@cboxdk/id-js 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -0,0 +1,185 @@
+# Changelog
+
+All notable changes to `@cboxdk/id-js` are recorded here. Earlier releases are described
+in their [GitHub releases](https://github.com/cboxdk/id-js/releases).
+
+## [0.20.0] - 2026-11-07
+
+### Upgrade
+
+Workspace team.remove requires its body with roles_version. Team writes use roles arrays and current CAS versions. Re-read state on conflicts. Live permission checks bind subject, organization and app; access-token role projections alone do not authorize sensitive actions.
+
+### Added
+
+- `checkPermissions()` and `PermissionDecision` for current server authorization, bound to the exact subject, organization and app. Decisions are never cached; malformed, redirected, oversized or unavailable responses fail closed.
+- Updated management clients for multiple app roles, independent role and environment-access versions, scoped invitations and nullable member email.
+
+### Changed
+
+- Manifest publication requires a complete acknowledgement for the submitted client, version and checksum, including valid publication counts. Publishing definitions never assigns access.
+- Workspace member removal now requires `roles_version` and removes native ID app roles only. Role edits require `roles` and `roles_version`; environment access uses its separate version.
+
+## [0.19.0] - 2026-10-10
+
+Needs laravel-id 1.24 / the Cbox ID release with feature flags, fine-grained
+authorization, Pipes and SMS as a second factor. Against an older instance the new claim
+reads as absent and the new endpoints answer 404.
+
+### Added
+
+- Feature flags: `featureFlags(source)` and `hasFeature(source, key)` read the
+  `feature_flags` claim from a signed-in user or a verified claim set, and
+  `CboxUser.featureFlags` carries it (`null` when the scope was not requested, `[]` when
+  nothing is on). `FEATURE_FLAGS_SCOPE` is the scope to request.
+- Management API regenerated from the current specs: `env.featureFlags.*` (including
+  `evaluate({ user_id, organization_id })`), `env.fga.*` (check, `checkBatch`, tuples
+  write/delete/list, resources and subjects lists, schema get/update/validate, with
+  `consistency_token` on every read), `env.pipes.*` (pipe setup, grants, connections),
+  `env.radar.*`, `env.signin.sms.*`, the environment sign-in methods (`env.signin.social.*`
+  update/enable/disable/inherit/offered, `environment_wide` / `organization_id` on social
+  set, the auth policy's method fields), `env.branding.appearance.set()` taking the logo and
+  favicon as base64 data URIs, `env.users.mfa.sms.remove()`, the HRIS directory
+  routes (`env.directories.*`), and on the account plane `me.mfa.sms.remove()` and
+  `me.pipes.disconnect()`. `fgaTuple()` writes a tuple in the notation the batch check takes.
+- Pipes: `VaultClient.leasePipeToken(provider, { userId?, purpose })` leases a fresh token
+  for a person's connected account. Refusals are typed: `PipeNotConnectedError` and
+  `PipeReauthorizationRequiredError` carry `connectUrl` (and `connectUrlWith({ clientId,
+  returnTo })`), `PipeTemporarilyUnavailableError` carries `retryAfter`,
+  `PipeLeaseDeniedError` is the 403. `client.pipeConnectUrl(provider, returnTo)` and
+  `pipeConnectUrl()` build the hosted connect page.
+- `CboxIdFrontend.config({ organization })`: the sign-in document for one organization (by
+  id or slug), whose `social` list is exactly what that organization's hosted page offers.
+  Each organization is cached on its own. `FrontendConfig.methods` says whether passkeys and
+  magic links are switched on.
+- Embedded sign-in: `mfa_required` lists the `factors` the person can answer with,
+  `CboxIdFrontend.sendSmsCode(mfaToken)` texts the code, and `submitSecondFactor()` accepts
+  `'sms'`.
+
+### Changed
+
+- The generator reads an action's own `202 Accepted` body (documented as `oneOf` it and the
+  approval body), so `env.directories.sync()` now returns the directory.
+
+## [0.18.0] - 2026-10-08
+
+### Added
+
+- `verifyStandardWebhook()`: verifies deliveries from an endpoint on the `standard_webhooks`
+  signature scheme (`webhook-id` / `webhook-timestamp` / `webhook-signature`, any valid `v1`
+  signature, 5-minute window). Takes a `whsec_…` secret or an endpoint's 64-hex Cbox secret.
+  Tested against the Standard Webhooks specification's vector.
+
+- `@cboxdk/id-js/management`: typed clients for Cbox ID's management planes, generated from
+  the OpenAPI documents the server publishes. `EnvironmentClient` (an environment's own host,
+  `cbid_env_…` key or delegated token), `WorkspaceClient` (`cbid_ws_…` key), `PlatformClient`
+  (operator token) and `AccountClient` (a person's own token). Methods are named after the
+  server's actions (`env.apps.secrets.rotate(id, body)`, `workspace.environments.create(body)`),
+  with typed bodies, queries and responses.
