@filelayer/core 0.4.1 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +221 -140
- package/README.md +6 -8
- package/dist/filelayer.d.ts +22 -9
- package/dist/filelayer.d.ts.map +1 -1
- package/dist/filelayer.js +21 -2
- package/dist/filelayer.js.map +1 -1
- package/dist/simple.d.ts +1 -1
- package/dist/store.d.ts +98 -7
- package/dist/store.d.ts.map +1 -1
- package/dist/store.js +115 -18
- package/dist/store.js.map +1 -1
- package/package.json +1 -1
- package/src/filelayer.ts +25 -11
- package/src/store.ts +243 -28
- package/test/audit-resolution.test.ts +379 -0
package/CHANGELOG.md
CHANGED
|
@@ -7,25 +7,234 @@ Versioning is pre-1.0 and is explained in [`MIGRATIONS.md`](MIGRATIONS.md) §1.
|
|
|
7
7
|
|
|
8
8
|
## A note on honesty, before the entries
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
are writing them up as a changelog rather than starting the history at the first
|
|
13
|
-
publish because a consumer deciding whether to depend on a `0.x` library is
|
|
14
|
-
entitled to know what has already moved underneath it, and because most of the
|
|
15
|
-
entries are security defects we found in our own code.
|
|
16
|
-
|
|
17
|
-
They are described the way we found them, including the ones that were
|
|
10
|
+
Most of the entries below are security defects we found in our own code, and
|
|
11
|
+
they are described the way we found them, including the ones that were
|
|
18
12
|
embarrassing. A changelog that only records features is a marketing document.
|
|
19
13
|
|
|
20
|
-
`0.3.0`
|
|
14
|
+
`0.3.0` was the first version published to npm, under the `alpha` dist-tag.
|
|
15
|
+
`0.1.0` and `0.2.0` predate the registry: they are real, dated development
|
|
16
|
+
milestones in this repository rather than releases anyone could install. They
|
|
17
|
+
are written up anyway, because a consumer deciding whether to depend on a `0.x`
|
|
18
|
+
library is entitled to know what has already moved underneath it.
|
|
21
19
|
|
|
22
20
|
---
|
|
23
21
|
|
|
24
22
|
## [Unreleased]
|
|
25
23
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
24
|
+
Nothing yet.
|
|
25
|
+
|
|
26
|
+
---
|
|
27
|
+
|
|
28
|
+
## [0.4.2] — 2026-09-06
|
|
29
|
+
|
|
30
|
+
The audit log now answers in your identifiers instead of ours. No schema
|
|
31
|
+
change, no API break, no change to any authorization decision.
|
|
32
|
+
|
|
33
|
+
### Changed
|
|
34
|
+
|
|
35
|
+
- **`auditLog()` answers "who touched this?" in the caller's own vocabulary.**
|
|
36
|
+
The log stored `actor_id`, `file_id` and `org_id` — internal uuids — and
|
|
37
|
+
shipped no supported way back to the ids the caller had supplied. So the one
|
|
38
|
+
question the audit trail exists to answer rendered as
|
|
39
|
+
`97cf1649-dd8...` where the developer had written `marco`, and the only route
|
|
40
|
+
to a readable answer was to find the `actor` table in `schema.sql` and write
|
|
41
|
+
SQL against it. The first developer to try it from the public docs lost about
|
|
42
|
+
eight minutes there, on the step this product is *for*.
|
|
43
|
+
|
|
44
|
+
Every row returned by `fl.auditLog()` (and therefore by `fl.orgs.audit()`) is
|
|
45
|
+
now a `ResolvedAuditRow`, which is `AuditRow` **plus** four fields:
|
|
46
|
+
|
|
47
|
+
```ts
|
|
48
|
+
const [row] = await fl.orgs.audit('acme', { as: 'ceo', decision: 'deny' });
|
|
49
|
+
|
|
50
|
+
row.summary; // '2026-09-06T10:12:41.002Z marco file.read deny:grant_revoked contract.pdf @acme'
|
|
51
|
+
row.actor.label; // 'marco' — the `as:` that was passed
|
|
52
|
+
row.file.label; // 'contract.pdf'
|
|
53
|
+
row.org.label; // 'acme' — the `org:` that was passed
|
|
54
|
+
row.actorId; // the uuid, unchanged, exactly where it has always been
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
- **Additive, deliberately.** Every internal id is still on the row, in the
|
|
58
|
+
same field, with the same value. Something downstream may be keyed on them;
|
|
59
|
+
replacing them would have been a breaking change wearing a usability
|
|
60
|
+
costume.
