@forgezero/access 0.1.13 → 0.1.15

package/dist/vault.js

@@ -0,0 +1,264 @@
+// src/schema.ts
+var contractType = Symbol("forgezero.contract.type");
+var optionalProperty = Symbol("forgezero.contract.optional");
+function freeze(schema) {
+  return Object.freeze(schema);
+}
+var schema = Object.freeze({
+  unknown: () => freeze({}),
+  string: (options = {}) => freeze({ type: "string", ...options }),
+  number: (options = {}) => freeze({ type: "number", ...options }),
+  integer: (options = {}) => freeze({ type: "integer", ...options }),
+  boolean: () => freeze({ type: "boolean" }),
+  null: () => freeze({ type: "null" }),
+  literal: (value) => freeze({ const: value }),
+  optional: (value) => Object.freeze({ ...value, [optionalProperty]: true }),
+  array: (items, options = {}) => freeze({ type: "array", items, ...options }),
+  union: (...members) => freeze({ anyOf: members }),
+  object: (properties, options = { additionalProperties: false }) => {
+    const required = Object.entries(properties).filter(([, value]) => !(optionalProperty in value)).map(([key]) => key);
+    const cleanProperties = Object.fromEntries(Object.entries(properties).map(([key, value]) => {
+      if (!(optionalProperty in value))
+        return [key, value];
+      const { [optionalProperty]: _, ...clean } = value;
+      return [key, clean];
+    }));
+    return freeze({ type: "object", properties: cleanProperties, required, ...options });
+  },
+  record: (values, options = {}) => freeze({
+    type: "object",
+    properties: {},
+    additionalProperties: values,
+    ...options.minProperties === undefined ? {} : { minProperties: options.minProperties },
+    ...options.maxProperties === undefined ? {} : { maxProperties: options.maxProperties },
+    ...options.keyPattern === undefined ? {} : { propertyNames: { pattern: options.keyPattern } }
+  })
+});
+function extend(base, extension) {
+  const baseProperties = base.properties ?? {};
+  const extensionProperties = extension.properties ?? {};
+  const required = [...new Set([
+    ...base.required ?? [],
+    ...extension.required ?? []
+  ])];
+  return freeze({
+    type: "object",
+    properties: { ...baseProperties, ...extensionProperties },
+    required,
+    additionalProperties: false
+  });
+}
+function pick(source, keys) {
+  const sourceProperties = source.properties ?? {};
+  const selected = Object.fromEntries(keys.map((key) => [key, sourceProperties[key]]));
+  const required = (source.required ?? []).filter((key) => keys.includes(key));
+  return freeze({ type: "object", properties: selected, required, additionalProperties: false });
+}
+function omit(source, keys) {
+  const omitted = new Set(keys);
+  const sourceProperties = source.properties ?? {};
+  const selected = Object.fromEntries(Object.entries(sourceProperties).filter(([key]) => !omitted.has(key)));
+  const required = (source.required ?? []).filter((key) => !omitted.has(key));
+  return freeze({ type: "object", properties: selected, required, additionalProperties: false });
+}
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function validate(current, value, path, issues) {
+  if (issues.length >= 32)
+    return false;
+  if ("const" in current) {
+    const valid = value === current.const;
+    if (!valid)
+      issues.push({ path, expected: JSON.stringify(current.const) });
+    return valid;
+  }
+  if (Array.isArray(current.anyOf)) {
+    for (const member of current.anyOf) {
+      const candidate = [];
+      if (validate(member, value, path, candidate))
+        return true;
+    }
+    issues.push({ path, expected: "one declared union member" });
+    return false;
+  }
+  if (current.type === "string") {
+    const valid = typeof value === "string" && (typeof current.minLength !== "number" || value.length >= current.minLength) && (typeof current.maxLength !== "number" || value.length <= current.maxLength) && (typeof current.pattern !== "string" || new RegExp(current.pattern).test(value));
+    if (!valid)
+      issues.push({ path, expected: "declared string" });
+    return valid;
+  }
+  if (current.type === "number" || current.type === "integer") {
