@aventara/access 0.0.0-stage → 1.0.0-rc.1

package/dist/resources/auth-tables.guard.d.ts

@@ -0,0 +1,106 @@
+import type { AccessFields, AccessFieldsQuestion } from "../policies.decider.js";
+import type { AccessDenyRule, AccessPolicies } from "../policies-contract.js";
+import type { ClosedTables } from "../reference-reads.check.js";
+import { type AuthResourceKey, type AuthTable, type AuthTableNaming } from "./auth-tables.catalog.js";
+/**
+ * The `resources` block: which of Better Auth's tables are Resources of the app's
+ * rules. Every other table of Better Auth's stays closed.
+ */
+export type AccessResourcesOptions = {
+    /**
+     * Better Auth's `user`, `session` and `account` tables: read as the rules grant,
+     * secret columns excepted; through Aventara, a user's `role` is the one field a
+     * write may set.
+     */
+    readonly users?: boolean;
+    /**
+     * The organization plugin's `member` table (and its `organization`, read only):
+     * read as the rules grant; a membership may be created, removed, and its `role`
+     * changed. Needs `organization()` in `betterAuth.plugins`.
+     */
+    readonly members?: boolean;
+    /**
+     * Which Resource of the rules' schema is each of Better Auth's tables, by Better
+     * Auth model name (`{ user: "User", session: "AuthSession", jwks: null, … }`),
+     * `null` for a table the schema does not have (not "closed": a table the schema
+     * has is named, and closed or opened by its key). Each named Resource has every
+     * column of its table, by Better Auth's `fieldName`. Required, naming every table
+     * Better Auth is built with (its plugins' and Access's own included), when Better
+     * Auth does not run on its Prisma adapter and the rules have a schema: only the
+     * Prisma adapter ties a table to a model by name. Refused with the Prisma adapter.
+     */
+    readonly authTables?: {
+        readonly [model: string]: string | null;
+    };
+};
+/** The `resources` block, checked. */
+export type ResourcesChoice = {
+    readonly [K in AuthResourceKey]: boolean;
+} & {
+    readonly authTables: {
+        readonly [model: string]: string | null;
+    } | undefined;
+};
+/** The fields a write may set on one opened table, by action. */
+type WritableSets = {
+    readonly create: ReadonlySet<string>;
+    readonly update: ReadonlySet<string>;
+};
+/** The built-in rules over Better Auth's tables, as the engine runs them. */
+export type AuthTablesGuard = {
+    /** Denies added to the rules': closed tables, and the writes an opened one never takes. */
+    readonly denies: readonly AccessDenyRule[];
+    /** The secret columns, by Resource: never in an answer of `fieldsOf`. */
+    readonly sealed: ReadonlyMap<string, ReadonlySet<string>>;
+    /** The fields a write may set, by opened Resource. */
+    readonly writable: ReadonlyMap<string, WritableSets>;
+    /** The closed tables a `resources` key opens, by Resource: Better Auth's model name and that key. */
+    readonly closed: ClosedTables;
+    /** The fields governed for writing, by opened Resource: a grant that names one sets it. */
+    readonly governed: ReadonlyMap<string, readonly string[]>;
+};
+/** The `resources` block, checked: `users` and `members` `true` or `false`, `authTables` a map of names or `null`. */
+export declare const checkResourcesOptions: (value: unknown) => ResourcesChoice;
+/**
+ * How the rules' schema names Better Auth's tables, checked when the instance is
+ * built: with Better Auth on its Prisma adapter, by the adapter's own delegates
+ * (and no `authTables`); else by `authTables`, which must name every table
+ * (`models`) and nothing else. A rules' schema with no Resource needs neither.
+ */
+export declare const authTableNaming: (input: {
+    readonly prisma: {
+        readonly usePlural: boolean;
+    } | undefined;
+    readonly authTables: ResourcesChoice["authTables"];
+    readonly models: readonly string[];
+    readonly schemaEmpty: boolean;
+}) => AuthTableNaming;
+/**
+ * The built-in rules for one set of rules: `resources` as the app gave it, Better
+ * Auth's tables as it is built (`authTablesOf`), and the rules' file. Throws
+ * `ACCESS_RESOURCE_MISSING` when a key's tables are missing, and
+ * `ACCESS_OPTIONS_INVALID` for a grant the built-in rules would leave without effect.
