@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-authorization-files.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductAuthorizationFiles = renderProductAuthorizationFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_authorization_storage_js_1 = require("./built-in-plan-authorization-storage.js");
 /** @internal */
 function renderProductAuthorizationFiles(name, pascalName) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     return {
+        'authorization/record-store.ts': (0, built_in_plan_authorization_storage_js_1.renderAuthorizationRecordStore)(),
         'authorization/policy.ts': `import {
   defineAuthorizationPolicy,
   defineCoarseAdmission,
@@ -267,14 +269,18 @@ export const ${identifierPrefix}AuthorizationPolicy =
   });
 `,
         'authorization/runtime.ts': `import { createHash } from 'node:crypto';
+import { sliceAuthorizationGroupNames, sliceAuthorizationRoles } from './groups.mjs';
 import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
 import {
   createBetterAuthConfig,
+  AuthError,
+  authErrorCodes,
   type Principal,
 } from '@empire-builder-kit/runtime/auth';
 import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
 import type { ApiAuthorizationInput } from '@empire-builder-kit/runtime/api-server';
 import type { ApiOperationDefinition } from '@empire-builder-kit/runtime/api-contract';
+import { ${identifierPrefix}GetRecord, ${identifierPrefix}PutRecord } from '../api/contracts/protected.js';
 import {
   createAuthorizationEvaluator,
   composeAuthorizationPrincipal,
@@ -288,7 +294,8 @@ import {
   type AuthorizationPrincipal,
 } from '@empire-builder-kit/runtime/authorization';
 import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
+import { readAuthorizationRecord, writeAuthorizationAudit${', readRecordDeletionApproval'} } from './record-store.js';
+import { ${''}create${pascalName}DelegationStore } from './store.js';
 import {
   ${identifierPrefix}AuthorizationActions,
   ${identifierPrefix}MachineScopes,
@@ -345,7 +352,7 @@ function getGuard() {
       acceptedClientIds: [webClientId, ...machineClientIds],
     },
     policy: {
-      admin: { groups: ['${name}-admin'] },
+      admin: { groups: [sliceAuthorizationGroupNames(stage).admin] },
       agent: {
         scopes: Object.values(${identifierPrefix}MachineScopes(stage)),
       },
@@ -392,40 +399,16 @@ async function operationResource(
         'A record authorization action requires its validated record path.',
       );
     }
-    const existing = await withPrimaryDatabase(
-      { correlationId },
-      'api-database-records',
-      async (client) => {
-        const record = await client.query<{ ownerId: string }>(
-          \`SELECT owner_id AS "ownerId"
-           FROM records
-           WHERE id = $1::uuid\`,
-          [recordId],
-        );
-        if (record.rows[0]) return record.rows[0];
-
+    const existing = await (async () => {
+        const record = await readAuthorizationRecord(correlationId, recordId);
+        if (record) return record;
         const delegationId = candidate.path?.delegationId;
         if (
           operation.authorizationActions[0] ===
             ${identifierPrefix}AuthorizationActions.recordDelegationRevoke &&
           typeof delegationId === 'string'
         ) {
-          const delegation = await client.query<{
-            grantJson: {
-              delegator?: { id?: unknown };
-              resourceBoundary?: {
-                kind?: unknown;
-                resourceIds?: unknown;
-                resourceType?: unknown;
-              };
-            };
-          }>(
-            \`SELECT grant_json AS "grantJson"
-             FROM delegation_grants
-             WHERE id = $1::uuid\`,
-            [delegationId],
-          );
-          const grant = delegation.rows[0]?.grantJson;
+          const grant = await create${pascalName}DelegationStore(correlationId).read(delegationId);
           if (
             grant?.resourceBoundary?.kind === 'exact' &&
             grant.resourceBoundary.resourceType === 'record' &&
@@ -448,21 +431,11 @@ async function operationResource(
         ) {
           return undefined;
         }
-        const approval = await client.query<{ ownerId: string }>(