|
|
61
|
+
- **`label` is never null**, so a row always prints. An access with no
|
|
62
|
+
principal — a share link, a public URL — reads as `anonymous` rather than a
|
|
63
|
+
null the caller has to interpret. An event with no tenant (the system
|
|
64
|
+
chain, `org_id IS NULL`) reads as `system`. An id that resolves to nothing
|
|
65
|
+
keeps its uuid and says `resolution: 'unresolved'` rather than inventing a
|
|
66
|
+
name. `.actor.externalId`, `.org.externalId` and `.file.name` are the same
|
|
67
|
+
values without the fallback, for callers who want the null.
|
|
68
|
+
- **It is still one query.** Resolution is three `LEFT JOIN`s on the statement
|
|
69
|
+
that already reads the events, not a lookup per row: an audit read happens
|
|
70
|
+
during an incident, and turning it into N+1 round trips would be a worse
|
|
71
|
+
defect than the one being fixed.
|
|
72
|
+
- **The joins are project-scoped (P8).** An audit event may legitimately name
|
|
73
|
+
an identifier belonging to another application — that is what a probe looks
|
|
74
|
+
like — and such an id must resolve to nothing rather than print another
|
|
75
|
+
customer's vocabulary into this tenant's trail.
|
|
76
|
+
- `packages/core/test/audit-resolution.test.ts` covers the legible answer, a
|
|
77
|
+
denial with its reason and the principal who was refused, anonymous access,
|
|
78
|
+
the system chain, the project boundary, and the single-statement claim.
|
|
79
|
+
|
|
80
|
+
### Fixed — documentation
|
|
81
|
+
|
|
82
|
+
- **`packages/core/CHANGELOG.md` asserted in bold that "No version of this
|
|
83
|
+
package has been published to npm", directly above dated entries for `0.3.0`,
|
|
84
|
+
`0.4.0` and `0.4.1`, all of which are on the registry.** It was true when it
|
|
85
|
+
was written and nobody deleted it at the first publish. The same staleness had
|
|
86
|
+
left everything shipped in `0.3.0` and `0.4.0` sitting under an
|
|
87
|
+
`[Unreleased]` heading; that material is now filed under the releases it went
|
|
88
|
+
out in, with its text unchanged.
|
|
89
|
+
- `llms.txt` announced the current version as `0.3.0`, and `README.md` dated its
|
|
90
|
+
Limitations list "current as of `0.3.0`". Both are `0.4.2`.
|
|
91
|
+
- The HTML comment in `README.md` explaining that the CI and npm badges "render
|
|
92
|
+
as unknown until the repository is pushed and the package is published" has
|
|
93
|
+
outlived both conditions and is gone.
|
|
94
|
+
- `TRUST.md` and `README.md` both put the suite at 313 tests. It is 324.
|
|
95
|
+
|
|
96
|
+
---
|
|
97
|
+
|
|
98
|
+
## [0.4.1] — 2026-09-06
|
|
99
|
+
|
|
100
|
+
A single defect, in the first command a new user runs. Nothing else changed: no
|
|
101
|
+
API change, no schema change, no behaviour change. If you already have a working
|
|
102
|
+
install, this release does nothing for you.
|
|
103
|
+
|
|
104
|
+
### Fixed
|
|
105
|
+
|
|
106
|
+
- **The documented command for installing PGlite could not resolve against the
|
|
107
|
+
peer range this package declares.** `0.4.0` declares
|
|
108
|
+
`peerDependencies: { "@electric-sql/pglite": "^0.3.11" }`, as an optional peer.
|
|
109
|
+
The install command in the `createTestDb()` error message, in `README.md`, in
|
|
110
|
+
`docs/QUICKSTART.md`, in `llms.txt` and in the changelog entry above carried no
|
|
111
|
+
version at all. PGlite's `latest` on npm is `0.5.8`, outside `^0.3.11`, so
|
|
112
|
+
following our own written instructions could put a version on disk that the
|
|
113
|
+
declared range does not admit — and npm then refuses the whole tree:
|
|
114
|
+
|
|
115
|
+
```
|
|
116
|
+
npm error Could not resolve dependency:
|
|
117
|
+
npm error peerOptional @electric-sql/pglite@"^0.3.11" from @filelayer/core@0.4.0
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
It is deterministic for anyone whose project already has PGlite, or who asks
|
|
121
|
+
for a specific version, and it is a hard stop about sixty seconds in. Every
|
|
122
|
+
install command in this repository is now version-explicit:
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
npm install --save-dev "@electric-sql/pglite@^0.3.11"
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
The quotes are for the shell, not for npm — `^` is a glob operator under `zsh`
|
|
129
|
+
with `extendedglob` and an escape character in `cmd.exe`, and a command that
|
|
130
|
+
breaks in a common shell is the same defect wearing a different hat.
