@forestadmin/agent-bff 1.15.1 → 1.17.0

package/dist/openapi/unfolding.d.ts

@@ -0,0 +1,66 @@
+import type { FieldType } from '../read-model/capabilities-cache';
+import type { PrimaryKeyField } from '../read-model/read-model';
+import type { Operator } from '@forestadmin/datasource-toolkit';
+/**
+ * The snapshot the OpenAPI generator unfolds. It is plain data on purpose: collecting it hits the
+ * network (schema + capabilities per collection), generating from it does not, so the route and the
+ * CLI can be proven to emit the same document by feeding them one snapshot.
+ */
+export interface Unfolding {
+    collections: UnfoldedCollection[];
+}
+export interface UnfoldedCollection {
+    name: string;
+    fields: CollectionFields;
+    primaryKeys: PrimaryKeyField[];
+    /** To-many relations whose foreign collection is exposed too — the only ones with a route. */
+    relations: UnfoldedRelation[];
+    actions: UnfoldedAction[];
+}
+export interface UnfoldedRelation {
+    name: string;
+    foreignCollection: string;
+}
+/**
+ * `projectable` is every capability field; `filterable` is the subset carrying operators. They
+ * differ: a `ManyToOne` is reported by the agent without operators, so projecting or sorting on it
+ * works while filtering on it answers 422 field_not_filterable.
+ *
+ * `degraded` is set when the field set could not be established. The collection keeps its paths, but
+ * their field schemas stay free-form strings — an empty enum would forbid every valid call.
+ */
+export interface CollectionFields {
+    projectable: string[];
+    filterable: FilterableField[];
+    degraded: DegradedReason | null;
+}
+/**
+ * A field the agent reports at least one operator for, with that operator set — the very set the
+ * runtime validates a filter leaf against. Normalized to canonical PascalCase and to the
+ * `allOperators` order at collect time, so the same capabilities answer always yields the same
+ * document whatever order the agent serialized the operators in.
+ */
+export interface FilterableField {
+    name: string;
+    operators: Operator[];
+}
+export type DegradedReason = 'capabilities_unavailable' | 'no_fields';
+/** True when at least one collection went out without its field set. */
+export declare function hasDegradedCollection(unfolding: Unfolding): boolean;
+/**
+ * True when NO collection got its field set — the signature of an unreachable agent rather than of
+ * one odd collection. An empty schema is not degraded: there was nothing to enumerate.
+ */
+export declare function isFullyDegraded(unfolding: Unfolding): boolean;
+export interface UnfoldedAction {
+    name: string;
+    fields: UnfoldedActionField[];
+}
+export interface UnfoldedActionField {
+    name: string;
+    type: FieldType;
+    isRequired: boolean;
+    enums: string[] | null;
+}
+export type { FieldType };
+//# sourceMappingURL=unfolding.d.ts.map

package/dist/openapi/unfolding.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasDegradedCollection = hasDegradedCollection;
+exports.isFullyDegraded = isFullyDegraded;
+/** True when at least one collection went out without its field set. */
+function hasDegradedCollection(unfolding) {
+    return unfolding.collections.some(collection => collection.fields.degraded !== null);
+}
+/**
+ * True when NO collection got its field set — the signature of an unreachable agent rather than of
+ * one odd collection. An empty schema is not degraded: there was nothing to enumerate.
+ */
+function isFullyDegraded(unfolding) {
+    return (unfolding.collections.length > 0 &&
+        unfolding.collections.every(collection => collection.fields.degraded !== null));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5mb2xkaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29wZW5hcGkvdW5mb2xkaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBdURBLHNEQUVDO0FBTUQsMENBS0M7QUFkRCx3RUFBd0U7QUFDeEUsU0FBZ0IscUJBQXFCLENBQUMsU0FBb0I7SUFDeEQsT0FBTyxTQUFTLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDO0FBQ3ZGLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixlQUFlLENBQUMsU0FBb0I7SUFDbEQsT0FBTyxDQUNMLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUM7UUFDaEMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FDL0UsQ0FBQztBQUNKLENBQUMifQ==

package/dist/permissions/build-permission-hints.d.ts

@@ -0,0 +1,40 @@
+import type ReadModel from '../read-model/read-model';
+import type { ActionPermissions } from '@forestadmin/forestadmin-client';
+export declare const DISPLAY_HINT_FINALITY = "display_hint";
+export interface CrudHints {
+    browse: boolean;
+    read: boolean;
+    edit: boolean;
+    add: boolean;
+    delete: boolean;
+    export: boolean;
+}
+export interface ActionHints {
+    collection: string;
+    name: string;
+    visible: boolean;
+    requiresApprovalHint: boolean;
+    canApproveHint: boolean;
+    canSelfApproveHint: boolean;
+    finality: typeof DISPLAY_HINT_FINALITY;
+}
+export interface VisibleActionRef {
+    collection: string;
+    name: string;
+}
+export interface CollectionHints {
+    crud: CrudHints;
+    actions: Record<string, ActionHints>;
+}
+export interface PermissionHints {
+    collections: Record<string, CollectionHints>;
+    visibleActions: VisibleActionRef[];
+}
+export interface BuildPermissionHintsParams {
+    actionPermissions: ActionPermissions;
+    roleId: number;
+    readModel: ReadModel;
+    collections: string[];
+}
+export default function buildPermissionHints(params: BuildPermissionHintsParams): PermissionHints;
+//# sourceMappingURL=build-permission-hints.d.ts.map