+ */
+export declare const guardAuthTables: (input: {
+    readonly resources: { readonly [K in AuthResourceKey]: boolean; };
+    readonly tables: ReadonlyMap<string, AuthTable>;
+    readonly naming: AuthTableNaming;
+    readonly policies: AccessPolicies;
+}) => AuthTablesGuard;
+/**
+ * The rules' file with the built-in rules in it: their denies beside the file's, and
+ * each field they govern for writing governed so (a field the rules govern for
+ * reading only is then governed for both; one they govern for writing or both stays).
+ */
+export declare const withBuiltInRules: (policies: AccessPolicies, guard: AuthTablesGuard) => AccessPolicies;
+/**
+ * `fieldsOf`'s answer with the built-in rules applied: a secret column is never
+ * listed, and a write lists only the fields its action may set on an opened table.
+ * `"all"` becomes the list it stands for (every field that is not governed) when
+ * something is taken out of it.
+ */
+export declare const guardedFields: (guard: AuthTablesGuard, question: AccessFieldsQuestion, answer: AccessFields, resource: {
+    readonly fields: readonly string[];
+    readonly governed: readonly string[];
+}) => AccessFields;
+export {};

package/dist/resources/auth-tables.guard.js

@@ -0,0 +1,462 @@
+// The built-in rules Access adds over Better Auth's tables, from the `resources` block
+// and the tables Better Auth is built with. The engine runs them beside the app's
+// rules, and they only narrow:
+//
+// - a table no `resources` key opens is closed: a deny on every action;
+// - an opened table takes the app's grants for reading, and only the writes its
+//   key allows (a deny on the other actions; the fields a write may set);
+// - a secret column (a password hash, a session token, a signing key) is never in
+//   an answer of `fieldsOf`, whatever the grants say: naming it is refused.
+//
+// At startup (the first read of `access.policy`, which is the framework's
+// construction), a key whose tables are missing (from Better Auth, or from the
+// rules' schema) is refused, and so is a grant that could never apply: one on a
+// closed table, or one naming a write the table never takes.
+import { AccessError } from "../access/access.error.js";
+import { ACTIONS } from "../policies.compiler.js";
+import { ownOf } from "../scope.resolver.js";
+import { KEY_TABLES, OPENED_TABLES, SECRET_COLUMNS, } from "./auth-tables.catalog.js";
+/** The prefix of the built-in deny ids, so `explain` and the audit log tell them from the rules'. */
+const BUILT_IN_ID = "better-auth:";
+const KEYS = ["users", "members"];
+const refuse = (message) => {
+    throw new AccessError("ACCESS_OPTIONS_INVALID", message);
+};
+const missing = (message) => {
+    throw new AccessError("ACCESS_RESOURCE_MISSING", message);
+};
+/** The `resources` block, checked: `users` and `members` `true` or `false`, `authTables` a map of names or `null`. */
+export const checkResourcesOptions = (value) => {
+    if (value === undefined) {
+        return { users: false, members: false, authTables: undefined };
+    }
+    const shape = "`resources` is `{ users?: boolean, members?: boolean, authTables?: { [model]: Resource | null } }`: which of Better Auth's tables are Resources of the rules";
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return refuse(`${shape}.`);
+    }
+    const block = value;
+    for (const [key, on] of Object.entries(block)) {
+        if (key === "authTables") {
+            if (typeof on !== "object" || on === null || Array.isArray(on)) {
+                refuse(`${shape}; \`resources.authTables\` names each table's Resource, or \`null\`.`);
+            }
+            for (const [model, resource] of Object.entries(on)) {
+                if (resource !== null && typeof resource !== "string") {
+                    refuse(`${shape}; \`resources.authTables.${model}\` is a Resource's name or \`null\`.`);
+                }
+            }
+            continue;
+        }
+        if (!KEYS.includes(key)) {
+            refuse(`${shape}; it does not take \`${key}\`.`);
+        }
+        if (typeof on !== "boolean") {
+            refuse(`${shape}; \`resources.${key}\` was ${JSON.stringify(on)}.`);
+        }
+    }
+    return {
+        users: block.users === true,
+        members: block.members === true,
+        authTables: block.authTables,
+    };
+};
+/**
+ * How the rules' schema names Better Auth's tables, checked when the instance is
+ * built: with Better Auth on its Prisma adapter, by the adapter's own delegates
+ * (and no `authTables`); else by `authTables`, which must name every table
+ * (`models`) and nothing else. A rules' schema with no Resource needs neither.