|
|
131
|
+
|
|
132
|
+
### Not changed, deliberately
|
|
133
|
+
|
|
134
|
+
- **The peer range is still `^0.3.11`. PGlite 0.5.x is not supported.** Before
|
|
135
|
+
choosing between widening the range and fixing the instructions, the full
|
|
136
|
+
suite was run against `0.5.8`. It does not pass. `tsc --noEmit` is clean and
|
|
137
|
+
every assertion that executes passes, but seven test files are killed by the
|
|
138
|
+
operating system and the run aborts after 92 of 313 tests. Reproduced in
|
|
139
|
+
isolation with 3.6 GB free, so it is not a plain out-of-memory: one suite runs
|
|
140
|
+
20 of 21 subtests green and is then killed. Against `0.3.16` the identical
|
|
141
|
+
suite is 313 of 313.
|
|
142
|
+
|
|
143
|
+
We have not diagnosed it further, because the supported range is the decision
|
|
144
|
+
in front of us and the cause is upstream. What we will not do is widen the
|
|
145
|
+
range to whatever npm installs by default and describe an untested
|
|
146
|
+
configuration as supported. When 0.5.x passes, the range moves and this entry
|
|
147
|
+
gets a successor.
|
|
148
|
+
|
|
149
|
+
### Added
|
|
150
|
+
|
|
151
|
+
- **`tools/check-install-commands.mjs`, wired into `npm run verify`.** It reads
|
|
152
|
+
every tracked file and fails the build if an install command names a
|
|
153
|
+
version-constrained package without a version constraint, or pins one to a
|
|
154
|
+
range that is not the range `packages/core/package.json` declares. The
|
|
155
|
+
comparison is semver intervals rather than string equality and runs in both
|
|
156
|
+
directions, so widening the peer range without updating the documentation
|
|
157
|
+
fails, and so does the reverse. No network and no install: it is a check on
|
|
158
|
+
what we wrote, evaluated against what we declared.
|
|
159
|
+
|
|
160
|
+
It carries a negative control that runs on every invocation, before the real
|
|
161
|
+
scan: fourteen commands whose correct classification is known — including the
|
|
162
|
+
exact unversioned command `0.4.0` shipped, in each of the five forms it was
|
|
163
|
+
written in — plus seven pieces of text that must *not* be read as install
|
|
164
|
+
commands. If the detector misclassifies any of them the check exits `2` and
|
|
165
|
+
says the detector is broken rather than reporting a clean repository. A
|
|
166
|
+
checker that has never rejected anything is a green tick of unknown value.
|
|
167
|
+
|
|
168
|
+
### Changed
|
|
169
|
+
|
|
170
|
+
- **The release gate now runs the documented command instead of its own.**
|
|
171
|
+
`tools/verify-release.mjs` reads the install command out of `README.md` at run
|
|
172
|
+
time and executes that string in its empty consumer directory. It used to
|
|
173
|
+
write its own equivalent, which is why a green gate and a broken instruction
|
|
174
|
+
could coexist for a whole release: the gate was testing a command no user
|
|
175
|
+
would ever type.
|
|
176
|
+
- **The gate also installs in the other order.** Phases 1 and 2 install the
|
|
177
|
+
package first and PGlite second, and in that order npm can rescue a bad
|
|
178
|
+
instruction by quietly walking `latest` back into the peer range — which is
|
|
179
|
+
precisely how `0.4.0`'s command passed. A new phase does it the other way
|
|
180
|
+
round, in a second directory that has never contained anything: the documented
|
|
181
|
+
command first, then `@filelayer/core` on top. There is nothing left to rescue
|
|
182
|
+
there, so the resolution failure is either real or absent. It asserts, too,
|
|
183
|
+
that the version actually installed satisfies the declared range, because an
|
|
184
|
+
install that succeeds by giving the reader something other than what they
|
|
185
|
+
asked for is still a broken instruction.
|
|
186
|
+
- `README.md`, `docs/QUICKSTART.md` and the `createTestDb()` error message now
|
|
187
|
+
state the supported range in words as well as in the command: the 0.3.x line
|
|
188
|
+
is supported, 0.5.x is not, and the reason is that the suite does not pass
|
|
189
|
+
against it.
