@guardian/permissions-client 0.0.0 → 0.0.2

package/LICENSE

@@ -0,0 +1,8 @@
+This software is licensed under the Apache 2 license, quoted below.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this project except in compliance with
+the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific
+language governing permissions and limitations under the License.

package/README.md

@@ -0,0 +1,47 @@
+# `@guardian/permissions-client`
+
+Client for reading Guardian user permissions data in Node.js services
+
+## Installation
+
+```bash
+npm install @guardian/permissions-client
+```
+
+or
+
+```bash
+pnpm add @guardian/permissions-client
+```
+
+(`@aws-sdk/client-s3` and `@aws-sdk/credential-providers` must also be installed)
+
+## Usage
+
+```js
+import { init } from '@guardian/permissions-client';
+
+const { hasPermission } = init({ isRunningLocally: true });
+
+const doesLiamHaveGridAccess = await hasPermission(
+	'grid_access',
+	'liam.duffy@guardian.co.uk',
+);
+```
+
+## Releasing
+
+The Node client library is published to NPM using [Changesets](https://changesets.dev/)
+
+- Please follow [semver](https://semver.org/) principles:
+  - **Patch**: bug fixes and backwards-compatible changes.
+  - **Minor**: backwards-compatible new features.
+  - **Major**: breaking changes.
+
+- Run `npx changeset` to create a changeset when you make changes that should be included in a release.
+  - Follow the prompts to describe your changes, ensuring you choose `node-client` as the package being release, and select the appropriate version bump (patch, minor, major).
+  - This will generate a markdown file in the `.changeset` directory.
+  - Commit the changeset file along with your code changes.
+
+- Once your changes are merged into the `main` branch, the changeset will be picked up in the next release cycle, and the version will be bumped accordingly and the package released once the generated `🦋 Release package updates` PR is merged.
+- You can also create a canary release from a branch by opening a PR and adding the `🐥 Canaries` label, this can be useful for testing your changes with a downstream project before creating a production-ready release.

package/dist/cjs/index.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const normalise_ts_1 = require("./normalise.js");
+let permissionsResult = {
+    allPermissions: {},
+    loadTime: null,
+};
+let permissionsRequest = Promise.resolve(permissionsResult);
+const permissionValidForUser = (userEntry) => !!(userEntry.active && !userEntry.isCasualNotOnShift);
+function init({ stage = 'CODE', region = 'eu-west-1', bucket = 'permissions-cache', file = 'permissions.json', cacheIntervalMs = 60_000, // 1 minute,
+isRunningLocally = false, localProfile = 'workflow', } = {}) {
+    const awsConfig = {
+        region,
+        credentials: isRunningLocally
+            ? (0, credential_providers_1.fromIni)({ profile: localProfile })
+            : (0, credential_providers_1.fromNodeProviderChain)(),
+    };
+    const s3 = new client_s3_1.S3(awsConfig);
+    async function loadPermissions() {
+        const { Body } = await s3.getObject({
+            Bucket: bucket,
+            Key: `${stage}/${file}`,
+        });
+        if (!Body) {
+            throw Error('Could not fetch permissions');
+        }
+        const transformedBody = await Body.transformToString();
+        const permissionsCache = JSON.parse(transformedBody);
+        const allPermissions = (0, normalise_ts_1.normalisePermissionsCache)(permissionsCache);
+        return { allPermissions, loadTime: Date.now() };
+    }
+    async function getOrRefresh() {
+        const latestResult = await permissionsRequest;
+        const cacheExpired = latestResult.loadTime !== null
+            ? Date.now() > latestResult.loadTime + cacheIntervalMs
+            : true;
+        if (cacheExpired) {
+            try {
+                permissionsRequest = loadPermissions();
+                permissionsResult = await permissionsRequest;
+            }
+            catch (error) {
+                console.error('Refreshing permissions cache failed with error, so keeping stale cache...', error);
+            }
+        }
+        return permissionsResult.allPermissions;
+    }
+    async function hasPermission(permissionName, userId) {
+        const permissionsCache = await getOrRefresh();
+        const userEntry = permissionsCache[userId]?.[permissionName];
+        return userEntry ? permissionValidForUser(userEntry) : false;
+    }
+    async function listUserPermissions(userId) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache[userId] ?? {})
+            .filter(([, userEntry]) => permissionValidForUser(userEntry))
+            .flatMap(([permissionName]) => permissionName);
+    }
+    async function listUsersWithPermission(permissionName) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache)
+            .filter(([, userPermissions]) => {
+            const userEntry = userPermissions[permissionName];
+            return userEntry && permissionValidForUser(userEntry);
+        })
+            .flatMap(([userId]) => userId);
+    }
+    function storeIsEmpty() {
+        return permissionsResult.loadTime === null;
+    }
+    // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
+    void getOrRefresh();
+    return {
+        hasPermission,
+        listUserPermissions,
+        listUsersWithPermission,
+        storeIsEmpty,
+    };
+}