+ */
+export const authTableNaming = (input) => {
+    const { prisma, authTables, models, schemaEmpty } = input;
+    if (prisma !== undefined) {
+        if (authTables !== undefined) {
+            refuse("`resources.authTables` is for Better Auth on another adapter than Prisma's: on Prisma's, Access finds each table by the Prisma model its adapter reads. Remove it.");
+        }
+        return { kind: "prisma", usePlural: prisma.usePlural };
+    }
+    if (schemaEmpty && authTables === undefined) {
+        return { kind: "map", map: {} };
+    }
+    const map = authTables ?? {};
+    const unnamed = [];
+    for (const model of models) {
+        if (!Object.hasOwn(map, model)) {
+            unnamed.push(model);
+        }
+    }
+    if (unnamed.length > 0) {
+        refuse(`Better Auth does not run on its Prisma adapter here, so nothing ties its tables to the rules' Resources by name (a Prisma schema can call any table anything, with \`@@map\`), and a table Access does not know would be an ordinary Resource, open to every grant, its secret columns included. Name the Resource each table is in \`resources.authTables\`, or \`null\` for a table the rules' schema does not have; it lacks ${unnamed.map((model) => `\`${model}\``).join(", ")}.`);
+    }
+    for (const model of Object.keys(map)) {
+        if (!models.includes(model)) {
+            refuse(`\`resources.authTables\` names \`${model}\`, which is no table of Better Auth's as it is built (its tables: ${models.join(", ")}).`);
+        }
+    }
+    return { kind: "map", map };
+};
+/** One Better Auth field's name in the app's schema, when the Resource has it. */
+const fieldOf = (table, facts, field) => {
+    const name = table.fields.get(field) ?? field;
+    return facts.fields.includes(name) ? name : undefined;
+};
+/**
+ * The fields a write may set: Better Auth's fields the catalog lists, the row's
+ * identifier for a create, and each relation whose reference fields are all among
+ * them (writing the relation writes those fields).
+ */
+const writableSet = (table, facts, fields, withIdentifier) => {
+    const set = new Set();
+    for (const field of fields ?? []) {
+        const name = fieldOf(table, facts, field);
+        if (name !== undefined) {
+            set.add(name);
+        }
+    }
+    if (fields !== undefined && withIdentifier) {
+        for (const field of facts.identifiers[0] ?? []) {
+            set.add(field);
+        }
+    }
+    for (const [relation, fact] of Object.entries(facts.relations)) {
+        if (fact.referenceFields?.every((field) => set.has(field))) {
+            set.add(relation);
+        }
+    }
+    return set;
+};
+const actionList = (actions) => actions.length === 1
+    ? (actions[0] ?? "")
+    : `${actions.slice(0, -1).join(", ")} and ${actions.at(-1)}`;
+/** Better Auth's columns of a table, as the app's schema names them (`fieldName`). */
+const columnsOf = (table) => {
+    const columns = [];
+    for (const name of table?.fields.values() ?? []) {
+        columns.push(name);
+    }
+    return columns;
+};
+/** Whether a Resource has every one of `columns` (and there is at least one). */
+const hasAll = (facts, columns) => {
+    for (const column of columns) {
+        if (!facts.fields.includes(column)) {
+            return false;
+        }
+    }
+    return columns.length > 0;
+};
+/**
+ * `resources.authTables`, held to the rules' schema: a table's Resource exists, is
+ * no other table's, and has every column of the table (by its `fieldName`); a table
+ * the map says the schema does not have (`null`) is not, column for column, a
+ * Resource the map leaves unnamed. A map that says otherwise than the schema would
+ * leave a table of Better Auth's an ordinary Resource.