package/dist/permissions/build-permission-hints.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISPLAY_HINT_FINALITY = void 0;
+exports.default = buildPermissionHints;
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+const can_role_perform_1 = require("./can-role-perform");
+exports.DISPLAY_HINT_FINALITY = 'display_hint';
+function buildCrudHints(permissions, roleId, collection) {
+    const can = (action) => (0, can_role_perform_1.canRolePerformCollectionAction)(permissions, roleId, action, collection);
+    return {
+        browse: can(forestadmin_client_1.CollectionActionEvent.Browse),
+        read: can(forestadmin_client_1.CollectionActionEvent.Read),
+        edit: can(forestadmin_client_1.CollectionActionEvent.Edit),
+        add: can(forestadmin_client_1.CollectionActionEvent.Add),
+        delete: can(forestadmin_client_1.CollectionActionEvent.Delete),
+        export: can(forestadmin_client_1.CollectionActionEvent.Export),
+    };
+}
+function visibleWithoutApprovalHints(collection, name) {
+    return {
+        collection,
+        name,
+        visible: true,
+        requiresApprovalHint: false,
+        canApproveHint: false,
+        canSelfApproveHint: false,
+        finality: exports.DISPLAY_HINT_FINALITY,
+    };
+}
+function normalModeAction(permissions, roleId, collection, name) {
+    const can = (event) => (0, can_role_perform_1.canRolePerformCustomAction)({
+        permissions,
+        roleId,
+        event,
+        actionName: name,
+        collectionName: collection,
+    });
+    return {
+        collection,
+        name,
+        visible: can(forestadmin_client_1.CustomActionEvent.Trigger),
+        requiresApprovalHint: can(forestadmin_client_1.CustomActionEvent.RequireApproval),
+        canApproveHint: can(forestadmin_client_1.CustomActionEvent.Approve),
+        canSelfApproveHint: can(forestadmin_client_1.CustomActionEvent.SelfApprove),
+        finality: exports.DISPLAY_HINT_FINALITY,
+    };
+}
+function buildCollectionHints(params, collection) {
+    const { permissions, roleId, readModel } = params;
+    const { isDevelopment } = permissions;
+    const schemaExposedActionNames = Object.keys(readModel.getActionEndpoints()[collection] ?? {});
+    const actions = Object.create(null);
+    for (const name of schemaExposedActionNames) {
+        actions[name] = isDevelopment
+            ? visibleWithoutApprovalHints(collection, name)
+            : normalModeAction(permissions, roleId, collection, name);
+    }
+    return { crud: buildCrudHints(permissions, roleId, collection), actions };
+}
+function buildPermissionHints(params) {
+    const permissions = params.actionPermissions;
+    const collections = Object.create(null);
+    const visibleActions = [];
+    for (const collection of params.collections) {
+        const hints = buildCollectionHints({ ...params, permissions }, collection);
+        collections[collection] = hints;
+        visibleActions.push(...Object.values(hints.actions)
+            .filter(action => action.visible)
+            .map(({ name }) => ({ collection, name })));
+    }
+    return { collections, visibleActions };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtcGVybWlzc2lvbi1oaW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wZXJtaXNzaW9ucy9idWlsZC1wZXJtaXNzaW9uLWhpbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQTZIQSx1Q0FnQkM7QUExSUQsd0VBQTJGO0FBRTNGLHlEQUFnRztBQUVuRixRQUFBLHFCQUFxQixHQUFHLGNBQWMsQ0FBQztBQTJDcEQsU0FBUyxjQUFjLENBQ3JCLFdBQThCLEVBQzlCLE1BQWMsRUFDZCxVQUFrQjtJQUVsQixNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQTZCLEVBQUUsRUFBRSxDQUM1QyxJQUFBLGlEQUE4QixFQUFDLFdBQVcsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBRTFFLE9BQU87UUFDTCxNQUFNLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLE1BQU0sQ0FBQztRQUN6QyxJQUFJLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLElBQUksQ0FBQztRQUNyQyxJQUFJLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLElBQUksQ0FBQztRQUNyQyxHQUFHLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLEdBQUcsQ0FBQztRQUNuQyxNQUFNLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLE1BQU0sQ0FBQztRQUN6QyxNQUFNLEVBQUUsR0FBRyxDQUFDLDBDQUFxQixDQUFDLE1BQU0sQ0FBQztLQUMxQyxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsMkJBQTJCLENBQUMsVUFBa0IsRUFBRSxJQUFZO0lBQ25FLE9BQU87UUFDTCxVQUFVO1FBQ1YsSUFBSTtRQUNKLE9BQU8sRUFBRSxJQUFJO1FBQ2Isb0JBQW9CLEVBQUUsS0FBSztRQUMzQixjQUFjLEVBQUUsS0FBSztRQUNyQixrQkFBa0IsRUFBRSxLQUFLO1FBQ3pCLFFBQVEsRUFBRSw2QkFBcUI7S0FDaEMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGdCQUFnQixDQUN2QixXQUE4QixFQUM5QixNQUFjLEVBQ2QsVUFBa0IsRUFDbEIsSUFBWTtJQUVaLE1BQU0sR0FBRyxHQUFHLENBQUMsS0FBd0IsRUFBRSxFQUFFLENBQ3ZDLElBQUEsNkNBQTBCLEVBQUM7UUFDekIsV0FBVztRQUNYLE1BQU07UUFDTixLQUFLO1FBQ0wsVUFBVSxFQUFFLElBQUk7UUFDaEIsY0FBYyxFQUFFLFVBQVU7S0FDM0IsQ0FBQyxDQUFDO0lBRUwsT0FBTztRQUNMLFVBQVU7UUFDVixJQUFJO1FBQ0osT0FBTyxFQUFFLEdBQUcsQ0FBQyxzQ0FBaUIsQ0FBQyxPQUFPLENBQUM7UUFDdkMsb0JBQW9CLEVBQUUsR0FBRyxDQUFDLHNDQUFpQixDQUFDLGVBQWUsQ0FBQztRQUM1RCxjQUFjLEVBQUUsR0FBRyxDQUFDLHNDQUFpQixDQUFDLE9BQU8sQ0FBQztRQUM5QyxrQkFBa0IsRUFBRSxHQUFHLENBQUMsc0NBQWlCLENBQUMsV0FBVyxDQUFDO1FBQ3RELFFBQVEsRUFBRSw2QkFBcUI7S0FDaEMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUMzQixNQUF1RSxFQUN2RSxVQUFrQjtJQUVsQixNQUFNLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbEQsTUFBTSxFQUFFLGFBQWEsRUFBRSxHQUFHLFdBQVcsQ0FBQztJQUN0QyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLGtCQUFrQixFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFFL0YsTUFBTSxPQUFPLEdBQWdDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFakUsS0FBSyxNQUFNLElBQUksSUFBSSx3QkFBd0IsRUFBRSxDQUFDO1FBQzVDLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxhQUFhO1lBQzNCLENBQUMsQ0FBQywyQkFBMkIsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQsT0FBTyxFQUFFLElBQUksRUFBRSxjQUFjLENBQUMsV0FBVyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUM1RSxDQUFDO0FBRUQsU0FBd0Isb0JBQW9CLENBQUMsTUFBa0M7SUFDN0UsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixDQUFDO0lBQzdDLE1BQU0sV0FBVyxHQUFvQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3pFLE1BQU0sY0FBYyxHQUF1QixFQUFFLENBQUM7SUFFOUMsS0FBSyxNQUFNLFVBQVUsSUFBSSxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDNUMsTUFBTSxLQUFLLEdBQUcsb0JBQW9CLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxXQUFXLEVBQUUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMzRSxXQUFXLENBQUMsVUFBVSxDQUFDLEdBQUcsS0FBSyxDQUFDO1FBQ2hDLGNBQWMsQ0FBQyxJQUFJLENBQ2pCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDO2FBQzVCLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7YUFDaEMsR0FBRyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQzdDLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsQ0FBQztBQUN6QyxDQUFDIn0=

