@consciousclouds/access 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,EACL,gBAAgB,EAChB,YAAY,EACb,MAAM,aAAa,CAAC;AAErB;yCACyC;AACzC,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;iGAC6F;IAC7F,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAChC,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACpD,oDAAoD;IACpD,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IACvC,gGAAgG;IAChG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,+FAA+F;IAC/F,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC3G;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,EACL,gBAAgB,EAChB,YAAY,EACb,MAAM,aAAa,CAAC;AAErB;yCACyC;AACzC,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;iGAC6F;IAC7F,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAChC,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACpD,oDAAoD;IACpD,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IACvC,gGAAgG;IAChG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,+FAA+F;IAC/F,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC3G;AA6BD,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAwDrE"}
|
package/dist/server/index.js
CHANGED
|
@@ -12,7 +12,15 @@
|
|
|
12
12
|
*/
|
|
13
13
|
import { createAccessClient, identityFromToken } from '../client/index.js';
|
|
14
14
|
const EMPTY_SCOPE = { project: '', environment: '' };
|
|
15
|
-
/**
|
|
15
|
+
/**
|
|
16
|
+
* Pull one cookie value out of a raw `Cookie:` header.
|
|
17
|
+
*
|
|
18
|
+
* FAIL-CLOSED ON A MALFORMED VALUE. `decodeURIComponent` THROWS a URIError on an invalid percent-escape, and a
|
|
19
|
+
* cookie header is attacker-influenced input: a request carrying `cc=%` made identity, session and can all
|
|
20
|
+
* throw rather than deny, which turns a fail-closed adapter into a 500 — and a crash is not a denial. A value
|
|
21
|
+
* that cannot be decoded is not a credential, so it reads as ABSENT, which is exactly the state every caller
|
|
22
|
+
* already handles.
|
|
23
|
+
*/
|
|
16
24
|
function readCookie(header, name) {
|
|
17
25
|
if (!header)
|
|
18
26
|
return null;
|
|
@@ -20,8 +28,15 @@ function readCookie(header, name) {
|
|
|
20
28
|
const eq = part.indexOf('=');
|
|
21
29
|
if (eq < 0)
|
|
22
30
|
continue;
|
|
23
|
-
if (part.slice(0, eq).trim()
|
|
24
|
-
|
|
31
|
+
if (part.slice(0, eq).trim() !== name)
|
|
32
|
+
continue;
|
|
33
|
+
const raw = part.slice(eq + 1).trim();
|
|
34
|
+
try {
|
|
35
|
+
return decodeURIComponent(raw);
|
|
36
|
+
}
|
|
37
|
+
catch {
|
|
38
|
+
return null; // undecodable ⇒ no credential ⇒ the caller's fail-closed path
|
|
39
|
+
}
|
|
25
40
|
}
|
|
26
41
|
return null;
|
|
27
42
|
}
|
package/dist/server/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiD3E,MAAM,WAAW,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAEnE
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiD3E,MAAM,WAAW,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,8DAA8D;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,YAAY,GAAuB;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,MAAM,GAAiB,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAE7C,MAAM,OAAO,GAAG,CAAC,GAAgB,EAAiB,EAAE,CAClD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,CAAC,QAAuB,EAAgB,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC;IAEnG,SAAS,QAAQ,CAAC,GAAgB;QAChC,OAAO,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,KAAK,CAAC,IAAkB;QAC/B,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,GAAgB,EAAE,QAAuB;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjH,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC;gBAClC,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,GAAG,CAChB,GAAgB,EAChB,QAAsB,EACtB,MAAa,EACb,SAAuB,QAAQ;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@consciousclouds/access",
|
|
3
|
-
"version": "0.1.
|
|
4
|
-
"description": "Conscious Clouds Access SDK
|
|
3
|
+
"version": "0.1.1",
|
|
4
|
+
"description": "Conscious Clouds Access SDK \u2014 the thin, policy-free client for the Control Plane's operator identity + Access surface. Types (root) + isomorphic HTTP wrappers (/client) + a request-bound fail-closed BFF adapter (/server) + React hooks & AccessProvider (/react). Reuses the `Capability` `<primitive>.<verb>` vocabulary and the operator-shell's allowed|denied|unknown decision union. NO policy logic \u2014 every decision is the Control Plane's; the SDK only asks the five operating questions and enforces the answers (fail-closed).",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "./dist/index.js",
|
|
@@ -24,7 +24,12 @@
|
|
|
24
24
|
"import": "./dist/react/index.js"
|
|
25
25
|
}
|
|
26
26
|
},
|
|
27
|
-
"files": [
|
|
27
|
+
"files": [
|
|
28
|
+
"dist",
|
|
29
|
+
"README.md",
|
|
30
|
+
"CHANGELOG.md",
|
|
31
|
+
"LICENSE"
|
|
32
|
+
],
|
|
28
33
|
"scripts": {
|
|
29
34
|
"build": "tsc -p tsconfig.build.json",
|
|
30
35
|
"clean": "rm -rf dist",
|