+ */
+const checkAuthTablesMap = (map, tables, policies) => {
+    const named = new Map();
+    for (const [model, resource] of Object.entries(map)) {
+        if (resource === null) {
+            continue;
+        }
+        const facts = ownOf(policies.schema, resource);
+        if (facts === undefined) {
+            refuse(`\`resources.authTables\` puts Better Auth's \`${model}\` table in ${resource}, and the rules' schema has no ${resource}.`);
+        }
+        const other = named.get(resource);
+        if (other !== undefined) {
+            refuse(`\`resources.authTables\` puts Better Auth's \`${other}\` and \`${model}\` tables both in ${resource}.`);
+        }
+        named.set(resource, model);
+        const lacking = [];
+        for (const column of columnsOf(tables.get(model))) {
+            if (!facts?.fields.includes(column)) {
+                lacking.push(column);
+            }
+        }
+        if (lacking.length > 0) {
+            refuse(`\`resources.authTables\` puts Better Auth's \`${model}\` table in ${resource}, which lacks its columns ${lacking.join(", ")}: ${resource} is not that table, or names its columns otherwise than Better Auth's \`fieldName\`s say. Name the table's Resource, and its columns as Better Auth names them.`);
+        }
+    }
+    for (const [model, resource] of Object.entries(map)) {
+        if (resource !== null) {
+            continue;
+        }
+        const table = tables.get(model);
+        const columns = columnsOf(table);
+        const secrets = [];
+        for (const field of SECRET_COLUMNS[model] ?? []) {
+            secrets.push(table?.fields.get(field) ?? field);
+        }
+        for (const [other, facts] of Object.entries(policies.schema)) {
+            if (named.has(other)) {
+                continue;
+            }
+            const held = [];
+            let secret = false;
+            for (const column of columns) {
+                if (facts.fields.includes(column)) {
+                    held.push(column);
+                    secret ||= secrets.includes(column);
+                }
+            }
+            // Every column of the table, or one of its secrets with another of its
+            // columns beside it (a model that keeps only some): it may be the table.
+            if (hasAll(facts, columns) || (secret && held.length > 1)) {
+                refuse(`\`resources.authTables\` says the rules' schema does not have Better Auth's \`${model}\` table, and ${other} has columns of it (${held.join(", ")}), ${secret ? "a secret among them" : "every one"}. If ${other} is that table, name it: \`${model}: "${other}"\`; if it is your own, it cannot keep Better Auth's secret beside its columns.`);
+            }
+        }
+    }
+};
+/**
+ * On Prisma's adapter, refuses a table the adapter reads through a delegate no
+ * Resource answers to, while the schema has one that differs from it only in case
+ * or a plural `s`: the schema and the adapter disagree (an adapter without
+ * `usePlural` on a plural schema, say), and the table the adapter really reads is
+ * not certain to be closed.
+ */
+const refuseDisagreement = (tables, usePlural, policies) => {
+    for (const table of tables.values()) {
+        if (table.resource !== undefined) {
+            continue;
+        }
+        const delegate = (usePlural ? `${table.name}s` : table.name).toLowerCase();
+        for (const resource of Object.keys(policies.schema)) {
+            const lowered = resource.toLowerCase();
+            if (lowered === delegate ||
+                lowered === `${delegate}s` ||
+                `${lowered}s` === delegate) {
+                refuse(`Better Auth's Prisma adapter reads its \`${table.model}\` table as \`prisma.${usePlural ? `${table.name}s` : table.name}\`, and the rules' schema has no such model but has ${resource}: the schema and the adapter disagree (\`usePlural\`?). Make them agree, so Access knows which Resource is the table.`);
+            }
+        }
+    }
+};
+/** Whether a Resource's name is the ownership beacon's table's: `AventaraBeacon`, `_aventara_beacon`, their plurals, in any case. */
+const isBeaconName = (resource) => /^aventarabeacons?$/.test(resource.replace(/_/g, "").toLowerCase());
+/**
+ * Closes every Resource that is the ownership beacon's table, whoever's it is: the
+ * Access server's (Better Auth's `aventaraBeacon`, found as its tables are) and one
+ * that only looks like it by name (a service's own `_aventara_beacon` in the rules'
+ * schema). Each is denied every action and its `value` sealed, whatever grants
+ * name it (`"*"` included): any deny wins. A grant on the Access server's table is
+ * refused as on any closed Better Auth table. A beacon is read by the startup check
+ * through the service's own connection, never through a grant.
+ */
+const closeBeaconTables = (policies, tables, denies, sealed) => {
+    const found = tables.get(BEACON_TABLE_MODEL)?.resource;
+    for (const [resource, facts] of Object.entries(policies.schema)) {
+        if (facts.foreign !== undefined ||
+            (resource !== found && !isBeaconName(resource))) {
+            continue;
+        }
+        if (!denies.some((deny) => deny.id === `${BUILT_IN_ID}${resource}`)) {
+            denies.push({
+                id: `${BUILT_IN_ID}${resource}`,
+                actions: "*",
+                resource,
+            });
+        }
+        const secrets = new Set(sealed.get(resource) ?? []);
+        const value = resource === found
+            ? (tables.get(BEACON_TABLE_MODEL)?.fields.get("value") ?? "value")
+            : "value";
+        if (facts.fields.includes(value)) {
+            secrets.add(value);
+        }
+        if (secrets.size > 0) {
+            sealed.set(resource, secrets);
+        }
+    }
+};
+/** The Access server's beacon table, by Better Auth model name. */
+const BEACON_TABLE_MODEL = "aventaraBeacon";
+/**
+ * The built-in rules for one set of rules: `resources` as the app gave it, Better
+ * Auth's tables as it is built (`authTablesOf`), and the rules' file. Throws
+ * `ACCESS_RESOURCE_MISSING` when a key's tables are missing, and
+ * `ACCESS_OPTIONS_INVALID` for a grant the built-in rules would leave without effect.