package/dist/permissions/can-role-perform.d.ts

@@ -0,0 +1,12 @@
+import type { ActionPermissions, CollectionActionEvent, CustomActionEvent } from '@forestadmin/forestadmin-client';
+export declare function isActionIdentifierAllowedForRole(permissions: ActionPermissions, roleId: number, actionName: string): boolean;
+export declare function canRolePerformCollectionAction(permissions: ActionPermissions, roleId: number, action: CollectionActionEvent, collectionName: string): boolean;
+export interface CanRolePerformCustomActionParams {
+    permissions: ActionPermissions;
+    roleId: number;
+    event: CustomActionEvent;
+    actionName: string;
+    collectionName: string;
+}
+export declare function canRolePerformCustomAction({ permissions, roleId, event, actionName, collectionName, }: CanRolePerformCustomActionParams): boolean;
+//# sourceMappingURL=can-role-perform.d.ts.map

package/dist/permissions/can-role-perform.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isActionIdentifierAllowedForRole = isActionIdentifierAllowedForRole;
+exports.canRolePerformCollectionAction = canRolePerformCollectionAction;
+exports.canRolePerformCustomAction = canRolePerformCustomAction;
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+function isActionIdentifierAllowedForRole(permissions, roleId, actionName) {
+    return Boolean(permissions.isDevelopment ||
+        permissions.actionsGloballyAllowed.has(actionName) ||
+        permissions.actionsByRole.get(actionName)?.allowedRoles.has(roleId));
+}
+function canRolePerformCollectionAction(permissions, roleId, action, collectionName) {
+    return isActionIdentifierAllowedForRole(permissions, roleId, (0, forestadmin_client_1.generateCollectionActionIdentifier)(action, collectionName));
+}
+function canRolePerformCustomAction({ permissions, roleId, event, actionName, collectionName, }) {
+    return isActionIdentifierAllowedForRole(permissions, roleId, (0, forestadmin_client_1.generateCustomActionIdentifier)(event, actionName, collectionName));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2FuLXJvbGUtcGVyZm9ybS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wZXJtaXNzaW9ucy9jYW4tcm9sZS1wZXJmb3JtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBV0EsNEVBVUM7QUFFRCx3RUFXQztBQVVELGdFQVlDO0FBbERELHdFQUd5QztBQUV6QyxTQUFnQixnQ0FBZ0MsQ0FDOUMsV0FBOEIsRUFDOUIsTUFBYyxFQUNkLFVBQWtCO0lBRWxCLE9BQU8sT0FBTyxDQUNaLFdBQVcsQ0FBQyxhQUFhO1FBQ3ZCLFdBQVcsQ0FBQyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1FBQ2xELFdBQVcsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQ3RFLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBZ0IsOEJBQThCLENBQzVDLFdBQThCLEVBQzlCLE1BQWMsRUFDZCxNQUE2QixFQUM3QixjQUFzQjtJQUV0QixPQUFPLGdDQUFnQyxDQUNyQyxXQUFXLEVBQ1gsTUFBTSxFQUNOLElBQUEsdURBQWtDLEVBQUMsTUFBTSxFQUFFLGNBQWMsQ0FBQyxDQUMzRCxDQUFDO0FBQ0osQ0FBQztBQVVELFNBQWdCLDBCQUEwQixDQUFDLEVBQ3pDLFdBQVcsRUFDWCxNQUFNLEVBQ04sS0FBSyxFQUNMLFVBQVUsRUFDVixjQUFjLEdBQ21CO0lBQ2pDLE9BQU8sZ0NBQWdDLENBQ3JDLFdBQVcsRUFDWCxNQUFNLEVBQ04sSUFBQSxtREFBOEIsRUFBQyxLQUFLLEVBQUUsVUFBVSxFQUFFLGNBQWMsQ0FBQyxDQUNsRSxDQUFDO0FBQ0osQ0FBQyJ9

