@foir/sdk 0.18.0 → 0.20.0

package/dist/server.js

@@ -72,6 +72,208 @@ async function verifyWebhookSignature(payload, signature, secret) {
   return mismatch === 0;
 }
 
+// src/auth/grant-table.generated.ts
+var GRANT_TABLE = [
+  ["records:read", true, ["own", "named", "all"], []],
+  ["records:create", true, [], []],
+  ["records:write", true, ["own", "named", "all"], []],
+  ["records:delete", true, ["own", "named", "all"], []],
+  ["records:publish", true, ["own", "all"], []],
+  ["records:attribute", true, [], []],
+  ["search:read", true, [], []],
+  ["embeddings:read", false, [], []],
+  ["embeddings:write", false, [], []],
+  ["schemas:read", false, [], []],
+  ["drafts:read", false, [], []],
+  ["files:read", false, ["own", "all"], []],
+  ["files:write", false, ["own", "all"], []],
+  ["files:delete", false, ["own", "all"], []],
+  ["notifications:read", false, ["own", "all"], []],
+  ["notifications:write", false, ["own", "named", "all"], []],
+  ["notifications:consent", false, [], []],
+  ["pushcredentials:read", false, [], []],
+  ["pushcredentials:write", false, [], []],
+  ["notes:read", false, [], []],
+  ["notes:write", false, [], []],
+  ["notes:create", false, [], []],
+  ["approvals:read", false, [], []],
+  ["approvals:write", false, [], []],
+  ["rooms:read", true, [], []],
+  ["rooms:write", true, [], []],
+  ["presence:read", true, [], []],
+  ["operations:read", false, [], []],
+  ["operations:execute", true, [], []],
+  ["operations:write", false, [], []],
+  ["operations:complete", false, [], []],
+  ["status:write", false, [], []],
+  ["appconfig:read", false, [], []],
+  ["schedules:read", false, [], []],
+  ["schedules:write", false, [], []],
+  ["hooks:read", false, [], []],
+  ["hooks:write", false, [], []],
+  ["relyingparties:read", false, [], []],
+  ["relyingparties:write", false, [], []],
+  ["domains:read", false, [], []],
+  ["domains:write", false, [], []],
+  ["secrets:read", false, [], []],
+  ["secrets:list", false, [], []],
+  ["secrets:put", false, [], []],
+  ["secrets:delete", false, [], []],
+  ["appsecrets:read", false, [], []],
+  ["appsecrets:list", false, [], []],
+  ["appsecrets:put", false, [], []],
+  ["appsecrets:delete", false, [], []],
+  ["opsecrets:read", false, [], []],
+  ["opsecrets:write", false, [], []],
+  ["settings:read", false, [], []],
+  ["settings:write", false, [], []],
+  ["designtokens:read", false, [], []],
+  ["designtokens:write", false, [], []],
+  ["models:read", false, [], []],
+  ["models:write", false, [], []],
+  ["configs:read", false, [], []],
+  ["configs:write", false, [], []],
+  ["apps:read", false, [], []],
+  ["apps:write", false, [], []],
+  ["events:read", false, [], []],
+  ["targeting:debug", false, [], []],
+  ["visitors:forward", false, [], []],
+  ["apikeys:read", false, [], []],
+  ["apikeys:write", false, [], []],
+  ["organizations:read", false, [], []],
+  ["organizations:write", false, [], []],
+  ["organizations:create", false, [], []],
+  ["organizations:delete", false, [], []],
+  ["organizations:reach", false, [], []],
+  ["members:read", false, [], []],
+  ["members:write", false, [], []],
+  ["roles:read", false, [], []],
+  ["roles:write", false, [], []],
+  ["projects:read", false, [], []],
+  ["projects:write", false, [], []],
+  ["project:manage", false, [], ["records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read", "notes:write", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write"]],
+  ["projects:create", false, [], []],
+  ["projects:delete", false, [], []],
+  ["tenants:read", false, [], []],
+  ["tenants:write", false, [], []],
+  ["tenants:delete", false, [], []],
+  ["audit:read", false, [], []],
+  ["export:run", false, [], []],
+  ["billing:read", false, [], []],
+  ["billing:manage", false, [], []],
+  ["usage:read", false, [], []],
+  ["controlkeys:read", false, [], []],
+  ["controlkeys:write", false, [], []],
+  ["tenanthooks:read", false, [], []],
+  ["tenanthooks:write", false, [], []],
+  ["apps:install", false, [], []],
+  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "audit:read", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["platform:read", false, [], []],
+  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace", "users:setup"]],
+  ["platform:create_workspace", false, [], []],
+  ["users:read", false, ["own", "named", "all"], []],
+  ["users:write", false, ["own", "all"], []],
+  ["users:setup", false, [], []],
+  ["users:delete", false, ["own", "all"], []],
+  ["users:create", false, [], []],
+  ["identities:read", false, [], []],
+  ["identities:delete", false, [], []],
