@celsoft/platform 0.16.0 → 0.17.0

package/dist/runtime/access.js

@@ -2,13 +2,15 @@ import { sql } from "drizzle-orm";
 import { EndpointError } from "./endpoint-error.js";
 import { LINK_HEADER } from "./link-header.js";
 export { LINK_HEADER };
-// Who may do what to an app's items; see docs/design.md, App Code, Access, and the cases in
-// docs/access-rules.md. Every check is one query against the app's own Postgres, never cached.
+// Who may do what to an app's resources, through control points; see docs/design.md, App Code,
+// Access, and the cases in docs/access-rules.md. Every check is one query against the app's own
+// Postgres, never cached.
 export const LEVELS = ["read", "create", "write", "delete", "manage"];
-// The longest chain from an item up to its user or organization, counting the item itself.
+// The longest chain from a point up through its parents, counting the point itself.
 export const MAX_DEPTH = 64;
-const ROOTS = ["user", "organization"];
-const KIND = /^[a-z][a-z0-9_-]{0,62}$/;
+export const organizationPoint = (organizationId) => `organization:${organizationId}`;
+export const teamPoint = (teamId) => `team:${teamId}`;
+const RESERVED = /^(organization|team):/;
 const [READ, CREATE, WRITE, DELETE, MANAGE] = [1, 2, 3, 4, 5];
 export function rank(level) {
     const n = LEVELS.indexOf(level);
@@ -17,16 +19,12 @@ export function rank(level) {
     return n + 1;
 }
 const named = (n) => (n >= READ ? LEVELS[n - 1] : null);
-function checkKind(kind) {
-    if (typeof kind !== "string" || !KIND.test(kind) || ROOTS.includes(kind)) {
-        throw new Error(`access kind ${JSON.stringify(kind)} must be lowercase letters, digits, - and _, and not "user" or "organization"`);
-    }
-}
-function checkId(id) {
+export function checkPointId(id) {
     if (typeof id !== "string" || id.length === 0 || id.length > 200)
-        throw new Error(`access id ${JSON.stringify(id)} must be 1 to 200 characters`);
+        throw new Error(`a control point id must be 1 to 200 characters; got ${JSON.stringify(id)}`);
 }
 const notFound = () => new EndpointError(404, "not found");
+const conflict = (message) => new EndpointError(409, message);
 export function shareMessage(notice, appName, origin) {
     const who = notice.sharedBy || "Someone";
     const url = new URL(notice.path, origin).toString();
@@ -44,57 +42,74 @@ function newToken() {
     const bytes = crypto.getRandomValues(new Uint8Array(32));
     return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-// The caller's level on one item, 0 for none, as a scalar subquery. It walks up the chain to the
-// user or organization at the top, stops counting grants and links above the first restricted
-// item, and gives nothing at all to a chain that never reaches a user or organization that exists.
-function levelSql(kind, id, who) {
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// A user id that is not a UUID can match nobody, so it is treated as no user at all.
+const userParam = (userId) => (userId && UUID.test(userId) ? userId : null);
+// The caller's level on one point, 0 for none, as a scalar subquery. The chain is the point and,
+// while each point inherits, its parents. Each of the caller's principals (the person, by user id
+// or confirmed email, each team, each organization, and Everyone) stops at its nearest grant on
+// the chain, and the highest of those wins; organization and team grants count only on points of
+// their own organization or none. The organization's Admins get `manage`, and a link counts only
+// on the point it was made for.
+function levelSql(point, who) {
+    if (who.app)
+        return sql `(select case when exists (select 1 from access_point where id = (${point})) then ${MANAGE} else 0 end)`;
+    const userId = userParam(who.userId);
+    // The point is read once, in a query with no tables of its own, so a column the app passes,
+    // such as `p.id`, always means the app's row; every name inside starts with `_ac` for the same reason.