-          \`SELECT author_reference AS "ownerId"
-           FROM approval_requests
-           WHERE id = $1::uuid
-             AND request_json->'resource'->>'id' = $2
-             AND request_json->>'action' = $3\`,
-          [
-            approvalRequestId,
-            recordId,
-            ${identifierPrefix}AuthorizationActions.recordDelete,
-          ],
-        );
-        return approval.rows[0];
-      },
-    );
+        const approval = await ${`readRecordDeletionApproval(approvalRequestId, recordId, ${identifierPrefix}AuthorizationActions.recordDelete)`};
+        return approval?.resource.id === recordId && approval.action === ${identifierPrefix}AuthorizationActions.recordDelete
+          ? { ownerId: approval.author.effectiveHumanId ?? approval.author.actorId }
+          : undefined;
+      })();
     const missingOwnerId =
       operation.authorizationActions[0] ===
       ${identifierPrefix}AuthorizationActions.recordWrite
@@ -526,39 +499,12 @@ async function persistAuthorizationDecision<
     stage: decisionInput.context.stage,
     timestamp: decisionInput.context.now,
   });
-  await withPrimaryDatabase(
-    { correlationId },
-    workload,
-    (client) =>
-      client.query(
-        \`INSERT INTO authorization_audit
-           (action, approval_reference, authority_mode, correlation_id,
-            decision, delegation_reference, policy_version,
-            principal_kind, pseudonymous_subject_id, reason_category,
-            resource_reference, resource_type, slice, stage, subject_type)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
-                 $13, $14, $15)\`,
-        [
-          audit.action,
-          null,
-          audit.authorityMode,
-          audit.correlationId,
-          audit.decision,
-          decisionInput.principal.authority.mode === 'delegated'
-            ? decisionInput.principal.authority.delegationId
-            : null,
-          audit.policyVersion,
-          decisionInput.principal.kind,
-          audit.pseudonymousSubjectId,
-          audit.reasonCategory,
-          audit.resourceReference ?? null,
-          audit.resourceType,
-          audit.slice,
-          audit.stage,
-          decisionInput.principal.actor.type,
-        ],
-      ),
-  );
+  await writeAuthorizationAudit({
+    ...audit,
+    ...(decisionInput.principal.authority.mode === 'delegated'
+      ? { delegationReference: decisionInput.principal.authority.delegationId }
+      : {}),
+  }, workload);
   return audit;
 }
 
@@ -618,17 +564,24 @@ export async function authorize${pascalName}InternalOperation(input: {
   await evaluator.authorize(authorizationInput);
 }
 
-async function evaluate${pascalName}Operation<
+type ${pascalName}AuthorizedOperationInput<Operation extends ApiOperationDefinition> = Pick<
+  ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+  'context' | 'logger' | 'operation' | 'request'
+>;
+
+async function evaluate${pascalName}AuthenticatedOperation<
   Operation extends ApiOperationDefinition,
 >(
-  input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+  input: ${pascalName}AuthorizedOperationInput<Operation>,
+  verified: Principal,
 ): Promise<{
   authenticated: Principal;
   principal: AuthorizationPrincipal;
 }> {
-  const authenticated = await getGuard().authorize(input.event, {
-    logger: input.logger,
-  });
+  const authenticated = {
+    ...verified,
+    roles: sliceAuthorizationRoles(process.env.EBK_STAGE ?? '', verified.roles),
+  };
   const action = operationAction(input.operation);
   const recognizedMachineScopes = Object.values(
     ${identifierPrefix}MachineScopes(process.env.EBK_STAGE ?? ''),
@@ -696,6 +649,34 @@ async function evaluate${pascalName}Operation<
   return { authenticated, principal };
 }
 
+async function evaluate${pascalName}Operation<
+  Operation extends ApiOperationDefinition,
+>(input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>): Promise<{
+  authenticated: Principal;
+  principal: AuthorizationPrincipal;
+}> {
+  const verified = await getGuard().authorize(input.event, {
+    logger: input.logger,
+  });
+  return evaluate${pascalName}AuthenticatedOperation(input, verified);
+}
+
+/** Fleet-only native Next transport; Lambda continues using the same evaluator. */
