@foir/sdk 0.22.0 → 0.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (29) hide show
  1. package/CHANGELOG.md +51 -0
  2. package/README.md +6 -6
  3. package/dist/app/client.d.ts +5 -4
  4. package/dist/app/errors.d.ts +8 -6
  5. package/dist/auth/auth.d.ts +41 -9
  6. package/dist/auth/grant-table.generated.d.ts +5 -4
  7. package/dist/auth/hosted.d.ts +24 -0
  8. package/dist/auth/index.d.ts +4 -4
  9. package/dist/auth/operations.d.ts +28 -4
  10. package/dist/auth.js +174 -123
  11. package/dist/client.js +1 -4
  12. package/dist/codegen/preset.d.ts +1 -1
  13. package/dist/data/client.d.ts +1 -1
  14. package/dist/data/schema.d.ts +1 -1
  15. package/dist/data/transport.d.ts +7 -6
  16. package/dist/data.js +2 -5
  17. package/dist/index.js +1 -4
  18. package/dist/next.js +1 -4
  19. package/dist/placement.js +124 -116
  20. package/dist/push.js +1 -4
  21. package/dist/react/FoirProvider.d.ts +1 -1
  22. package/dist/react/feedback-notes.d.ts +4 -2
  23. package/dist/react.js +125 -120
  24. package/dist/server/events-client.d.ts +7 -7
  25. package/dist/server/types.d.ts +1 -1
  26. package/dist/server.js +121 -120
  27. package/dist/transport/foir-http.d.ts +1 -1
  28. package/dist/transport/key-kind.d.ts +1 -12
  29. package/package.json +3 -3
package/dist/placement.js CHANGED
@@ -1,124 +1,124 @@
1
1
  // src/auth/grant-table.generated.ts
2
2
  var GRANT_TABLE = [
3
- ["records:read", true, ["own", "all"], []],
4
- ["records:create", true, [], []],
5
- ["records:write", true, ["own", "all"], []],
6
- ["records:delete", true, ["own", "all"], []],
7
- ["records:publish", true, ["own", "all"], []],
8
- ["records:attribute", true, [], []],
9
- ["search:read", true, [], []],
10
- ["embeddings:read", false, [], []],
11
- ["embeddings:write", false, [], []],
12
- ["schemas:read", false, [], []],
13
- ["drafts:read", false, [], []],
14
- ["files:read", false, ["own", "all"], []],
15
- ["files:write", false, ["own", "all"], []],
16
- ["files:delete", false, ["own", "all"], []],
17
- ["notifications:read", false, ["own", "all"], []],
18
- ["notifications:write", false, ["own", "named", "all"], []],
19
- ["notifications:consent", false, [], []],
20
- ["pushcredentials:read", false, [], []],
21
- ["pushcredentials:write", false, [], []],
22
- ["notes:read", false, ["own", "all"], []],
23
- ["notes:write", false, ["own", "all"], []],
24
- ["notes:create", false, [], []],
25
- ["approvals:read", false, [], []],
26
- ["approvals:write", false, [], []],
27
- ["rooms:read", true, [], []],
28
- ["rooms:write", true, [], []],
29
- ["presence:read", true, [], []],
30
- ["operations:read", false, [], []],
31
- ["operations:execute", true, [], []],
32
- ["operations:write", false, [], []],
33
- ["operations:complete", false, [], []],
34
- ["status:write", false, [], []],
35
- ["appconfig:read", false, [], []],
36
- ["schedules:read", false, [], []],
37
- ["schedules:write", false, [], []],
38
- ["hooks:read", false, [], []],
39
- ["hooks:write", false, [], []],
40
- ["relyingparties:read", false, [], []],
41
- ["relyingparties:write", false, [], []],
42
- ["domains:read", false, [], []],
43
- ["domains:write", false, [], []],
44
- ["secrets:read", false, [], []],
45
- ["secrets:list", false, [], []],
46
- ["secrets:put", false, [], []],
47
- ["secrets:delete", false, [], []],
48
- ["appsecrets:read", false, [], []],
49
- ["appsecrets:list", false, [], []],
50
- ["appsecrets:put", false, [], []],
51
- ["appsecrets:delete", false, [], []],
52
- ["opsecrets:read", false, [], []],