     return sql `(
-    with recursive chain as (
-      select i.kind, i.id, i.parent_kind, i.parent_id, i.restricted, 0 as depth
-      from access_item i where i.kind = ${kind} and i.id = ${id}
+    with recursive _ac_target as (select (${point}) as id),
+    _ac_chain as (
+      select _ac_p.id, _ac_p.parent_id, _ac_p.inherits, _ac_p.organization_id, 0 as depth
+      from access_point _ac_p where _ac_p.id = (select id from _ac_target)
       union all
-      select p.kind, p.id, p.parent_kind, p.parent_id, p.restricted, c.depth + 1
-      from chain c join access_item p on p.kind = c.parent_kind and p.id = c.parent_id
-      where c.depth < ${MAX_DEPTH - 1}
+      select _ac_q.id, _ac_q.parent_id, _ac_q.inherits, _ac_q.organization_id, _ac_c.depth + 1
+      from _ac_chain _ac_c join access_point _ac_q on _ac_q.id = _ac_c.parent_id
+      where _ac_c.inherits and _ac_c.depth < ${MAX_DEPTH - 1}
     ),
-    root as (
-      select parent_kind as kind, parent_id as id from chain
-      where (parent_kind = 'user' and exists (select 1 from "user" u where u.id::text = parent_id))
-         or (parent_kind = 'organization' and exists (select 1 from organization o where o.id::text = parent_id))
+    _ac_me as (select _ac_u.id, case when _ac_u.email_verified then lower(_ac_u.email) end as email from "user" _ac_u where _ac_u.id = ${userId}::uuid),
+    _ac_orgs as (select _ac_m.organization_id from member _ac_m join _ac_me on _ac_m.user_id = _ac_me.id),
+    _ac_teams as (
+      select _ac_tm.team_id, _ac_t.admins, _ac_t.organization_id from team_member _ac_tm
+      join _ac_me on _ac_tm.user_id = _ac_me.id
+      join team _ac_t on _ac_t.id = _ac_tm.team_id
+      join _ac_orgs on _ac_orgs.organization_id = _ac_t.organization_id
     ),
-    cut as (select min(depth) as depth from chain where restricted),
-    reach as (select chain.kind, chain.id from chain, cut where cut.depth is null or chain.depth <= cut.depth),
-    me as (select ${who.userId}::uuid as id),
-    levels as (
-      select ${MANAGE} as level from root, me where root.kind = 'user' and root.id = me.id::text
-      union all
-      select case btrim(roles.name)
-          when 'owner' then ${MANAGE}
-          when 'admin' then ${DELETE}
-          when 'member' then (select case when cut.depth is null then ${READ} else 0 end from cut)
-          else 0 end
-      from root
-      join member m on root.kind = 'organization' and m.organization_id::text = root.id
-      join me on m.user_id = me.id
-      cross join lateral unnest(string_to_array(m.role, ',')) as roles(name)
+    _ac_matched as (
+      select _ac_c.depth, _ac_g.level,
+        case when _ac_g.user_id is not null or _ac_g.email is not null then 'person'
+             when _ac_g.team_id is not null then 'team ' || _ac_g.team_id
+             when _ac_g.organization_id is not null then 'organization ' || _ac_g.organization_id
+             else 'everyone' end as principal
+      from _ac_chain _ac_c join access_grant _ac_g on _ac_g.point_id = _ac_c.id
+      where _ac_g.everyone
+         or _ac_g.user_id = (select id from _ac_me)
+         or _ac_g.email = (select email from _ac_me)
+         or (_ac_g.organization_id in (select organization_id from _ac_orgs) and (_ac_c.organization_id is null or _ac_c.organization_id = _ac_g.organization_id))
+         or exists (select 1 from _ac_teams _ac_x where _ac_x.team_id = _ac_g.team_id and (_ac_c.organization_id is null or _ac_c.organization_id = _ac_x.organization_id))
+    ),
+    _ac_nearest as (select distinct on (principal) level from _ac_matched order by principal, depth, level desc),
+    _ac_levels as (
+      select level from _ac_nearest
       union all
-      select g.level from access_grant g join reach on g.item_kind = reach.kind and g.item_id = reach.id, me
-      where g.user_id = me.id
-        or g.team_id in (select tm.team_id from team_member tm where tm.user_id = me.id)
-        or g.organization_id in (select mm.organization_id from member mm where mm.user_id = me.id)
-        or g.email = (select lower(u.email) from "user" u where u.id = me.id and u.email_verified)
+      select ${MANAGE} from _ac_chain _ac_c join _ac_teams _ac_x on _ac_x.admins and _ac_x.organization_id = _ac_c.organization_id where _ac_c.depth = 0
       union all
-      select l.level from access_link l join reach on l.item_kind = reach.kind and l.item_id = reach.id
-      where l.token_hash = ${who.linkHash} and (l.expires_at is null or l.expires_at > now())
+      select _ac_l.level from access_link _ac_l
+      where _ac_l.point_id = (select id from _ac_target) and _ac_l.token_hash = ${who.linkHash} and (_ac_l.expires_at is null or _ac_l.expires_at > now())
     )
-    select case when exists (select 1 from root) then coalesce(max(level), 0) else 0 end from levels
