@aventara/access 0.0.0-stage → 0.1.0-rc.0

package/dist/guardrails/guardrails.compiler.js

@@ -0,0 +1,254 @@
+// Builder → `guardrails@1` file, and the checks every guardrails file passes before
+// a registry stores it or an engine applies it: the format, the members (a `grants`
+// member, or a guardrail's `where`, is refused by name: guardrails only deny, and
+// never read a row), the actions, the Resource lists, the principal conditions and
+// the claims they compare. Errors name the guardrail.
+import { asList, CLAIM_SCALARS, checkActions, compilePrincipalIf, fail, idAllocator, isNamespace, isRecord, ORIGINS, } from "../policies.compiler.js";
+import { POLICIES_FORMAT, } from "../policies-contract.js";
+import { GUARDRAILS_FORMAT, } from "./guardrails-contract.js";
+/** The members of a `guardrails@1` file, and of one guardrail. Anything else is refused. */
+const FILE_KEYS = new Set(["format", "claims", "denies"]);
+const RULE_KEYS = new Set(["id", "actions", "resources", "if"]);
+const GUARDRAIL_OPTIONS = new Set(["name", "if"]);
+const NO_GRANT = "guardrails only deny: a grant belongs in the file of the namespace that owns its Resource";
+const NO_ROW = "a guardrail reads the principal (claims, origin) and never a row; a row condition belongs in the denies of the namespace that owns the Resource";
+/** The author's Resource lists, copied into the file (anything malformed is left for the checks). */
+const resourcesCopy = (resources) => isRecord(resources)
+    ? Object.fromEntries(Object.entries(resources).map(([namespace, list]) => [
+        namespace,
+        Array.isArray(list) ? [...list] : list,
+    ]))
+    : resources;
+/** Compiles the builder's guardrails to the `guardrails@1` file and checks it. */
+export const compileGuardrails = (definition) => {
+    const claimTypes = {};
+    const allocate = idAllocator();
+    const denies = definition.denies.map((rule) => {
+        const actions = rule.actions === "*" ? "*" : [...asList(rule.actions)];
+        const prefix = `guardrail/${actions === "*" ? "*" : actions.join(",")}`;
+        for (const key of Object.keys(rule.options)) {
+            if (key === "where") {
+                fail(prefix, `\`where\` is not a guardrail option: ${NO_ROW}`);
+            }
+            if (!GUARDRAIL_OPTIONS.has(key)) {
+                fail(prefix, `unknown guardrail option "${key}" (name, if)`);
+            }
+        }
+        const id = allocate(prefix, rule.options.name);
+        const condition = rule.options.if === undefined
+            ? undefined
+            : compilePrincipalIf(id, rule.options.if, claimTypes);
+        if (condition !== undefined) {
+            checkDeclared(id, condition, definition.claims);
+        }
+        return {
+            id,
+            actions,
+            resources: resourcesCopy(rule.resources),
+            ...(condition !== undefined ? { if: condition } : {}),
+        };
+    });
+    const guardrails = {
+        format: GUARDRAILS_FORMAT,
+        claims: Object.fromEntries(Object.entries(claimTypes).sort(([a], [b]) => a.localeCompare(b))),
+        denies,
+    };
+    checkGuardrails(guardrails);
+    return guardrails;
+};
+/** Each claim a guardrail's condition compares is in `defineGuardrails({ claims })`, as the type it is compared as. */
+const checkDeclared = (rule, condition, declared) => {
+    switch (condition.op) {
+        case "and":
+            for (const arg of condition.args) {
+                checkDeclared(rule, arg, declared);
+            }
+            return;
+        case "origin":
+            return;
+        case "cmp": {
+            const [claim] = condition.claim;
+            const scalar = typeof condition.value;
+            const type = declared?.[claim];
+            if (type === undefined) {