53
- ["opsecrets:write", false, [], []],
54
- ["settings:read", false, [], []],
55
- ["settings:write", false, [], []],
56
- ["designtokens:read", false, [], []],
57
- ["designtokens:write", false, [], []],
58
- ["models:read", false, [], []],
59
- ["models:write", false, [], []],
60
- ["configs:read", false, [], []],
61
- ["configs:write", false, [], []],
62
- ["apps:read", false, [], []],
63
- ["apps:write", false, [], []],
64
- ["events:read", false, [], []],
65
- ["targeting:debug", false, [], []],
66
- ["visitors:forward", false, [], []],
67
- ["apikeys:read", false, [], []],
68
- ["apikeys:write", false, [], []],
69
- ["organizations:read", false, [], []],
70
- ["organizations:write", false, [], []],
71
- ["organizations:create", false, [], []],
72
- ["organizations:delete", false, [], []],
73
- ["organizations:reach", false, [], []],
74
- ["members:read", false, [], []],
75
- ["members:write", false, [], []],
76
- ["roles:read", false, [], []],
77
- ["roles:write", false, [], []],
78
- ["projects:read", false, [], []],
79
- ["projects:write", false, [], []],
80
- ["project:stand", false, [], []],
81
- ["project:manage", false, [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
82
- ["projects:create", false, [], []],
83
- ["projects:delete", false, [], []],
84
- ["tenants:read", false, [], []],
85
- ["tenants:write", false, [], []],
86
- ["tenants:delete", false, [], []],
87
- ["audit:read", false, [], []],
88
- ["export:run", false, [], []],
89
- ["billing:read", false, [], []],
90
- ["billing:manage", false, [], []],
91
- ["usage:read", false, [], []],
92
- ["controlkeys:read", false, [], []],
93
- ["controlkeys:write", false, [], []],
94
- ["tenantsigninproviders:read", false, [], []],
95
- ["tenantsigninproviders:write", false, [], []],
96
- ["tenanthooks:read", false, [], []],
97
- ["tenanthooks:write", false, [], []],
98
- ["apps:install", false, [], []],
99
- ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "tenantsigninproviders:read", "tenantsigninproviders:write", "apps:install"]],
100
- ["platform:read", false, [], []],
101
- ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
102
- ["platform:create_workspace", false, [], []],
103
- ["users:read", false, ["own", "named", "all"], []],
104
- ["users:write", false, ["own", "all"], []],
105
- ["users:setup", false, [], []],
106
- ["users:delete", false, ["own", "all"], []],
107
- ["users:create", false, [], []],
108
- ["identities:read", false, [], []],
109
- ["identities:delete", false, [], []],
110
- ["usersecrets:read", false, [], []],
111
- ["usersecrets:list", false, [], []],
112
- ["usersecrets:put", false, [], []],
113
- ["usersecrets:delete", false, [], []],
114
- ["auth:login_with_foir", false, [], []],
115
- ["signinproviders:read", false, [], []],
116
- ["signinproviders:write", false, [], []]
3
+ ["records:read", "model", ["own", "all"], []],
4
+ ["records:create", "model", [], []],
5
+ ["records:write", "model", ["own", "all"], []],
6
+ ["records:delete", "model", ["own", "all"], []],
7
+ ["records:publish", "model", ["own", "all"], []],
8
+ ["records:attribute", "model", [], []],
9
+ ["search:read", "model", [], []],
10
+ ["embeddings:read", "none", [], []],
11
+ ["embeddings:write", "none", [], []],
12
+ ["schemas:read", "none", [], []],
13
+ ["drafts:read", "none", [], []],
14
+ ["files:read", "none", ["own", "all"], []],
15
+ ["files:write", "none", ["own", "all"], []],
16
+ ["files:delete", "none", ["own", "all"], []],
17
+ ["notifications:read", "none", ["own", "all"], []],