+    const valid = typeof value === "number" && Number.isFinite(value) && (current.type !== "integer" || Number.isSafeInteger(value)) && (typeof current.minimum !== "number" || value >= current.minimum) && (typeof current.maximum !== "number" || value <= current.maximum);
+    if (!valid)
+      issues.push({ path, expected: `declared ${String(current.type)}` });
+    return valid;
+  }
+  if (current.type === "boolean" || current.type === "null") {
+    const valid = current.type === "boolean" ? typeof value === "boolean" : value === null;
+    if (!valid)
+      issues.push({ path, expected: String(current.type) });
+    return valid;
+  }
+  if (current.type === "array") {
+    if (!Array.isArray(value)) {
+      issues.push({ path, expected: "array" });
+      return false;
+    }
+    let valid = (typeof current.minItems !== "number" || value.length >= current.minItems) && (typeof current.maxItems !== "number" || value.length <= current.maxItems);
+    if (current.uniqueItems === true && new Set(value.map((entry) => JSON.stringify(entry))).size !== value.length)
+      valid = false;
+    if (!valid)
+      issues.push({ path, expected: "bounded declared array" });
+    for (let index = 0;index < value.length && issues.length < 32; index += 1) {
+      valid = validate(current.items, value[index], `${path}[${index}]`, issues) && valid;
+    }
+    return valid;
+  }
+  if (current.type === "object") {
+    if (!record(value)) {
+      issues.push({ path, expected: "object" });
+      return false;
+    }
+    const properties = current.properties ?? {};
+    const required = new Set(current.required ?? []);
+    let valid = (typeof current.minProperties !== "number" || Object.keys(value).length >= current.minProperties) && (typeof current.maxProperties !== "number" || Object.keys(value).length <= current.maxProperties);
+    if (!valid)
+      issues.push({ path, expected: "bounded property count" });
+    const keyPattern = current.propertyNames?.pattern;
+    if (typeof keyPattern === "string") {
+      for (const key of Object.keys(value))
+        if (!new RegExp(keyPattern).test(key)) {
+          issues.push({ path: `${path}.${key}`, expected: "declared property name" });
+          valid = false;
+        }
+    }
+    for (const key of required) {
+      if (!(key in value)) {
+        issues.push({ path: `${path}.${key}`, expected: "required property" });
+        valid = false;
+      }
+    }
+    if (current.additionalProperties === false) {
+      for (const key of Object.keys(value)) {
+        if (!(key in properties)) {
+          issues.push({ path: `${path}.${key}`, expected: "no additional property" });
+          valid = false;
+        }
+      }
+    } else if (record(current.additionalProperties)) {
+      for (const [key, child] of Object.entries(value)) {
+        if (!(key in properties))
+          valid = validate(current.additionalProperties, child, `${path}.${key}`, issues) && valid;
+      }
+    }
+    for (const [key, child] of Object.entries(properties)) {
+      if (key in value)
+        valid = validate(child, value[key], `${path}.${key}`, issues) && valid;
+    }
+    return valid;
+  }
+  return true;
+}
+function parse(contract, value) {
+  const issues = [];
+  return validate(contract, value, "$", issues) ? { ok: true, value } : { ok: false, issues };
+}
+
+// src/vault.ts
+var KeySchema = schema.string({ minLength: 1, maxLength: 128, pattern: "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" });
+var EnvironmentKeySchema = schema.string({ minLength: 1, maxLength: 64, pattern: "^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$" });
+var SchemaCoordinateSchema = schema.string({ minLength: 1, maxLength: 192, pattern: "^[A-Za-z0-9][A-Za-z0-9._:/-]*@[1-9][0-9]{0,8}$" });
+var VaultDomainSchema = schema.union(schema.literal("service"), schema.literal("platform-authority"), schema.literal("deployment"));
+var VaultEntryScopeSchema = schema.union(schema.object({ kind: schema.literal("account") }), schema.object({ kind: schema.literal("project"), projectKey: KeySchema }), schema.object({ kind: schema.literal("deployment"), projectKey: KeySchema, deploymentKey: KeySchema }));
