@consciousclouds/access 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/dist/server/index.d.ts.map +1 -1
- package/dist/server/index.js +18 -3
- package/dist/server/index.js.map +1 -1
- package/package.json +8 -3
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,20 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to `@consciousclouds/access` are documented here.
|
|
4
4
|
|
|
5
|
+
## 0.1.2
|
|
6
|
+
|
|
7
|
+
- No API change. Republished so that the bytes on the registry reproduce from the committed tree and are
|
|
8
|
+
pinned by the published-byte digest gate (`scripts/sdk_packed_digest.py`). 0.1.1's immutable bytes differ
|
|
9
|
+
from the source that followed it by one comment, which no gate could see because no digest was recorded;
|
|
10
|
+
from this release the packed contents are pinned per version and CI refuses a source change that would
|
|
11
|
+
diverge from what was published.
|
|
12
|
+
|
|
13
|
+
## 0.1.1
|
|
14
|
+
|
|
15
|
+
- Fail-closed repair: `decodeURIComponent` sat outside every guard, so a malformed cookie threw `URIError` out
|
|
16
|
+
of every server-side entry point instead of denying. Packaging repair: the `capability-sdk` dependency was
|
|
17
|
+
`workspace:*`, which would have shipped an uninstallable tarball. No API change.
|
|
18
|
+
|
|
5
19
|
## 0.1.0
|
|
6
20
|
|
|
7
21
|
- Initial release. The policy-free Access SDK for the Control Plane's operator
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,EACL,gBAAgB,EAChB,YAAY,EACb,MAAM,aAAa,CAAC;AAErB;yCACyC;AACzC,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;iGAC6F;IAC7F,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAChC,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACpD,oDAAoD;IACpD,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IACvC,gGAAgG;IAChG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,+FAA+F;IAC/F,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC3G;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,KAAK,EACL,gBAAgB,EAChB,YAAY,EACb,MAAM,aAAa,CAAC;AAErB;yCACyC;AACzC,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;iGAC6F;IAC7F,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAChC,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACpD,oDAAoD;IACpD,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IACvC,gGAAgG;IAChG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,+FAA+F;IAC/F,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC3G;AA6BD,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAwDrE"}
|
package/dist/server/index.js
CHANGED
|
@@ -12,7 +12,15 @@
|
|
|
12
12
|
*/
|
|
13
13
|
import { createAccessClient, identityFromToken } from '../client/index.js';
|
|
14
14
|
const EMPTY_SCOPE = { project: '', environment: '' };
|
|
15
|
-
/**
|
|
15
|
+
/**
|
|
16
|
+
* Pull one cookie value out of a raw `Cookie:` header.
|
|
17
|
+
*
|
|
18
|
+
* FAIL-CLOSED ON A MALFORMED VALUE. `decodeURIComponent` THROWS a URIError on an invalid percent-escape, and a
|
|
19
|
+
* cookie header is attacker-influenced input: a request carrying `cc=%` made every entry point below throw
|
|
20
|
+
* rather than deny, which turns a fail-closed adapter into a 500 — and a crash is not a denial. A value
|
|
21
|
+
* that cannot be decoded is not a credential, so it reads as ABSENT, which is exactly the state every caller
|
|
22
|
+
* already handles.
|
|
23
|
+
*/
|
|
16
24
|
function readCookie(header, name) {
|
|
17
25
|
if (!header)
|
|
18
26
|
return null;
|
|
@@ -20,8 +28,15 @@ function readCookie(header, name) {
|
|
|
20
28
|
const eq = part.indexOf('=');
|
|
21
29
|
if (eq < 0)
|
|
22
30
|
continue;
|
|
23
|
-
if (part.slice(0, eq).trim()
|
|
24
|
-
|
|
31
|
+
if (part.slice(0, eq).trim() !== name)
|
|
32
|
+
continue;
|
|
33
|
+
const raw = part.slice(eq + 1).trim();
|
|
34
|
+
try {
|
|
35
|
+
return decodeURIComponent(raw);
|
|
36
|
+
}
|
|
37
|
+
catch {
|
|
38
|
+
return null; // undecodable ⇒ no credential ⇒ the caller's fail-closed path
|
|
39
|
+
}
|
|
25
40
|
}
|
|
26
41
|
return null;
|
|
27
42
|
}
|
package/dist/server/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiD3E,MAAM,WAAW,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAEnE
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiD3E,MAAM,WAAW,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,8DAA8D;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,YAAY,GAAuB;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,MAAM,MAAM,GAAiB,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAE7C,MAAM,OAAO,GAAG,CAAC,GAAgB,EAAiB,EAAE,CAClD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,CAAC,QAAuB,EAAgB,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC;IAEnG,SAAS,QAAQ,CAAC,GAAgB;QAChC,OAAO,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,KAAK,CAAC,IAAkB;QAC/B,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,GAAgB,EAAE,QAAuB;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjH,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC;gBAClC,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,GAAG,CAChB,GAAgB,EAChB,QAAsB,EACtB,MAAa,EACb,SAAuB,QAAQ;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@consciousclouds/access",
|
|
3
|
-
"version": "0.1.
|
|
4
|
-
"description": "Conscious Clouds Access SDK
|
|
3
|
+
"version": "0.1.2",
|
|
4
|
+
"description": "Conscious Clouds Access SDK \u2014 the thin, policy-free client for the Control Plane's operator identity + Access surface. Types (root) + isomorphic HTTP wrappers (/client) + a request-bound fail-closed BFF adapter (/server) + React hooks & AccessProvider (/react). Reuses the `Capability` `<primitive>.<verb>` vocabulary and the operator-shell's allowed|denied|unknown decision union. NO policy logic \u2014 every decision is the Control Plane's; the SDK only asks the five operating questions and enforces the answers (fail-closed).",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "./dist/index.js",
|
|
@@ -24,7 +24,12 @@
|
|
|
24
24
|
"import": "./dist/react/index.js"
|
|
25
25
|
}
|
|
26
26
|
},
|
|
27
|
-
"files": [
|
|
27
|
+
"files": [
|
|
28
|
+
"dist",
|
|
29
|
+
"README.md",
|
|
30
|
+
"CHANGELOG.md",
|
|
31
|
+
"LICENSE"
|
|
32
|
+
],
|
|
28
33
|
"scripts": {
|
|
29
34
|
"build": "tsc -p tsconfig.build.json",
|
|
30
35
|
"clean": "rm -rf dist",
|