+- Every write sends an `Idempotency-Key` (a fresh UUID unless you pass one) and is retried
+  with the same key on network failures, `5xx`, `429` and `409 idempotency_in_progress`,
+  respecting `Retry-After`. `replayed` reports `Idempotent-Replayed`.
+- Approvals: a `202 approval_required` calls `onApprovalRequired` (show the binding code),
+  polls the approval and repeats the request with `Cbox-Approval` and the same key.
+  `ApprovalDeniedError` and `ApprovalExpiredError` when it is not approved;
+  `{ approval: 'return' }` hands back the pending approval with a `resume()`.
+- `CboxIdApiError` (`status`, `error`, `message`, `errors`, `requestId` from the envelope's
+  `request_id` or `X-Request-Id`, `retryAfter`) and `ManagementNetworkError` (with the
+  `idempotencyKey` to repeat safely).
+- `environment` on `EnvironmentClient`: with a person's root access token and the platform
+  root as `baseUrl`, it sends `Cbox-Environment` so one token can drive any environment of
+  the workspace.
+- Audit Logs helpers: `AuditLogger` (buffers events and sends batches of up to 100, each
+  with its own Idempotency-Key, on size, interval and `flush()`), `exportAuditLogs()`
+  (creates an export and polls it until ready), and `verifyAuditChain()` /
+  `verifyAuditLogChain()` with `canonicalJson()` and `auditEventHash()`, which recompute an
+  organization's hash chain exactly as the server does.
+- `…All` async iterators on every paged list (cursor and page-number paging).
+- DPoP-bound access tokens: `createDPoPSigner()` and `generateDPoPKeyPair()` (ES256 on
+  WebCrypto, with `DPoP-Nonce` challenge handling).
+- Operation tables (`environmentOperations`, …) with each action's method, path, scope, danger
+  (from the spec's `x-scope` / `x-danger`) and whether it can be held for approval.
+- `npm run generate` regenerates the clients from the vendored specs in `openapi/`, and
+  `--fetch <plane>=<host>` refreshes a spec from a running server first. The test suite fails
+  when the two disagree.
+
+## [0.17.0] - 2026-09-24
+
+Organization selection and support sessions. Needs a Cbox ID instance that understands the
+`organization` / `organization_hint` authorize parameters and emits `org_role` and `act`
+(laravel-id 1.19). Against an older instance the new fields stay empty, and a switch fails
+at the callback instead of silently landing in the old organization (see below).
+
+### Added
+
+- `createAuthorizationRequest()` accepts `organization` (bind the sign-in to one
+  organization), `organizationHint` (preselect it in the hosted picker), and the prompts
+  `select_organization` and `create_organization`.
+- `client.switchOrganization(id)` and, on the Next.js adapter,
+  `cboxId.switchOrganization(id)`: a new authorization bound to another organization.
+- The organization a sign-in was bound to is echoed on the `AuthorizationRequest` and
+  verified at the callback (`stored.organization`): tokens for any other organization are
+  refused. The Next.js adapter carries it in a `cbox_id_organization` cookie, and clears
+  that cookie on a plain sign-in so an abandoned switch cannot leak its binding into it.
+- `CboxUser` gains typed `organization` (`{ id, name, role }` from `org`, `org_name`,
+  `org_role`), `roles`, `permissions` and `actor` (the RFC 8693 `act` claim).
+- Claim helpers that work on a `CboxUser` or on a claim set you verified yourself:
+  `organization()`, `actor()`, `isSupportSession()`, `roles()`, `permissions()`,
+  `hasRole()`, `hasPermission()`.
+- `client.apiKeysUrl({ clientId?, returnTo?, organization? })` (and `cboxId.apiKeysUrl()`
+  on the Next.js adapter): the hosted page where a person creates and revokes API keys for
+  your API, `/account/api-keys`, preselected to this app.
+- `ApiKeyVerifier` in a new server-only entry, `@cboxdk/id-js/server`, and
+  `cboxId.verifyApiKey(key)` on the Next.js adapter: verifies a customer API key with
+  `POST /oauth/api-keys/verify` (HTTP Basic client auth) and returns the typed answer
+  `{ active, key_id, sub, org, org_role, permissions, client_id, expires_at }`. It refuses
+  an answer for any other `client_id`, treats a key past `expires_at` as inactive, refuses
+  to run in a browser, and has an optional cache of active answers (`cacheTtlMs`, at most
+  60 s, never past the key's expiry). Not exported from the main entry.
+- `CboxUser.sessionId` and `sessionId()`: the ID Token's `sid`, the sign-in session a
+  back-channel logout token names.
+- Staff roles: `tenantAssignable: false` on a `RoleDefinition` publishes the role as
+  staff-only (`tenant_assignable: false`), which Cbox ID never offers or accepts on an
+  organization's own admin pages.
+- Self-serve permissions: `tenantAssignable: true` on a `PermissionDefinition` publishes it
+  as one an organization's administrators may put in their own custom roles
+  (`tenant_assignable: true`). Permissions stay internal by default.
+- Exported wire types `ManifestPermission` and `ManifestRole`.