+    select coalesce(max(level), 0) from _ac_levels
   )`;
 }
 const rows = async (db, query) => (await db.execute(query)).rows;
 function granteeColumns(to) {
     const keys = Object.keys(to ?? {});
-    if (keys.length !== 1 || !["user", "team", "organization", "email"].includes(keys[0])) {
-        throw new Error("share with exactly one of { user }, { team }, { organization } or { email }");
+    if (keys.length !== 1 || !["user", "team", "organization", "email", "everyone"].includes(keys[0])) {
+        throw new Error("grant to exactly one of { user }, { team }, { organization }, { email } or { everyone: true }");
+    }
+    if ("everyone" in to) {
+        if (to.everyone !== true)
+            throw new Error("a grant to Everyone is { everyone: true }");
+        return { user: null, team: null, organization: null, everyone: true, email: null };
     }
     const value = Object.values(to)[0];
     if (typeof value !== "string" || value.trim() === "")
@@ -103,6 +118,7 @@ function granteeColumns(to) {
         user: "user" in to ? to.user : null,
         team: "team" in to ? to.team : null,
         organization: "organization" in to ? to.organization : null,
+        everyone: null,
         email: "email" in to ? to.email.trim().toLowerCase() : null,
     };
 }
@@ -113,8 +129,11 @@ function grantee(row) {
         return { team: row.team_id };
     if (row.organization_id)
         return { organization: row.organization_id };
+    if (row.everyone)
+        return { everyone: true };
     return { email: row.email };
 }
+const pgCode = (error) => error.code ?? error.cause?.code;
 // Postgres refuses a grant to a user, team or organization that does not exist, or whose id is not
 // a UUID at all; both look like any other missing thing.
 async function missingAsNotFound(work) {
@@ -122,186 +141,319 @@ async function missingAsNotFound(work) {
         return await work;
     }
     catch (error) {
-        const code = error.code ?? error.cause?.code;
+        const code = pgCode(error);
         if (code === "23503" || code === "22P02")
             throw notFound();
         throw error;
     }
 }
-export function createAccess(db, caller, notify) {
-    let who;
-    const me = () => (who ??= caller().then(async ({ userId, link }) => ({ userId, linkHash: link ? await hashToken(link) : null })));
-    async function levelOf(on, kind, id) {
-        checkKind(kind);
-        checkId(id);
-        const [row] = await rows(on, sql `select ${levelSql(sql `${kind}`, sql `${id}`, await me())} as level`);
-        const level = Number(row?.level ?? 0);
-        if (level === 0)
-            await reportTooDeep(on, kind, id);
-        return level;
-    }
-    // A chain longer than place allows can only come from writing the tables directly; it is
-    // refused like any other, and logged, since it means a bug.
-    async function reportTooDeep(on, kind, id) {
-        const [up] = await rows(on, chainUp(kind, id, MAX_DEPTH + 1));
-        if (up && Number(up.depth) >= MAX_DEPTH)
-            console.error(`access: ${kind} ${id} sits more than ${MAX_DEPTH} items deep; refused`);
-    }
-    async function need(on, kind, id, level) {
-        if ((await levelOf(on, kind, id)) < level)
+const pointRow = async (on, id) => (await rows(on, sql `select id, parent_id, organization_id, for_organization, for_team, inherits, static from access_point where id = ${id}`))[0];
+// One structural change at a time per database, so two moves can never pass each other's loop check.
+const lockTree = (tx) => tx.execute(sql `select pg_advisory_xact_lock(hashtext('@celsoft/platform access tree'))`);
+// The number of points from this one to the top, counting itself.
+async function depthOf(on, id) {
+    const [row] = await rows(on, sql `with recursive up as (
+          select id, parent_id, 1 as depth from access_point where id = ${id}
+          union all
+          select p.id, p.parent_id, u.depth + 1 from up u join access_point p on p.id = u.parent_id where u.depth <= ${MAX_DEPTH}
+        )
+        select coalesce(max(depth), 0) as depth from up`);
+    return Number(row?.depth ?? 0);
+}
+// Every point under this one and itself, the point first, as far down as MAX_DEPTH allows.
+async function subtree(on, id) {
+    return rows(on, sql `with recursive down as (
+          select id, 0 as depth from access_point where id = ${id}
+          union all
+          select c.id, d.depth + 1 from down d join access_point c on c.parent_id = d.id where d.depth < ${MAX_DEPTH}
+        )
+        select id, depth from down order by depth, id`);
+}
+// Organization and team grants under an organization must belong to it; `organizationId` null
+// means the points sit under no organization, where any principal may be granted.