+export async function authorize${pascalName}FleetRecordOperation<
+  Operation extends ApiOperationDefinition,
+>(input: ${pascalName}AuthorizedOperationInput<Operation> & { accessToken: string | null }): Promise<AuthorizationPrincipal> {
+  if (!Object.is(input.operation, ${identifierPrefix}GetRecord) &&
+      !Object.is(input.operation, ${identifierPrefix}PutRecord))
+    throw new Error('Fleet record authorization requires the exact generated record operation.');
+  const verified = await getGuard().authorizeToken(input.accessToken, { logger: input.logger });
+  const webClientId = process.env.AUTH_CLIENT_ID;
+  if (!webClientId || verified.audience !== webClientId ||
+      verified.session.subject.type !== 'user' || verified.kind !== 'customer')
+    throw new AuthError({ code: authErrorCodes.invalidToken,
+      message: 'The access token is not a task web-client human token.', status: 401 });
+  return (await evaluate${pascalName}AuthenticatedOperation(input, verified)).principal;
+}
+
 export async function authorize${pascalName}Operation<
   Operation extends ApiOperationDefinition,
 >(
@@ -716,184 +697,7 @@ export async function authorize${pascalName}DataRightsOperation<
   return (await evaluate${pascalName}Operation(input)).principal;
 }
 `,
-        'authorization/store.ts': `import type {
-  ApprovalRequest,
-  DelegationGrant,
-  DelegationStore,
-} from '@empire-builder-kit/runtime/authorization';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
-import type { ${pascalName}AuthorizationAction } from './policy.js';
-
-/**
- * Slice-owned online delegation state. The opaque capability is never stored;
- * grantJson contains only the runtime's digest-bearing safe grant record.
- */
-export function create${pascalName}DelegationStore(
-  correlationId: string,
-): DelegationStore<${pascalName}AuthorizationAction> {
-  return {
-    async create(grant) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`INSERT INTO delegation_grants
-               (id, capability_digest, expires_at, grant_json, issued_at,
-                policy_version, revision, status)
-             VALUES ($1::uuid, $2, $3, $4::jsonb, $5, $6, $7, $8)
-             ON CONFLICT (id) DO NOTHING\`,
-            [
-              grant.id,
-              grant.capabilityDigest,
-              grant.expiresAt,
-              JSON.stringify(grant),
-              grant.issuedAt,
-              grant.issuedUnderPolicyVersion,
-              grant.revision,
-              grant.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-    async read(delegationId) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query<{ grantJson: DelegationGrant<${pascalName}AuthorizationAction> }>(
-            \`SELECT grant_json AS "grantJson"
-             FROM delegation_grants
-             WHERE id = $1::uuid\`,
-            [delegationId],
-          ),
-      );
-      return result.rows[0]?.grantJson;
-    },
-    async write(delegationId, expectedRevision, grant) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`UPDATE delegation_grants
-             SET capability_digest = $3,
-                 expires_at = $4,
-                 grant_json = $5::jsonb,
-                 policy_version = $6,
-                 revision = $7,
-                 status = $8
-             WHERE id = $1::uuid AND revision = $2\`,
-            [
-              delegationId,
-              expectedRevision,
-              grant.capabilityDigest,
-              grant.expiresAt,
-              JSON.stringify(grant),
-              grant.issuedUnderPolicyVersion,
-              grant.revision,
-              grant.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-  };
-}
-
-export interface ${pascalName}ApprovalStore {
-  create(
-    request: ApprovalRequest<${pascalName}AuthorizationAction>,
-  ): Promise<boolean>;
-  read(
-    requestId: string,
-  ): Promise<ApprovalRequest<${pascalName}AuthorizationAction> | undefined>;
-  write(
-    requestId: string,
-    expectedRevision: number,
-    request: ApprovalRequest<${pascalName}AuthorizationAction>,
-  ): Promise<boolean>;
-}
-
-/**
- * Approval transitions are persisted with the same compare-and-set boundary
- * used by delegation, so two reviewers or executors cannot claim one request.