+                fail(rule, `compares the claim "${claim}", which defineGuardrails({ claims }) does not declare; declare it as "${scalar}"`);
+            }
+            if (type !== scalar) {
+                fail(rule, `compares the claim "${claim}" with a ${scalar}, and defineGuardrails({ claims }) declares it as ${type}`);
+            }
+            return;
+        }
+    }
+};
+// ---------------------------------------------------------------------------
+// Checks every guardrails file passes (a compiled one, or one pulled as JSON)
+// ---------------------------------------------------------------------------
+const LITERAL_TYPES = new Set(["string", "number", "boolean"]);
+/** A principal condition, member by member, against the file's `claims` block. */
+const checkCondition = (rule, condition, claims) => {
+    if (!isRecord(condition)) {
+        fail(rule, "`if` is a condition object");
+    }
+    const node = condition;
+    const only = (...keys) => {
+        for (const key of Object.keys(node)) {
+            if (!keys.includes(key)) {
+                fail(rule, `"${key}" is not a member of an "${String(node.op)}" condition (${keys.join(", ")})`);
+            }
+        }
+    };
+    switch (node.op) {
+        case "and": {
+            only("op", "args");
+            if (!Array.isArray(node.args) || node.args.length === 0) {
+                fail(rule, 'an "and" condition takes a non-empty `args` list');
+            }
+            for (const arg of node.args) {
+                checkCondition(rule, arg, claims);
+            }
+            return;
+        }
+        case "origin":
+            only("op", "value");
+            if (!ORIGINS.includes(node.value)) {
+                fail(rule, `unknown origin ${JSON.stringify(node.value)} (application, client, agent)`);
+            }
+            return;
+        case "cmp": {
+            only("op", "claim", "cmp", "value");
+            const path = node.claim;
+            if (!Array.isArray(path) ||
+                path.length !== 1 ||
+                typeof path[0] !== "string") {
+                fail(rule, 'a claim comparison names one claim: `"claim": ["<name>"]`');
+            }
+            const claim = path[0];
+            if (node.cmp !== "eq") {
+                fail(rule, `a claim comparison is "eq"; it was ${JSON.stringify(node.cmp)}`);
+            }
+            const type = typeof node.value;
+            if (!LITERAL_TYPES.has(type) ||
+                (type === "number" && !Number.isFinite(node.value))) {
+                fail(rule, `claim "${claim}" compares with a string, a finite number or a boolean`);
+            }
+            const declared = Object.hasOwn(claims, claim) ? claims[claim] : undefined;
+            if (declared === undefined) {
+                fail(rule, `compares the claim "${claim}", which the file's "claims" block does not list`);
+            }
+            if (declared?.scalar !== type) {
+                fail(rule, `compares the claim "${claim}" with a ${type}, and the file's "claims" block lists it as ${declared?.scalar}`);
+            }
+            return;
+        }
+        default:
+            fail(rule, `unknown condition ${JSON.stringify(node.op)}: a guardrail's \`if\` is "and", "cmp" on a claim, or "origin"`);
+    }
+};
+/** A guardrail's `resources`: `"*"`, or namespaces to `"*"` or a non-empty list of Resource names. */
+const checkResources = (rule, resources) => {
+    if (resources === "*") {
+        return;
+    }
+    if (!isRecord(resources)) {
+        fail(rule, '`resources` is "*" or, by namespace, "*" or a list of Resources: { "campaign": ["Note"] }');
+    }
+    const entries = Object.entries(resources);
+    if (entries.length === 0) {
+        fail(rule, "`resources` names no namespace");
+    }
+    for (const [namespace, list] of entries) {
+        if (!isNamespace(namespace)) {