+var VaultAccessTargetSchema = schema.object({
+  projectKey: KeySchema,
+  deploymentKey: schema.optional(schema.union(KeySchema, schema.null()))
+});
+var DeploymentCredentialPurposeSchema = schema.union(schema.literal("deployment-infrastructure"), schema.literal("runtime-secret"));
+var DeploymentCredentialRequirementSchema = schema.object({
+  alias: KeySchema,
+  purpose: DeploymentCredentialPurposeSchema,
+  schema: schema.optional(SchemaCoordinateSchema),
+  defaultEntryKey: KeySchema
+});
+var DeploymentVaultBindingSchema = schema.object({
+  alias: KeySchema,
+  purpose: DeploymentCredentialPurposeSchema,
+  projectKey: KeySchema,
+  deploymentKey: KeySchema,
+  vaultEntryRef: KeySchema,
+  environmentKey: EnvironmentKeySchema,
+  entryKey: KeySchema,
+  schema: SchemaCoordinateSchema
+});
+var DeploymentVaultBindingsSchema = schema.record(DeploymentVaultBindingSchema, {
+  maxProperties: 128,
+  keyPattern: "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+});
+var DeploymentVaultEntryTypeSchema = schema.union(schema.literal("text"), schema.literal("secret"), schema.literal("json"));
+var DeploymentVaultEntryBaseSchema = schema.object({
+  projectKey: KeySchema,
+  deploymentKey: KeySchema,
+  environmentKey: EnvironmentKeySchema,
+  entryKey: KeySchema,
+  schema: schema.optional(SchemaCoordinateSchema),
+  description: schema.optional(schema.string({ minLength: 1, maxLength: 512 }))
+});
+var ManualDeploymentVaultEntryInputSchema = schema.union(extend(DeploymentVaultEntryBaseSchema, schema.object({
+  entryType: schema.literal("text"),
+  value: schema.string({ minLength: 1, maxLength: 262144 })
+})), extend(DeploymentVaultEntryBaseSchema, schema.object({
+  entryType: schema.literal("secret"),
+  value: schema.string({ minLength: 1, maxLength: 262144 })
+})), extend(DeploymentVaultEntryBaseSchema, schema.object({
+  entryType: schema.literal("json"),
+  value: schema.string({ minLength: 1, maxLength: 262144 })
+})));
+var DeploymentVaultEntryInputSchema = schema.union(ManualDeploymentVaultEntryInputSchema, extend(DeploymentVaultEntryBaseSchema, schema.object({
+  schema: SchemaCoordinateSchema,
+  value: schema.unknown()
+})));
+var PipelineVaultBindRequestSchema = schema.object({
+  pipelineKey: KeySchema,
+  alias: KeySchema,
+  environmentKey: EnvironmentKeySchema,
+  entryKey: KeySchema
+});
+var PipelineVaultUnbindRequestSchema = schema.object({
+  pipelineKey: KeySchema,
+  alias: KeySchema
+});
+var DeploymentVaultCreateAndBindRequestSchema = schema.object({
+  pipelineKey: KeySchema,
+  alias: KeySchema,
+  entry: DeploymentVaultEntryInputSchema
+});
+function validVaultEntryScope(value) {
+  return parse(VaultEntryScopeSchema, value).ok;
+}
+function vaultScopeAllows(scope, target) {
+  if (scope.kind === "account")
+    return true;
+  if (scope.projectKey !== target.projectKey)
+    return false;
+  return scope.kind === "project" || scope.deploymentKey === target.deploymentKey;
+}
+function deploymentBindingAllows(binding, target) {
+  return binding.projectKey === target.projectKey && binding.deploymentKey === target.deploymentKey && binding.alias === target.alias;
+}
+export {
+  vaultScopeAllows,
+  validVaultEntryScope,
+  deploymentBindingAllows,
+  VaultEntryScopeSchema,
+  VaultDomainSchema,
+  VaultAccessTargetSchema,
+  PipelineVaultUnbindRequestSchema,
+  PipelineVaultBindRequestSchema,
+  DeploymentVaultEntryTypeSchema,
+  DeploymentVaultEntryInputSchema,
+  DeploymentVaultCreateAndBindRequestSchema,
+  DeploymentVaultBindingsSchema,
+  DeploymentVaultBindingSchema,
+  DeploymentCredentialRequirementSchema,
+  DeploymentCredentialPurposeSchema
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/access",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -66,6 +66,14 @@
     "./ceremony-modes": {
       "types": "./dist/ceremony-modes.d.ts",
       "default": "./dist/ceremony-modes.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "default": "./dist/schema.js"
+    },
+    "./vault": {
+      "types": "./dist/vault.d.ts",
+      "default": "./dist/vault.js"
     }
   },
   "scripts": {