@githolon/dsl 0.108.7 → 0.110.1

package/src/codegen_workspace_access.ts

@@ -0,0 +1,105 @@
+import type { LawGraph, LawFieldNode, LawQueryReadNode } from "./law_graph.js";
+import { composedWireIdentity, operationMessageIdentity, protoFieldName, protoMessageName } from "./codegen_call_proto.js";
+import { emitDartQueryProtoEncoder, emitTsQueryProtoEncoder } from "./codegen_query_proto.js";
+
+/** Generate a narrow projection of a normal RelationTuple query. Every protobuf
+ * member comes from the same composed law graph; no copied tags or USDA parser. */
+function accessReadShape(graph: LawGraph, paths: ReadonlyMap<string, string>) {
+  const nodes = new Map(graph.nodes.map(node => [node.entity.id, node]));
+  const aggregate = graph.nodes.find(node => node.kind === "aggregate" && node.entity.label === "RelationTuple");
+  const query = graph.nodes.find((node): node is LawQueryReadNode => node.kind === "read" &&
+    node.readKind === "query" && node.entity.label === "receivedWorkspaceAccess");
+  if (aggregate?.kind !== "aggregate" || query === undefined) throw new Error("Home access discovery requires RelationTuple and its object query");
+  const field = (name: string): LawFieldNode => {
+    const node = aggregate.fields.map(ref => nodes.get(ref.id)).find(node => node?.kind === "field" && node.entity.label === name);
+    if (node?.kind !== "field") throw new Error(`RelationTuple has no ${name} field`);
+    return node;
+  };
+  const member = (sid: string) => protoFieldName(sid).replace(/_([a-zA-Z0-9])/g, (_, c: string) => c.toUpperCase());
+  const has = (name: string) => `has${name[0]!.toUpperCase()}${name.slice(1)}()`;
+  const object = member(composedWireIdentity(paths, field("object").entity));
+  const relation = member(composedWireIdentity(paths, field("relation").entity));
+  const subjects = member(composedWireIdentity(paths, field("subjects").entity));
+  const map = nodes.get(field("subjects").value.id);
+  if (map?.kind !== "structural" || map.structuralKind !== "value-type" || map.expression.kind !== "map") {
+    throw new Error("RelationTuple.subjects must be the declared typed map");
+  }
+  const leaf = nodes.get(map.expression.value.id);
+  const statusNode = leaf?.kind === "type"
+    ? leaf.fields.map(ref => nodes.get(ref.id)).find(node => node?.kind === "field" && node.entity.label === "status")
+    : leaf?.kind === "structural" && leaf.structuralKind === "value-type" && leaf.expression.kind === "record"
+    ? leaf.expression.fields.map(ref => nodes.get(ref.id)).find(node => node?.kind === "structural" && node.structuralKind === "value-field" && node.name === "status")
+    : undefined;
+  if (statusNode === undefined) throw new Error("RelationshipSubject has no typed status field");
+  const status = member(composedWireIdentity(paths, statusNode.entity));
+  const result = protoMessageName("QueryResult", operationMessageIdentity(graph, query.entity.sid));
+  const rows = member(`${query.entity.sid}:result:rows`);
+  return { query, object, relation, subjects, status, result, rows, has };
+}
+
+export function generateDartWorkspaceAccessRead(graph: LawGraph, paths: ReadonlyMap<string, string>): string {
+  const { query, object, relation, subjects, status, result, rows, has } = accessReadShape(graph, paths);
+  const encoder = emitDartQueryProtoEncoder(graph, paths, graph.domain.entity.label, query.entity.label,
+    [{ authoredPath: "object", name: "object", type: "String", value: "object", kind: "string" }]);
+  return [
+    "// Generated from Home's RelationTuple law and protoc operation bindings. No lifecycle state.",
+    "// ignore_for_file: invalid_use_of_internal_member",
+    "import 'dart:typed_data';",
+    "import 'package:nomos_client/src/nms_generated_runtime.dart' show NomosSession, NmsGeneratedQuery, NmsInternalGeneratedQueries;",
+    "import 'operation_payloads.pb.dart' as _nmsop;",
+    ...encoder.source,
+    "Future<List<({String workspace, String object, String relation})>> nomosInternalReadReceivedAccess(NomosSession session, String principal) async {",