+- Exported types `AuthorizationPrompt`, `AuthorizationRequestOptions`,
+  `OrganizationRole`, `CboxActiveOrganization`, `CboxActor`, `ClaimSource`,
+  `CboxOrganization`, and `SignInOptions` from `@cboxdk/id-js/nextjs`.
+
+### Fixed
+
+- `CboxIdConfig.accountPath` was documented as defaulting to `/settings`, which on Cbox ID
+  is the organization's settings page for its administrators. `profileUrl()` has actually
+  defaulted to the person's own account area, `/account`, since 0.8.0; the documentation
+  now says so. If you set `accountPath: '/settings'` because of it, remove it: members who
+  are not organization admins are redirected away from that page and lose `return_to`.
+
+### Changed
+
+- An error returned to the callback (`?error=access_denied`) now sets
+  `AuthenticationError.error` and `.errorDescription`, as the back-channel errors already
+  did. A refused organization switch is `access_denied`, and an app answers it by switching
+  back, not by signing the person out — which it could not tell apart before.
+- `prompt` is typed as `AuthorizationPrompt | AuthorizationPrompt[]` instead of `string`,
+  and `prompt: 'none'` combined with another value is refused (OIDC Core §3.1.2.1).
+  **Breaking for TypeScript callers that pass a `string` variable**; narrow it to
+  `AuthorizationPrompt`.
+- `organization` together with `prompt: 'select_organization'` or `'create_organization'`,
+  or an empty `organization` / `organizationHint`, throws `ConfigurationError` before any
+  redirect.
+- The manifest `version` now covers both `tenant_assignable` flags, byte-for-byte as the
+  PHP reference hashes them: present only in their non-default state, so a catalog that
+  never sets them keeps the version it had. The shared cross-SDK fixture gained the
+  `staff_role` and `self_serve_permission` cases.
+- `AuthzManifest.permissions` / `.roles` are typed as the wire shapes (`ManifestPermission`,
+  `ManifestRole`, snake_case flags) rather than as the declaration types.
+- `defineAuthz()` / `buildManifest()` now refuse a key that is not a lowercase
+  `feature:action` slug, and a `tenantAssignable` that is not a boolean, with a
+  `ConfigurationError` — both were refused by the server on push anyway.
+- A role that lists the same permission twice is sent and hashed with it once, as the
+  server stores it; the repeat used to give a `version` no server computes.
+- `CboxUser` has five new required fields. Code that builds a `CboxUser` by hand (test
+  fixtures) must add `organization: null, roles: [], permissions: [], actor: null,
+  sessionId: null`.

package/README.md

@@ -189,12 +189,14 @@ access token's payload on a resource server:
 ```ts
 import { organization, hasPermission, hasRole, isSupportSession } from '@cboxdk/id-js';
 
-if (!hasPermission(payload, 'invoices:create')) return forbidden();
+const showCreateHint = hasPermission(payload, 'invoices:create');
 if (organization(user)?.role === 'owner') showBilling();
 ```
 
 Matching is exact — `invoices:*` does not grant `invoices:delete`. An `org_role` this SDK
 version does not recognise reads as `null`, never as a tier it would have to guess.
+These are token snapshots for presentation. Protected operations require the fresh
+`checkPermissions` decision described below; hiding a control is not authorization.
 
 ### Feature flags
 
@@ -619,8 +621,27 @@ the hosted connect page, preselected to your app; they come back with
 
 Declare your app's authorization **roles** and **permissions** in code, then push them
 to Cbox ID on deploy. Your app owns what a role *means*; Cbox ID owns identity and who
-*holds* each role — assignments arrive back in the token's `roles` / `permissions`
-claims for you to enforce. Requires the app's client to hold the `apps.manifest` scope.
+*holds* each role. Publication requires the client's `apps.manifest` scope and a
+server acknowledgement matching the client, version and full catalog checksum.
+It does not assign roles. Expansions of existing roles await explicit activation.
+
+Token role and permission claims are snapshots for presentation. Authorize protected
+server requests and queued work using a fresh decision, then enforce your own row
+ownership/organization rules. Shared organization Admin is not app Admin.
+
+```ts
+import { checkPermissions } from '@cboxdk/id-js/server';
+
+const decision = await checkPermissions(
+  { issuer, clientId }, accessToken, authenticatedSubject, selectedOrganization,
+  ['invoices:create'],
+);
+if (!decision.allowed()) throw new Error('Forbidden');
+```
+
+Derive the subject from verified authentication and authorize the selected organization;
+do not accept either as an unchecked form value. The check has no positive cache,
+refuses redirects and rejects mismatched, incomplete or unavailable decisions.
 
 ```ts
 import { defineAuthz, publishManifest } from '@cboxdk/id-js';

package/RELEASE-CANDIDATE.md

@@ -0,0 +1,11 @@
+# id-js 0.20.0
+
+Status: prepared local candidate. No public tag, registry publication or deployment has occurred.
+
+Add request-bound live permission decisions and catalog checksums; regenerate app catalog, role-definition activation, invitations and native management APIs.