|
|
190
|
+
|
|
191
|
+
---
|
|
192
|
+
|
|
193
|
+
## [0.4.0] — 2026-09-06
|
|
194
|
+
|
|
195
|
+
### Changed
|
|
196
|
+
|
|
197
|
+
- **`@electric-sql/pglite` is no longer a runtime dependency.** It is now a
|
|
198
|
+
dev dependency and an *optional* peer. The published package declares zero
|
|
199
|
+
runtime dependencies. A library whose premise is "run it against your own
|
|
200
|
+
Postgres" should not install an embedded WASM Postgres into every production
|
|
201
|
+
deployment; it did, and that was wrong.
|
|
202
|
+
`createTestDb()` and `Filelayer.quickstart()` still need it, and now say so
|
|
203
|
+
with an actionable message instead of a module-resolution error. If you use
|
|
204
|
+
either in tests, add
|
|
205
|
+
`npm install --save-dev "@electric-sql/pglite@^0.3.11"`. Nothing
|
|
206
|
+
else changes; production code paths never imported it.
|
|
207
|
+
|
|
208
|
+
*(The command in this entry originally omitted the version constraint. That
|
|
209
|
+
omission is the defect fixed in 0.4.1, and the command has been corrected here
|
|
210
|
+
so that nobody reading the history copies the broken one.)*
|
|
211
|
+
|
|
212
|
+
### Added
|
|
213
|
+
|
|
214
|
+
- A CI job that exercises the S3/R2 storage adapter against live object storage
|
|
215
|
+
when credentials are configured, and states plainly in the build summary when
|
|
216
|
+
they are not. See `docs/LIVE-S3-TESTS.md`.
|
|
217
|
+
- `TRUST.md` — the current state of this project in numbers, including the ones
|
|
218
|
+
that are zero, and what would change them.
|
|
219
|
+
|
|
220
|
+
### Fixed
|
|
221
|
+
|
|
222
|
+
- `FILELAYER_TEST_S3_PREFIX` used `??` rather than `||`, so the empty string CI
|
|
223
|
+
supplies for an unset variable became a real value and rooted test objects at
|
|
224
|
+
the bucket root instead of under the prefix cleanup deletes.
|
|
225
|
+
|
|
226
|
+
---
|
|
227
|
+
|
|
228
|
+
## Detail for 0.4.0 and 0.3.0
|
|
229
|
+
|
|
230
|
+
Everything below shipped. It was written under an `[Unreleased]` heading and
|
|
231
|
+
stayed there through two releases; the heading was wrong, the text was not, so
|
|
232
|
+
the text is kept verbatim and correctly filed. **Packaging** — the published
|
|
233
|
+
tarball having no runtime dependencies — and the live-storage CI job are
|
|
234
|
+
`0.4.0`. **Group grant subjects** (RFC-001), the byte-range status fix and the
|
|
235
|
+
`getActorGrants` ordering fix are `0.3.0`. The dated entries above and below are
|
|
236
|
+
the short form of the same work; this is the long form, kept because it is where
|
|
237
|
+
the reasoning is.
|
|
29
238
|
|
|
30
239
|
### Changed — packaging
|
|
31
240
|
|
|
@@ -168,134 +377,6 @@ change with an additive API whose migration is `MIGRATIONS.md` Entry 2.
|
|
|
168
377
|
|
|
169
378
|
---
|
|
170
379
|
|
|
171
|
-
## [0.4.1] — 2026-09-06
|
|
172
|
-
|
|
173
|
-
A single defect, in the first command a new user runs. Nothing else changed: no
|
|
174
|
-
API change, no schema change, no behaviour change. If you already have a working
|
|
175
|
-
install, this release does nothing for you.
|
|
176
|
-
|
|
177
|
-
### Fixed
|
|
178
|
-
|
|
179
|
-
- **The documented command for installing PGlite could not resolve against the
|
|
180
|
-
peer range this package declares.** `0.4.0` declares
|
|
181
|
-
`peerDependencies: { "@electric-sql/pglite": "^0.3.11" }`, as an optional peer.
|
|
182
|
-
The install command in the `createTestDb()` error message, in `README.md`, in
|
|
183
|
-
`docs/QUICKSTART.md`, in `llms.txt` and in the changelog entry above carried no
|
|
184
|
-
version at all. PGlite's `latest` on npm is `0.5.8`, outside `^0.3.11`, so
|
|
185
|
-
following our own written instructions could put a version on disk that the
|
|
186
|
-
declared range does not admit — and npm then refuses the whole tree:
|
|
187
|
-
|
|
188
|
-
```
|
|
189
|
-
npm error Could not resolve dependency:
|
|
190
|
-
npm error peerOptional @electric-sql/pglite@"^0.3.11" from @filelayer/core@0.4.0
|
|
191
|
-
```
|
|
192
|
-
|
|
193
|
-
It is deterministic for anyone whose project already has PGlite, or who asks
|
|
194
|
-
for a specific version, and it is a hard stop about sixty seconds in. Every
|
|
195
|
-
install command in this repository is now version-explicit:
|
|
196
|
-
|
|
197
|
-
```bash
|
|
198
|
-
npm install --save-dev "@electric-sql/pglite@^0.3.11"
|
|
199
|
-
```
|
|
200
|
-
|
|
201
|
-
The quotes are for the shell, not for npm — `^` is a glob operator under `zsh`
|
|
202
|
-
with `extendedglob` and an escape character in `cmd.exe`, and a command that
|
|
203
|
-
breaks in a common shell is the same defect wearing a different hat.