18
+ ["notifications:write", "none", ["own", "named", "all"], []],
19
+ ["notifications:consent", "none", [], []],
20
+ ["pushcredentials:read", "none", [], []],
21
+ ["pushcredentials:write", "none", [], []],
22
+ ["notes:read", "none", ["own", "all"], []],
23
+ ["notes:write", "none", ["own", "all"], []],
24
+ ["notes:create", "none", [], []],
25
+ ["approvals:read", "none", [], []],
26
+ ["approvals:write", "none", [], []],
27
+ ["rooms:read", "model", [], []],
28
+ ["rooms:write", "model", [], []],
29
+ ["presence:read", "model", [], []],
30
+ ["operations:read", "none", [], []],
31
+ ["operations:execute", "operation", [], []],
32
+ ["operations:write", "none", [], []],
33
+ ["operations:complete", "none", [], []],
34
+ ["status:write", "none", [], []],
35
+ ["appconfig:read", "none", [], []],
36
+ ["schedules:read", "none", [], []],
37
+ ["schedules:write", "none", [], []],
38
+ ["hooks:read", "none", [], []],
39
+ ["hooks:write", "none", [], []],
40
+ ["authclients:read", "none", [], []],
41
+ ["authclients:write", "none", [], []],
42
+ ["domains:read", "none", [], []],
43
+ ["domains:write", "none", [], []],
44
+ ["secrets:read", "none", [], []],
45
+ ["secrets:list", "none", [], []],
46
+ ["secrets:put", "none", [], []],
47
+ ["secrets:delete", "none", [], []],
48
+ ["appsecrets:read", "none", [], []],
49
+ ["appsecrets:list", "none", [], []],
50
+ ["appsecrets:put", "none", [], []],
51
+ ["appsecrets:delete", "none", [], []],
52
+ ["opsecrets:read", "none", [], []],
53
+ ["opsecrets:write", "none", [], []],
54
+ ["settings:read", "none", [], []],
55
+ ["settings:write", "none", [], []],
56
+ ["designtokens:read", "none", [], []],
57
+ ["designtokens:write", "none", [], []],
58
+ ["models:read", "none", [], []],
59
+ ["models:write", "none", [], []],
60
+ ["configs:read", "none", [], []],
61
+ ["configs:write", "none", [], []],
62
+ ["apps:read", "none", [], []],
63
+ ["apps:write", "none", [], []],
64
+ ["events:read", "none", [], []],
65
+ ["targeting:debug", "none", [], []],
66
+ ["visitors:forward", "none", [], []],
67
+ ["apikeys:read", "none", [], []],
68
+ ["apikeys:write", "none", [], []],
69
+ ["organizations:read", "none", [], []],
70
+ ["organizations:write", "none", [], []],
71
+ ["organizations:create", "none", [], []],
72
+ ["organizations:delete", "none", [], []],
73
+ ["organizations:reach", "none", [], []],
74
+ ["members:read", "none", [], []],
75
+ ["members:write", "none", [], []],
76
+ ["roles:read", "none", [], []],
77
+ ["roles:write", "none", [], []],
78
+ ["projects:read", "none", [], []],
79
+ ["projects:write", "none", [], []],
80
+ ["project:stand", "none", [], []],
81
+ ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
82
+ ["projects:create", "none", [], []],
83
+ ["projects:delete", "none", [], []],
84
+ ["tenants:read", "none", [], []],
85
+ ["tenants:write", "none", [], []],
86
+ ["tenants:delete", "none", [], []],
87
+ ["audit:read", "none", [], []],
88
+ ["export:run", "none", [], []],
89
+ ["billing:read", "none", [], []],
90
+ ["billing:manage", "none", [], []],
91
+ ["usage:read", "none", [], []],
92
+ ["controlkeys:read", "none", [], []],
93
+ ["controlkeys:write", "none", [], []],
94
+ ["tenanthooks:read", "none", [], []],
95
+ ["tenanthooks:write", "none", [], []],
96
+ ["apps:install", "none", [], []],
97
+ ["tenant:manage", "none", [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
98
+ ["platform:read", "none", [], []],
99
+ ["platform:manage", "none", [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
