@authup/access 1.0.0-beta.68 → 1.0.0-beta.70

package/dist/index.mjs

@@ -969,6 +969,11 @@ var DatePolicyEvaluator = class {
 };
 //#endregion
 //#region src/policy/built-in/identity/data/validator.ts
+function isPermissionPolicyBinding(input) {
+	if (!input || typeof input !== "object") return false;
+	const { permission } = input;
+	return !!permission && typeof permission === "object" && typeof permission.name === "string";
+}
 var PolicyIdentityDataValidator = class extends Container {
 	initialize() {
 		super.initialize();
@@ -976,6 +981,7 @@ var PolicyIdentityDataValidator = class extends Container {
 		this.mount("id", createValidator(z.uuid()));
 		this.mount("clientId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
 		this.mount("realmId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
+		this.mount("grants", createValidator(z.array(z.custom((input) => isPermissionPolicyBinding(input))).optional()));
 		this.mount("realmName", createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
 	}
 };
@@ -1205,12 +1211,10 @@ var IdentityPermissionBindingPolicyEvaluator = class {
 	validator;
 	identityEvaluator;
 	realmMatchEvaluator;
-	identityPermissionProvider;
-	constructor(identityPermissionProvider) {
+	constructor() {
 		this.validator = new PermissionBindingPolicyValidator();
 		this.identityEvaluator = new IdentityPolicyEvaluator();
 		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
-		this.identityPermissionProvider = identityPermissionProvider;
 	}
 	requires() {
 		return ["permissionBinding"];
@@ -1223,6 +1227,18 @@ var IdentityPermissionBindingPolicyEvaluator = class {
 		ctx.data.setValidated("permissionBinding");
 		return data;
 	}
+	/**
+	* The grants the identity holds. An identity carrying none is missing
+	* data, which throws a PolicyError carrying the refusing issue.
+	*/
+	accessGrants(ctx, identity) {
+		if (!identity.grants) throw new PolicyError("The identity grants are missing", void 0, [definePolicyIssueItem({
+			code: "DATA_MISSING",
+			message: "The identity grants are missing",
+			path: ctx.path
+		})]);
+		return identity.grants;
+	}
 	async evaluate(value, ctx) {
 		const policy = await this.validator.run(value);
 		const identity = await this.identityEvaluator.accessData(ctx);
@@ -1243,10 +1259,20 @@ var IdentityPermissionBindingPolicyEvaluator = class {
 				path: ctx.path
 			})]
 		};
-		const identityBindings = await this.identityPermissionProvider.getFor(identity).then((bindings) => bindings.filter((item) => {
+		let grants;
+		try {
+			grants = this.accessGrants(ctx, identity);
+		} catch (e) {
+			if (isPolicyError(e)) return {
+				success: false,
+				issues: [...e.issues]
+			};
+			throw e;
+		}
+		const identityBindings = grants.filter((item) => {
 			if (item.permission.name !== binding.permission.name) return false;
 			return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
-		}));
+		});
 		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
 		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
@@ -1689,6 +1715,105 @@ var PermissionEvaluator = class {
 	}
 };
 //#endregion
+//#region src/permission/record/module.ts
+function describeName(name) {
+	return Array.isArray(name) ? name.join(", ") : name;
+}
+/**
+* An IPolicyData that is not this package's PolicyData (another
+* implementation, or a second copy of the package). Spreading one as a record
+* would keep only its internal fields and drop every key it carries.
+*/
+function isPolicyDataLike(input) {
+	return isObject(input) && typeof input.has === "function" && typeof input.get === "function" && typeof input.clone === "function";
+}
+/**
+* A fresh policy data bag for one record: the caller's data is cloned, never
+* written to, so one bag can be reused across records.
+*/
+function buildRecordData(name, target) {
+	if (typeof target.realm === "undefined") throw new Error(`The record realm for permission ${describeName(name)} is undefined.`);
+	let data;
+	if (target.data instanceof PolicyData) data = target.data.clone();
+	else if (isPolicyDataLike(target.data)) throw new Error(`The policy data for permission ${describeName(name)} must be a PolicyData instance of this package or a plain record.`);