+  ["usersecrets:read", false, [], []],
+  ["usersecrets:list", false, [], []],
+  ["usersecrets:put", false, [], []],
+  ["usersecrets:delete", false, [], []],
+  ["auth:login_with_foir", false, [], []],
+  ["signinproviders:read", false, [], []],
+  ["signinproviders:write", false, [], []]
+];
+
+// src/auth/grants.ts
+var index;
+function catalogue() {
+  if (!index) {
+    const byName = new Map(GRANT_TABLE.map((row) => [row[0], row]));
+    const longestFirst = [...byName.keys()].sort(
+      (a, b) => a.length !== b.length ? b.length - a.length : a < b ? -1 : 1
+    );
+    index = { byName, longestFirst };
+  }
+  return index;
+}
+function hasReach(permission, reach) {
+  const reaches = permission[2];
+  return reaches.length === 0 ? reach === "own" : reaches.includes(reach);
+}
+function parseGrant(s) {
+  const { byName, longestFirst } = catalogue();
+  for (const name of longestFirst) {
+    if (!s.startsWith(name)) continue;
+    let rest = s.slice(name.length);
+    if (rest !== "" && rest[0] !== "." && rest[0] !== ":") continue;
+    const permission = byName.get(name);
+    let reach = "own";
+    if (rest.startsWith(".")) {
+      const after = rest.slice(1);
+      const colon = after.indexOf(":");
+      const word = colon < 0 ? after : after.slice(0, colon);
+      if (word !== "named" && word !== "all") return null;
+      if (!hasReach(permission, word)) return null;
+      reach = word;
+      rest = after.slice(word.length);
+    }
+    let target = "";
+    if (rest.startsWith(":")) {
+      target = rest.slice(1);
+      if (!permission[1]) return null;
+      if (target === "" || /[: \t\n*]/.test(target)) return null;
+    }
+    return { permission, reach, target };
+  }
+  return null;
+}
+
+// src/server/older-claims.generated.ts
+var OLDER_CLAIM_TARGET = "{target}";
+var OLDER_CAPABILITY_GRANTS = {
+  "config:read": ["appconfig:read"],
+  "customers:read": ["users:read.all"],
+  "customers:read:identity": ["identities:read"],
+  "customers:read:named": ["users:read.named"],
+  "customers:write": ["users:create"],
+  "embeddings:read": ["embeddings:read"],
+  "embeddings:write": ["embeddings:write"],
+  "files:delete": ["files:delete"],
+  "files:list": ["files:read"],
+  "files:read": ["files:read"],
+  "files:write": ["files:write"],
+  "notifications:consent": ["notifications:consent"],
+  "notifications:read": ["notifications:read"],
+  "notifications:write": ["notifications:write.named"],
+  "operations:complete": ["operations:complete"],
+  "records:attribute": ["records:attribute"],
+  "records:attribute:{target}": ["records:attribute:{target}"],
+  "records:delete": [],
+  "records:delete:{target}": ["records:delete:{target}"],
+  "records:publish": [],
+  "records:publish:{target}": ["records:publish:{target}"],
+  "records:read": [],
+  "records:read:{target}": ["records:read:{target}"],
+  "records:write": [],
+  "records:write:{target}": ["records:write.all:{target}", "records:create:{target}"],
+  "secrets:delete.app": ["appsecrets:delete"],
+  "secrets:delete.customer": ["usersecrets:delete"],
+  "secrets:delete.project": ["secrets:delete"],
+  "secrets:list.app": ["appsecrets:list"],
+  "secrets:list.customer": ["usersecrets:list"],
+  "secrets:list.project": ["secrets:list"],
+  "secrets:put.app": ["appsecrets:put"],
+  "secrets:put.customer": ["usersecrets:put"],
+  "secrets:put.project": ["secrets:put"],
+  "secrets:read.app": ["appsecrets:read"],
+  "secrets:read.customer": ["usersecrets:read"],
+  "secrets:read.project": ["secrets:read"],
+  "status:write": ["status:write"]
+};
+
 // src/server/verify-scoped-token.ts
 var JWKS_CACHE_TTL_MS = 5 * 60 * 1e3;
 function getCache() {
@@ -129,11 +331,66 @@ function parseSubject(sub) {
   }
   return { tenantId, projectId, appName: sub.slice(second + 1) };
 }
+function modelsFor(claims, permission) {
+  const out = [];
+  for (const grant of claims.grants) {
+    const parsed = parseGrant(grant);
+    if (!parsed || parsed.permission[0] !== permission || parsed.target === "") continue;
+    if (!out.includes(parsed.target)) out.push(parsed.target);
+  }
+  return out;
+}
 function recordsReadModels(claims) {
-  return claims.rrm ?? [];
+  return modelsFor(claims, "records:read");
 }
 function recordsWriteModels(claims) {
-  return claims.rwm ?? [];
+  return modelsFor(claims, "records:write");
+}
+function recordsCreateModels(claims) {
+  return modelsFor(claims, "records:create");
+}
+var OLDER_RECORD_LANES = [
+  ["records:read", "rrm"],
+  ["records:write", "rwm"],
+  ["records:delete", "rdm"],
+  ["records:publish", "rpm"]
+];