+
+## Upgrade requirements
+
+Workspace team.remove requires its body with roles_version. Team writes use roles arrays and current CAS versions. Re-read state on conflicts. Live permission checks bind subject, organization and app; access-token role projections alone do not authorize sensitive actions.
+
+Dependency installation against public registries remains contingent on the approved release cascade. Local artifact checks prove the enclosed contents only; they do not claim public indexing.

package/dist/api-keys-BE3R3q_A.d.ts

@@ -0,0 +1,105 @@
+import { O as OrganizationRole } from './types-CC1bz68x.js';
+
+/**
+ * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active
+ * member of `org`.
+ *
+ * The field names are the endpoint's own, so the claim helpers read it like a token —
+ * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type
+ * alias rather than an interface for that reason: only an alias is assignable to the
+ * helpers' record type.)
+ */
+type ActiveApiKey = {
+    active: true;
+    /** The key's id — log this, never the key. */
+    key_id: string;
+    /** The person who holds the key (their subject id). */
+    sub: string;
+    /** The organization the key acts in. */
+    org: string;
+    /** The holder's membership tier in `org`; null for a tier this SDK does not know. */
+    org_role: OrganizationRole | null;
+    /**
+     * What the key may do, already re-capped by Cbox ID: the key's own list intersected
+     * with what the holder holds for your app right now. A demoted holder's key loses the
+     * permission on the next verification, not at the next reissue.
+     */
+    permissions: string[];
+    /** Your app's client id — always, or the answer is refused. */
+    client_id: string;
+    /** ISO 8601 UTC expiry, or null for a key that does not expire. */
+    expires_at: string | null;
+};
+/**
+ * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who
+ * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and
+ * neither does this.
+ */
+interface InactiveApiKey {
+    active: false;
+}
+/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */
+type ApiKeyVerification = ActiveApiKey | InactiveApiKey;
+/** Configuration for an {@link ApiKeyVerifier}. */
+interface ApiKeyVerifierConfig {
+    /** Base URL (issuer) of the Cbox ID instance. */
+    issuer: string;
+    /** Your app's OAuth client id — the app the keys were issued for. */
+    clientId: string;
+    /** Your app's client secret. Verification is a confidential-client call. */
+    clientSecret: string;
+    /** Timeout (ms) for the verification request. Defaults to `10000`. */
+    timeoutMs?: number;
+    /**
+     * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs
+     * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:
+     * while an answer is cached, a revoked key keeps working, and a demoted holder keeps
+     * the permissions they lost. Never cached past the key's `expires_at`. Refusals are
+     * never cached, so a key issued a moment ago works on its first request.
+     */
+    cacheTtlMs?: number;
+}
+/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */
+declare const MAX_API_KEY_CACHE_TTL_MS = 60000;
+/**
+ * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,
+ * authenticated with your app's own client credentials.
+ *
+ * SERVER-SIDE ONLY. It holds your client secret, so it lives in the
+ * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a
+ * browser bundle pulls in — and it refuses to be constructed in a browser at all.
+ *
+ * ```ts
+ * import { ApiKeyVerifier } from '@cboxdk/id-js/server';
+ * import { hasPermission } from '@cboxdk/id-js';
+ *
+ * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });
+ *
+ * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');
+ * if (!answer.active) return unauthorized();
+ * if (!hasPermission(answer, 'invoices:create')) return forbidden();
+ * ```
+ */
+declare class ApiKeyVerifier {
+    private readonly config;
+    private readonly endpoint;
+    private readonly timeoutMs;
+    private readonly cacheTtlMs;
+    private readonly cache;
+    constructor(config: ApiKeyVerifierConfig);
+    /**
+     * Ask Cbox ID whether `key` is good for this app, and what it may do.
+     *
+     * Resolves `{ active: false }` for every kind of bad key, without a request for an empty
+     * one. Throws `AuthenticationError` when the call itself fails (wrong client
+     * credentials, an unreachable instance) or when the answer cannot be trusted — one that
+     * names another app's `client_id`, or does not have the promised shape. Both mean "do
+     * not let this request in"; the difference is that a throw is something to look at.
+     */
+    verifyApiKey(key: string): Promise<ApiKeyVerification>;
+    private request;
+    private parse;
+    private remember;
+}
+
+export { type ActiveApiKey as A, type InactiveApiKey as I, MAX_API_KEY_CACHE_TTL_MS as M, type ApiKeyVerification as a, ApiKeyVerifier as b, type ApiKeyVerifierConfig as c };

package/dist/api-keys-C8-Q4eFA.d.cts

@@ -0,0 +1,105 @@
+import { O as OrganizationRole } from './types-CC1bz68x.cjs';
+
+/**
+ * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active
+ * member of `org`.
+ *
+ * The field names are the endpoint's own, so the claim helpers read it like a token —
+ * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type
+ * alias rather than an interface for that reason: only an alias is assignable to the
+ * helpers' record type.)
