKey, actionGrants] of Object.entries(grants)) {
+      for (const [actionKey, value] of Object.entries(actionGrants)) {
+        if (value && typeof value === "object" && "when" in value) {
+          const whenKey = value.when;
+          if (!conditionKeys.has(whenKey)) {
+            throw new Error(
+              `Role "${key}".grants.${resourceKey}.${actionKey} references condition "${whenKey}" but it is not declared in conditions.` + (conditionKeys.size > 0 ? ` Declared conditions: ${[...conditionKeys].join(", ")}.` : ` No conditions are declared.`)
+            );
+          }
+        }
+      }
     }
   }
   return config;
@@ -258,17 +315,27 @@ Run \`npx @auth-gate/rbac init\` to create one.`
 }
 
 // src/diff.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key, i) => key === keysB[i] && deepEqual(a[key], b[key])
+  );
+}
 function hashConditionSource(fn) {
-  const src = fn.toString();
-  let hash = 0;
-  for (let i = 0; i < src.length; i++) {
-    const ch = src.charCodeAt(i);
-    hash = (hash << 5) - hash + ch | 0;
-  }
-  return hash.toString(36);
+  const { createHash } = require("crypto");
+  return createHash("sha256").update(fn.toString()).digest("hex").slice(0, 16);
 }
 function computeRbacDiff(config, server, memberCounts) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n;
   const resourceOps = [];
   const roleOps = [];
   const conditionOps = [];
@@ -327,7 +394,7 @@ function computeRbacDiff(config, server, memberCounts) {
     if (!existing && role.renamedFrom) {
       existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
       if (existing) {
-        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        const members = (_e = memberCounts[existing.configKey]) != null ? _e : 0;
         roleOps.push({
           type: "rename",
           key,
@@ -351,16 +418,19 @@ function computeRbacDiff(config, server, memberCounts) {
       if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
         changes.push("description changed");
       }
-      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
-      const configGrants = JSON.stringify(role.grants);
-      if (existingGrants !== configGrants) {
+      if (!deepEqual((_h = existing.grants) != null ? _h : null, (_i = role.grants) != null ? _i : null)) {
         changes.push("grants changed");
       }
-      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
-      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      const existingInherits = [...(_j = existing.inherits) != null ? _j : []].sort().join(",");
+      const configInherits = [...(_k = role.inherits) != null ? _k : []].sort().join(",");
       if (existingInherits !== configInherits) {
         changes.push("inherits changed");
       }
+      const existingDefault = (_l = existing.isDefault) != null ? _l : false;
+      const configDefault = (_m = role.isDefault) != null ? _m : false;
+      if (existingDefault !== configDefault) {
+        changes.push(`isDefault: ${existingDefault} -> ${configDefault}`);
+      }
       if (changes.length > 0) {
         roleOps.push({ type: "update", key, role, existing, changes });
       }
@@ -370,7 +440,7 @@ function computeRbacDiff(config, server, memberCounts) {
   for (const [key, role] of serverRoleByKey) {
     if (renameMap.has(key)) continue;
     if (role.isActive) {
-      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      const members = (_n = memberCounts[role.configKey]) != null ? _n : 0;
       if (members > 0) hasDestructive = true;
       roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
     }
@@ -457,6 +527,9 @@ function formatRbacDiff(diff, dryRun) {
             import_chalk.default.dim(`    inherits: [${[...op.role.inherits].join(", ")}]`)
           );
         }
+        if (op.role.isDefault) {
+          lines.push(import_chalk.default.dim(`    isDefault: true`));
+        }
       } else if (op.type === "update") {
         lines.push(import_chalk.default.yellow(`  ~ UPDATE role "${op.key}"`));
         for (const change of op.changes) {
@@ -532,6 +605,11 @@ var RbacSyncClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    if (!this.baseUrl.startsWith("https://") && !this.baseUrl.startsWith("http://localhost") && !this.baseUrl.startsWith("http://127.0.0.1")) {
+      console.warn(
+        "WARNING: AUTHGATE_BASE_URL does not use HTTPS. API key may be transmitted insecurely."
+      );
+    }
   }
   async request(method, path, body) {
     var _a, _b;
@@ -550,9 +628,12 @@ var RbacSyncClient = class {
       let message;
       try {
         const json = JSON.parse(text);
-        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : "Unknown error";
       } catch (e) {
-        message = text;
+        message = text.length > 500 ? text.slice(0, 500) + "..." : text;
+      }
+      if (this.apiKey) {
+        message = message.replaceAll(this.apiKey, "[REDACTED]");
       }
       throw new Error(`API error (${res.status}): ${message}`);
     }
@@ -572,7 +653,10 @@ var RbacSyncClient = class {
       resources: config.resources,
       roles: config.roles,
       conditions: config.conditions ? Object.fromEntries(
-        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+        Object.entries(config.conditions).map(([k, fn]) => [
+          k,
+          { key: k, sourceHash: hashConditionSource(fn) }
+        ])
       ) : void 0,
       force
     });
@@ -665,6 +749,7 @@ export const rbac = defineRbac({
     },
     viewer: {
       name: "Viewer",
+      isDefault: true,
       grants: {
         documents: { read: true },
       },

package/dist/cli.mjs

@@ -5,7 +5,7 @@ import {
   computeRbacDiff,
   formatRbacDiff,
   loadRbacConfig
-} from "./chunk-HE57TIQI.mjs";
+} from "./chunk-ZFKXT2MP.mjs";
 
 // src/cli.ts
 import chalk from "chalk";
@@ -93,6 +93,7 @@ export const rbac = defineRbac({
     },
     viewer: {
       name: "Viewer",
+      isDefault: true,
       grants: {
         documents: { read: true },
       },