+async function foreignGrant(on, ids, organizationId) {
+    if (organizationId === null || ids.length === 0)
+        return false;
+    const [row] = await rows(on, sql `select exists (
+          select 1 from access_grant g left join team t on t.id = g.team_id
+          where g.point_id in ${ids}
+            and ((g.organization_id is not null and g.organization_id <> ${organizationId}::uuid)
+              or (g.team_id is not null and t.organization_id <> ${organizationId}::uuid))
+        ) as foreign`);
+    return Boolean(row?.foreign);
+}
+// Refuses an organization or team grant from another organization on a point under one.
+async function checkSameOrganization(on, point, g) {
+    if (!point.organization_id)
+        return;
+    if (g.organization && g.organization !== point.organization_id)
+        throw conflict("a point under an organization can be granted only to that organization, its teams, people and Everyone");
+    if (g.team) {
+        const [team] = await missingAsNotFound(rows(on, sql `select organization_id from team where id = ${g.team}::uuid`));
+        if (!team)
             throw notFound();
+        if (team.organization_id !== point.organization_id)
+            throw conflict("a point under an organization can be granted only to that organization, its teams, people and Everyone");
     }
-    // The level the top of the tree gives: a user over their own items, a role over an organization's.
-    async function topLevel(on, kind, id) {
-        const { userId } = await me();
-        if (!userId)
-            return 0;
-        if (kind === "user")
-            return id === userId ? MANAGE : 0;
-        const [row] = await rows(on, sql `select coalesce(max(case btrim(roles.name) when 'owner' then ${MANAGE} when 'admin' then ${DELETE} when 'member' then ${READ} else 0 end), 0) as level
-          from member m cross join lateral unnest(string_to_array(m.role, ',')) as roles(name)
-          where m.organization_id::text = ${id} and m.user_id = ${userId}::uuid`);
-        return Number(row?.level ?? 0);
-    }
-    async function place(on, kind, id, parentKind, parentId) {
-        checkKind(kind);
-        checkId(id);
-        checkId(parentId);
-        await on.transaction(async (raw) => {
-            const tx = raw;
-            // One move at a time per database, so two moves can never pass each other's loop check.
-            await tx.execute(sql `select pg_advisory_xact_lock(hashtext('@celsoft/platform access place'))`);
-            const [existing] = await rows(tx, sql `select 1 from access_item where kind = ${kind} and id = ${id}`);
-            if (existing)
-                await need(tx, kind, id, WRITE);
-            let above = 0;
-            if (ROOTS.includes(parentKind)) {
-                if ((await topLevel(tx, parentKind, parentId)) < CREATE)
-                    throw notFound();
-            }
-            else {
-                await need(tx, parentKind, parentId, CREATE);
-                const [up] = await rows(tx, sql `${chainUp(parentKind, parentId, MAX_DEPTH)}, (select exists (select 1 from up where kind = ${kind} and id = ${id})) as within`);
-                if (up?.within)
-                    throw new EndpointError(409, "an item cannot be placed inside itself");
-                above = Number(up?.depth ?? 0) + 1;
-            }
-            const [down] = await rows(tx, sql `with recursive down as (
-              select kind, id, 1 as depth from access_item where parent_kind = ${kind} and parent_id = ${id}
-              union all
-              select c.kind, c.id, d.depth + 1 from down d join access_item c on c.parent_kind = d.kind and c.parent_id = d.id
-              where d.depth < ${MAX_DEPTH}
-            )
-            select coalesce(max(depth), 0) as height from down`);
-            if (above + 1 + Number(down?.height ?? 0) > MAX_DEPTH)
-                throw new EndpointError(409, `items can sit at most ${MAX_DEPTH} deep`);
-            await tx.execute(sql `
-        insert into access_item (kind, id, parent_kind, parent_id) values (${kind}, ${id}, ${parentKind}, ${parentId})
-        on conflict (kind, id) do update set parent_kind = excluded.parent_kind, parent_id = excluded.parent_id, updated_at = now()`);
-        });
-    }
-    function bound(on) {
+}
+export function createAccess(db, caller, options = {}) {
+    const { notify, ready } = options;
+    let human;
+    const person = () => (human ??= Promise.all([caller(), ready?.()]).then(async ([{ userId, link }]) => ({ userId, linkHash: link ? await hashToken(link) : null, app: false })));
+    const asApp = async () => (await ready?.(), { userId: null, linkHash: null, app: true });
+    function bound(on, me) {
+        async function levelOf(at, point) {
+            checkPointId(point);
+            const [row] = await rows(at, sql `select ${levelSql(sql `${point}`, await me())} as level`);
+            return Number(row?.level ?? 0);
+        }
+        async function need(at, point, level) {
+            const has = await levelOf(at, point);
+            if (has < level)
+                throw notFound();
+            return has;
+        }
+        // A point the caller has `level` on, refusing changes to static points, whose grants change
+        // only with a deploy, and to the points the platform keeps for organizations and teams where
+        // `structural` is set.