|
|
204
|
-
|
|
205
|
-
### Not changed, deliberately
|
|
206
|
-
|
|
207
|
-
- **The peer range is still `^0.3.11`. PGlite 0.5.x is not supported.** Before
|
|
208
|
-
choosing between widening the range and fixing the instructions, the full
|
|
209
|
-
suite was run against `0.5.8`. It does not pass. `tsc --noEmit` is clean and
|
|
210
|
-
every assertion that executes passes, but seven test files are killed by the
|
|
211
|
-
operating system and the run aborts after 92 of 313 tests. Reproduced in
|
|
212
|
-
isolation with 3.6 GB free, so it is not a plain out-of-memory: one suite runs
|
|
213
|
-
20 of 21 subtests green and is then killed. Against `0.3.16` the identical
|
|
214
|
-
suite is 313 of 313.
|
|
215
|
-
|
|
216
|
-
We have not diagnosed it further, because the supported range is the decision
|
|
217
|
-
in front of us and the cause is upstream. What we will not do is widen the
|
|
218
|
-
range to whatever npm installs by default and describe an untested
|
|
219
|
-
configuration as supported. When 0.5.x passes, the range moves and this entry
|
|
220
|
-
gets a successor.
|
|
221
|
-
|
|
222
|
-
### Added
|
|
223
|
-
|
|
224
|
-
- **`tools/check-install-commands.mjs`, wired into `npm run verify`.** It reads
|
|
225
|
-
every tracked file and fails the build if an install command names a
|
|
226
|
-
version-constrained package without a version constraint, or pins one to a
|
|
227
|
-
range that is not the range `packages/core/package.json` declares. The
|
|
228
|
-
comparison is semver intervals rather than string equality and runs in both
|
|
229
|
-
directions, so widening the peer range without updating the documentation
|
|
230
|
-
fails, and so does the reverse. No network and no install: it is a check on
|
|
231
|
-
what we wrote, evaluated against what we declared.
|
|
232
|
-
|
|
233
|
-
It carries a negative control that runs on every invocation, before the real
|
|
234
|
-
scan: fourteen commands whose correct classification is known — including the
|
|
235
|
-
exact unversioned command `0.4.0` shipped, in each of the five forms it was
|
|
236
|
-
written in — plus seven pieces of text that must *not* be read as install
|
|
237
|
-
commands. If the detector misclassifies any of them the check exits `2` and
|
|
238
|
-
says the detector is broken rather than reporting a clean repository. A
|
|
239
|
-
checker that has never rejected anything is a green tick of unknown value.
|
|
240
|
-
|
|
241
|
-
### Changed
|
|
242
|
-
|
|
243
|
-
- **The release gate now runs the documented command instead of its own.**
|
|
244
|
-
`tools/verify-release.mjs` reads the install command out of `README.md` at run
|
|
245
|
-
time and executes that string in its empty consumer directory. It used to
|
|
246
|
-
write its own equivalent, which is why a green gate and a broken instruction
|
|
247
|
-
could coexist for a whole release: the gate was testing a command no user
|
|
248
|
-
would ever type.
|
|
249
|
-
- **The gate also installs in the other order.** Phases 1 and 2 install the
|
|
250
|
-
package first and PGlite second, and in that order npm can rescue a bad
|
|
251
|
-
instruction by quietly walking `latest` back into the peer range — which is
|
|
252
|
-
precisely how `0.4.0`'s command passed. A new phase does it the other way
|
|
253
|
-
round, in a second directory that has never contained anything: the documented
|
|
254
|
-
command first, then `@filelayer/core` on top. There is nothing left to rescue
|
|
255
|
-
there, so the resolution failure is either real or absent. It asserts, too,
|
|
256
|
-
that the version actually installed satisfies the declared range, because an
|
|
257
|
-
install that succeeds by giving the reader something other than what they
|
|
258
|
-
asked for is still a broken instruction.