+ */
+type ActiveApiKey = {
+    active: true;
+    /** The key's id — log this, never the key. */
+    key_id: string;
+    /** The person who holds the key (their subject id). */
+    sub: string;
+    /** The organization the key acts in. */
+    org: string;
+    /** The holder's membership tier in `org`; null for a tier this SDK does not know. */
+    org_role: OrganizationRole | null;
+    /**
+     * What the key may do, already re-capped by Cbox ID: the key's own list intersected
+     * with what the holder holds for your app right now. A demoted holder's key loses the
+     * permission on the next verification, not at the next reissue.
+     */
+    permissions: string[];
+    /** Your app's client id — always, or the answer is refused. */
+    client_id: string;
+    /** ISO 8601 UTC expiry, or null for a key that does not expire. */
+    expires_at: string | null;
+};
+/**
+ * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who
+ * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and
+ * neither does this.
+ */
+interface InactiveApiKey {
+    active: false;
+}
+/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */
+type ApiKeyVerification = ActiveApiKey | InactiveApiKey;
+/** Configuration for an {@link ApiKeyVerifier}. */
+interface ApiKeyVerifierConfig {
+    /** Base URL (issuer) of the Cbox ID instance. */
+    issuer: string;
+    /** Your app's OAuth client id — the app the keys were issued for. */
+    clientId: string;
+    /** Your app's client secret. Verification is a confidential-client call. */
+    clientSecret: string;
+    /** Timeout (ms) for the verification request. Defaults to `10000`. */
+    timeoutMs?: number;
+    /**
+     * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs
+     * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:
+     * while an answer is cached, a revoked key keeps working, and a demoted holder keeps
+     * the permissions they lost. Never cached past the key's `expires_at`. Refusals are
+     * never cached, so a key issued a moment ago works on its first request.
+     */
+    cacheTtlMs?: number;
+}
+/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */
+declare const MAX_API_KEY_CACHE_TTL_MS = 60000;
+/**
+ * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,
+ * authenticated with your app's own client credentials.
+ *
+ * SERVER-SIDE ONLY. It holds your client secret, so it lives in the
+ * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a
+ * browser bundle pulls in — and it refuses to be constructed in a browser at all.
+ *
+ * ```ts
+ * import { ApiKeyVerifier } from '@cboxdk/id-js/server';
+ * import { hasPermission } from '@cboxdk/id-js';
+ *
+ * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });
+ *
+ * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');
+ * if (!answer.active) return unauthorized();
+ * if (!hasPermission(answer, 'invoices:create')) return forbidden();
+ * ```
+ */
+declare class ApiKeyVerifier {
+    private readonly config;
+    private readonly endpoint;
+    private readonly timeoutMs;
+    private readonly cacheTtlMs;
+    private readonly cache;
+    constructor(config: ApiKeyVerifierConfig);
+    /**
+     * Ask Cbox ID whether `key` is good for this app, and what it may do.
+     *
+     * Resolves `{ active: false }` for every kind of bad key, without a request for an empty
+     * one. Throws `AuthenticationError` when the call itself fails (wrong client
+     * credentials, an unreachable instance) or when the answer cannot be trusted — one that
+     * names another app's `client_id`, or does not have the promised shape. Both mean "do
+     * not let this request in"; the difference is that a throw is something to look at.
+     */
+    verifyApiKey(key: string): Promise<ApiKeyVerification>;
+    private request;
+    private parse;
+    private remember;
+}
+
+export { type ActiveApiKey as A, type InactiveApiKey as I, MAX_API_KEY_CACHE_TTL_MS as M, type ApiKeyVerification as a, ApiKeyVerifier as b, type ApiKeyVerifierConfig as c };

package/dist/chunk-EVZ6RB3K.js

@@ -0,0 +1,98 @@
+import { assertSecureIssuer } from './chunk-QQW63PGU.js';
+import { ConfigurationError, AuthenticationError } from './chunk-SEUD4TE4.js';
+
+// src/decisions.ts
+var PermissionDecision = class {
+  constructor(subject, organization, clientId, organizationRole, organizationActive, permissions) {
+    this.subject = subject;
+    this.organization = organization;
+    this.clientId = clientId;
+    this.organizationRole = organizationRole;
+    this.organizationActive = organizationActive;
+    this.permissions = permissions;
+  }
+  subject;
+  organization;
+  clientId;
+  organizationRole;
+  organizationActive;
+  permissions;
+  allows(permission) {
+    return this.organizationActive && this.permissions[permission] === true;
+  }
+  allowed() {
+    const values = Object.values(this.permissions);
+    return this.organizationActive && values.length > 0 && values.every((value) => value === true);
+  }
+};