+        async function changeable(at, point, level, structural = false) {
+            await need(at, point, level);
+            const row = (await pointRow(at, point));
+            if (row.static)
+                throw conflict("a static point changes only in code, with a deploy");
+            if (structural && (row.for_organization || row.for_team))
+                throw conflict("an organization's or team's point changes only through the organization");
+            return row;
+        }
+        async function signedIn() {
+            const who = await me();
+            if (!who.app && !userParam(who.userId))
+                throw new EndpointError(401, "sign in first");
+            return who;
+        }
+        async function insertGrant(at, point, g, n, grantedBy) {
+            return missingAsNotFound(rows(at, 
+            // xmax is 0 only for a row this statement inserted, so a changed grant sends no second email.
+            sql `
+          insert into access_grant (point_id, user_id, team_id, organization_id, everyone, email, level, granted_by)
+          values (${point}, ${g.user}::uuid, ${g.team}::uuid, ${g.organization}::uuid, ${g.everyone}, ${g.email}, ${n}, ${grantedBy}::uuid)
+          on conflict on constraint access_grant_once do update set level = excluded.level, granted_by = excluded.granted_by, updated_at = now()
+          returning xmax = 0 as inserted,
+            coalesce(email, (select u.email from "user" u where u.id = access_grant.user_id)) as recipient,
+            (select u.name from "user" u where u.id = ${grantedBy}::uuid) as shared_by`));
+        }
+        function checkGrant(to, level) {
+            const n = rank(level);
+            const g = granteeColumns(to);
+            if (g.everyone && n !== READ)
+                throw new Error(`Everyone can be granted read only, never ${level}`);
+            return { g, n };
+        }
         return {
-            level: async (kind, id) => named(await levelOf(on, kind, id)),
-            can: async (kind, id, level) => (await levelOf(on, kind, id)) >= rank(level),
-            require: async (kind, id, level) => need(on, kind, id, rank(level)),
-            place: (kind, id, parentKind, parentId) => place(on, kind, id, parentKind, parentId),
-            async remove(kind, id) {
-                await need(on, kind, id, DELETE);
-                const [child] = await rows(on, sql `select 1 from access_item where parent_kind = ${kind} and parent_id = ${id} limit 1`);
-                if (child)
-                    throw new EndpointError(409, "move or delete what is inside first");
-                await on.execute(sql `delete from access_item where kind = ${kind} and id = ${id}`);
+            async point(point) {
+                await need(on, point, READ);
+                const row = (await pointRow(on, point));
+                return { id: row.id, parent: row.parent_id, inherits: row.inherits, static: row.static, organizationId: row.organization_id };
             },
-            async restrict(kind, id, restricted = true) {
-                await need(on, kind, id, MANAGE);
-                await on.execute(sql `update access_item set restricted = ${restricted}, updated_at = now() where kind = ${kind} and id = ${id}`);
+            level: async (point) => named(await levelOf(on, point)),
+            can: async (point, level) => (await levelOf(on, point)) >= rank(level),
+            check: async (point) => named(await need(on, point, READ)),
+            require: async (point, level) => named(await need(on, point, rank(level))),
+            async create(point, options = {}) {
+                checkPointId(point);
+                if (RESERVED.test(point))
+                    throw new Error(`control point ids starting organization: or team: belong to the platform; got ${JSON.stringify(point)}`);
+                const grants = (options.grants ?? []).map(({ to, level }) => checkGrant(to, level));
+                const who = await signedIn();
+                await on.transaction(async (raw) => {
+                    const tx = raw;
+                    await lockTree(tx);
+                    let organizationId = null;
+                    if (options.parent !== undefined) {
+                        await need(tx, options.parent, CREATE);
+                        const parent = (await pointRow(tx, options.parent));
+                        if ((await depthOf(tx, options.parent)) >= MAX_DEPTH)
+                            throw conflict(`points can sit at most ${MAX_DEPTH} deep`);