|
|
259
|
-
- `README.md`, `docs/QUICKSTART.md` and the `createTestDb()` error message now
|
|
260
|
-
state the supported range in words as well as in the command: the 0.3.x line
|
|
261
|
-
is supported, 0.5.x is not, and the reason is that the suite does not pass
|
|
262
|
-
against it.
|
|
263
|
-
|
|
264
|
-
---
|
|
265
|
-
|
|
266
|
-
## [0.4.0] — 2026-09-06
|
|
267
|
-
|
|
268
|
-
### Changed
|
|
269
|
-
|
|
270
|
-
- **`@electric-sql/pglite` is no longer a runtime dependency.** It is now a
|
|
271
|
-
dev dependency and an *optional* peer. The published package declares zero
|
|
272
|
-
runtime dependencies. A library whose premise is "run it against your own
|
|
273
|
-
Postgres" should not install an embedded WASM Postgres into every production
|
|
274
|
-
deployment; it did, and that was wrong.
|
|
275
|
-
`createTestDb()` and `Filelayer.quickstart()` still need it, and now say so
|
|
276
|
-
with an actionable message instead of a module-resolution error. If you use
|
|
277
|
-
either in tests, add
|
|
278
|
-
`npm install --save-dev "@electric-sql/pglite@^0.3.11"`. Nothing
|
|
279
|
-
else changes; production code paths never imported it.
|
|
280
|
-
|
|
281
|
-
*(The command in this entry originally omitted the version constraint. That
|
|
282
|
-
omission is the defect fixed in 0.4.1, and the command has been corrected here
|
|
283
|
-
so that nobody reading the history copies the broken one.)*
|
|
284
|
-
|
|
285
|
-
### Added
|
|
286
|
-
|
|
287
|
-
- A CI job that exercises the S3/R2 storage adapter against live object storage
|
|
288
|
-
when credentials are configured, and states plainly in the build summary when
|
|
289
|
-
they are not. See `docs/LIVE-S3-TESTS.md`.
|
|
290
|
-
- `TRUST.md` — the current state of this project in numbers, including the ones
|
|
291
|
-
that are zero, and what would change them.
|
|
292
|
-
|
|
293
|
-
### Fixed
|
|
294
|
-
|
|
295
|
-
- `FILELAYER_TEST_S3_PREFIX` used `??` rather than `||`, so the empty string CI
|
|
296
|
-
supplies for an unset variable became a real value and rooted test objects at
|
|
297
|
-
the bucket root instead of under the prefix cleanup deletes.
|
|
298
|
-
|
|
299
380
|
## [0.3.0] — 2026-09-05
|
|
300
381
|
|
|
301
382
|
The release that makes the package installable, and the one that closes the
|
package/README.md
CHANGED
|
@@ -5,11 +5,9 @@
|
|
|
5
5
|
[](https://nodejs.org)
|
|
6
6
|
[](https://github.com/filelayer/filelayer/blob/main/LICENSE)
|
|
7
7
|
|
|
8
|
-
<!--
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
namespaces are unclaimed and reserved for this project, so the badges
|
|
12
|
-
resolve on their own with no edit here. The licence badge is live now. -->
|
|
8
|
+
<!-- Every URL on this page is rooted at github.com/filelayer/filelayer and
|
|
9
|
+
npmjs.com/package/@filelayer/core, so the badges resolve on their own with
|
|
10
|
+
no edit here. -->
|
|
13
11
|
|
|
14
12
|
> ## ⚠️ Alpha — developer preview. Not production software.
|
|
15
13
|
|
|
@@ -154,7 +152,7 @@ engine, not by convention, and each has tests named after it.
|
|
|
154
152
|
| **P2** | No ambient authority | Knowing an object key, a URL or a file id grants nothing. Storage location is never an input to a decision. |
|
|
155
153
|
| **P3** | Structural tenant isolation | A grant's `org_id` must equal its file's `org_id`, enforced by a composite foreign key. Cross-tenant access is unrepresentable, not merely prevented by a `WHERE` clause. |
|
|
156
154
|
| **P4** | A URL never outlives its permission | Every signed URL embeds a grant id and is re-validated on **every** request, transitively through the whole delegation chain. Revocation beats a live URL. |
|
|
157
|
-
| **P5** | Every decision is audited, including denials | Hash-chained per tenant. Probes that cannot be attributed to a tenant go to a system chain rather than being dropped. |
|
|
155
|
+
| **P5** | Every decision is audited, including denials | Hash-chained per tenant. Probes that cannot be attributed to a tenant go to a system chain rather than being dropped. The log answers in *your* identifiers — `marco`, `contract.pdf`, `acme` — alongside the internal ones, so "who accessed this?" needs no SQL of yours. |
|
|
158
156
|
|
|
159
157
|
Three more properties are enforced in the schema and documented in
|
|
160
158
|
[`packages/core/SEMANTICS.md`](https://github.com/filelayer/filelayer/blob/main/packages/core/SEMANTICS.md): atomic download
|
|
@@ -230,7 +228,7 @@ running in-process, so there is no daemon and no Docker:
|
|
|
230
228
|
```bash
|
|
231
229
|
git clone https://github.com/filelayer/filelayer && cd filelayer
|
|
232
230
|
npm run bootstrap # npm ci in packages/core
|
|
233
|
-
npm test # the security property suite,
|
|
231
|
+
npm test # the security property suite, 324 tests
|
|
234
232
|
npm run typecheck
|
|
235
233
|
npm run verify # typecheck + tests + build + doc and language checks
|
|
236
234
|
npm run example:tier1 # a public avatar, on :3000
|
|
@@ -327,7 +325,7 @@ README says is the most valuable thing you can send us.