100
+ ["platform:create_workspace", "none", [], []],
101
+ ["users:read", "none", ["own", "named", "all"], []],
102
+ ["users:write", "none", ["own", "all"], []],
103
+ ["users:setup", "none", [], []],
104
+ ["users:delete", "none", ["own", "all"], []],
105
+ ["users:create", "none", [], []],
106
+ ["identities:read", "none", [], []],
107
+ ["identities:delete", "none", [], []],
108
+ ["usersecrets:read", "none", [], []],
109
+ ["usersecrets:list", "none", [], []],
110
+ ["usersecrets:put", "none", [], []],
111
+ ["usersecrets:delete", "none", [], []],
112
+ ["auth:login_with_foir", "none", [], []],
113
+ ["signinproviders:read", "none", [], []],
114
+ ["signinproviders:write", "none", [], []]
117
115
  ];
118
116
 
119
117
  // src/auth/grants.ts
120
118
  var WILDCARD = "*";
121
119
  var RESOURCE_WILDCARD = ":*";
120
+ var FIELD_PERMISSIONS = ["records:read", "records:write"];
121
+ var FIELD_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
122
122
  var index;
123
123
  function catalogue() {
124
124
  if (!index) {
@@ -159,15 +159,23 @@ function parseGrant(s) {
159
159
  let target = "";
160
160
  if (rest.startsWith(":")) {
161
161
  target = rest.slice(1);
162
- if (!permission[1]) return null;
162
+ if (permission[1] === "none") return null;
163
163
  if (target === "" || /[: \t\n*]/.test(target)) return null;
164
+ const dot = target.indexOf(".");
165
+ if (permission[1] === "model" && dot >= 0) {
166
+ if (!FIELD_PERMISSIONS.includes(name) || dot === 0 || !FIELD_KEY.test(target.slice(dot + 1))) return null;
167
+ }
164
168
  }
165
169
  return { permission, reach, target };
166
170
  }
167
171
  return null;
168
172
  }
169
173
  function covers(held, required) {
170
- return held.permission === required.permission && reachRank[held.reach] >= reachRank[required.reach] && (held.target === "" || held.target === required.target);
174
+ if (held.permission !== required.permission || reachRank[held.reach] < reachRank[required.reach]) return false;
175
+ if (required.permission[1] === "model" && required.target.includes(".")) {
176
+ return held.target === required.target || held.target === "" && held.reach === "all";
177
+ }
178
+ return held.target === "" || held.target === required.target;
171
179
  }
172
180
  function resourceWildcard(held) {
173
181
  if (!held.endsWith(RESOURCE_WILDCARD)) return null;
package/dist/push.js CHANGED
@@ -5,10 +5,7 @@ import { print as print2 } from "graphql";
5
5
  var KEY_PREFIXES = [
6
6
  ["foir_pub_", "publishable"],
7
7
  ["foir_srv_", "server"],
8
- ["foir_adm_", "admin"],
9
- ["pk_", "publishable"],
10
- ["sk_", "older"],
11
- ["tc_", "older"]
8
+ ["foir_adm_", "admin"]
12
9
  ];
13
10
  var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
14
11
  function foirKeyKind(apiKey) {
package/dist/react/FoirProvider.d.ts CHANGED
@@ -58,7 +58,7 @@ export interface FoirContextValue {
58
58
  hostedSignInUrl: ((returnTo?: string) => string) | null;
59
59
  }
60
60
  export interface FoirProviderProps {
61
- /** API config: `{ PLATFORM_API_URL, PLATFORM_API_KEY }` (a publishable `pk_` key). */
61
+ /** API config: `{ PLATFORM_API_URL, PLATFORM_API_KEY }` (a publishable key). */
62
62
  env: FoirEnv;
63
63
  /** Session store for token mode. Defaults to a browser localStorage adapter. */
64
64
  adapter?: SessionAdapter;
package/dist/react/feedback-notes.d.ts CHANGED
@@ -61,8 +61,10 @@ export type FoirFeedbackFault = {
61
61
  /**
62
62
  * Read the refusal, if it is one of the two the widget can act on.