+                        organizationId = parent.organization_id;
+                    }
+                    const creator = userParam(who.userId);
+                    try {
+                        await tx.execute(sql `
+              insert into access_point (id, parent_id, organization_id, inherits, created_by)
+              values (${point}, ${options.parent ?? null}, ${organizationId}::uuid, ${options.inherit ?? false}, ${creator}::uuid)`);
+                    }
+                    catch (error) {
+                        if (pgCode(error) === "23505")
+                            throw conflict("that control point already exists");
+                        throw error;
+                    }
+                    const row = (await pointRow(tx, point));
+                    for (const { g } of grants)
+                        await checkSameOrganization(tx, row, g);
+                    if (creator)
+                        await insertGrant(tx, point, { user: creator, team: null, organization: null, everyone: null, email: null }, MANAGE, creator);
+                    for (const { g, n } of grants)
+                        await insertGrant(tx, point, g, n, creator);
+                });
             },
-            async share(kind, id, to, level, options = {}) {
-                const n = rank(level);
-                const g = granteeColumns(to);
+            async move(point, parent) {
+                checkPointId(point);
+                if (parent !== null)
+                    checkPointId(parent);
+                await on.transaction(async (raw) => {
+                    const tx = raw;
+                    await lockTree(tx);
+                    await changeable(tx, point, MANAGE, true);
+                    let organizationId = null;
+                    let above = 0;
+                    if (parent !== null) {
+                        await need(tx, parent, CREATE);
+                        organizationId = (await pointRow(tx, parent)).organization_id;
+                        above = await depthOf(tx, parent);
+                    }
+                    const below = await subtree(tx, point);
+                    const ids = below.map((p) => p.id);
+                    if (parent !== null && ids.includes(parent))
+                        throw conflict("a point cannot sit under itself");
+                    const height = Math.max(...below.map((p) => Number(p.depth))) + 1;
+                    if (above + height > MAX_DEPTH)
+                        throw conflict(`points can sit at most ${MAX_DEPTH} deep`);
+                    if (await foreignGrant(tx, ids, organizationId))
+                        throw conflict("points under an organization can be granted only to its own teams and itself; revoke the other organization's grants first");
+                    await tx.execute(sql `update access_point set parent_id = ${parent}, updated_at = now() where id = ${point}`);
+                    await tx.execute(sql `update access_point set organization_id = ${organizationId}::uuid, updated_at = now() where id in ${ids}`);
+                });
+            },
+            async remove(point) {
+                checkPointId(point);
+                return on.transaction(async (raw) => {
+                    const tx = raw;
+                    await lockTree(tx);
+                    await changeable(tx, point, DELETE, true);
+                    const ids = (await subtree(tx, point)).map((p) => p.id);
+                    await tx.execute(sql `delete from access_point where id in ${ids}`);
+                    return ids;
+                });
+            },
+            async inherit(point, inherits) {
+                await changeable(on, point, MANAGE);
+                await on.execute(sql `update access_point set inherits = ${inherits}, updated_at = now() where id = ${point}`);
+            },
+            async grant(point, to, level, options = {}) {
+                const { g, n } = checkGrant(to, level);
                 const email = options.email ?? {};
                 if (email && email.path !== undefined && !/^\/(?![/\\])/.test(email.path))
                     throw new Error(`a sharing email's path must start with one /, such as /pages/7; got ${JSON.stringify(email.path)}`);
-                await need(on, kind, id, MANAGE);
+                const row = await changeable(on, point, MANAGE);
+                await checkSameOrganization(on, row, g);
                 const { userId } = await me();
-                // xmax is 0 only for a row this statement inserted, so a changed grant sends no second email.