package/dist/cjs/model.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/normalise.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalisePermissionsCache = void 0;
+// Invert shape of permissions cache, so we can look up permissions data without looping
+const normalisePermissionsCache = (permissionsCache) => {
+    return permissionsCache.reduce((acc, p) => {
+        const { permission, overrides } = p;
+        overrides.forEach(({ userId, active, isCasualNotOnShift }) => {
+            acc[userId] ??= {};
+            acc[userId][permission.name] = {
+                permission,
+                active,
+                isCasualNotOnShift,
+            };
+        });
+        return acc;
+    }, {});
+};
+exports.normalisePermissionsCache = normalisePermissionsCache;

package/dist/declaration/index.d.ts

@@ -10,7 +10,8 @@ interface ClientConfig {
 export declare function init({ stage, region, bucket, file, cacheIntervalMs, // 1 minute,
 isRunningLocally, localProfile, }?: ClientConfig): {
     hasPermission: (permissionName: string, userId: string) => Promise<boolean>;
-    listPermissions: (userId: string) => Promise<string[]>;
+    listUserPermissions: (userId: string) => Promise<string[]>;
+    listUsersWithPermission: (permissionName: string) => Promise<string[]>;
     storeIsEmpty: () => boolean;
 };
 export {};

package/dist/declaration/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/declaration/model.d.ts

@@ -1,4 +1,4 @@
-interface UserSetting {
+interface UserOverride {
     userId: string;
     active: boolean;
     isCasualNotOnShift: boolean;
@@ -8,9 +8,24 @@ interface PermissionDefinition {
     app: string;
     defaultValue: boolean;
 }
-export interface PermissionWithUsers {
+interface PermissionWithOverrides {
     permission: PermissionDefinition;
-    overrides: UserSetting[];
+    overrides: UserOverride[];
 }
-export type PermissionsCache = PermissionWithUsers[];
+export type PermissionsCache = PermissionWithOverrides[];
+export interface UserEntry {
+    permission: PermissionDefinition;
+    active: boolean;
+    isCasualNotOnShift: boolean;
+}
+/**
+ * I would find an interface more readable here than a record, but @typescript-eslint/consistent-indexed-object-style says no
+ * Here's what it would look like as an interface, with named types for the keys
+ * interface NormalisedPermissionsCache {
+ *   [userId: string]: {
+ *     [permissionName: string]: UserEntry;
+ *   }
+ * }
+ */
+export type NormalisedPermissionsCache = Record<string, Record<string, UserEntry>>;
 export {};

package/dist/declaration/normalise.d.ts

@@ -0,0 +1,2 @@
+import type { NormalisedPermissionsCache, PermissionsCache } from './model.ts';
+export declare const normalisePermissionsCache: (permissionsCache: PermissionsCache) => NormalisedPermissionsCache;