+function strings(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function worthBefore(capability) {
+  if (Object.hasOwn(OLDER_CAPABILITY_GRANTS, capability)) return OLDER_CAPABILITY_GRANTS[capability] ?? [];
+  for (const [form, grants] of Object.entries(OLDER_CAPABILITY_GRANTS)) {
+    if (!form.endsWith(OLDER_CLAIM_TARGET)) continue;
+    const prefix = form.slice(0, -OLDER_CLAIM_TARGET.length);
+    if (capability.startsWith(prefix) && capability.length > prefix.length) {
+      const model = capability.slice(prefix.length);
+      return grants.map((grant) => grant.replace(OLDER_CLAIM_TARGET, model));
+    }
+  }
+  return [];
+}
+var OLDER_WRITE = "records:write";
+var OLDER_DELETE = "records:delete";
+var OLDER_CREATE = "customers:write";
+function grantsOfOlderClaims(payload) {
+  const cap = strings(payload.cap);
+  const written = new Set(cap.includes(OLDER_WRITE) ? strings(payload.rwm) : []);
+  const grants = [];
+  for (const [marker, claim] of OLDER_RECORD_LANES) {
+    if (!cap.includes(marker)) continue;
+    for (const model of strings(payload[claim])) {
+      if (marker !== OLDER_WRITE && written.has(model)) grants.push(`${marker}.all:${model}`);
+      else grants.push(...worthBefore(`${marker}:${model}`));
+    }
+  }
+  for (const capability of cap) {
+    if (!OLDER_RECORD_LANES.some(([marker]) => marker === capability)) grants.push(...worthBefore(capability));
+  }
+  if (cap.includes(OLDER_CREATE) && cap.includes(OLDER_DELETE) && strings(payload.rdm).length > 0) {
+    grants.push("identities:delete");
+  }
+  return grants;
 }
 async function verifyScopedToken(token, jwksUrl, options) {
   return verifyWithKeys(token, () => loadJwks(jwksUrl), void 0, options);
@@ -169,12 +426,16 @@ async function verifyWithKeys(token, loadKeys, refetchForUnknownKid, options) {
     )
   );
   if (!ok) throw new Error("signature invalid");
-  let claims;
+  let payload;
   try {
-    claims = JSON.parse(new TextDecoder().decode(base64UrlDecode(rawPayload)));
+    payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(rawPayload)));
   } catch {
     throw new Error("unreadable token payload");
   }
+  const claims = {
+    ...payload,
+    grants: "grants" in payload ? strings(payload.grants) : grantsOfOlderClaims(payload)
+  };
   const now = Math.floor((options?.now?.() ?? Date.now()) / 1e3);
   if (claims.iss !== expectedIssuer) throw new Error(`bad iss ${claims.iss}`);
   if (typeof claims.exp !== "number" || claims.exp < now) {
@@ -1241,7 +1502,7 @@ function describe2(payload) {
 
 // src/server/events-client.ts
 var FOIR_EVENTS_PATH = "/v1/events";
-var FOIR_EVENTS_SCOPE = "events:list.project";
+var FOIR_EVENTS_SCOPE = "events:read";
 var FOIR_EVENTS_RETENTION_DAYS = 90;
 var FoirEventCursorExpiredError = class extends FoirRequestError {
   /**
@@ -1529,6 +1790,7 @@ export {
   parseContextHeader,
   parseSubject,
   readDispatch,
+  recordsCreateModels,
   recordsReadModels,
   recordsWriteModels,
   requireScopedToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -177,18 +177,19 @@
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
     "yjs": "^13.6.30",
+    "@foir/access-vocab": "0.0.0",
     "@foir/proto-ts": "0.109.0"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "build": "node scripts/generate-app-vocabulary.mjs && node scripts/clean-dist.mjs && tsup && tsc -p tsconfig.build.json && node scripts/bundle-app-contract-types.mjs && node scripts/assert-export-types.mjs && node scripts/assert-public-exports.mjs",
+    "build": "node scripts/generate-app-vocabulary.mjs && node scripts/generate-grant-table.mjs && node scripts/clean-dist.mjs && tsup && tsc -p tsconfig.build.json && node scripts/bundle-app-contract-types.mjs && node scripts/assert-export-types.mjs && node scripts/assert-public-exports.mjs",
     "snapshot:exports": "node scripts/assert-public-exports.mjs --update",
     "dev": "node scripts/dev-watch.mjs",
-    "check-types": "node scripts/generate-app-vocabulary.mjs && tsc --noEmit",
-    "test": "node scripts/generate-app-vocabulary.mjs && vitest run",
-    "test:watch": "node scripts/generate-app-vocabulary.mjs && vitest watch",
+    "check-types": "node scripts/generate-app-vocabulary.mjs && node scripts/generate-grant-table.mjs && tsc --noEmit",
+    "test": "node scripts/generate-app-vocabulary.mjs && node scripts/generate-grant-table.mjs && vitest run",
+    "test:watch": "node scripts/generate-app-vocabulary.mjs && node scripts/generate-grant-table.mjs && vitest watch",
     "release:patch": "pnpm version patch",
     "release:minor": "pnpm version minor",
     "release:major": "pnpm version major"