package/dist/permissions/permissions-cache.d.ts

@@ -0,0 +1,24 @@
+import type { ActionPermissions, UserPermissionV4 } from '@forestadmin/forestadmin-client';
+export declare const PERMISSIONS_CACHE_TTL_MS: number;
+export interface PermissionsCacheOptions {
+    now?: () => number;
+    ttlMs?: number;
+}
+export interface EvaluatedPermissions {
+    actionPermissions: ActionPermissions;
+    users: UserPermissionV4[];
+}
+export default class PermissionsCache {
+    private readonly now;
+    private readonly ttlMs;
+    private entry;
+    constructor({ now, ttlMs }?: PermissionsCacheOptions);
+    wasRejectedByLatestFetch(userId: number): boolean;
+    rememberRejected(userId: number): void;
+    getFresh(): EvaluatedPermissions | undefined;
+    set(permissions: EvaluatedPermissions): void;
+    get size(): number;
+    clear(): void;
+    private getFreshEntry;
+}
+//# sourceMappingURL=permissions-cache.d.ts.map

package/dist/permissions/permissions-cache.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSIONS_CACHE_TTL_MS = void 0;
+exports.PERMISSIONS_CACHE_TTL_MS = 15 * 60 * 1000;
+function sameUsers(previous, next) {
+    if (previous.length !== next.length)
+        return false;
+    const previousRoleById = new Map(previous.map(user => [user.id, user.roleId]));
+    return next.every(user => previousRoleById.get(user.id) === user.roleId);
+}
+class PermissionsCache {
+    constructor({ now = Date.now, ttlMs = exports.PERMISSIONS_CACHE_TTL_MS } = {}) {
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    wasRejectedByLatestFetch(userId) {
+        return this.getFreshEntry()?.rejectedUserIds.has(userId) ?? false;
+    }
+    rememberRejected(userId) {
+        this.getFreshEntry()?.rejectedUserIds.add(userId);
+    }
+    getFresh() {
+        return this.getFreshEntry()?.permissions;
+    }
+    set(permissions) {
+        const previous = this.getFreshEntry();
+        const carriesTheSameUsers = previous !== undefined && sameUsers(previous.permissions.users, permissions.users);
+        this.entry = {
+            permissions,
+            storedAt: this.now(),
+            rejectedUserIds: carriesTheSameUsers ? previous.rejectedUserIds : new Set(),
+        };
+    }
+    get size() {
+        return this.entry ? 1 : 0;
+    }
+    clear() {
+        this.entry = undefined;
+    }
+    getFreshEntry() {
+        if (!this.entry)
+            return undefined;
+        if (this.now() - this.entry.storedAt >= this.ttlMs) {
+            this.entry = undefined;
+            return undefined;
+        }
+        return this.entry;
+    }
+}
+exports.default = PermissionsCache;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMtY2FjaGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcGVybWlzc2lvbnMvcGVybWlzc2lvbnMtY2FjaGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBRWEsUUFBQSx3QkFBd0IsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQWtCdkQsU0FBUyxTQUFTLENBQUMsUUFBNEIsRUFBRSxJQUF3QjtJQUN2RSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQztJQUVsRCxNQUFNLGdCQUFnQixHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUUvRSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUMzRSxDQUFDO0FBRUQsTUFBcUIsZ0JBQWdCO0lBTW5DLFlBQVksRUFBRSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxLQUFLLEdBQUcsZ0NBQXdCLEtBQThCLEVBQUU7UUFDNUYsSUFBSSxDQUFDLEdBQUcsR0FBRyxHQUFHLENBQUM7UUFDZixJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztJQUNyQixDQUFDO0lBRUQsd0JBQXdCLENBQUMsTUFBYztRQUNyQyxPQUFPLElBQUksQ0FBQyxhQUFhLEVBQUUsRUFBRSxlQUFlLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQztJQUNwRSxDQUFDO0lBRUQsZ0JBQWdCLENBQUMsTUFBYztRQUM3QixJQUFJLENBQUMsYUFBYSxFQUFFLEVBQUUsZUFBZSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQsUUFBUTtRQUNOLE9BQU8sSUFBSSxDQUFDLGFBQWEsRUFBRSxFQUFFLFdBQVcsQ0FBQztJQUMzQyxDQUFDO0lBRUQsR0FBRyxDQUFDLFdBQWlDO1FBQ25DLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUN0QyxNQUFNLG1CQUFtQixHQUN2QixRQUFRLEtBQUssU0FBUyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFckYsSUFBSSxDQUFDLEtBQUssR0FBRztZQUNYLFdBQVc7WUFDWCxRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtZQUNwQixlQUFlLEVBQUUsbUJBQW1CLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLElBQUksR0FBRyxFQUFVO1NBQ3BGLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxJQUFJO1FBQ04sT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1QixDQUFDO0lBRUQsS0FBSztRQUNILElBQUksQ0FBQyxLQUFLLEdBQUcsU0FBUyxDQUFDO0lBQ3pCLENBQUM7SUFFTyxhQUFhO1FBQ25CLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRWxDLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNuRCxJQUFJLENBQUMsS0FBSyxHQUFHLFNBQVMsQ0FBQztZQUV2QixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDO0lBQ3BCLENBQUM7Q0FDRjtBQXRERCxtQ0FzREMifQ==

package/dist/permissions/permissions-client.d.ts

@@ -0,0 +1,21 @@
+import type { EnvironmentPermissionsV4, UserPermissionV4 } from '@forestadmin/forestadmin-client';
+export interface PermissionsClientOptions {
+    forestServerUrl: string;
+    envSecret: string;
+}
+export interface EnvironmentAndUserPermissions {
+    environmentPermissions: EnvironmentPermissionsV4;
+    users: UserPermissionV4[];
+}
+export interface PermissionsFetcher {
+    fetchPermissions(): Promise<EnvironmentAndUserPermissions>;
+}
+export default class PermissionsClient implements PermissionsFetcher {
+    private readonly api;
+    private readonly options;
+    private inFlight;
+    constructor(options: PermissionsClientOptions);
+    fetchPermissions(): Promise<EnvironmentAndUserPermissions>;
+    private doFetchPermissions;
+}
+//# sourceMappingURL=permissions-client.d.ts.map