package/dist/esm/index.js

@@ -0,0 +1,79 @@
+import { S3 } from '@aws-sdk/client-s3';
+import { fromIni, fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { normalisePermissionsCache } from "./normalise.js";
+let permissionsResult = {
+    allPermissions: {},
+    loadTime: null,
+};
+let permissionsRequest = Promise.resolve(permissionsResult);
+const permissionValidForUser = (userEntry) => !!(userEntry.active && !userEntry.isCasualNotOnShift);
+export function init({ stage = 'CODE', region = 'eu-west-1', bucket = 'permissions-cache', file = 'permissions.json', cacheIntervalMs = 60_000, // 1 minute,
+isRunningLocally = false, localProfile = 'workflow', } = {}) {
+    const awsConfig = {
+        region,
+        credentials: isRunningLocally
+            ? fromIni({ profile: localProfile })
+            : fromNodeProviderChain(),
+    };
+    const s3 = new S3(awsConfig);
+    async function loadPermissions() {
+        const { Body } = await s3.getObject({
+            Bucket: bucket,
+            Key: `${stage}/${file}`,
+        });
+        if (!Body) {
+            throw Error('Could not fetch permissions');
+        }
+        const transformedBody = await Body.transformToString();
+        const permissionsCache = JSON.parse(transformedBody);
+        const allPermissions = normalisePermissionsCache(permissionsCache);
+        return { allPermissions, loadTime: Date.now() };
+    }
+    async function getOrRefresh() {
+        const latestResult = await permissionsRequest;
+        const cacheExpired = latestResult.loadTime !== null
+            ? Date.now() > latestResult.loadTime + cacheIntervalMs
+            : true;
+        if (cacheExpired) {
+            try {
+                permissionsRequest = loadPermissions();
+                permissionsResult = await permissionsRequest;
+            }
+            catch (error) {
+                console.error('Refreshing permissions cache failed with error, so keeping stale cache...', error);
+            }
+        }
+        return permissionsResult.allPermissions;
+    }
+    async function hasPermission(permissionName, userId) {
+        const permissionsCache = await getOrRefresh();
+        const userEntry = permissionsCache[userId]?.[permissionName];
+        return userEntry ? permissionValidForUser(userEntry) : false;
+    }
+    async function listUserPermissions(userId) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache[userId] ?? {})
+            .filter(([, userEntry]) => permissionValidForUser(userEntry))
+            .flatMap(([permissionName]) => permissionName);
+    }
+    async function listUsersWithPermission(permissionName) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache)
+            .filter(([, userPermissions]) => {
+            const userEntry = userPermissions[permissionName];
+            return userEntry && permissionValidForUser(userEntry);
+        })
+            .flatMap(([userId]) => userId);
+    }
+    function storeIsEmpty() {
+        return permissionsResult.loadTime === null;
+    }
+    // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
+    void getOrRefresh();
+    return {
+        hasPermission,
+        listUserPermissions,
+        listUsersWithPermission,
+        storeIsEmpty,
+    };
+}