+ */
+export const guardAuthTables = (input) => {
+    const { resources, tables, naming, policies } = input;
+    if (naming.kind === "map") {
+        checkAuthTablesMap(naming.map, tables, policies);
+    }
+    else {
+        refuseDisagreement(tables, naming.usePlural, policies);
+    }
+    for (const key of KEYS) {
+        if (!resources[key]) {
+            continue;
+        }
+        for (const model of KEY_TABLES[key]) {
+            const table = tables.get(model);
+            const plugin = OPENED_TABLES[model]?.plugin;
+            if (table === undefined) {
+                missing(`\`resources.${key}\` opens Better Auth's \`${model}\` table, and Better Auth has none${plugin === undefined ? "" : `: add ${plugin} to betterAuth.plugins`}.`);
+                continue;
+            }
+            const facts = table.resource === undefined
+                ? undefined
+                : ownOf(policies.schema, table.resource);
+            if (facts === undefined) {
+                missing(naming.kind === "prisma"
+                    ? `\`resources.${key}\` opens Better Auth's \`${model}\` table, and the rules' schema has no model Better Auth's Prisma adapter reads it through (\`prisma.${table.name}${naming.usePlural ? "s" : ""}\`). Run Better Auth's \`npx auth generate\`, then regenerate the model the rules are built from.`
+                    : `\`resources.${key}\` opens Better Auth's \`${model}\` table, and \`resources.authTables\` puts it in no Resource of the rules' schema. Name its Resource there.`);
+            }
+            if (facts?.foreign !== undefined) {
+                refuse(`\`resources.${key}\` opens Better Auth's \`${model}\` table as the Resource ${table.resource}, which the rules read as namespace "${facts.foreign}"'s (foreign). Open it in the service that owns it.`);
+            }
+        }
+    }
+    const denies = [];
+    const sealed = new Map();
+    const writable = new Map();
+    const closed = new Map();
+    const governed = new Map();
+    for (const table of tables.values()) {
+        const { resource } = table;
+        const facts = resource === undefined ? undefined : ownOf(policies.schema, resource);
+        if (resource === undefined ||
+            facts === undefined ||
+            facts.foreign !== undefined) {
+            continue;
+        }
+        const opened = OPENED_TABLES[table.model];
+        const open = opened !== undefined && resources[opened.key];
+        const secrets = [];
+        for (const field of SECRET_COLUMNS[table.model] ?? []) {
+            const name = fieldOf(table, facts, field);
+            if (name !== undefined) {
+                secrets.push(name);
+            }
+            else if (open) {
+                // An opened table's secret must be found to be sealed: one the schema
+                // names otherwise (a Prisma `@map`) would be readable.