+            fail(rule, `${JSON.stringify(namespace)} is not a namespace name (a lowercase letter, then lowercase letters, digits, "_" or "-"; at most 63 characters)`);
+        }
+        if (list === "*") {
+            continue;
+        }
+        if (!Array.isArray(list) ||
+            list.length === 0 ||
+            list.some((name) => typeof name !== "string" || name === "")) {
+            fail(rule, `namespace "${namespace}": "*" or a non-empty list of Resource names`);
+        }
+        if (new Set(list).size !==
+            list.length) {
+            fail(rule, `namespace "${namespace}" names a Resource twice`);
+        }
+    }
+};
+/**
+ * Checks a guardrails file before a registry stores it or an engine applies it.
+ * Throws an `Error` naming the guardrail. The file is trusted for nothing it can be
+ * checked for.
+ */
+export const checkGuardrails = (guardrails) => {
+    if (!isRecord(guardrails)) {
+        fail("guardrails", "a guardrails file is a JSON object");
+    }
+    const file = guardrails;
+    if (file.format === POLICIES_FORMAT) {
+        fail("guardrails", `this is a policies file ("${POLICIES_FORMAT}"); the org's guardrails are a "${GUARDRAILS_FORMAT}" file. Write them with defineGuardrails(...).contract()`);
+    }
+    if (file.format !== GUARDRAILS_FORMAT) {
+        fail("guardrails", `format is ${JSON.stringify(file.format) ?? "missing"}, expected "${GUARDRAILS_FORMAT}"`);
+    }
+    for (const key of Object.keys(file)) {
+        if (key === "grants") {
+            fail("guardrails", `"grants" is not a member of ${GUARDRAILS_FORMAT}: ${NO_GRANT}`);
+        }
+        if (!FILE_KEYS.has(key)) {
+            fail("guardrails", `"${key}" is not a member of ${GUARDRAILS_FORMAT} (format, claims, denies)`);
+        }
+    }
+    if (!isRecord(file.claims)) {
+        fail("guardrails", '"claims" is an object');
+    }
+    if (!Array.isArray(file.denies)) {
+        fail("guardrails", '"denies" is a list');
+    }
+    for (const [claim, type] of Object.entries(guardrails.claims)) {
+        if (!isRecord(type) ||
+            Object.keys(type).some((key) => key !== "scalar") ||
+            !CLAIM_SCALARS.includes(type.scalar)) {
+            fail(`claim "${claim}"`, 'a claim\'s type is { "scalar": "string" | "number" | "boolean" }');
+        }
+    }
+    const ids = new Set();
+    for (const [index, deny] of guardrails.denies.entries()) {
+        if (!isRecord(deny)) {
+            fail(`guardrail ${index + 1}`, "a guardrail is an object");
+        }
+        const rule = deny;
+        if (typeof rule.id !== "string" || rule.id === "") {
+            fail(`guardrail ${index + 1}`, "`id` is a non-empty string");
+        }
+        const id = rule.id;
+        if (ids.has(id)) {
+            fail(id, "two guardrails have this id");
+        }
+        ids.add(id);
+        for (const key of Object.keys(rule)) {
+            if (key === "where") {
+                fail(id, `"where" is not a member of a guardrail: ${NO_ROW}`);
+            }
+            if (key === "subjects") {
+                fail(id, `"subjects" is not a member of a guardrail: ${NO_GRANT}`);
+            }
+            if (!RULE_KEYS.has(key)) {
+                fail(id, `"${key}" is not a member of a guardrail (id, actions, resources, if)`);
+            }
+        }
+        if (rule.actions !== "*") {
+            if (!Array.isArray(rule.actions)) {
+                fail(id, '`actions` is "*" or a list of actions');
+            }
+            checkActions(id, rule.actions);
+            if (new Set(rule.actions).size !==
+                rule.actions.length) {
+                fail(id, "names an action twice");
+            }
+        }
+        checkResources(id, rule.resources);
+        if (rule.if !== undefined) {
+            checkCondition(id, rule.if, guardrails.claims);
+        }
+    }
+};