|
|
|
327
325
|
## Limitations
|
|
328
326
|
|
|
329
327
|
Restated here so they are not only in an appendix. Each one is current as of
|
|
330
|
-
`0.
|
|
328
|
+
`0.4.2`; where a limitation has been lifted since an earlier release, the
|
|
331
329
|
[changelog](https://github.com/filelayer/filelayer/blob/main/packages/core/CHANGELOG.md) says so.
|
|
332
330
|
|
|
333
331
|
1. **No `Range` responses from the shipped HTTP routes.** `fileDownloadRoute()`
|
package/dist/filelayer.d.ts
CHANGED
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
*/
|
|
28
28
|
import { type Capability, type FileRef, type FileVisibility, type GrantSubjectType, type OrgRole, type Principal } from './authz.ts';
|
|
29
29
|
import { type Queryable } from './db.ts';
|
|
30
|
-
import { PostgresStore, type
|
|
30
|
+
import { PostgresStore, type AuditFilter, type AuditChainResult, type ResolvedAuditRow } from './store.ts';
|
|
31
31
|
import { type PutBody, type StorageAdapter } from './storage.ts';
|
|
32
32
|
import { FilesApi, OrgsApi, SharesApi } from './simple.ts';
|
|
33
33
|
import { type Disposition, type RedirectDeliveryConfig, type StreamedDelivery } from './delivery.ts';
|
|
@@ -491,14 +491,27 @@ export declare class Filelayer {
|
|
|
491
491
|
file: FileRecord;
|
|
492
492
|
remainingDownloads: number | null;
|
|
493
493
|
}>;
|
|
494
|
-
/**
|
|
495
|
-
|
|
496
|
-
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
494
|
+
/**
|
|
495
|
+
* "Who touched this?", answered in the words the caller used.
|
|
496
|
+
*
|
|
497
|
+
* Requires `read_audit` in the org, which is admin+. Asked of the engine.
|
|
498
|
+
*
|
|
499
|
+
* Each row is a `ResolvedAuditRow`: the stored `actorId`, `fileId` and
|
|
500
|
+
* `orgId` are present and unchanged, and alongside them are `.actor`,
|
|
501
|
+
* `.file` and `.org`, carrying the external ids the caller supplied, plus a
|
|
502
|
+
* `.summary` line that prints as an answer:
|
|
503
|
+
*
|
|
504
|
+
* ```text
|
|
505
|
+
* 2026-09-06T10:12:41.002Z marco file.read deny:grant_revoked contract.pdf @acme
|
|
506
|
+
* ```
|
|
507
|
+
*
|
|
508
|
+
* Resolution is a join on the same statement, so this remains one query.
|
|
509
|
+
* `.actor.label` is `'anonymous'` for a link redemption, `.org.label` is
|
|
510
|
+
* `'system'` on the system chain, and an id that resolves to nothing in this
|
|
511
|
+
* project (a probe) keeps the uuid as its label with `resolution:
|
|
512
|
+
* 'unresolved'` -- there is no null to interpret and nothing is invented.
|
|
513
|
+
*/
|
|
514
|
+
auditLog(principal: Principal, orgId: string, filter?: AuditFilter): Promise<ResolvedAuditRow[]>;
|
|
502
515
|
/**
|
|
503
516
|
* Verify the tamper-evidence chain for an org.