package/dist/permissions/permissions-client.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+class PermissionsClient {
+    constructor(options) {
+        this.inFlight = null;
+        this.api = new forestadmin_client_1.ForestHttpApi();
+        this.options = options;
+    }
+    fetchPermissions() {
+        if (!this.inFlight) {
+            this.inFlight = this.doFetchPermissions().finally(() => {
+                this.inFlight = null;
+            });
+        }
+        return this.inFlight;
+    }
+    async doFetchPermissions() {
+        const [environmentPermissions, users] = await Promise.all([
+            this.api.getEnvironmentPermissions(this.options),
+            this.api.getUsers(this.options),
+        ]);
+        return { environmentPermissions, users };
+    }
+}
+exports.default = PermissionsClient;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMtY2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Blcm1pc3Npb25zL3Blcm1pc3Npb25zLWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUVBLHdFQUFnRTtBQWdCaEUsTUFBcUIsaUJBQWlCO0lBTXBDLFlBQVksT0FBaUM7UUFGckMsYUFBUSxHQUFrRCxJQUFJLENBQUM7UUFHckUsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLGtDQUFhLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztJQUN6QixDQUFDO0lBRUQsZ0JBQWdCO1FBQ2QsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7Z0JBQ3JELElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQztJQUN2QixDQUFDO0lBRU8sS0FBSyxDQUFDLGtCQUFrQjtRQUM5QixNQUFNLENBQUMsc0JBQXNCLEVBQUUsS0FBSyxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1lBQ3hELElBQUksQ0FBQyxHQUFHLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUNoRCxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO1NBQ2hDLENBQUMsQ0FBQztRQUVILE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0NBQ0Y7QUE3QkQsb0NBNkJDIn0=

package/dist/permissions/permissions-routes-middleware.d.ts

@@ -0,0 +1,13 @@
+import type PermissionsCache from './permissions-cache';
+import type { PermissionsFetcher } from './permissions-client';
+import type { Logger } from '../ports/logger-port';
+import type ReadModelStore from '../read-model/read-model-store';
+import type { Middleware } from 'koa';
+export interface PermissionsRoutesMiddlewareOptions {
+    store: ReadModelStore;
+    client: PermissionsFetcher;
+    cache: PermissionsCache;
+    logger: Logger;
+}
+export default function createPermissionsRoutesMiddleware({ store, client, cache, logger, }: PermissionsRoutesMiddlewareOptions): Middleware;
+//# sourceMappingURL=permissions-routes-middleware.d.ts.map

