@dudousxd/nestjs-catalog 0.1.0 → 0.2.1

package/dist/catalog.principal.d.ts

@@ -162,7 +162,7 @@ export declare function composePrincipalId(applicationId: string, actorId?: stri
  *
  * Total, and lenient by design: every id ever written parses, including the
  * millions written before actors existed. This is what lets a governance query
- * keep asking "everything `flip-nestjs` did" — it matches on `applicationId`
+ * keep asking "everything this application did" — it matches on `applicationId`
  * and gets both the machine's own loads and anything a person did through it.
  *
  * Splits on the *first* separator, so an actor id that somehow contains one

package/dist/catalog.principal.js

@@ -101,7 +101,7 @@ function composePrincipalId(applicationId, actorId) {
  *
  * Total, and lenient by design: every id ever written parses, including the
  * millions written before actors existed. This is what lets a governance query
- * keep asking "everything `flip-nestjs` did" — it matches on `applicationId`
+ * keep asking "everything this application did" — it matches on `applicationId`
  * and gets both the machine's own loads and anything a person did through it.
  *
  * Splits on the *first* separator, so an actor id that somehow contains one

package/dist/catalog.route-auth.d.ts

@@ -0,0 +1,31 @@
+import type { CatalogScope } from './catalog.principal';
+/**
+ * What a route requires, as metadata a host's guard reads.
+ *
+ * The vocabulary lives here rather than in whichever package ships the routes,
+ * because otherwise every such package would invent its own metadata key and a
+ * host would need one guard per package to read them. A host writes ONE guard
+ * against these two keys and it governs every catalog route it mounts, from this
+ * library or any other.
+ *
+ * Declaring is deliberately separate from enforcing. This library has no opinion
+ * about how a caller is authenticated — that is `CATALOG_PRINCIPAL_RESOLVER` and
+ * the host's guard — only about what each route is asking for.
+ */
+/** Scopes a route needs. Absence means "authenticated is enough". */
+export declare const REQUIRED_SCOPES = "aviary:catalog:required-scopes";
+/** Whether a route refuses machine principals. */
+export declare const REQUIRES_HUMAN = "aviary:catalog:requires-human";
+/** Declares what a route needs. Absence means "authenticated is enough". */
+export declare const RequireScopes: (...scopes: CatalogScope[]) => import("@nestjs/common").CustomDecorator<string>;
+/**
+ * Declares that a route may only be taken by a person, not by an application
+ * holding a key.
+ *
+ * Orthogonal to scopes, and needed because a scope cannot express it. Some
+ * decisions want a name against them for reasons that have nothing to do with
+ * permission: a machine principal holding `catalog:admin` is perfectly
+ * authorised to make them and would leave an application id as the answer to
+ * "who did this", which is not an answer.
+ */
+export declare const RequireHuman: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/catalog.route-auth.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireHuman = exports.RequireScopes = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * What a route requires, as metadata a host's guard reads.
+ *
+ * The vocabulary lives here rather than in whichever package ships the routes,
+ * because otherwise every such package would invent its own metadata key and a
+ * host would need one guard per package to read them. A host writes ONE guard
+ * against these two keys and it governs every catalog route it mounts, from this
+ * library or any other.
+ *
+ * Declaring is deliberately separate from enforcing. This library has no opinion
+ * about how a caller is authenticated — that is `CATALOG_PRINCIPAL_RESOLVER` and
+ * the host's guard — only about what each route is asking for.
+ */
+/** Scopes a route needs. Absence means "authenticated is enough". */
+exports.REQUIRED_SCOPES = 'aviary:catalog:required-scopes';
+/** Whether a route refuses machine principals. */
+exports.REQUIRES_HUMAN = 'aviary:catalog:requires-human';
+/** Declares what a route needs. Absence means "authenticated is enough". */
+const RequireScopes = (...scopes) => (0, common_1.SetMetadata)(exports.REQUIRED_SCOPES, scopes);
+exports.RequireScopes = RequireScopes;
+/**
+ * Declares that a route may only be taken by a person, not by an application
+ * holding a key.
+ *
+ * Orthogonal to scopes, and needed because a scope cannot express it. Some
+ * decisions want a name against them for reasons that have nothing to do with
+ * permission: a machine principal holding `catalog:admin` is perfectly
+ * authorised to make them and would leave an application id as the answer to
+ * "who did this", which is not an answer.
+ */
+const RequireHuman = () => (0, common_1.SetMetadata)(exports.REQUIRES_HUMAN, true);
+exports.RequireHuman = RequireHuman;