-                const [row] = await missingAsNotFound(rows(on, sql `
-            insert into access_grant (item_kind, item_id, user_id, team_id, organization_id, email, level, granted_by)
-            values (${kind}, ${id}, ${g.user}::uuid, ${g.team}::uuid, ${g.organization}::uuid, ${g.email}, ${n}, ${userId}::uuid)
-            on conflict on constraint access_grant_once do update set level = excluded.level, granted_by = excluded.granted_by, updated_at = now()
-            returning xmax = 0 as inserted,
-              coalesce(email, (select u.email from "user" u where u.id = access_grant.user_id)) as recipient,
-              (select u.name from "user" u where u.id = ${userId}::uuid) as shared_by`));
-                if (!notify || email === false || !row?.inserted || !row.recipient)
+                const [inserted] = await insertGrant(on, point, g, n, userParam(userId));
+                if (!notify || email === false || !inserted?.inserted || !inserted.recipient || !(g.user || g.email))
                     return;
-                await notify({ to: row.recipient, sharedBy: row.shared_by, level, path: email.path ?? "/", subject: email.subject, text: email.text });
+                await notify({ to: inserted.recipient, sharedBy: inserted.shared_by, level, path: email.path ?? "/", subject: email.subject, text: email.text });
             },
-            async revoke(kind, id, to) {
+            async revoke(point, to) {
                 const g = granteeColumns(to);
-                await need(on, kind, id, MANAGE);
-                await on.execute(sql `
-          delete from access_grant where item_kind = ${kind} and item_id = ${id}
-            and user_id is not distinct from ${g.user}::uuid and team_id is not distinct from ${g.team}::uuid
-            and organization_id is not distinct from ${g.organization}::uuid and email is not distinct from ${g.email}`);
+                await changeable(on, point, MANAGE);
+                await missingAsNotFound(on.execute(sql `
+            delete from access_grant where point_id = ${point}
+              and user_id is not distinct from ${g.user}::uuid and team_id is not distinct from ${g.team}::uuid
+              and organization_id is not distinct from ${g.organization}::uuid and everyone is not distinct from ${g.everyone}
+              and email is not distinct from ${g.email}`));
             },
-            async grants(kind, id) {
-                await need(on, kind, id, MANAGE);
-                const found = await rows(on, sql `select user_id, team_id, organization_id, email, level, granted_by from access_grant where item_kind = ${kind} and item_id = ${id} order by created_at, id`);
+            async grants(point) {
+                await need(on, point, MANAGE);
+                const found = await rows(on, sql `select user_id, team_id, organization_id, everyone, email, level, granted_by from access_grant where point_id = ${point} order by created_at, id`);
                 return found.map((row) => ({ to: grantee(row), level: named(Number(row.level)), grantedBy: row.granted_by }));
             },
-            async sharedWithMe(kind) {
-                checkKind(kind);
-                const who = await me();
-                if (!who.userId)
-                    return [];
-                const found = await rows(on, sql `select distinct g.item_id from access_grant g
-              where g.item_kind = ${kind}
-                and (g.user_id = ${who.userId}::uuid
-                  or g.team_id in (select team_id from team_member where user_id = ${who.userId}::uuid)
-                  or g.organization_id in (select organization_id from member where user_id = ${who.userId}::uuid)
-                  or g.email = (select lower(email) from "user" where id = ${who.userId}::uuid and email_verified))
-                and ${levelSql(sql `g.item_kind`, sql `g.item_id`, who)} >= ${READ}
-              order by g.item_id`);
-                return found.map((row) => row.item_id);
-            },
-            async link(kind, id, level, options = {}) {
+            async link(point, level, options = {}) {
                 const n = rank(level);
                 if (n > WRITE)
                     throw new Error(`a link can carry read, create or write, never ${level}`);
-                await need(on, kind, id, MANAGE);
+                if (options.expires !== undefined && !(options.expires instanceof Date && !Number.isNaN(options.expires.getTime())))
+                    throw new Error("a link's expires must be a valid Date");
+                await changeable(on, point, MANAGE);
                 const token = newToken();
                 const { userId } = await me();
-                const [row] = await rows(on, sql `insert into access_link (item_kind, item_id, token_hash, level, expires_at, created_by)
-              values (${kind}, ${id}, ${await hashToken(token)}, ${n}, ${options.expires ?? null}, ${userId}::uuid) returning id`);
+                const [row] = await rows(on, sql `insert into access_link (point_id, token_hash, level, expires_at, created_by)
+              values (${point}, ${await hashToken(token)}, ${n}, ${options.expires ?? null}, ${userParam(userId)}::uuid) returning id`);
                 return { id: row.id, token };
             },
-            async links(kind, id) {
-                await need(on, kind, id, MANAGE);
-                const found = await rows(on, sql `select id, level, expires_at from access_link where item_kind = ${kind} and item_id = ${id} order by created_at, id`);
+            async links(point) {
+                await need(on, point, MANAGE);
+                const found = await rows(on, sql `select id, level, expires_at from access_link where point_id = ${point} order by created_at, id`);
                 return found.map((row) => ({ id: row.id, level: named(Number(row.level)), expiresAt: row.expires_at ? new Date(row.expires_at) : null }));
             },
-            async revokeLink(kind, id, linkId) {
-                await need(on, kind, id, MANAGE);
-                await on.execute(sql `delete from access_link where item_kind = ${kind} and item_id = ${id} and id::text = ${linkId}`);
+            async revokeLink(point, linkId) {
+                await need(on, point, MANAGE);
+                await on.execute(sql `delete from access_link where point_id = ${point} and id::text = ${String(linkId)}`);
             },
-            async accessible(kind, level, column) {
-                checkKind(kind);
-                return sql `(${levelSql(sql `${kind}`, sql `(${column})::text`, await me())} >= ${rank(level)})`;
-            },
-            in: (tx) => bound(tx),
+            readable: async (column) => sql `(${levelSql(sql `(${column})::text`, await me())} >= ${READ})`,
+            allows: async (level, column) => sql `(${levelSql(sql `(${column})::text`, await me())} >= ${rank(level)})`,
+            in: (tx) => bound(tx, me),
+            asApp: () => bound(on, asApp),
         };
     }
-    return bound(db);
+    return bound(db, person);
 }
-// The chain above an item, the item included, as `up`, with `depth` the topmost step reached.