package/dist/permissions/permissions-routes-middleware.js

@@ -0,0 +1,99 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createPermissionsRoutesMiddleware;
+const forestadmin_client_1 = require("@forestadmin/forestadmin-client");
+const build_permission_hints_1 = __importDefault(require("./build-permission-hints"));
+const agent_route_helpers_1 = require("../http/agent-route-helpers");
+const bff_http_error_1 = require("../http/bff-http-error");
+const bff_local_errors_1 = require("../http/bff-local-errors");
+const PERMISSIONS_ROUTE = '/agent/v1/permissions';
+const UNAVAILABLE_RETRY_AFTER_SECONDS = 5;
+function resolveCaller(ctx) {
+    const principal = ctx.state.principal;
+    if (principal)
+        return { userId: principal.id };
+    const identity = ctx.state.apiKeyIdentity;
+    if (identity)
+        return { userId: identity.user.id };
+    throw (0, bff_http_error_1.unauthorized)('No caller identity for this request');
+}
+function resolveRequestedCollections(ctx, readModel) {
+    const raw = ctx.query.collections;
+    if (raw === undefined)
+        return readModel.getAllowedCollections();
+    const value = Array.isArray(raw) ? raw.join(',') : raw;
+    const requested = value
+        .split(',')
+        .map(name => name.trim())
+        .filter(name => name !== '');
+    return [...new Set(requested.filter(name => readModel.isCollectionAllowed(name)))];
+}
+function findCallerRoleId(users, userId) {
+    return users.find(user => user.id === userId)?.roleId;
+}
+async function resolvePermissions({ cache, client, logger, }) {
+    let resolved;
+    try {
+        resolved = await client.fetchPermissions();
+    }
+    catch (error) {
+        logger('Warn', 'Permission resolution failed', {
+            cause: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+        });
+        const stillFresh = cache.getFresh();
+        if (stillFresh)
+            return { permissions: stillFresh, fromFreshFetch: false };
+        throw (0, bff_local_errors_1.permissionsUnavailable)(UNAVAILABLE_RETRY_AFTER_SECONDS);
+    }
+    const permissions = {
+        actionPermissions: (0, forestadmin_client_1.generateActionsFromPermissions)(resolved.environmentPermissions),
+        users: resolved.users,
+    };
+    cache.set(permissions);
+    return { permissions, fromFreshFetch: true };
+}
+async function resolveCallerPermissions({ caller, cache, client, logger, }) {
+    const cached = cache.getFresh();
+    const cachedRoleId = cached && findCallerRoleId(cached.users, caller.userId);
+    if (cached && cachedRoleId !== undefined) {
+        return { permissions: cached, roleId: cachedRoleId };
+    }
+    if (cache.wasRejectedByLatestFetch(caller.userId))
+        throw (0, bff_local_errors_1.forestIdentityNotAllowed)();
+    const { permissions, fromFreshFetch } = await resolvePermissions({ cache, client, logger });
+    const roleId = findCallerRoleId(permissions.users, caller.userId);
+    if (roleId === undefined) {
+        if (fromFreshFetch)
+            cache.rememberRejected(caller.userId);
+        throw (0, bff_local_errors_1.forestIdentityNotAllowed)();
+    }
+    return { permissions, roleId };
+}
+function createPermissionsRoutesMiddleware({ store, client, cache, logger, }) {
+    return async function permissionsRoutesMiddleware(ctx, next) {
+        if (ctx.path !== PERMISSIONS_ROUTE || ctx.method !== 'GET') {
+            await next();
+            return;
+        }
+        const caller = resolveCaller(ctx);
+        const { permissions, roleId } = await resolveCallerPermissions({
+            caller,
+            cache,
+            client,
+            logger,
+        });
+        const readModel = await (0, agent_route_helpers_1.resolveReadModel)(store);
+        const collections = resolveRequestedCollections(ctx, readModel);
+        ctx.status = 200;
+        ctx.body = (0, build_permission_hints_1.default)({
+            actionPermissions: permissions.actionPermissions,
+            roleId,
+            readModel,
+            collections,
+        });
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMtcm91dGVzLW1pZGRsZXdhcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcGVybWlzc2lvbnMvcGVybWlzc2lvbnMtcm91dGVzLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFpSUEsb0RBZ0NDO0FBdEpELHdFQUFpRjtBQUVqRixzRkFBNEQ7QUFDNUQscUVBQStEO0FBQy9ELDJEQUFzRDtBQUN0RCwrREFBNEY7QUFFNUYsTUFBTSxpQkFBaUIsR0FBRyx1QkFBdUIsQ0FBQztBQUNsRCxNQUFNLCtCQUErQixHQUFHLENBQUMsQ0FBQztBQWExQyxTQUFTLGFBQWEsQ0FBQyxHQUFZO0lBQ2pDLE1BQU0sU0FBUyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBOEMsQ0FBQztJQUUzRSxJQUFJLFNBQVM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztJQUUvQyxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQW9ELENBQUM7SUFFaEYsSUFBSSxRQUFRO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO0lBRWxELE1BQU0sSUFBQSw2QkFBWSxFQUFDLHFDQUFxQyxDQUFDLENBQUM7QUFDNUQsQ0FBQztBQUVELFNBQVMsMkJBQTJCLENBQUMsR0FBWSxFQUFFLFNBQW9CO0lBQ3JFLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO0lBRWxDLElBQUksR0FBRyxLQUFLLFNBQVM7UUFBRSxPQUFPLFNBQVMsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO0lBRWhFLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUN2RCxNQUFNLFNBQVMsR0FBRyxLQUFLO1NBQ3BCLEtBQUssQ0FBQyxHQUFHLENBQUM7U0FDVixHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7U0FDeEIsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBRS9CLE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDckYsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsS0FBeUIsRUFBRSxNQUFjO0lBQ2pFLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssTUFBTSxDQUFDLEVBQUUsTUFBTSxDQUFDO0FBQ3hELENBQUM7QUFFRCxLQUFLLFVBQVUsa0JBQWtCLENBQUMsRUFDaEMsS0FBSyxFQUNMLE1BQU0sRUFDTixNQUFNLEdBS1A7SUFDQyxJQUFJLFFBQXVDLENBQUM7SUFFNUMsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE1BQU0sTUFBTSxDQUFDLGdCQUFnQixFQUFFLENBQUM7SUFDN0MsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLENBQUMsTUFBTSxFQUFFLDhCQUE4QixFQUFFO1lBQzdDLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO1NBQ2xGLENBQUMsQ0FBQztRQUVILE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUVwQyxJQUFJLFVBQVU7WUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFFMUUsTUFBTSxJQUFBLHlDQUFzQixFQUFDLCtCQUErQixDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVELE1BQU0sV0FBVyxHQUF5QjtRQUN4QyxpQkFBaUIsRUFBRSxJQUFBLG1EQUE4QixFQUFDLFFBQVEsQ0FBQyxzQkFBc0IsQ0FBQztRQUNsRixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUs7S0FDdEIsQ0FBQztJQUVGLEtBQUssQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFdkIsT0FBTyxFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDL0MsQ0FBQztBQUVELEtBQUssVUFBVSx3QkFBd0IsQ0FBQyxFQUN0QyxNQUFNLEVBQ04sS0FBSyxFQUNMLE1BQU0sRUFDTixNQUFNLEdBTVA7SUFDQyxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDaEMsTUFBTSxZQUFZLEdBQUcsTUFBTSxJQUFJLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRTdFLElBQUksTUFBTSxJQUFJLFlBQVksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6QyxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFBRSxNQUFNLElBQUEsMkNBQXdCLEdBQUUsQ0FBQztJQUVwRixNQUFNLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sa0JBQWtCLENBQUMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDNUYsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFbEUsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDekIsSUFBSSxjQUFjO1lBQUUsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUUxRCxNQUFNLElBQUEsMkNBQXdCLEdBQUUsQ0FBQztJQUNuQyxDQUFDO0lBRUQsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUNqQyxDQUFDO0FBRUQsU0FBd0IsaUNBQWlDLENBQUMsRUFDeEQsS0FBSyxFQUNMLE1BQU0sRUFDTixLQUFLLEVBQ0wsTUFBTSxHQUM2QjtJQUNuQyxPQUFPLEtBQUssVUFBVSwyQkFBMkIsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUN6RCxJQUFJLEdBQUcsQ0FBQyxJQUFJLEtBQUssaUJBQWlCLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxLQUFLLEVBQUUsQ0FBQztZQUMzRCxNQUFNLElBQUksRUFBRSxDQUFDO1lBRWIsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbEMsTUFBTSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLHdCQUF3QixDQUFDO1lBQzdELE1BQU07WUFDTixLQUFLO1lBQ0wsTUFBTTtZQUNOLE1BQU07U0FDUCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsc0NBQWdCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDaEQsTUFBTSxXQUFXLEdBQUcsMkJBQTJCLENBQUMsR0FBRyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBRWhFLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1FBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsSUFBQSxnQ0FBb0IsRUFBQztZQUM5QixpQkFBaUIsRUFBRSxXQUFXLENBQUMsaUJBQWlCO1lBQ2hELE1BQU07WUFDTixTQUFTO1lBQ1QsV0FBVztTQUNaLENBQUMsQ0FBQztJQUNMLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/read-model/agent-capabilities-fetcher.d.ts

