@danypops/pi-packed 0.28.13 → 0.28.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@danypops/pi-packed",
|
|
3
|
-
"version": "0.28.
|
|
3
|
+
"version": "0.28.14",
|
|
4
4
|
"description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -36,9 +36,9 @@
|
|
|
36
36
|
"@danypops/armada": "^0.5.1",
|
|
37
37
|
"@danypops/packed": "^0.7.0",
|
|
38
38
|
"@danypops/pi-extension-harness": "^0.7.0",
|
|
39
|
-
"@danypops/vehicle-client": "^0.10.
|
|
40
|
-
"@danypops/vehicle-core": "^0.19.
|
|
41
|
-
"@danypops/vehicle-server": "^0.27.
|
|
39
|
+
"@danypops/vehicle-client": "^0.10.8",
|
|
40
|
+
"@danypops/vehicle-core": "^0.19.1",
|
|
41
|
+
"@danypops/vehicle-server": "^0.27.1",
|
|
42
42
|
"jiti": "^2.7.0",
|
|
43
43
|
"malevich-tui-components": "^0.32.1",
|
|
44
44
|
"publint": "0.3.22",
|
|
@@ -302,7 +302,12 @@ export function createApp(deps: Deps): { fetch: (req: Request) => Promise<Respon
|
|
|
302
302
|
vehicleRegistry.useExecutionMiddleware(createVehicleMetricsMiddleware(deps.vehicleMetrics, "packed"));
|
|
303
303
|
registerVehicleMetricsOperations(vehicleRegistry, deps.vehicleMetrics, "packed");
|
|
304
304
|
}
|
|
305
|
-
const
|
|
305
|
+
const permissions = [...new Set(vehicleRegistry.manifest().operations.flatMap((operation) => operation.permissions))];
|
|
306
|
+
const vehicleApp = createVehicleHttpApp({
|
|
307
|
+
registry: vehicleRegistry,
|
|
308
|
+
token: deps.token,
|
|
309
|
+
invocationAuthority: { mode: "attested", resolve: () => ({ permissions, principal: { id: "packed-authenticated-client" } }) },
|
|
310
|
+
});
|
|
306
311
|
|
|
307
312
|
function authorize(operation: PackageOperation, approved: boolean): Response | undefined {
|
|
308
313
|
try {
|
|
@@ -97,6 +97,24 @@ describe("packed's daemon operation surface, through the real Vehicle wire proto
|
|
|
97
97
|
expect(byName.get("setup.update")).toBe(false);
|
|
98
98
|
});
|
|
99
99
|
|
|
100
|
+
it("derives Vehicle permissions from authenticated server state", async () => {
|
|
101
|
+
const app = createApp(deps());
|
|
102
|
+
const response = await app.fetch(
|
|
103
|
+
new Request("http://packed.internal/vehicle/invoke", {
|
|
104
|
+
method: "POST",
|
|
105
|
+
headers: { authorization: "Bearer test-token", "content-type": "application/json" },
|
|
106
|
+
body: JSON.stringify({
|
|
107
|
+
name: "package.search",
|
|
108
|
+
version: 1,
|
|
109
|
+
input: { query: "lsp", limit: 10 },
|
|
110
|
+
permissions: [],
|
|
111
|
+
principal: { id: "forged-caller" },
|
|
112
|
+
}),
|
|
113
|
+
}),
|
|
114
|
+
);
|
|
115
|
+
expect(response.status).toBe(200);
|
|
116
|
+
});
|
|
117
|
+
|
|
100
118
|
it("package.search round-trips through /vehicle/invoke, matching /api/v1/ops's own shape", async () => {
|
|
101
119
|
const app = createApp(deps());
|
|
102
120
|
const result = await invoke(app, "package.search", { query: "lsp", limit: 10 });
|