package/dist/esm/index.test.js

@@ -0,0 +1,165 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import assert from 'node:assert';
+import { randomUUID } from 'node:crypto';
+import { mock, test } from 'node:test';
+const mockPermissionsCache = [
+    {
+        permission: {
+            name: 'permission1',
+            app: 'app1',
+            defaultValue: false,
+        },
+        overrides: [
+            {
+                userId: 'user1',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user2',
+                active: false,
+                isCasualNotOnShift: true,
+            },
+            {
+                userId: 'user3',
+                active: true,
+                isCasualNotOnShift: true,
+            },
+        ],
+    },
+    {
+        permission: {
+            name: 'permission2',
+            app: 'app1',
+            defaultValue: false,
+        },
+        overrides: [
+            {
+                userId: 'user1',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user2',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user3',
+                active: false,
+                isCasualNotOnShift: false,
+            },
+        ],
+    },
+];
+let currentMockPermissionsCache = mockPermissionsCache;
+const originalCredentialProviders = await import('@aws-sdk/credential-providers');
+mock.module('@aws-sdk/credential-providers', {
+    exports: {
+        ...originalCredentialProviders,
+        fromNodeProviderChain: () => () => Promise.resolve({}),
+    },
+});
+const originalClientS3 = await import('@aws-sdk/client-s3');
+mock.module('@aws-sdk/client-s3', {
+    exports: {
+        ...originalClientS3,
+        S3: class {
+            getObject() {
+                return Promise.resolve({
+                    Body: {
+                        transformToString: () => Promise.resolve(JSON.stringify(currentMockPermissionsCache)),
+                    },
+                });
+            }
+        },
+    },
+});
+const getClient = async () => {
+    // This is required to get a fresh instance of the module for each test, with a new cache state.
+    const { init } = (await import(__rewriteRelativeImportExtension(`./index.ts?cache-bust=${randomUUID()}`)));
+    return init();
+};
+test('hasPermission() returns true for a user with active: true in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user1');
+    assert.equal(result, true);
+});
+test('hasPermission() returns false for a user with active: false in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user2');
+    assert.equal(result, false);
+});
+test('hasPermission() returns false for a user who is not present in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user9001');
+    assert.equal(result, false);
+});
+test('hasPermission() returns false for a user with active: true but isCasualNotOnShift: true in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user3');
+    assert.equal(result, false);
+});
+test('hasPermission() returns the latest permission information when the cache expires', async () => {
+    mock.timers.enable();
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user1');
+    assert.equal(result, true);
+    const updatedPermissionsCache = [
+        {
+            permission: {
+                name: 'permission1',
+                app: 'app1',
+                defaultValue: false,
+            },
+            overrides: [
+                {
+                    userId: 'user1',
+                    active: false,
+                    isCasualNotOnShift: false,
+                },
+            ],
+        },
+    ];
+    currentMockPermissionsCache = updatedPermissionsCache;
+    mock.timers.tick(30_000);
+    const resultAfter30Seconds = await client.hasPermission('permission1', 'user1');
+    assert.equal(resultAfter30Seconds, true);
+    mock.timers.tick(30_001);
+    const resultAfter60Seconds = await client.hasPermission('permission1', 'user1');
+    assert.equal(resultAfter60Seconds, false);
+    // Reset to original state
+    currentMockPermissionsCache = mockPermissionsCache;
+});
+test('listUserPermissions() returns list of valid permissions for user', async () => {
+    const client = await getClient();
+    const user1Result = await client.listUserPermissions('user1');
+    assert.deepEqual(user1Result, ['permission1', 'permission2']);
+    const user2Result = await client.listUserPermissions('user2');
+    assert.deepEqual(user2Result, ['permission2']);
+    const user3Result = await client.listUserPermissions('user3');
+    assert.deepEqual(user3Result, []);
+});
+test('listUsersWithPermission() returns list of users validated for a given permission', async () => {
+    const client = await getClient();
+    const permission1Result = await client.listUsersWithPermission('permission1');
+    assert.deepEqual(permission1Result, ['user1']);
+    const permission2Result = await client.listUsersWithPermission('permission2');
+    assert.deepEqual(permission2Result, ['user1', 'user2']);
+});
+test('storeIsEmpty() returns true when cache is empty, and false when cache is populated', async (t) => {
+    const client = await getClient();
+    const initialResult = client.storeIsEmpty();
+    assert.equal(initialResult, true);
+    t.waitFor(() => {
+        const laterResult = client.storeIsEmpty();
+        assert.equal(laterResult, false);
+    });
+});

package/dist/esm/model.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/normalise.js

@@ -0,0 +1,15 @@
+// Invert shape of permissions cache, so we can look up permissions data without looping
+export const normalisePermissionsCache = (permissionsCache) => {
+    return permissionsCache.reduce((acc, p) => {
+        const { permission, overrides } = p;
+        overrides.forEach(({ userId, active, isCasualNotOnShift }) => {
+            acc[userId] ??= {};
+            acc[userId][permission.name] = {
+                permission,
+                active,
+                isCasualNotOnShift,
+            };
+        });
+        return acc;
+    }, {});
+};