package/dist/index.d.ts

@@ -17,3 +17,4 @@ export { CATALOG_PRINCIPAL_RESOLVER, type CatalogActor, type CatalogGrants, type
 export { assertNoColumnCollisions, CATALOG_RESERVED_COLUMNS, CATALOG_SNAPSHOT_MODES, CATALOG_STORE, type CarryForwardResult, type CatalogColumnCollision, CatalogColumnCollisionError, type CatalogMergeStore, type CatalogReadQuery, type CatalogReadResult, type CatalogReadStore, type CatalogReservedColumn, type CatalogSnapshotMode, type CatalogStoreCapabilities, type CatalogWriteStore, type ColumnCollisionOptions, findColumnCollisions, isCatalogStoreCapabilities, isReservedColumn, isWriteStore, type SnapshotRef, supportsCarryForward, } from './catalog.store';
 export { MikroOrmReadStore } from './stores/mikro-orm-read.store';
 export type { CatalogGraph, CatalogObjectPage, CatalogObjectQuery, CatalogObjectTypeDef, CatalogOverlay, CatalogPropertyDef, CatalogRelationDef, CatalogSnapshot, RelationKind, ScalarType, } from './catalog.types';
+export { REQUIRED_SCOPES, REQUIRES_HUMAN, RequireHuman, RequireScopes, } from './catalog.route-auth';

package/dist/index.js

@@ -15,7 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CATALOG_PRINCIPAL_RESOLVER = exports.traceOutcomeFilter = exports.isWorkspaceStore = exports.isTraceStore = exports.isCatalogTraceOutcome = exports.CATALOG_WORKSPACE_STORE = exports.CATALOG_TRACE_STORE = exports.CATALOG_TRACE_OUTCOMES = exports.CatalogService = exports.SubprocessTransformRunner = exports.toCsv = exports.QueryCache = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.TRANSFORM_RUNNER = exports.supportsWorkflowStages = exports.supportsWorkflows = exports.isWorkflowNodeKind = exports.isWorkflowNode = exports.isWorkflowExecutionMode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isPipelineStore = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.CATALOG_PIPELINE_STORE = exports.CatalogRegistry = exports.MikroOrmCatalogRegistry = exports.CATALOG_OVERLAY_STORE = exports.InMemoryCatalogOverlayStore = exports.FileCatalogOverlayStore = exports.CATALOG_OPTIONS = exports.isQueryStore = exports.assertReadOnlyShape = exports.CatalogModule = exports.emitCatalog = exports.channelNameFor = exports.catalogEventPhase = exports.CATALOG_LIB = exports.CATALOG_EVENTS = exports.CATALOG_EVENT_PHASE_FALLBACK = exports.CATALOG_EVENT_PHASE = exports.CatalogType = exports.CatalogProperty = void 0;
-exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.StaticKeyPrincipalResolver = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = void 0;
+exports.RequireScopes = exports.RequireHuman = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.StaticKeyPrincipalResolver = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = void 0;
 var catalog_decorators_1 = require("./catalog.decorators");
 Object.defineProperty(exports, "CatalogProperty", { enumerable: true, get: function () { return catalog_decorators_1.CatalogProperty; } });
 Object.defineProperty(exports, "CatalogType", { enumerable: true, get: function () { return catalog_decorators_1.CatalogType; } });
@@ -107,3 +107,8 @@ Object.defineProperty(exports, "isWriteStore", { enumerable: true, get: function
 Object.defineProperty(exports, "supportsCarryForward", { enumerable: true, get: function () { return catalog_store_1.supportsCarryForward; } });
 var mikro_orm_read_store_1 = require("./stores/mikro-orm-read.store");
 Object.defineProperty(exports, "MikroOrmReadStore", { enumerable: true, get: function () { return mikro_orm_read_store_1.MikroOrmReadStore; } });
+var catalog_route_auth_1 = require("./catalog.route-auth");
+Object.defineProperty(exports, "REQUIRED_SCOPES", { enumerable: true, get: function () { return catalog_route_auth_1.REQUIRED_SCOPES; } });
+Object.defineProperty(exports, "REQUIRES_HUMAN", { enumerable: true, get: function () { return catalog_route_auth_1.REQUIRES_HUMAN; } });
+Object.defineProperty(exports, "RequireHuman", { enumerable: true, get: function () { return catalog_route_auth_1.RequireHuman; } });
+Object.defineProperty(exports, "RequireScopes", { enumerable: true, get: function () { return catalog_route_auth_1.RequireScopes; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-catalog",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "A metadata registry for NestJS: object types, properties and relations, derived from your ORM and enriched with decorators.",
   "license": "MIT",
   "author": "Davide Carvalho",