63
63
  *
64
- * Matched on the platform's own sentences rather than on an error code, because
65
- * these two arrive as plain GraphQL errors with no `extensions.code` to read.
64
+ * Matched on the platform's own sentences rather than on an error code: the
65
+ * sign-in refusal carries no `extensions.code`, and the scope refusal's code
66
+ * (`PERMISSION_DENIED`) does not say which permission, which only its sentence
67
+ * names.
66
68
  * Both the wrapper's message and every individual GraphQL error are scanned: the
67
69
  * transport joins them into one string on the way out, but a partial-error
68
70
  * envelope keeps them apart, and only one of the two forms is guaranteed.
package/dist/react.js CHANGED
@@ -18,10 +18,7 @@ import { print as print2 } from "graphql";
18
18
  var KEY_PREFIXES = [
19
19
  ["foir_pub_", "publishable"],
20
20
  ["foir_srv_", "server"],
21
- ["foir_adm_", "admin"],
22
- ["pk_", "publishable"],
23
- ["sk_", "older"],
24
- ["tc_", "older"]
21
+ ["foir_adm_", "admin"]
25
22
  ];
26
23
  function foirKeyKind(apiKey) {
27
24
  if (typeof apiKey !== "string") return void 0;
@@ -1200,125 +1197,125 @@ async function authedOp(adapter, env, op, args) {
1200
1197
 
1201
1198
  // src/auth/grant-table.generated.ts
1202
1199
  var GRANT_TABLE = [
1203
- ["records:read", true, ["own", "all"], []],
1204
- ["records:create", true, [], []],
1205
- ["records:write", true, ["own", "all"], []],
1206
- ["records:delete", true, ["own", "all"], []],
1207
- ["records:publish", true, ["own", "all"], []],
1208
- ["records:attribute", true, [], []],
1209
- ["search:read", true, [], []],
1210
- ["embeddings:read", false, [], []],
1211
- ["embeddings:write", false, [], []],
1212
- ["schemas:read", false, [], []],
1213
- ["drafts:read", false, [], []],
1214
- ["files:read", false, ["own", "all"], []],
1215
- ["files:write", false, ["own", "all"], []],
1216
- ["files:delete", false, ["own", "all"], []],
1217
- ["notifications:read", false, ["own", "all"], []],
1218
- ["notifications:write", false, ["own", "named", "all"], []],
1219
- ["notifications:consent", false, [], []],
1220
- ["pushcredentials:read", false, [], []],
1221
- ["pushcredentials:write", false, [], []],
1222
- ["notes:read", false, ["own", "all"], []],
1223
- ["notes:write", false, ["own", "all"], []],
1224
- ["notes:create", false, [], []],
1225
- ["approvals:read", false, [], []],
1226
- ["approvals:write", false, [], []],
1227
- ["rooms:read", true, [], []],
1228
- ["rooms:write", true, [], []],
1229
- ["presence:read", true, [], []],
1230
- ["operations:read", false, [], []],
1231
- ["operations:execute", true, [], []],
1232
- ["operations:write", false, [], []],
1233
- ["operations:complete", false, [], []],
1234
- ["status:write", false, [], []],
1235
- ["appconfig:read", false, [], []],
1236
- ["schedules:read", false, [], []],
1237
- ["schedules:write", false, [], []],
1238
- ["hooks:read", false, [], []],
1239
- ["hooks:write", false, [], []],
1240
- ["relyingparties:read", false, [], []],
1241
- ["relyingparties:write", false, [], []],
1242
- ["domains:read", false, [], []],
1243
- ["domains:write", false, [], []],
1244
- ["secrets:read", false, [], []],
1245
- ["secrets:list", false, [], []],
1246
- ["secrets:put", false, [], []],
1247
- ["secrets:delete", false, [], []],
1248