package/package.json

@@ -1,27 +1,37 @@
 {
-	"name": "@guardian/permissions-client",
-	"version": "0.0.0",
-	"description": "Client for Guardian's permissions service",
-	"scripts": {
-		"build": "tsc",
-		"test": "echo \"Error: no test specified\" && exit 1",
-		"format": "prettier --write \"src/**/*.ts\"",
-		"format:ci": "prettier --check \"src/**/*.ts\"",
-		"lint": "eslint src/** --ext .ts"
-	},
-	"type": "module",
-	"exports": {
-		".": {
-			"import": "./dist/index.js",
-			"types": "./dist/declaration/index.d.ts"
-		}
-	},
-	"devDependencies": {
-		"@aws-sdk/client-s3": "3.1090.0",
-		"@aws-sdk/credential-providers": "^3.1090.0"
-	},
-	"peerDependencies": {
-		"@aws-sdk/client-s3": "^3.1090.0",
-		"@aws-sdk/credential-providers": "^3.1090.0"
-	}
-}
+  "name": "@guardian/permissions-client",
+  "version": "0.0.2",
+  "description": "Client for Guardian's permissions service",
+  "repository": {
+    "url": "https://github.com/guardian/permissions",
+    "directory": "node-client"
+  },
+  "type": "module",
+  "main": "./dist/cjs/index.js",
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js",
+      "types": "./dist/declaration/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@aws-sdk/client-s3": "3.1090.0",
+    "@aws-sdk/credential-providers": "^3.1090.0"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.1090.0",
+    "@aws-sdk/credential-providers": "^3.1090.0"
+  },
+  "prettier": "@guardian/prettier",
+  "scripts": {
+    "build": "tsc --project tsconfig.emit.json && tsc --project tsconfig.emit-cjs.json",
+    "test": "node --test --test-timeout=500 --experimental-test-module-mocks src/**/*.test.ts",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "format:ci": "prettier --check \"src/**/*.ts\"",
+    "lint": "eslint src/** --ext .ts"
+  }
+}

package/dist/index.js

@@ -1,73 +0,0 @@
-import { S3 } from "@aws-sdk/client-s3";
-import { fromIni, fromNodeProviderChain } from "@aws-sdk/credential-providers";
-let permissionsResult = {
-    allPermissions: [],
-    loadTime: null,
-};
-let permissionsRequest = Promise.resolve(permissionsResult);
-const permissionValidForUser = (permission, userId) => {
-    const userOverride = permission.overrides.find((o) => o.userId === userId);
-    return !!(userOverride?.active && !userOverride.isCasualNotOnShift);
-};
-export function init({ stage = "CODE", region = "eu-west-1", bucket = "permissions-cache", file = "permissions.json", cacheIntervalMs = 60_000, // 1 minute,
-isRunningLocally = false, localProfile = "workflow", } = {}) {
-    const awsConfig = {
-        region,
-        credentials: isRunningLocally
-            ? fromIni({ profile: localProfile })
-            : fromNodeProviderChain(),
-    };
-    const s3 = new S3(awsConfig);
-    async function loadPermissions() {
-        const { Body } = await s3.getObject({
-            Bucket: bucket,
-            Key: `${stage}/${file}`,
-        });
-        if (!Body) {
-            throw Error("Could not fetch permissions");
-        }
-        const transformedBody = await Body.transformToString();
-        const allPermissions = JSON.parse(transformedBody);
-        return { allPermissions, loadTime: Date.now() };
-    }
-    async function getOrRefresh() {
-        const latestResult = await permissionsRequest;
-        const cacheExpired = latestResult.loadTime
-            ? Date.now() > latestResult.loadTime + cacheIntervalMs
-            : true;
-        if (cacheExpired) {
-            try {
-                permissionsRequest = loadPermissions();
-                permissionsResult = await permissionsRequest;
-            }
-            catch (error) {
-                console.error("Refreshing permissions cache failed with error, so keeping stale cache...", error);
-            }
-        }
-        return permissionsResult.allPermissions;
-    }
-    async function hasPermission(permissionName, userId) {
-        const permissionsCache = await getOrRefresh();
-        const permissionData = permissionsCache.find((p) => p.permission.name === permissionName);
-        if (!permissionData) {
-            throw Error(`Permission data for "${permissionName}" not found`);
-        }
-        return permissionValidForUser(permissionData, userId);
-    }
-    async function listPermissions(userId) {
-        const permissionsCache = await getOrRefresh();
-        return permissionsCache
-            .filter((p) => permissionValidForUser(p, userId))
-            .map((p) => p.permission.name);
-    }
-    function storeIsEmpty() {
-        return permissionsResult.loadTime === null;
-    }
-    // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
-    void getOrRefresh();
-    return {
-        hasPermission,
-        listPermissions,
-        storeIsEmpty,
-    };
-}

package/dist/model.js

@@ -1,2 +0,0 @@
-// TODO: should we have runtime type checking with zod, or just trust what's coming back from the bucket?
-export {};

