@coffre/cli 0.1.1 → 0.1.2

package/README.md

@@ -4,11 +4,14 @@ The `coffre` command: secrets in your shell, and a new deployment.
 
 ```sh
 npx @coffre/cli init --workers my-coffre   # or --node
+npx @coffre/cli setup                      # its database logins, migrations and keys
 coffre login https://secrets.acme.example
 coffre run market/prod -- node server.js
 ```
 
-It bundles everything it runs, so it installs with no dependencies.
+It bundles everything it runs, so it installs with no dependencies:
+`setup` brings its own Postgres driver and coffre's migrations, at the
+CLI's version.
 
 Part of [coffre](https://github.com/erwinkn/coffre), a secrets manager you
 deploy as a small project of your own. Its eight `@coffre/*` packages are

package/dist/access-CO1kGjWW.js

@@ -0,0 +1,74 @@
+//#region ../core/dist/access.js
+/**
+* Who may do what: seven permissions and the six roles that bundle them.
+*
+* Deliberately constants and not tables or a policy language. A grant names
+* one role for one member on one place, and a check is a lookup in this file,
+* so authorisation stays something you can read end to end.
+*/
+const PERMISSIONS = [
+	"secret.read",
+	"secret.write",
+	"secret.archive",
+	"audit.read",
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+/**
+* Permissions that only make sense on a project. Granting
+* `environment.manage` on one environment would be incoherent: what it
+* authorises is creating that environment's siblings.
+*/
+const PROJECT_ONLY_PERMISSIONS = [
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+const ROLES = {
+	viewer: {
+		name: "Viewer",
+		description: "Read secret values.",
+		permissions: ["secret.read"]
+	},
+	developer: {
+		name: "Developer",
+		description: "Read and write secrets.",
+		permissions: ["secret.read", "secret.write"]
+	},
+	maintainer: {
+		name: "Maintainer",
+		description: "Read, write and retire secrets, and manage environments.",
+		permissions: [
+			"secret.read",
+			"secret.write",
+			"secret.archive",
+			"environment.manage"
+		]
+	},
+	"access-manager": {
+		name: "Access manager",
+		description: "Manage who has access. Cannot read secret values.",
+		permissions: ["grant.manage"]
+	},
+	auditor: {
+		name: "Auditor",
+		description: "Read the audit log. Cannot read secret values.",
+		permissions: ["audit.read"]
+	},
+	owner: {
+		name: "Owner",
+		description: "Everything, including reading secret values.",
+		permissions: [...PERMISSIONS]
+	}
+};
+const ROLE_NAMES = Object.keys(ROLES);
+function isRole(value) {
+	return Object.hasOwn(ROLES, value);
+}
+/** Roles that hold a project-only permission can only be granted on a project. */
+function assignableToEnvironment(role) {
+	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
+}
+//#endregion
+export { isRole as i, ROLE_NAMES as n, assignableToEnvironment as r, ROLES as t };