- */
-export function create${pascalName}ApprovalStore(
-  correlationId: string,
-): ${pascalName}ApprovalStore {
-  return {
-    async create(request) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`INSERT INTO approval_requests
-               (id, author_reference, expires_at, policy_version,
-                request_digest, request_json, revision, status)
-             VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)
-             ON CONFLICT (id) DO NOTHING\`,
-            [
-              request.id,
-              request.author.effectiveHumanId ?? request.author.actorId,
-              request.expiresAt,
-              request.policyVersion,
-              request.requestDigest,
-              JSON.stringify(request),
-              request.revision,
-              request.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-    async read(requestId) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query<{ requestJson: ApprovalRequest<${pascalName}AuthorizationAction> }>(
-            \`SELECT request_json AS "requestJson"
-             FROM approval_requests
-             WHERE id = $1::uuid\`,
-            [requestId],
-          ),
-      );
-      return result.rows[0]?.requestJson;
-    },
-    async write(requestId, expectedRevision, request) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`UPDATE approval_requests
-             SET expires_at = $3,
-                 policy_version = $4,
-                 request_digest = $5,
-                 request_json = $6::jsonb,
-                 revision = $7,
-                 status = $8
-             WHERE id = $1::uuid AND revision = $2\`,
-            [
-              requestId,
-              expectedRevision,
-              request.expiresAt,
-              request.policyVersion,
-              request.requestDigest,
-              JSON.stringify(request),
-              request.revision,
-              request.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-  };
-}
-`,
+        'authorization/store.ts': (0, built_in_plan_authorization_storage_js_1.renderDynamoAuthorizationStore)(pascalName),
         'authorization/workflows.ts': `import { createHash } from 'node:crypto';
 import type { Principal } from '@empire-builder-kit/runtime/auth';
 import {
@@ -911,7 +715,7 @@ import {
 } from '@empire-builder-kit/runtime/authorization';
 import { RuntimeError } from '@empire-builder-kit/runtime/response';
 import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
+import { readAuthorizationRecord, writeAuthorizationAudit } from './record-store.js';
 import {
   ${identifierPrefix}AuthorizationActions,
   ${identifierPrefix}AuthorizationPolicy,
@@ -1052,35 +856,23 @@ async function writeDelegationAudit(input: {
   recordId: string;
   reasonCategory: string;
 }): Promise<void> {
-  await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query(
-        \`INSERT INTO authorization_audit
-           (action, approval_reference, authority_mode, correlation_id,
-            decision, delegation_reference, policy_version, principal_kind,
-            pseudonymous_subject_id, reason_category, resource_reference,
-            resource_type, slice, stage, subject_type)
-         VALUES ($1, NULL, $2, $3, $4, $5, $6, $7, $8, $9, $10,
-                 'record', $11, $12, $13)\`,
-        [
-          input.action,
-          input.principal.authority.mode,
-          input.correlationId,
-          input.decision.decision,
-          pseudonymousReference('delegation', input.delegationId),
-          input.decision.policyVersion,
-          input.principal.kind,
-          pseudonymousReference('subject', input.principal.actor.id),
-          input.reasonCategory,
-          pseudonymousReference('record', input.recordId),
-          '${name}',
-          stage(),
-          input.principal.actor.type,
-        ],
-      ),
-  );
+  await writeAuthorizationAudit({
+    action: input.action,
+    authorityMode: input.principal.authority.mode,
+    correlationId: input.correlationId,