+                refuse(`Better Auth's \`${table.model}\` table keeps a secret in \`${field}\`, and ${resource} has no field \`${table.fields.get(field) ?? field}\`: Access could not keep it sealed. Name the field as Better Auth's \`fieldName\` for it says, or leave the table closed.`);
+            }
+        }
+        if (secrets.length > 0) {
+            sealed.set(resource, new Set(secrets));
+        }
+        const grants = policies.grants.filter((grant) => grant.resource === resource);
+        if (opened === undefined || !open) {
+            denies.push({
+                id: `${BUILT_IN_ID}${resource}`,
+                actions: "*",
+                resource,
+            });
+            if (opened !== undefined) {
+                closed.set(resource, { model: table.model, key: opened.key });
+            }
+            const [grant] = grants;
+            if (grant !== undefined) {
+                refuse(opened === undefined
+                    ? `the rules grant ${actionList(grant.actions)} on ${resource} (grant "${grant.id}"), Better Auth's \`${table.model}\` table, which Access keeps closed: no grant opens it. Remove the grant.`
+                    : `the rules grant ${actionList(grant.actions)} on ${resource} (grant "${grant.id}"), Better Auth's \`${table.model}\` table, which is closed until \`resources: { ${opened.key}: true }\` opens it as a Resource of the rules.`);
+            }
+            continue;
+        }
+        const { writes } = opened;
+        const refused = ACTIONS.filter((action) => (action === "create" && writes.create === undefined) ||
+            (action === "update" && writes.update === undefined) ||
+            (action === "delete" && !writes.delete));
+        if (refused.length > 0) {
+            denies.push({
+                id: `${BUILT_IN_ID}${resource}/${refused.join(",")}`,
+                actions: refused,
+                resource,
+            });
+        }
+        for (const grant of grants) {
+            const never = grant.actions.filter((action) => refused.includes(action));
+            if (never.length > 0) {
+                refuse(`the rules grant ${actionList(never)} on ${resource} (grant "${grant.id}"), Better Auth's \`${table.model}\` table, which Access never writes that way: a write through Aventara skips Better Auth's hooks and caches. Use Better Auth's own API for it, and remove ${actionList(never)} from the grant.`);
+            }
+        }
+        writable.set(resource, {
+            create: writableSet(table, facts, writes.create, true),
+            update: writableSet(table, facts, writes.update, false),
+        });
+        const writeGoverned = (opened.governed ?? []).flatMap((field) => {
+            const name = fieldOf(table, facts, field);
+            return name === undefined ? [] : [name];
+        });
+        if (writeGoverned.length > 0) {
+            governed.set(resource, writeGoverned);
+        }
+    }
+    closeBeaconTables(policies, tables, denies, sealed);
+    return { denies, sealed, writable, closed, governed };
+};
+/**
+ * The rules' file with the built-in rules in it: their denies beside the file's, and
+ * each field they govern for writing governed so (a field the rules govern for
+ * reading only is then governed for both; one they govern for writing or both stays).
+ */
+export const withBuiltInRules = (policies, guard) => {
+    if (guard.denies.length === 0 && guard.governed.size === 0) {
+        return policies;
+    }
+    const govern = {
+        ...policies.govern,
+    };
+    const governModes = { ...policies.governModes };
+    for (const [resource, fields] of guard.governed) {
+        const listed = ownOf(policies.govern, resource) ?? [];
+        const modes = Object.hasOwn(governModes, resource)
+            ? { ...governModes[resource] }
+            : {};
+        const added = [];
+        for (const field of fields) {
+            if (!listed.includes(field)) {
+                added.push(field);
+                modes[field] = "write";
+            }
+            else if (Object.hasOwn(modes, field) && modes[field] === "read") {
+                // Governed for reading by the rules, for writing by Access: for both.
+                delete modes[field];
+            }
+        }
+        govern[resource] = [...listed, ...added];
+        if (Object.keys(modes).length > 0) {
+            governModes[resource] = modes;
+        }
+        else {
+            delete governModes[resource];
+        }
+    }
+    const { governModes: _given, ...rest } = policies;
+    return {
+        ...rest,
+        govern,
+        ...(Object.keys(governModes).length > 0 ? { governModes } : {}),
+        denies: [...policies.denies, ...guard.denies],
+    };
+};
+/**
+ * `fieldsOf`'s answer with the built-in rules applied: a secret column is never
+ * listed, and a write lists only the fields its action may set on an opened table.
+ * `"all"` becomes the list it stands for (every field that is not governed) when
+ * something is taken out of it.
+ */
+export const guardedFields = (guard, question, answer, resource) => {
+    const secrets = guard.sealed.get(question.resource);
+    const sets = question.access === "write"
+        ? guard.writable.get(question.resource)
+        : undefined;
+    const writes = sets === undefined || question.access !== "write"
+        ? undefined
+        : question.action === "create"
+            ? sets.create
+            : question.action === "update"
+                ? sets.update
+                : new Set([...sets.create].filter((field) => sets.update.has(field)));
+    if (secrets === undefined && writes === undefined) {
+        return answer;
+    }
+    const keeps = (field) => !(secrets?.has(field) ?? false) && (writes?.has(field) ?? true);
+    return {
+        always: answer.always === "all"
+            ? resource.fields.filter((field) => !resource.governed.includes(field) && keeps(field))
+            : answer.always.filter(keeps),
+        perRow: Object.fromEntries(Object.entries(answer.perRow).filter(([field]) => keeps(field))),
+    };
+};