+    "  final object = 'received-access:$principal';",
+    `  final result = await session.nmsQuery(${encoder.call});`,
+    `  if (result.protobufType != ${JSON.stringify(`type.nomos.dev/nomos.operation.v1.QueryResult_${query.entity.sid}`)}) throw const FormatException('Received access query returned the wrong nominal type');`,
+    `  final message = _nmsop.${result}.fromBuffer(result.protobufPayload);`,
+    "  final access = <({String workspace, String object, String relation})>[];",
+    `  for (final row in message.${rows}) {`,
+    `    if (!row.${has(object)} || !row.${has(relation)} || row.${object} != object) throw const FormatException('Received access query returned a foreign object');`,
+    `    if (row.${relation} != 'receivedAccess') continue;`,
+    `    for (final entry in row.${subjects}.entries) {`,
+    `      if (!entry.hasValue() || !entry.value.${has(status)}) throw const FormatException('Received access relationship has no status');`,
+    `      if (entry.value.${status} == 'revoked') continue;`,
+    `      if (entry.value.${status} != 'active') throw const FormatException('Received access relationship has an unknown status');`,
+    "      final match = RegExp(r'^shared:([^/]+)/(.+)/([1-9][0-9]*)#([A-Za-z0-9][A-Za-z0-9_.-]*)$').firstMatch(entry.key);",
+    "      if (match == null) throw const FormatException('Malformed source-qualified access relationship');",
+    "      access.add((workspace: match.group(1)!, object: match.group(2)!, relation: match.group(4)!));",
+    "    }",
+    "  }",
+    "  return access;",
+    "}",
+  ].join("\n");
+}
+
+/** Same nominal kernel query as Dart. The generated function owns no cache or delivery. */
+export function generateTsWorkspaceAccessRead(graph: LawGraph, paths: ReadonlyMap<string, string>) {
+  const { query, object, relation, subjects, status, result, rows } = accessReadShape(graph, paths);
+  const encoder = emitTsQueryProtoEncoder(graph, paths, graph.domain.entity.label, query.entity.label,
+    [{ authoredPath: "object", name: "object", type: "string", value: "object", kind: "string" }]);
+  const encodeName = `${encoder.functionName}_receivedAccess`;
+  const functionName = `_nmsReceivedAccess_${query.entity.sid}`;
+  return { functionName, source: [
+    ...encoder.source.map(line => line.replaceAll(encoder.functionName, encodeName)),
+    `async function ${functionName}(holon: NomosHolon): Promise<readonly { workspace: string; object: string; relation: string }[]> {`,
+    "  if (!holon.principal) throw new Error('No signed-in principal');",
+    "  const object = 'received-access:' + holon.principal;",
+    `  const result = await holon.__nomosQuery(${encoder.call.replaceAll(encoder.functionName, encodeName)});`,
+    `  if (result.protobufType !== ${JSON.stringify(`type.nomos.dev/nomos.operation.v1.QueryResult_${query.entity.sid}`)}) throw new Error('Received access query returned the wrong nominal type');`,
+    `  const message = fromBinary(_nmsop.${result}Schema, result.protobufPayload);`,
+    "  const access: { workspace: string; object: string; relation: string }[] = [];",
+    `  for (const row of message.${rows}) {`,
+    `    if (row.${object} !== object) throw new Error('Received access query returned a foreign object');`,
+    `    if (row.${relation} !== 'receivedAccess') continue;`,
+    `    for (const entry of row.${subjects}?.entries ?? []) {`,
+    `      if (entry.value?.${status} === 'revoked') continue;`,
+    `      if (entry.value?.${status} !== 'active') throw new Error('Received access relationship has an unknown status');`,
+    "      if (typeof entry.key !== 'string') throw new Error('Received access relationship has no subject');",
+    "      const match = /^shared:([^/]+)\\/(.+)\\/([1-9][0-9]*)#([A-Za-z0-9][A-Za-z0-9_.-]*)$/.exec(entry.key);",
+    "      if (!match) throw new Error('Malformed source-qualified access relationship');",
+    "      access.push({ workspace: match[1]!, object: match[2]!, relation: match[4]! });",
+    "    }",
+    "  }",
+    "  return access;",
+    "}",
+  ] };
+}