+async function checkPermissions(config, accessToken, subject, organization, permissions) {
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId || !subject || organization === "" || !accessToken || accessToken.length > 32768 || /[\x00-\x20\x7f]/.test(accessToken) || !permissions.length || permissions.length > 50 || permissions.some((permission) => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {
+    throw new ConfigurationError("Permission decision request is not configured or valid.");
+  }
+  const requested = [...new Set(permissions)];
+  try {
+    const response = await fetch(`${config.issuer.replace(/\/$/, "")}/oauth/decisions`, {
+      method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 1e4)),
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ subject, org: organization, permission: requested })
+    });
+    if (response.status !== 200) {
+      await response.body?.cancel();
+      throw new AuthenticationError("Permission decision could not be verified.", void 0, void 0, response.status);
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new AuthenticationError("Permission decision response is invalid.");
+    let size = 0;
+    let raw = "";
+    const decoder = new TextDecoder();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 65536) throw new AuthenticationError("Permission decision response exceeded its limit.");
+        raw += decoder.decode(value, { stream: true });
+      }
+      raw += decoder.decode();
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    const data = JSON.parse(raw);
+    if (!record(data) || !record(data.subject) || data.mode !== "rbac" || data.subject.type !== "user" || data.subject.id !== subject || data.organization !== organization || data.client_id !== config.clientId || typeof data.organization_active !== "boolean" || typeof data.allowed !== "boolean" || !(data.org_role === null || typeof data.org_role === "string" && ["owner", "admin", "developer", "member", "viewer"].includes(data.org_role)) || !Array.isArray(data.results) || data.results.length !== requested.length) {
+      throw new AuthenticationError("Permission decision response binding is invalid.");
+    }
+    const checks = /* @__PURE__ */ Object.create(null);
+    for (const result of data.results) {
+      if (!record(result) || typeof result.permission !== "string" || typeof result.allowed !== "boolean" || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {
+        throw new AuthenticationError("Permission decision result is invalid.");
+      }
+      checks[result.permission] = result.allowed;
+    }
+    const decision = new PermissionDecision(
+      subject,
+      organization,
+      config.clientId,
+      data.org_role,
+      data.organization_active,
+      Object.freeze(checks)
+    );
+    if (data.allowed !== decision.allowed()) throw new AuthenticationError("Permission decision result is inconsistent.");
+    return decision;
+  } catch (error) {
+    if (error instanceof AuthenticationError) throw error;
+    throw new AuthenticationError("Permission decision could not be verified.");
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export { PermissionDecision, checkPermissions };
+//# sourceMappingURL=chunk-EVZ6RB3K.js.map
+//# sourceMappingURL=chunk-EVZ6RB3K.js.map

package/dist/chunk-EVZ6RB3K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/decisions.ts"],"names":[],"mappings":";;;;AAWO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YACW,OAAA,EACA,YAAA,EACA,QAAA,EACA,gBAAA,EACA,oBACA,WAAA,EACT;AANS,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EACR;AAAA,EANQ,OAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EAGX,OAAO,UAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,kBAAA,IAAsB,IAAA,CAAK,WAAA,CAAY,UAAU,CAAA,KAAM,IAAA;AAAA,EACrE;AAAA,EAEA,OAAA,GAAmB;AACjB,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,OAAO,IAAA,CAAK,sBAAsB,MAAA,CAAO,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,CAAA,KAAA,KAAS,KAAA,KAAU,IAAI,CAAA;AAAA,EAC7F;AACF;AAGA,eAAsB,gBAAA,CACpB,MAAA,EACA,WAAA,EACA,OAAA,EACA,cACA,WAAA,EAC6B;AAC7B,EAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AACpC,EAAA,IAAI,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA,IAAY,OAAO,MAAA,IAAU,MAAA,CAAO,QAAQ,CAAC,MAAA,CAAO,YAC7E,CAAC,OAAA,IAAW,iBAAiB,EAAA,IAAM,CAAC,eAAe,WAAA,CAAY,MAAA,GAAS,SACxE,iBAAA,CAAkB,IAAA,CAAK,WAAW,CAAA,IAAK,CAAC,YAAY,MAAA,IAAU,WAAA,CAAY,SAAS,EAAA,IACnF,WAAA,CAAY,KAAK,CAAA,UAAA,KAAc,CAAC,WAAW,IAAA,EAAK,IAAK,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA,CAAE,MAAA,GAAS,GAAG,CAAA,EAAG;AAC5G,IAAA,MAAM,IAAI,mBAAmB,yDAAyD,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,YAAY,CAAC,GAAG,IAAI,GAAA,CAAI,WAAW,CAAC,CAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,gBAAA,CAAA,EAAoB;AAAA,MAClF,MAAA,EAAQ,MAAA;AAAA,MAAQ,QAAA,EAAU,OAAA;AAAA,MAAS,KAAA,EAAO,UAAA;AAAA,MAC1C,MAAA,EAAQ,YAAY,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG,MAAA,CAAO,SAAA,IAAa,GAAM,CAAC,CAAA;AAAA,MACnE,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAI,MAAA,EAAQ,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAClH,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,SAAS,GAAA,EAAK,YAAA,EAAc,UAAA,EAAY,SAAA,EAAW;AAAA,KAC3E,CAAA;AACD,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,MAAA,MAAM,IAAI,mBAAA,CAAoB,4CAAA,EAA8C,KAAA,CAAA,EAAW,KAAA,CAAA,EAAW,SAAS,MAAM,CAAA;AAAA,IACnH;AACA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,oBAAoB,0CAA0C,CAAA;AACrF,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI;AACF,MAAA,WAAS;AACP,QAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AACV,QAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AACd,QAAA,IAAI,IAAA,GAAO,KAAA,EAAO,MAAM,IAAI,oBAAoB,kDAAkD,CAAA;AAClG,QAAA,GAAA,IAAO,QAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAM,CAAA;AAAA,MAC/C;AACA,MAAA,GAAA,IAAO,QAAQ,MAAA,EAAO;AAAA,IACxB,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,MAAA,CAAO,WAAA,EAAY;AAAA,IACrB;AACA,IAAA,MAAM,IAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,MAAA,CAAO,IAAI,CAAA,IAAK,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA,CAAK,IAAA,KAAS,MAAA,IACvD,KAAK,OAAA,CAAQ,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,OAAA,CAAQ,EAAA,KAAO,OAAA,IACpD,IAAA,CAAK,YAAA,KAAiB,YAAA,IAAgB,IAAA,CAAK,SAAA,KAAc,MAAA,CAAO,QAAA,IAChE,OAAO,IAAA,CAAK,wBAAwB,SAAA,IAAa,OAAO,IAAA,CAAK,OAAA,KAAY,SAAA,IACzE,EAAE,IAAA,CAAK,QAAA,KAAa,IAAA,IAAS,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IACpD,CAAC,OAAA,EAAS,OAAA,EAAS,aAAa,QAAA,EAAU,QAAQ,CAAA,CAAE,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,CAAA,IAC5E,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA,CAAK,OAAA,CAAQ,MAAA,KAAW,UAAU,MAAA,EAAQ;AAC7E,MAAA,MAAM,IAAI,oBAAoB,kDAAkD,CAAA;AAAA,IAClF;AACA,IAAA,MAAM,MAAA,mBAAkC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1D,IAAA,KAAA,MAAW,MAAA,IAAU,KAAK,OAAA,EAAsB;AAC9C,MAAA,IAAI,CAAC,OAAO,MAAM,CAAA,IAAK,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,IAAY,OAAO,MAAA,CAAO,OAAA,KAAY,aACrF,CAAC,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,IAAK,OAAO,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,UAAU,CAAA,EAAG;AACvF,QAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,MACxE;AACA,MAAA,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,GAAI,MAAA,CAAO,OAAA;AAAA,IACrC;AACA,IAAA,MAAM,WAAW,IAAI,kBAAA;AAAA,MAAmB,OAAA;AAAA,MAAS,YAAA;AAAA,MAAc,MAAA,CAAO,QAAA;AAAA,MACpE,IAAA,CAAK,QAAA;AAAA,MAAqC,IAAA,CAAK,mBAAA;AAAA,MAAqB,MAAA,CAAO,OAAO,MAAM;AAAA,KAAC;AAC3F,IAAA,IAAI,IAAA,CAAK,YAAY,QAAA,CAAS,OAAA,IAAW,MAAM,IAAI,oBAAoB,6CAA6C,CAAA;AACpH,IAAA,OAAO,QAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,qBAAqB,MAAM,KAAA;AAChD,IAAA,MAAM,IAAI,oBAAoB,4CAA4C,CAAA;AAAA,EAC5E;AACF;AAEA,SAAS,OAAO,KAAA,EAAkD;AAChE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E","file":"chunk-EVZ6RB3K.js","sourcesContent":["import { AuthenticationError, ConfigurationError } from './errors.js';\nimport { assertSecureIssuer } from './issuer.js';\nimport type { OrganizationRole } from './claims.js';\n\nexport interface PermissionDecisionConfig {\n  issuer: string;\n  clientId: string;\n  timeoutMs?: number;\n}\n\n/** A current server decision; shared membership tiers are not app grants. */\nexport class PermissionDecision {\n  constructor(\n    readonly subject: string,\n    readonly organization: string | null,\n    readonly clientId: string,\n    readonly organizationRole: OrganizationRole | null,\n    readonly organizationActive: boolean,\n    readonly permissions: Readonly<Record<string, boolean>>,\n  ) {}\n\n  allows(permission: string): boolean {\n    return this.organizationActive && this.permissions[permission] === true;\n  }\n\n  allowed(): boolean {\n    const values = Object.values(this.permissions);\n    return this.organizationActive && values.length > 0 && values.every(value => value === true);\n  }\n}\n\n/** No positive cache: check each request and again when queued work starts. */\nexport async function checkPermissions(\n  config: PermissionDecisionConfig,\n  accessToken: string,\n  subject: string,\n  organization: string | null,\n  permissions: readonly string[],\n): Promise<PermissionDecision> {\n  assertSecureIssuer(config.issuer);\n  const issuer = new URL(config.issuer);\n  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId\n    || !subject || organization === '' || !accessToken || accessToken.length > 32768\n    || /[\\x00-\\x20\\x7f]/.test(accessToken) || !permissions.length || permissions.length > 50\n    || permissions.some(permission => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {\n    throw new ConfigurationError('Permission decision request is not configured or valid.');\n  }\n  const requested = [...new Set(permissions)];\n  try {\n    const response = await fetch(`${config.issuer.replace(/\\/$/, '')}/oauth/decisions`, {\n      method: 'POST', redirect: 'error', cache: 'no-store',\n      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 10_000)),\n      headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json', 'content-type': 'application/json' },\n      body: JSON.stringify({ subject, org: organization, permission: requested }),\n    });\n    if (response.status !