@canopy-io/node 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @canopy-io/node
 
+## 0.10.0
+
+### Minor Changes
+
+- f2ee649: `LocalAuthorizer` is held to Canopy's own authorization rules. Its suite replays the conformance vectors Canopy publishes at `/conformance/authorization.json`, the same cases Canopy's API suite replays end to end, and `npm run generate` keeps the copy in step with the published one.
+  
+  The grant roots (`GET /api/v1/identities/:id/grants`) and the hierarchy's parent edges (`GET /api/v1/nodes/parents`) now carry the `model_version` of the authorization model they describe. `LocalAuthorizer` refuses a version it does not know with `CanopyAuthorizerError` (`authorizer.model_version_unknown`), which `authorizationErrorStatus` and the NestJS guard answer as a `500` misconfiguration, rather than walking rows whose meaning has changed. It knows version 1. This release requires a Canopy that sends `model_version`; against one that does not, every check is refused, so upgrade after the API has it.
+  
+  `@canopy-io/nestjs` picks up the new authorizer; its own options and behaviour are unchanged.
+
 ## 0.9.0
 
 ### Minor Changes

package/README.md

@@ -278,8 +278,12 @@ instances behind a load balancer, each keeps its own cache until its TTL runs
 out or it is told to invalidate too.
 
 A failed check (Canopy unreachable, a credential that cannot read the
-hierarchy, an identity not in the Environment) throws rather than answering
-`false`. `authorizationErrorStatus` turns the error into the response to send:
+hierarchy, an identity not in the Environment, or a Canopy serving an
+authorization model this version does not know) throws rather than answering
+`false`. The grant roots and the hierarchy each carry the `model_version` of
+the rules they describe; an unknown one is refused with `CanopyAuthorizerError`
+(`authorizer.model_version_unknown`) instead of being walked as if the rules
+had not changed, and upgrading the package is the fix. `authorizationErrorStatus` turns the error into the response to send:
 `503` when Canopy did not answer, `500` for a misconfiguration no retry fixes,
 `403` for an identity Canopy does not know. The NestJS guard uses the same
 mapping.

package/dist/index.cjs

@@ -1155,6 +1155,16 @@ var MAX_WALK_DEPTH = 256;
 var PAGE_SIZE = 100;
 var MAX_PAGES = 1e4;
 var MAX_TREE_WALKS = 3;
+var KNOWN_MODEL_VERSIONS = /* @__PURE__ */ new Set([1]);
+function understood(page, path) {
+  if (!KNOWN_MODEL_VERSIONS.has(page.model_version)) {
+    throw new CanopyAuthorizerError(
+      "authorizer.model_version_unknown",
+      `${path} describes authorization model version ${page.model_version}, which this version of @canopy-io/node does not understand. It knows ${[...KNOWN_MODEL_VERSIONS].join(", ")}. Upgrade @canopy-io/node; until then this authorizer cannot decide, rather than guess.`
+    );
+  }
+  return page;
+}
 var GRANTS_PATH = (identityId) => `/api/v1/identities/${encodeURIComponent(identityId)}/grants`;
 var PARENTS_PATH = "/api/v1/nodes/parents";
 var LocalAuthorizer = class {
@@ -1330,7 +1340,7 @@ var LocalAuthorizer = class {
         return this.client.request("GET", path, {
           ...this.readOptions,
           query
-        });
+        }).then((page) => understood(page, path));
       },
       { page: 1, take: PAGE_SIZE },
       { maxPages: MAX_PAGES }
@@ -1410,12 +1420,15 @@ var LocalAuthorizer = class {
   }
   parentsFirstPage(etag) {
     this.stats.treePages += 1;
-    return this.client.requestConditional(
-      "GET",
-      PARENTS_PATH,
-      etag,
-      { ...this.readOptions, query: { page: 1, take: PAGE_SIZE } }
-    );
+    return this.client.requestConditional("GET", PARENTS_PATH, etag, {
+      ...this.readOptions,
+      query: { page: 1, take: PAGE_SIZE }
+    }).then((result) => {
+      if (result.modified) {
+        understood(result.data, PARENTS_PATH);
+      }
+      return result;
+    });
   }
   /** The first page's edges followed by every later page's. */
   async parentsRemainingPages(first) {
@@ -1429,7 +1442,7 @@ var LocalAuthorizer = class {
         return this.client.request("GET", PARENTS_PATH, {
           ...this.readOptions,
           query
-        });
+        }).then((page) => understood(page, PARENTS_PATH));
       },
       { page: first.pagination.page + 1, take: PAGE_SIZE },
       { maxPages: MAX_PAGES - 1 }