@@ -1,12 +1,17 @@
 import type { CapabilitiesFetcher } from './capabilities-cache';
 export interface AgentCapabilitiesFetcherOptions {
     agentUrl: string;
-    token: string;
+    /** A borrowed request token, or a factory when the caller can mint one per fetch. */
+    token: string | (() => string);
     timeoutMs?: number;
 }
 /**
- * Builds a capabilities fetcher bound to a request's agent token. The cache calls it only on a
- * miss, so the token of whichever request first populates a collection is the one used.
+ * Builds a capabilities fetcher bound to an agent token. The cache calls it only on a miss, so the
+ * token of whichever request first populates a collection is the one used.
+ *
+ * A factory exists for the token because an agent token lives 5 minutes: a caller fanning out over
+ * hundreds of collections can outlive a single one, and the tail of that fan-out would fail on an
+ * expired token. A request can only borrow its caller's, so it passes the string.
  */
 export default function createAgentCapabilitiesFetcher({ agentUrl, token, timeoutMs, }: AgentCapabilitiesFetcherOptions): CapabilitiesFetcher;
 //# sourceMappingURL=agent-capabilities-fetcher.d.ts.map

package/dist/read-model/agent-capabilities-fetcher.js

@@ -7,15 +7,23 @@ exports.default = createAgentCapabilitiesFetcher;
 const agent_client_1 = require("@forestadmin/agent-client");
 const create_agent_http_requester_1 = __importDefault(require("../agent/create-agent-http-requester"));
 /**
- * Builds a capabilities fetcher bound to a request's agent token. The cache calls it only on a
- * miss, so the token of whichever request first populates a collection is the one used.
+ * Builds a capabilities fetcher bound to an agent token. The cache calls it only on a miss, so the
+ * token of whichever request first populates a collection is the one used.
+ *
+ * A factory exists for the token because an agent token lives 5 minutes: a caller fanning out over
+ * hundreds of collections can outlive a single one, and the tail of that fan-out would fail on an
+ * expired token. A request can only borrow its caller's, so it passes the string.
  */
 function createAgentCapabilitiesFetcher({ agentUrl, token, timeoutMs, }) {
-    const client = (0, agent_client_1.createRemoteAgentClient)({
+    const clientFor = (bearer) => (0, agent_client_1.createRemoteAgentClient)({
         url: agentUrl,
-        token,
-        httpRequester: (0, create_agent_http_requester_1.default)(token, agentUrl, timeoutMs),
+        token: bearer,
+        httpRequester: (0, create_agent_http_requester_1.default)(bearer, agentUrl, timeoutMs),
     });
-    return collection => client.collection(collection).capabilities();
+    if (typeof token === 'string') {
+        const client = clientFor(token);
+        return collection => client.collection(collection).capabilities();
+    }
+    return collection => clientFor(token()).collection(collection).capabilities();
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtY2FwYWJpbGl0aWVzLWZldGNoZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVhZC1tb2RlbC9hZ2VudC1jYXBhYmlsaXRpZXMtZmV0Y2hlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQWdCQSxpREFZQztBQTFCRCw0REFBb0U7QUFFcEUsdUdBQTRFO0FBUTVFOzs7R0FHRztBQUNILFNBQXdCLDhCQUE4QixDQUFDLEVBQ3JELFFBQVEsRUFDUixLQUFLLEVBQ0wsU0FBUyxHQUN1QjtJQUNoQyxNQUFNLE1BQU0sR0FBRyxJQUFBLHNDQUF1QixFQUFDO1FBQ3JDLEdBQUcsRUFBRSxRQUFRO1FBQ2IsS0FBSztRQUNMLGFBQWEsRUFBRSxJQUFBLHFDQUF3QixFQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDO0tBQ3BFLENBQUMsQ0FBQztJQUVILE9BQU8sVUFBVSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFlBQVksRUFBRSxDQUFDO0FBQ3BFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtY2FwYWJpbGl0aWVzLWZldGNoZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVhZC1tb2RlbC9hZ2VudC1jYXBhYmlsaXRpZXMtZmV0Y2hlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQXFCQSxpREFtQkM7QUF0Q0QsNERBQW9FO0FBRXBFLHVHQUE0RTtBQVM1RTs7Ozs7OztHQU9HO0FBQ0gsU0FBd0IsOEJBQThCLENBQUMsRUFDckQsUUFBUSxFQUNSLEtBQUssRUFDTCxTQUFTLEdBQ3VCO0lBQ2hDLE1BQU0sU0FBUyxHQUFHLENBQUMsTUFBYyxFQUFFLEVBQUUsQ0FDbkMsSUFBQSxzQ0FBdUIsRUFBQztRQUN0QixHQUFHLEVBQUUsUUFBUTtRQUNiLEtBQUssRUFBRSxNQUFNO1FBQ2IsYUFBYSxFQUFFLElBQUEscUNBQXdCLEVBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUM7S0FDckUsQ0FBQyxDQUFDO0lBRUwsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM5QixNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFaEMsT0FBTyxVQUFVLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsWUFBWSxFQUFFLENBQUM7SUFDcEUsQ0FBQztJQUVELE9BQU8sVUFBVSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsWUFBWSxFQUFFLENBQUM7QUFDaEYsQ0FBQyJ9