-function chainUp(kind, id, limit) {
-    return sql `with recursive up as (
-      select kind, id, parent_kind, parent_id, 0 as depth from access_item where kind = ${kind} and id = ${id}
-      union all
-      select p.kind, p.id, p.parent_kind, p.parent_id, u.depth + 1 from up u join access_item p on p.kind = u.parent_kind and p.id = u.parent_id
-      where u.depth < ${limit}
-    )
-    select (select max(depth) from up) as depth`;
+// Writes the app's static points, as declared in code: each is created or updated, and its grants
+// replaced. Points no longer declared are left alone. Run once per Worker start, before any check.
+export async function applyStaticPoints(db, points) {
+    const names = Object.keys(points);
+    if (names.length === 0)
+        return;
+    for (const name of names) {
+        checkPointId(name);
+        if (RESERVED.test(name))
+            throw new Error(`static point ${JSON.stringify(name)} uses a prefix that belongs to the platform`);
+        const parent = points[name].parent;
+        if (parent !== undefined && !(parent in points))
+            throw new Error(`static point ${name}'s parent ${JSON.stringify(parent)} is not a static point`);
+    }
+    // Parents first, refusing a loop among them.
+    const order = [];
+    const visiting = new Set();
+    const visit = (name) => {
+        if (order.includes(name))
+            return;
+        if (visiting.has(name))
+            throw new Error(`static points ${[...visiting].join(", ")} sit under each other`);
+        visiting.add(name);
+        const parent = points[name].parent;
+        if (parent !== undefined)
+            visit(parent);
+        visiting.delete(name);
+        order.push(name);
+    };
+    names.forEach(visit);
+    const depth = (name) => (points[name].parent ? 1 + depth(points[name].parent) : 1);
+    if (names.some((n) => depth(n) > MAX_DEPTH))
+        throw new Error(`static points can sit at most ${MAX_DEPTH} deep`);
+    await db.transaction(async (raw) => {
+        const tx = raw;
+        await lockTree(tx);
+        for (const name of order) {
+            const point = points[name];
+            const grants = (point.grants ?? []).map(({ to, level }) => {
+                const n = rank(level);
+                const g = granteeColumns(to);
+                if (g.everyone && n !== READ)
+                    throw new Error(`static point ${name}: Everyone can be granted read only`);
+                return { g, n };
+            });
+            const [existing] = await rows(tx, sql `select static from access_point where id = ${name}`);
+            if (existing && !existing.static)
+                throw new Error(`static point ${JSON.stringify(name)} has the id of a point the app created at runtime`);
+            await tx.execute(sql `
+        insert into access_point (id, parent_id, inherits, static) values (${name}, ${point.parent ?? null}, ${point.inherit ?? false}, true)
+        on conflict (id) do update set parent_id = excluded.parent_id, inherits = excluded.inherits, updated_at = now()`);
+            await tx.execute(sql `delete from access_grant where point_id = ${name}`);
+            for (const { g, n } of grants) {
+                await tx.execute(sql `
+          insert into access_grant (point_id, user_id, team_id, organization_id, everyone, email, level)
+          values (${name}, ${g.user}::uuid, ${g.team}::uuid, ${g.organization}::uuid, ${g.everyone}, ${g.email}, ${n})`);
+            }
+        }
+    });
 }
 //# sourceMappingURL=access.js.map