|
|
504
517
|
*
|
package/dist/filelayer.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"filelayer.d.ts","sourceRoot":"","sources":["../src/filelayer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAUL,KAAK,UAAU,EAEf,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,aAAa,EAMb,KAAK,
|
|
1
|
+
{"version":3,"file":"filelayer.d.ts","sourceRoot":"","sources":["../src/filelayer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAUL,KAAK,UAAU,EAEf,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,aAAa,EAMb,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAOL,KAAK,WAAW,EAGhB,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACpC,4CAA4C;GAC1C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAChC,qDAAqD;GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sEAAsE;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,UAAW,SAAQ,OAAO;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AA8BD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED,qBAAa,SAAS;;IACpB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IAExC,OAAO,CAAC,MAAM,CAAC,CAAW;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAU;IACxB,OAAO,CAAC,OAAO,CAAC,CAAY;IAE5B,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;gBAE7C,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,GAAE,gBAAqB;IAmD/E;;;;;;;OAOG;WACU,UAAU,CAAC,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAS5E,yEAAyE;IACzE,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAOD,IAAI,KAAK,IAAI,QAAQ,CAEpB;IAED,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,IAAI,MAAM,IAAI,SAAS,CAEtB;IAMD;;;;;;;;;OASG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBpB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAS9D;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCxE;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,iFAAiF;IAC3E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB9C;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BlD;;;;OAIG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtD;;;;;;;;OAQG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC;IAUV,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgG1F;;;;;;;;;;;;;OAaG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAA;KAAO,GACvC,OAAO,CAAC;QACT,IAAI,EAAE,UAAU,CAAC;QACjB,IAAI,EAAE,UAAU,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,6EAA6E;QAC7E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IAkBF;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM;IACd;;;;;;OAMG;IACH,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAO,GACzG,OAAO,CAAC,gBAAgB,GAAG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAgBxG;;;;;;;;;;OAUG;IACG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsQrE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC;IAyBxB;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,qBAAqB,CACzB,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;KACb,GACL,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAsEjF,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAsL1F;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsD5D,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoC/E;;;;;;;;OAQG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;KACtB,GACL,OAAO,CAAC;QACT,IAAI,EAAE,UAAU,CAAC;QACjB,IAAI,EAAE,UAAU,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IAaF,gFAAgF;IAC1E,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpC,GACL,OAAO,CAAC,gBAAgB,GAAG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA+CtF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,QAAQ,CACZ,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,WAAgB,GACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAS9B;;;;;;OAMG;IACG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA4BvF;AA0CD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAqCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKhE"}
|
package/dist/filelayer.js
CHANGED
|
@@ -1212,14 +1212,33 @@ export class Filelayer {
|
|
|
1212
1212
|
// ---------------------------------------------------------------------------
|
|
1213
1213
|
// Audit
|
|
1214
1214
|
// ---------------------------------------------------------------------------
|
|
1215
|
-
/**
|
|
1215
|
+
/**
|
|
1216
|
+
* "Who touched this?", answered in the words the caller used.
|
|
1217
|
+
*
|
|
1218
|
+
* Requires `read_audit` in the org, which is admin+. Asked of the engine.
|
|
1219
|
+
*
|
|
1220
|
+
* Each row is a `ResolvedAuditRow`: the stored `actorId`, `fileId` and
|
|
1221
|
+
* `orgId` are present and unchanged, and alongside them are `.actor`,
|
|
1222
|
+
* `.file` and `.org`, carrying the external ids the caller supplied, plus a
|
|
1223
|
+
* `.summary` line that prints as an answer:
|
|
1224
|
+
*
|
|
1225
|
+
* ```text
|
|
1226
|
+
* 2026-09-06T10:12:41.002Z marco file.read deny:grant_revoked contract.pdf @acme
|
|
1227
|
+
* ```
|
|
1228
|
+
*
|
|
1229
|
+
* Resolution is a join on the same statement, so this remains one query.
|
|
1230
|
+
* `.actor.label` is `'anonymous'` for a link redemption, `.org.label` is
|
|
1231
|
+
* `'system'` on the system chain, and an id that resolves to nothing in this
|
|
1232
|
+
* project (a probe) keeps the uuid as its label with `resolution:
|
|
1233
|
+
* 'unresolved'` -- there is no null to interpret and nothing is invented.
|
|
1234
|
+
*/
|
|
1216
1235
|
async auditLog(principal, orgId, filter = {}) {
|
|
1217
1236
|
const decision = await authorizeOrg(this.store, principal, orgId, 'read_audit', {
|
|
1218
1237
|
action: 'audit.read',
|
|
1219
1238
|
emitAllow: false, // reading the log should not spam the log
|
|
1220
1239
|
});
|
|
1221
1240
|
this.#raise(decision);
|
|
1222
|
-
return this.store.
|
|
1241
|
+
return this.store.listAuditResolved(orgId, filter);
|
|
1223
1242
|
}
|
|
1224
1243
|
/**
|
|
1225
1244
|
* Verify the tamper-evidence chain for an org.
|