package/dist/guardrails/guardrails.composer.d.ts

@@ -0,0 +1,7 @@
+import type { AccessPolicies } from "../policies-contract.js";
+import type { AccessGuardrails } from "./guardrails-contract.js";
+/**
+ * The policies file with the guardrails that reach it added as denies. Both files
+ * are checked first; a guardrail that cannot be applied as written throws, naming it.
+ */
+export declare const composeGuardrails: (policies: AccessPolicies, guardrails: AccessGuardrails) => AccessPolicies;

package/dist/guardrails/guardrails.composer.js

@@ -0,0 +1,95 @@
+// How a service's engine applies the org's guardrails: each guardrail that reaches
+// the service's Resources becomes a deny of the policies file the engine runs from.
+// A deny only narrows (any deny wins over every grant), and a guardrail adds no
+// grant, no role, no governed field and no row condition, so the composition can
+// take away what the service's own grants allow and never add to it.
+//
+// Which Resources a guardrail reaches:
+// - `"*"`: every Resource the service asks about;
+// - a namespace's list: only when the namespace is the file's own. Another
+//   namespace's list is that namespace's business and is left alone. A Resource in
+//   the file's own list that the file lacks, or reads as another namespace's, is a
+//   typo or a wrong owner: it is refused, since the guardrail would otherwise apply
+//   to nothing without a word.
+import { fail } from "../policies.compiler.js";
+import { ownOf } from "../scope.resolver.js";
+import { checkGuardrails } from "./guardrails.compiler.js";
+/** The prefix of the deny ids a guardrail becomes, so `explain` tells them from the file's own. */
+const GUARDRAIL_ID = "guardrail:";
+/** The file's own Resources: its schema entries not marked foreign. */
+const ownResources = (policies) => Object.entries(policies.schema)
+    .filter(([, facts]) => facts.foreign === undefined)
+    .map(([resource]) => resource);
+/** The Resources of `policies` that one guardrail narrows, by name; `"*"` for every one. */
+const reach = (policies, guardrail) => {
+    const { resources } = guardrail;
+    if (resources === "*") {
+        return "*";
+    }
+    const own = policies.namespace;
+    const rule = `guardrail "${guardrail.id}"`;
+    if (own === undefined) {
+        return fail(rule, `names Resources by namespace (${Object.keys(resources).join(", ")}), and this policies file names no namespace, so it cannot tell which list is its own. Give the rules their namespace: definePolicies(model, { namespace })`);
+    }
+    const list = Object.hasOwn(resources, own) ? resources[own] : undefined;
+    if (list === undefined) {
+        return [];
+    }
+    if (list === "*") {
+        return ownResources(policies);
+    }
+    for (const resource of list) {
+        const facts = ownOf(policies.schema, resource);
+        if (facts === undefined) {
+            fail(rule, `names ${resource} for namespace "${own}", this file's namespace, and the file has no Resource ${resource}. A guardrail on a misspelled Resource would narrow nothing, so it is refused: correct the guardrail's Resource list`);
+        }
+        if (facts?.foreign !== undefined) {
+            fail(rule, `names ${resource} for namespace "${own}", and this file reads ${resource} as namespace "${facts.foreign}"'s (foreign). List it under "${facts.foreign}" in the guardrail`);
+        }
+    }
+    return list;
+};
+/** The claim types the rules and the guardrails compare, refusing a claim the two compare as different types. */
+const mergedClaims = (policies, guardrails) => {
+    for (const [claim, { scalar }] of Object.entries(guardrails.claims)) {
+        const ruled = ownOf(policies.claims, claim);
+        if (ruled !== undefined && ruled.scalar !== scalar) {
+            fail("guardrails", `the guardrails compare the claim "${claim}" with a ${scalar}, and the rules compare it with a ${ruled.scalar}; make the two agree`);
+        }
+    }
+    return Object.fromEntries(Object.entries({ ...guardrails.claims, ...policies.claims }).sort(([a], [b]) => a.localeCompare(b)));
+};
+/**
+ * The policies file with the guardrails that reach it added as denies. Both files
+ * are checked first; a guardrail that cannot be applied as written throws, naming it.
+ */
+export const composeGuardrails = (policies, guardrails) => {
+    checkGuardrails(guardrails);
+    const denies = [];
+    for (const guardrail of guardrails.denies) {
+        const condition = guardrail.if === undefined ? {} : { if: guardrail.if };
+        const reached = reach(policies, guardrail);
+        if (reached === "*") {
+            denies.push({
+                id: `${GUARDRAIL_ID}${guardrail.id}`,
+                actions: guardrail.actions,
+                resource: "*",
+                ...condition,
+            });
+            continue;
+        }
+        for (const resource of reached) {
+            denies.push({
+                id: `${GUARDRAIL_ID}${guardrail.id}/${resource}`,
+                actions: guardrail.actions,
+                resource,
+                ...condition,
+            });
+        }
+    }
+    return {
+        ...policies,
+        claims: mergedClaims(policies, guardrails),
+        denies: [...policies.denies, ...denies],
+    };
+};

package/dist/guardrails/guardrails.hash.d.ts

@@ -0,0 +1,10 @@
+import type { AccessGuardrails } from "./guardrails-contract.js";
+/** The canonical text of a `guardrails@1` file (see the header). The file is not checked here. */
+export declare const canonicalGuardrails: (guardrails: AccessGuardrails) => string;
+/**
+ * The canonical hash of a guardrails file: `sha256:` and the SHA-256 of its
+ * canonical byte form, in lowercase hex. The same guardrails give the same hash
+ * however the file's members and guardrails are ordered. The file is checked first,
+ * so a file the engine would refuse has no hash.
+ */
+export declare const guardrailsHash: (guardrails: AccessGuardrails) => string;