+	else data = new PolicyData({ ...target.data || {} });
+	if (data.has("realmMatch")) throw new Error(`The policy data for permission ${describeName(name)} must not carry realmMatch.`);
+	data.set("realmMatch", target.realm);
+	return data;
+}
+function buildEvaluationContext(ctx) {
+	return {
+		name: ctx.name,
+		data: buildRecordData(ctx.name, ctx),
+		options: ctx.options
+	};
+}
+/**
+* Throws a permission error unless `name` passes for the record: each grant's
+* `realm_scope` is matched against the record's realm and its policies are
+* evaluated against the record. An array of names must ALL pass, like
+* `evaluate()`.
+*/
+async function evaluateRecord(evaluator, ctx) {
+	await evaluator.evaluate(buildEvaluationContext(ctx));
+}
+/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
+async function evaluateRecordOneOf(evaluator, ctx) {
+	await evaluator.evaluateOneOf(buildEvaluationContext(ctx));
+}
+async function asPredicate(fn) {
+	try {
+		await fn();
+		return true;
+	} catch (error) {
+		if (isPermissionError(error)) return false;
+		throw error;
+	}
+}
+/**
+* {@link evaluateRecord} as a predicate. Only a permission error reads as
+* `false`; anything else propagates, so a failure on the authorization path
+* never turns into a quiet "not authorized".
+*/
+async function reachesRecord(evaluator, ctx) {
+	return asPredicate(() => evaluateRecord(evaluator, ctx));
+}
+/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
+async function reachesRecordOneOf(evaluator, ctx) {
+	return asPredicate(() => evaluateRecordOneOf(evaluator, ctx));
+}
+/**
+* An update passes only when `name` passes for BOTH the stored row (the actor
+* may only change a row it can already reach) and the updated row (the row
+* must stay in reach afterwards). Evaluating the updated row alone lets an
+* update move a row INTO reach.
+*/
+async function evaluateRecordUpdate(evaluator, ctx) {
+	await evaluateRecord(evaluator, {
+		realm: ctx.current.realm,
+		data: ctx.current.data,
+		name: ctx.name,
+		options: ctx.options
+	});
+	await evaluateRecord(evaluator, {
+		realm: ctx.next.realm,
+		data: ctx.next.data,
+		name: ctx.name,
+		options: ctx.options
+	});
+}
+/**
+* Whether a grant of `name` (any of, for an array) reaches every realm with
+* no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
+* verdict, so it relies on the binding policy (`system.default`) being bound
+* to the permission: without it a grant's reach is never evaluated and any
+* grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
+* compiles to `conditional` and reads as `false`.
+*/
+async function hasUnboundedReach(evaluator, name) {
+	return (await evaluator.compile({ name })).verdict === "allow";
+}
+//#endregion
 //#region src/permission/authorization/error.ts
 const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE = Symbol.for("@authup/access/AuthorizationCatalogStaleError");
 /**
@@ -2132,7 +2257,7 @@ async function createAuthorizationEvaluator(input, options = {}) {
 		});
 	}
 	const engine = new PolicyEngine(options.evaluators ?? PolicyDefaultEvaluators);
-	engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator({ getFor: async () => bindings }));
+	engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator());
 	const evaluator = new PermissionEvaluator({
 		provider: new PermissionMemoryProvider(definitions),
 		policyEngine: engine
@@ -2148,7 +2273,8 @@ async function createAuthorizationEvaluator(input, options = {}) {
 			type: identity.type,
 			realmId: identity.realmId ?? void 0,
 			realmName: identity.realmName ?? void 0,
-			clientId: identity.clientId ?? null
+			clientId: identity.clientId ?? null,
+			grants: bindings
 		});
 		return data;
 	};
@@ -2267,6 +2393,6 @@ async function createAuthorizationCheckEvaluator(input) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
+export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, evaluateRecord, evaluateRecordOneOf, evaluateRecordUpdate, grantDominates, hasUnboundedReach, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, reachesRecord, reachesRecordOneOf, realmScopeMatches };
 
 //# sourceMappingURL=index.mjs.map