== 200) {\n      await response.body?.cancel();\n      throw new AuthenticationError('Permission decision could not be verified.', undefined, undefined, response.status);\n    }\n    const reader = response.body?.getReader();\n    if (!reader) throw new AuthenticationError('Permission decision response is invalid.');\n    let size = 0;\n    let raw = '';\n    const decoder = new TextDecoder();\n    try {\n      for (;;) {\n        const { value, done } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > 65536) throw new AuthenticationError('Permission decision response exceeded its limit.');\n        raw += decoder.decode(value, { stream: true });\n      }\n      raw += decoder.decode();\n    } finally {\n      await reader.cancel();\n      reader.releaseLock();\n    }\n    const data: unknown = JSON.parse(raw);\n    if (!record(data) || !record(data.subject) || data.mode !== 'rbac'\n      || data.subject.type !== 'user' || data.subject.id !== subject\n      || data.organization !== organization || data.client_id !== config.clientId\n      || typeof data.organization_active !== 'boolean' || typeof data.allowed !== 'boolean'\n      || !(data.org_role === null || (typeof data.org_role === 'string'\n        && ['owner', 'admin', 'developer', 'member', 'viewer'].includes(data.org_role)))\n      || !Array.isArray(data.results) || data.results.length !== requested.length) {\n      throw new AuthenticationError('Permission decision response binding is invalid.');\n    }\n    const checks: Record<string, boolean> = Object.create(null) as Record<string, boolean>;\n    for (const result of data.results as unknown[]) {\n      if (!record(result) || typeof result.permission !== 'string' || typeof result.allowed !== 'boolean'\n        || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {\n        throw new AuthenticationError('Permission decision result is invalid.');\n      }\n      checks[result.permission] = result.allowed;\n    }\n    const decision = new PermissionDecision(subject, organization, config.clientId,\n      data.org_role as OrganizationRole | null, data.organization_active, Object.freeze(checks));\n    if (data.allowed !== decision.allowed()) throw new AuthenticationError('Permission decision result is inconsistent.');\n    return decision;\n  } catch (error) {\n    if (error instanceof AuthenticationError) throw error;\n    throw new AuthenticationError('Permission decision could not be verified.');\n  }\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n"]}

package/dist/decisions-C84Fzah4.d.ts

@@ -0,0 +1,23 @@
+import { O as OrganizationRole } from './types-CC1bz68x.js';
+
+interface PermissionDecisionConfig {
+    issuer: string;
+    clientId: string;
+    timeoutMs?: number;
+}
+/** A current server decision; shared membership tiers are not app grants. */
+declare class PermissionDecision {
+    readonly subject: string;
+    readonly organization: string | null;
+    readonly clientId: string;
+    readonly organizationRole: OrganizationRole | null;
+    readonly organizationActive: boolean;
+    readonly permissions: Readonly<Record<string, boolean>>;
+    constructor(subject: string, organization: string | null, clientId: string, organizationRole: OrganizationRole | null, organizationActive: boolean, permissions: Readonly<Record<string, boolean>>);
+    allows(permission: string): boolean;
+    allowed(): boolean;
+}
+/** No positive cache: check each request and again when queued work starts. */
+declare function checkPermissions(config: PermissionDecisionConfig, accessToken: string, subject: string, organization: string | null, permissions: readonly string[]): Promise<PermissionDecision>;
+
+export { PermissionDecision as P, type PermissionDecisionConfig as a, checkPermissions as c };

package/dist/decisions-DNd9UXwi.d.cts

@@ -0,0 +1,23 @@
+import { O as OrganizationRole } from './types-CC1bz68x.cjs';
+
+interface PermissionDecisionConfig {
+    issuer: string;
+    clientId: string;
+    timeoutMs?: number;
+}
+/** A current server decision; shared membership tiers are not app grants. */
+declare class PermissionDecision {
+    readonly subject: string;
+    readonly organization: string | null;
+    readonly clientId: string;
+    readonly organizationRole: OrganizationRole | null;
+    readonly organizationActive: boolean;
+    readonly permissions: Readonly<Record<string, boolean>>;
+    constructor(subject: string, organization: string | null, clientId: string, organizationRole: OrganizationRole | null, organizationActive: boolean, permissions: Readonly<Record<string, boolean>>);
+    allows(permission: string): boolean;
+    allowed(): boolean;
+}
+/** No positive cache: check each request and again when queued work starts. */
+declare function checkPermissions(config: PermissionDecisionConfig, accessToken: string, subject: string, organization: string | null, permissions: readonly string[]): Promise<PermissionDecision>;
+
+export { PermissionDecision as P, type PermissionDecisionConfig as a, checkPermissions as c };