- ["appsecrets:read", false, [], []],
1249
- ["appsecrets:list", false, [], []],
1250
- ["appsecrets:put", false, [], []],
1251
- ["appsecrets:delete", false, [], []],
1252
- ["opsecrets:read", false, [], []],
1253
- ["opsecrets:write", false, [], []],
1254
- ["settings:read", false, [], []],
1255
- ["settings:write", false, [], []],
1256
- ["designtokens:read", false, [], []],
1257
- ["designtokens:write", false, [], []],
1258
- ["models:read", false, [], []],
1259
- ["models:write", false, [], []],
1260
- ["configs:read", false, [], []],
1261
- ["configs:write", false, [], []],
1262
- ["apps:read", false, [], []],
1263
- ["apps:write", false, [], []],
1264
- ["events:read", false, [], []],
1265
- ["targeting:debug", false, [], []],
1266
- ["visitors:forward", false, [], []],
1267
- ["apikeys:read", false, [], []],
1268
- ["apikeys:write", false, [], []],
1269
- ["organizations:read", false, [], []],
1270
- ["organizations:write", false, [], []],
1271
- ["organizations:create", false, [], []],
1272
- ["organizations:delete", false, [], []],
1273
- ["organizations:reach", false, [], []],
1274
- ["members:read", false, [], []],
1275
- ["members:write", false, [], []],
1276
- ["roles:read", false, [], []],
1277
- ["roles:write", false, [], []],
1278
- ["projects:read", false, [], []],
1279
- ["projects:write", false, [], []],
1280
- ["project:stand", false, [], []],
1281
- ["project:manage", false, [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
1282
- ["projects:create", false, [], []],
1283
- ["projects:delete", false, [], []],
1284
- ["tenants:read", false, [], []],
1285
- ["tenants:write", false, [], []],
1286
- ["tenants:delete", false, [], []],
1287
- ["audit:read", false, [], []],
1288
- ["export:run", false, [], []],
1289
- ["billing:read", false, [], []],
1290
- ["billing:manage", false, [], []],
1291
- ["usage:read", false, [], []],
1292
- ["controlkeys:read", false, [], []],
1293
- ["controlkeys:write", false, [], []],
1294
- ["tenantsigninproviders:read", false, [], []],
1295
- ["tenantsigninproviders:write", false, [], []],
1296
- ["tenanthooks:read", false, [], []],
1297
- ["tenanthooks:write", false, [], []],
1298
- ["apps:install", false, [], []],
1299
- ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "tenantsigninproviders:read", "tenantsigninproviders:write", "apps:install"]],
1300
- ["platform:read", false, [], []],
1301
- ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
1302
- ["platform:create_workspace", false, [], []],
1303
- ["users:read", false, ["own", "named", "all"], []],
1304
- ["users:write", false, ["own", "all"], []],
1305
- ["users:setup", false, [], []],
1306
- ["users:delete", false, ["own", "all"], []],
1307
- ["users:create", false, [], []],
1308
- ["identities:read", false, [], []],
1309
- ["identities:delete", false, [], []],
1310
- ["usersecrets:read", false, [], []],
1311
- ["usersecrets:list", false, [], []],
1312
- ["usersecrets:put", false, [], []],
1313
- ["usersecrets:delete", false, [], []],
1314
- ["auth:login_with_foir", false, [], []],
1315
- ["signinproviders:read", false, [], []],
1316
- ["signinproviders:write", false, [], []]
1200
+ ["records:read", "model", ["own", "all"], []],
1201
+ ["records:create", "model", [], []],
1202
+ ["records:write", "model", ["own", "all"], []],
1203
+ ["records:delete", "model", ["own", "all"], []],