+    decision: input.decision.decision,
+    delegationReference: pseudonymousReference('delegation', input.delegationId),
+    policyVersion: input.decision.policyVersion,
+    principalKind: input.principal.kind,
+    pseudonymousSubjectId: pseudonymousReference('subject', input.principal.actor.id),
+    reasonCategory: input.reasonCategory,
+    resourceReference: pseudonymousReference('record', input.recordId),
+    resourceType: 'record',
+    slice: '${name}',
+    stage: stage(),
+    subjectType: input.principal.actor.type,
+    timestamp: new Date().toISOString(),
+  }, 'api-database-records');
 }
 
 export async function issue${pascalName}RecordDelegation(input: {
@@ -1100,18 +892,8 @@ export async function issue${pascalName}RecordDelegation(input: {
   ) {
     invalidInput();
   }
-  const ownership = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<{ ownerId: string }>(
-        \`SELECT owner_id AS "ownerId"
-         FROM records
-         WHERE id = $1::uuid\`,
-        [input.recordId],
-      ),
-  );
-  if (ownership.rows[0]?.ownerId !== input.principal.id) denied();
+  const ownership = await readAuthorizationRecord(input.correlationId, input.recordId);
+  if (ownership?.ownerId !== input.principal.id) denied();
   const delegator = createDirectAuthorizationPrincipal(input.principal);
   let issued: IssuedDelegation<${pascalName}AuthorizationAction>;
   try {
@@ -1183,20 +965,10 @@ export async function use${pascalName}RecordDelegation(input: {
   } catch {
     denied();
   }
-  const owner = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<{ ownerId: string }>(
-        \`SELECT owner_id AS "ownerId"
-         FROM records
-         WHERE id = $1::uuid\`,
-        [input.recordId],
-      ),
-  );
+  const owner = await readAuthorizationRecord(input.correlationId, input.recordId);
   const resource = {
     attributes: {
-      ownerId: owner.rows[0]?.ownerId ?? 'missing-resource-owner',
+      ownerId: owner?.ownerId ?? 'missing-resource-owner',
     },
     id: input.recordId,
     type: 'record' as const,
@@ -1246,20 +1018,11 @@ export async function use${pascalName}RecordDelegation(input: {
         : result.decision.category,
   });
   assertAuthorizationAllowed(result.decision);
-  if (!result.grant || !owner.rows[0]) notFound();
-
-  const record = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<RecordResult>(
-        \`SELECT id::text, name, run_scope AS "runScope"
-         FROM records
-         WHERE id = $1::uuid AND owner_id = $2\`,
-        [input.recordId, result.grant?.delegator.id],
-      ),
-  );
-  return record.rows[0] ?? notFound();
+  if (!result.grant || !owner) notFound();
+
+  const record = await readAuthorizationRecord(input.correlationId, input.recordId, result.grant.delegator.id);
+  if (!record) notFound();
+  return { id: record.id, name: record.name, runScope: record.runScope };
 }
 
 function grantMatchesRecord(
@@ -1426,18 +1189,23 @@ async function exchange(input: {
     token_type?: unknown;
   };
   const expiresIn = Number(value.expires_in);
-  const scopes =
-    typeof value.scope === 'string'
-      ? value.scope.split(/\\s+/).filter(Boolean)
-      : [];
   if (
     typeof value.access_token !== 'string' ||
     value.token_type !== 'Bearer' ||
     !Number.isFinite(expiresIn) ||
-    expiresIn < 1
+    expiresIn < 1 ||
+    (value.scope !== undefined && typeof value.scope !== 'string')
   ) {
     throw new Error('Machine token exchange returned an invalid response.');
   }
+  // RFC 6749 section 5.1: an omitted scope is identical to the requested
+  // scope. Amazon Cognito omits it from client_credentials responses and
+  // rejects, never narrows, a scope the client may not use. A returned scope
+  // is still parsed, and createMachineTokenProvider requires the exact set.
+  const scopes =
+    value.scope === undefined
+      ? [...input.scopes]
+      : value.scope.split(/\\s+/).filter(Boolean);
   return {
     accessToken: value.access_token,
     audience: input.audience,