package/dist/guardrails/guardrails.hash.js

@@ -0,0 +1,38 @@
+// The canonical byte form of a `guardrails@1` file and its hash, by the same rules as
+// a policies file's (`policies.hash.ts`): the registry keys guardrails revisions by
+// it, and a service's lock pins it.
+//
+// The canonical form is the file's JSON text, written by `canonical-json.writer.ts`
+// (members sorted by key, no whitespace) and encoded as UTF-8, with the lists whose
+// order the format gives no meaning sorted: `denies` by `id`, each guardrail's
+// `actions`, and each namespace's Resource list. A condition's arguments keep their
+// order.
+import { byId, canonicalJson, sortedNames, } from "../canonical-json.writer.js";
+import { sha256Hex } from "../sha256.digest.js";
+import { checkGuardrails } from "./guardrails.compiler.js";
+const canonicalResources = (resources) => resources === "*"
+    ? "*"
+    : Object.fromEntries(Object.entries(resources).map(([namespace, list]) => [
+        namespace,
+        list === "*" ? "*" : sortedNames(list),
+    ]));
+const canonicalRule = (rule) => ({
+    ...rule,
+    actions: rule.actions === "*" ? "*" : sortedNames(rule.actions),
+    resources: canonicalResources(rule.resources),
+});
+/** The canonical text of a `guardrails@1` file (see the header). The file is not checked here. */
+export const canonicalGuardrails = (guardrails) => canonicalJson({
+    ...guardrails,
+    denies: [...guardrails.denies].map(canonicalRule).sort(byId),
+});
+/**
+ * The canonical hash of a guardrails file: `sha256:` and the SHA-256 of its
+ * canonical byte form, in lowercase hex. The same guardrails give the same hash
+ * however the file's members and guardrails are ordered. The file is checked first,
+ * so a file the engine would refuse has no hash.
+ */
+export const guardrailsHash = (guardrails) => {
+    checkGuardrails(guardrails);
+    return `sha256:${sha256Hex(canonicalGuardrails(guardrails))}`;
+};

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export { AccessError, type AccessErrorCode } from "./access/access.error.js";
+export type { AccessClaimsDeclaration, AccessClaimsOf, } from "./access/claims.mapper.js";
+export { type AccessBuilder, type AccessClaimsCondition, type AccessDenyOptions, type AccessGrantOptions, type AccessPrincipalRef, type AccessRoleDefinitions, type AccessWhereInput, definePolicies, } from "./access.builder.js";
+export { type AccessEngine, type AccessEngineOptions, type AccessExplanation, createAccessEngine, } from "./access.engine.js";
+export type { AccessSchema } from "./access-schema.js";
+export type { AccessWhere } from "./aventara-where.translator.js";
+export type { AccessBeaconPins, AccessBeaconReader, } from "./beacon/beacon.check.js";
+export type { AccessBeaconStore } from "./beacon/beacon.store.js";
+export { type AccessGuardrailDeny, type AccessGuardrailDenyFunction, type AccessGuardrailOptions, type AccessGuardrailsBuilder, defineGuardrails, } from "./guardrails/guardrails.builder.js";
+export { guardrailsHash } from "./guardrails/guardrails.hash.js";
+export type { AccessGuardrailResources, AccessGuardrailRule, AccessGuardrails, AccessGuardrailsJson, } from "./guardrails/guardrails-contract.js";
+export type { AccessLock, AccessLockPin } from "./lock/lock-contract.js";
+export type { AccessCanQuestion, AccessFields, AccessFieldsQuestion, AccessGrantsQuestion, AccessQuestion, AccessRuleOutcome, AccessScopeQuestion, } from "./policies.decider.js";
+export { policiesHash } from "./policies.hash.js";
+export type { AccessAction, AccessBuiltInSubject, AccessClaimType, AccessComparison, AccessDenyRule, AccessGrantRule, AccessLiteral, AccessOperand, AccessOrigin, AccessPolicies, AccessPoliciesJson, AccessPredicate, AccessPrincipalCondition, AccessPrincipalOperand, AccessRoleDefinition, AccessSchemaRelationFact, AccessSchemaResourceFacts, } from "./policies-contract.js";
+export type { AccessExists, AccessLookup, AccessRow, } from "./predicate.evaluator.js";

package/dist/index.js

@@ -0,0 +1,6 @@
+export { AccessError } from "./access/access.error.js";
+export { definePolicies, } from "./access.builder.js";
+export { createAccessEngine, } from "./access.engine.js";
+export { defineGuardrails, } from "./guardrails/guardrails.builder.js";
+export { guardrailsHash } from "./guardrails/guardrails.hash.js";
+export { policiesHash } from "./policies.hash.js";