1204
+ ["records:publish", "model", ["own", "all"], []],
1205
+ ["records:attribute", "model", [], []],
1206
+ ["search:read", "model", [], []],
1207
+ ["embeddings:read", "none", [], []],
1208
+ ["embeddings:write", "none", [], []],
1209
+ ["schemas:read", "none", [], []],
1210
+ ["drafts:read", "none", [], []],
1211
+ ["files:read", "none", ["own", "all"], []],
1212
+ ["files:write", "none", ["own", "all"], []],
1213
+ ["files:delete", "none", ["own", "all"], []],
1214
+ ["notifications:read", "none", ["own", "all"], []],
1215
+ ["notifications:write", "none", ["own", "named", "all"], []],
1216
+ ["notifications:consent", "none", [], []],
1217
+ ["pushcredentials:read", "none", [], []],
1218
+ ["pushcredentials:write", "none", [], []],
1219
+ ["notes:read", "none", ["own", "all"], []],
1220
+ ["notes:write", "none", ["own", "all"], []],
1221
+ ["notes:create", "none", [], []],
1222
+ ["approvals:read", "none", [], []],
1223
+ ["approvals:write", "none", [], []],
1224
+ ["rooms:read", "model", [], []],
1225
+ ["rooms:write", "model", [], []],
1226
+ ["presence:read", "model", [], []],
1227
+ ["operations:read", "none", [], []],
1228
+ ["operations:execute", "operation", [], []],
1229
+ ["operations:write", "none", [], []],
1230
+ ["operations:complete", "none", [], []],
1231
+ ["status:write", "none", [], []],
1232
+ ["appconfig:read", "none", [], []],
1233
+ ["schedules:read", "none", [], []],
1234
+ ["schedules:write", "none", [], []],
1235
+ ["hooks:read", "none", [], []],
1236
+ ["hooks:write", "none", [], []],
1237
+ ["authclients:read", "none", [], []],
1238
+ ["authclients:write", "none", [], []],
1239
+ ["domains:read", "none", [], []],
1240
+ ["domains:write", "none", [], []],
1241
+ ["secrets:read", "none", [], []],
1242
+ ["secrets:list", "none", [], []],
1243
+ ["secrets:put", "none", [], []],
1244
+ ["secrets:delete", "none", [], []],
1245
+ ["appsecrets:read", "none", [], []],
1246
+ ["appsecrets:list", "none", [], []],
1247
+ ["appsecrets:put", "none", [], []],
1248
+ ["appsecrets:delete", "none", [], []],
1249
+ ["opsecrets:read", "none", [], []],
1250
+ ["opsecrets:write", "none", [], []],
1251
+ ["settings:read", "none", [], []],
1252
+ ["settings:write", "none", [], []],
1253
+ ["designtokens:read", "none", [], []],
1254
+ ["designtokens:write", "none", [], []],
1255
+ ["models:read", "none", [], []],
1256
+ ["models:write", "none", [], []],
1257
+ ["configs:read", "none", [], []],
1258
+ ["configs:write", "none", [], []],
1259
+ ["apps:read", "none", [], []],
1260
+ ["apps:write", "none", [], []],
1261
+ ["events:read", "none", [], []],
1262
+ ["targeting:debug", "none", [], []],
1263
+ ["visitors:forward", "none", [], []],
1264
+ ["apikeys:read", "none", [], []],
1265
+ ["apikeys:write", "none", [], []],
1266
+ ["organizations:read", "none", [], []],
1267
+ ["organizations:write", "none", [], []],
1268
+ ["organizations:create", "none", [], []],
1269
+ ["organizations:delete", "none", [], []],
1270
+ ["organizations:reach", "none", [], []],
1271
+ ["members:read", "none", [], []],
1272
+ ["members:write", "none", [], []],
1273
+ ["roles:read", "none", [], []],
1274
+ ["roles:write", "none", [], []],
1275
+ ["projects:read", "none", [], []],
1276
+ ["projects:write", "none", [], []],
1277
+ ["project:stand", "none", [], []],
1278
+ ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
1279
+ ["projects:create", "none", [], []],
1280
+ ["projects:delete", "none", [], []],
1281
+ ["tenants:read", "none", [], []],
1282
+ ["tenants:write", "none", [], []],
1283
+ ["tenants:delete", "none", [], []],
1284
+ ["audit:read", "none", [], []],
1285
+ ["export:run", "none", [], []],
1286
+ ["billing:read", "none", [], []],
1287
+ ["billing:manage", "none", [], []],
1288
+ ["usage:read", "none", [], []],
1289
+ ["controlkeys:read", "none", [], []],
1290
+ ["controlkeys:write", "none", [], []],
1291
+ ["tenanthooks:read", "none", [], []],
1292
+ ["tenanthooks:write", "none", [], []],
1293
+ ["apps:install", "none", [], []],
1294
+ ["tenant:manage", "none", [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
1295
+ ["platform:read", "none", [], []],
1296
+ ["platform:manage", "none", [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
1297
+ ["platform:create_workspace", "none", [], []],
1298
+ ["users:read", "none", ["own", "named", "all"], []],
1299
+ ["users:write", "none", ["own", "all"], []],
1300
+ ["users:setup", "none", [], []],
1301
+ ["users:delete", "none", ["own", "all"], []],
1302
+ ["users:create", "none", [], []],
1303
+ ["identities:read", "none", [], []],
1304
+ ["identities:delete", "none", [], []],
1305
+ ["usersecrets:read", "none", [], []],
1306
+ ["usersecrets:list", "none", [], []],
1307
+ ["usersecrets:put", "none", [], []],
1308
+ ["usersecrets:delete", "none", [], []],
1309
+ ["auth:login_with_foir", "none", [], []],
1310
+ ["signinproviders:read", "none", [], []],
1311
+ ["signinproviders:write", "none", [], []]
1317
1312
  ];
1318
1313
 
1319
1314
  // src/auth/grants.ts
1320
1315
  var WILDCARD = "*";
1321
1316
  var RESOURCE_WILDCARD = ":*";
1317
+ var FIELD_PERMISSIONS = ["records:read", "records:write"];
1318
+ var FIELD_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
1322
1319
  var index;
1323
1320
  function catalogue() {
1324
1321
  if (!index) {
@@ -1359,15 +1356,23 @@ function parseGrant(s) {
1359
1356
  let target = "";
1360
1357
  if (rest.startsWith(":")) {
1361
1358
  target = rest.slice(1);
1362
- if (!permission[1]) return null;
1359
+ if (permission[1] === "none") return null;
1363
1360
  if (target === "" || /[: \t\n*]/.test(target)) return null;
1361
+ const dot = target.indexOf(".");
1362
+ if (permission[1] === "model" && dot >= 0) {
1363
+ if (!FIELD_PERMISSIONS.includes(name) || dot === 0 || !FIELD_KEY.test(target.slice(dot + 1))) return null;
1364
+ }
1364
1365
  }
1365
1366
  return { permission, reach, target };
1366
1367
  }
1367
1368
  return null;
1368
1369
  }
1369
1370
  function covers(held, required) {
1370
- return held.permission === required.permission && reachRank[held.reach] >= reachRank[required.reach] && (held.target === "" || held.target === required.target);
1371
+ if (held.permission !== required.permission || reachRank[held.reach] < reachRank[required.reach]) return false;
1372
+ if (required.permission[1] === "model" && required.target.includes(".")) {
1373
+ return held.target === required.target || held.target === "" && held.reach === "all";
1374
+ }
1375
+ return held.target === "" || held.target === required.target;
1371
1376
  }
1372
1377
  function resourceWildcard(held) {
1373
1378
  if (!held.endsWith(RESOURCE_WILDCARD)) return null;