package/dist/read-model/capabilities-cache.d.ts

@@ -1,7 +1,17 @@
+/**
+ * A Forest column type: a primitive name, a one-element array wrapping another type, a composite
+ * `{ fields }`, or a relation marker like `ManyToOne`.
+ */
+export type FieldType = string | FieldType[] | {
+    fields: {
+        field: string;
+        type: FieldType;
+    }[];
+};
 export interface CapabilitiesResult {
     fields: {
         name: string;
-        type: string;
+        type: FieldType;
         operators?: string[];
     }[];
 }

package/dist/read-model/capabilities-cache.js

@@ -44,4 +44,4 @@ class CapabilitiesCache {
     }
 }
 exports.default = CapabilitiesCache;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2FwYWJpbGl0aWVzLWNhY2hlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3JlYWQtbW9kZWwvY2FwYWJpbGl0aWVzLWNhY2hlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsaURBQTRDO0FBa0I1Qzs7O0dBR0c7QUFDSCxNQUFxQixpQkFBaUI7SUFRcEMsWUFBWSxFQUFFLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEtBQUssR0FBRyx5QkFBVSxLQUErQixFQUFFO1FBSmhFLFlBQU8sR0FBRyxJQUFJLEdBQUcsRUFBc0IsQ0FBQztRQUN4QyxhQUFRLEdBQUcsSUFBSSxHQUFHLEVBQXVDLENBQUM7UUFDbkUsZUFBVSxHQUFHLENBQUMsQ0FBQztRQUdyQixJQUFJLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztRQUNmLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO0lBQ3JCLENBQUM7SUFFRCxLQUFLLENBQUMsR0FBRyxDQUFDLFVBQWtCLEVBQUUsT0FBNEI7UUFDeEQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDM0MsSUFBSSxLQUFLLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFFNUUsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDOUMsSUFBSSxPQUFPO1lBQUUsT0FBTyxPQUFPLENBQUM7UUFFNUIsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQztRQUM1QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDO2FBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUNiLHlGQUF5RjtZQUN6RixxRkFBcUY7WUFDckYsSUFBSSxJQUFJLENBQUMsVUFBVSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUNuQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDbEUsQ0FBQztZQUVELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUMsQ0FBQzthQUNELE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDWixJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEtBQUs7Z0JBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEYsQ0FBQyxDQUFDLENBQUM7UUFFTCxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFFckMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsS0FBSztRQUNILElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QixDQUFDO0NBQ0Y7QUE3Q0Qsb0NBNkNDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2FwYWJpbGl0aWVzLWNhY2hlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3JlYWQtbW9kZWwvY2FwYWJpbGl0aWVzLWNhY2hlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsaURBQTRDO0FBMEI1Qzs7O0dBR0c7QUFDSCxNQUFxQixpQkFBaUI7SUFRcEMsWUFBWSxFQUFFLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEtBQUssR0FBRyx5QkFBVSxLQUErQixFQUFFO1FBSmhFLFlBQU8sR0FBRyxJQUFJLEdBQUcsRUFBc0IsQ0FBQztRQUN4QyxhQUFRLEdBQUcsSUFBSSxHQUFHLEVBQXVDLENBQUM7UUFDbkUsZUFBVSxHQUFHLENBQUMsQ0FBQztRQUdyQixJQUFJLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztRQUNmLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO0lBQ3JCLENBQUM7SUFFRCxLQUFLLENBQUMsR0FBRyxDQUFDLFVBQWtCLEVBQUUsT0FBNEI7UUFDeEQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDM0MsSUFBSSxLQUFLLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFFNUUsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDOUMsSUFBSSxPQUFPO1lBQUUsT0FBTyxPQUFPLENBQUM7UUFFNUIsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQztRQUM1QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDO2FBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUNiLHlGQUF5RjtZQUN6RixxRkFBcUY7WUFDckYsSUFBSSxJQUFJLENBQUMsVUFBVSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUNuQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDbEUsQ0FBQztZQUVELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUMsQ0FBQzthQUNELE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDWixJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEtBQUs7Z0JBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEYsQ0FBQyxDQUFDLENBQUM7UUFFTCxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFFckMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsS0FBSztRQUNILElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QixDQUFDO0NBQ0Y7QUE3Q0Qsb0NBNkNDIn0=

package/dist/read-model/read-model.d.ts

@@ -14,6 +14,10 @@ export type PrimaryKeyField = {
     name: string;
     type: string;
 };
+export type ListableRelation = {
+    name: string;
+    foreignCollection: string;
+};
 /**
  * The agent read-model derived from a schema. Names are collection-scoped: relations and actions
  * are keyed by `(collection, name)` so the same relation/action name on two collections stays
@@ -23,6 +27,7 @@ export type PrimaryKeyField = {
 export default class ReadModel {
     private readonly collections;
     private readonly relations;
+    private readonly listableRelations;
     private readonly actionEndpoints;
     private readonly primaryKeys;
     constructor(collections: ForestSchemaCollection[]);
@@ -30,6 +35,16 @@ export default class ReadModel {
     private buildActionEndpoints;
     private buildPrimaryKeys;
     isCollectionAllowed(collection: string): boolean;
+    /** A fresh copy per call, so a consumer cannot mutate the shared cached read-model. */
+    getAllowedCollections(): string[];
+    /**
+     * The to-many, non-polymorphic relations of a collection — the only ones with a list/count route.
+     * The foreign collection is NOT checked against the allow-list here: the data routes must keep
+     * telling a non-listable relation (404 unknown_relation) from a listable one pointing at a hidden
+     * collection (404 unknown_collection), so that filter belongs to each caller.
+     */
+    getListableRelations(collection: string): ListableRelation[];
+    getListableRelationTarget(collection: string, relation: string): string | undefined;
     isRelationAllowed(collection: string, relation: string): boolean;
     getRelationTarget(collection: string, relation: string): RelationTarget | undefined;
     isActionAllowed(collection: string, action: string): boolean;