package/dist/kiosk/kiosk-verbs.schema.d.ts

@@ -0,0 +1,19 @@
+import { type AccessVerbRoute } from "../client/access-verbs.schema.js";
+/** The kiosk verbs, by name. */
+export type AccessKioskVerbName = "switchUser" | "lock" | "setPin" | "enrollDevice" | "revokeDevice";
+/** The PIN switch's path: a route that starts a session. */
+export declare const KIOSK_SWITCH_PATH = "/kiosk/switch-user";
+export declare const KIOSK_LOCK_PATH = "/kiosk/lock";
+export declare const KIOSK_SET_PIN_PATH = "/kiosk/set-pin";
+export declare const KIOSK_ENROLL_PATH = "/kiosk/enroll-device";
+export declare const KIOSK_REVOKE_PATH = "/kiosk/revoke-device";
+/** A manager's device list: a route, and `access.kiosk` on the server, but no verb (the framework's set of verbs is closed). */
+export declare const KIOSK_LIST_PATH = "/kiosk/list-devices";
+/** Every kiosk route lives under this prefix. */
+export declare const KIOSK_PREFIX = "/kiosk/";
+/** The kiosk verbs' routes, in the order `access.client.verbs` lists them after Better Auth's. */
+export declare const KIOSK_VERBS: {
+    readonly [V in AccessKioskVerbName]: AccessVerbRoute;
+};
+/** The kiosk's endpoint keys in Better Auth's API (`access.api.kioskSwitchUser`): its verbs', the device list's and the server-only PIN setter's. */
+export declare const KIOSK_ENDPOINT_KEYS: ReadonlySet<string>;

package/dist/kiosk/kiosk-verbs.schema.js

@@ -0,0 +1,61 @@
+// The kiosk profile's verbs: Access's own routes under Better Auth's base path, with
+// their arguments and what Access promises of each answer, in the same JSON Schema
+// forms as `$access`'s other verbs (`client/access-verbs.schema.ts`). The answers
+// carry ids and flags only: never a session token, a device credential or a PIN.
+import { BOOLEAN, closed, STRING, USER, } from "../client/access-verbs.schema.js";
+/** The PIN switch's path: a route that starts a session. */
+export const KIOSK_SWITCH_PATH = "/kiosk/switch-user";
+export const KIOSK_LOCK_PATH = "/kiosk/lock";
+export const KIOSK_SET_PIN_PATH = "/kiosk/set-pin";
+export const KIOSK_ENROLL_PATH = "/kiosk/enroll-device";
+export const KIOSK_REVOKE_PATH = "/kiosk/revoke-device";
+/** A manager's device list: a route, and `access.kiosk` on the server, but no verb (the framework's set of verbs is closed). */
+export const KIOSK_LIST_PATH = "/kiosk/list-devices";
+/** Every kiosk route lives under this prefix. */
+export const KIOSK_PREFIX = "/kiosk/";
+/** The device, as an answer names it. */
+const DEVICE = closed({ id: STRING, name: STRING }, ["id", "name"]);
+const SUCCESS = closed({ success: BOOLEAN }, ["success"]);
+/** The kiosk verbs' routes, in the order `access.client.verbs` lists them after Better Auth's. */
+export const KIOSK_VERBS = {
+    switchUser: {
+        method: "POST",
+        path: KIOSK_SWITCH_PATH,
+        args: closed({ userId: STRING, pin: STRING }, ["userId", "pin"]),
+        result: closed({ user: USER }, ["user"]),
+        endpoint: "kioskSwitchUser",
+    },
+    lock: {
+        method: "POST",
+        path: KIOSK_LOCK_PATH,
+        result: SUCCESS,
+        endpoint: "kioskLock",
+    },
+    setPin: {
+        method: "POST",
+        path: KIOSK_SET_PIN_PATH,
+        args: closed({ pin: STRING }, ["pin"]),
+        result: SUCCESS,
+        endpoint: "kioskSetPin",
+    },
+    enrollDevice: {
+        method: "POST",
+        path: KIOSK_ENROLL_PATH,
+        args: closed({ name: STRING }, ["name"]),
+        result: closed({ device: DEVICE }, ["device"]),
+        endpoint: "kioskEnrollDevice",
+    },
+    revokeDevice: {
+        method: "POST",
+        path: KIOSK_REVOKE_PATH,
+        args: closed({ deviceId: STRING }, ["deviceId"]),
+        result: SUCCESS,
+        endpoint: "kioskRevokeDevice",
+    },
+};
+/** The kiosk's endpoint keys in Better Auth's API (`access.api.kioskSwitchUser`): its verbs', the device list's and the server-only PIN setter's. */
+export const KIOSK_ENDPOINT_KEYS = new Set([
+    ...Object.values(KIOSK_VERBS).map((route) => route.endpoint),
+    "kioskListDevices",
+    "kioskSetUserPin",
+]);