package/src/index.ts

@@ -1,124 +0,0 @@
-import { S3 } from "@aws-sdk/client-s3";
-import { fromIni, fromNodeProviderChain } from "@aws-sdk/credential-providers";
-import type { PermissionsCache, PermissionWithUsers } from "./model";
-
-interface ClientConfig {
-  stage?: string;
-  region?: string;
-  bucket?: string;
-  file?: string;
-  cacheIntervalMs?: number;
-  isRunningLocally?: boolean;
-  localProfile?: string;
-}
-
-type PermissionsResult = {
-  allPermissions: PermissionsCache;
-  loadTime: number | null;
-};
-
-let permissionsResult: PermissionsResult = {
-  allPermissions: [],
-  loadTime: null,
-};
-let permissionsRequest: Promise<PermissionsResult> =
-  Promise.resolve(permissionsResult);
-
-const permissionValidForUser = (
-  permission: PermissionWithUsers,
-  userId: string,
-) => {
-  const userOverride = permission.overrides.find((o) => o.userId === userId);
-
-  return !!(userOverride?.active && !userOverride.isCasualNotOnShift);
-};
-
-export function init({
-  stage = "CODE",
-  region = "eu-west-1",
-  bucket = "permissions-cache",
-  file = "permissions.json",
-  cacheIntervalMs = 60_000, // 1 minute,
-  isRunningLocally = false,
-  localProfile = "workflow",
-}: ClientConfig = {}) {
-  const awsConfig = {
-    region,
-    credentials: isRunningLocally
-      ? fromIni({ profile: localProfile })
-      : fromNodeProviderChain(),
-  };
-
-  const s3 = new S3(awsConfig);
-
-  async function loadPermissions() {
-    const { Body } = await s3.getObject({
-      Bucket: bucket,
-      Key: `${stage}/${file}`,
-    });
-
-    if (!Body) {
-      throw Error("Could not fetch permissions");
-    }
-
-    const transformedBody = await Body.transformToString();
-    const allPermissions = JSON.parse(transformedBody) as PermissionsCache;
-
-    return { allPermissions, loadTime: Date.now() };
-  }
-
-  async function getOrRefresh() {
-    const latestResult = await permissionsRequest;
-    const cacheExpired = latestResult.loadTime
-      ? Date.now() > latestResult.loadTime + cacheIntervalMs
-      : true;
-
-    if (cacheExpired) {
-      try {
-        permissionsRequest = loadPermissions();
-        permissionsResult = await permissionsRequest;
-      } catch (error) {
-        console.error(
-          "Refreshing permissions cache failed with error, so keeping stale cache...",
-          error,
-        );
-      }
-    }
-
-    return permissionsResult.allPermissions;
-  }
-
-  async function hasPermission(permissionName: string, userId: string) {
-    const permissionsCache = await getOrRefresh();
-    const permissionData = permissionsCache.find(
-      (p) => p.permission.name === permissionName,
-    );
-
-    if (!permissionData) {
-      throw Error(`Permission data for "${permissionName}" not found`);
-    }
-
-    return permissionValidForUser(permissionData, userId);
-  }
-
-  async function listPermissions(userId: string) {
-    const permissionsCache = await getOrRefresh();
-
-    return permissionsCache
-      .filter((p) => permissionValidForUser(p, userId))
-      .map((p) => p.permission.name);
-  }
-
-  function storeIsEmpty() {
-    return permissionsResult.loadTime === null;
-  }
-
-  // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
-  void getOrRefresh();
-
-  return {
-    hasPermission,
-    listPermissions,
-    storeIsEmpty,
-  };
-}

package/src/model.ts

@@ -1,20 +0,0 @@
-// TODO: should we have runtime type checking with zod, or just trust what's coming back from the bucket?
-
-interface UserSetting {
-  userId: string;
-  active: boolean;
-  isCasualNotOnShift: boolean;
-}
-
-interface PermissionDefinition {
-  name: string;
-  app: string;
-  defaultValue: boolean;
-}
-
-export interface PermissionWithUsers {
-  permission: PermissionDefinition;
-  overrides: UserSetting[];
-}
-
-export type PermissionsCache = PermissionWithUsers[];

package/tsconfig.json

@@ -1,16 +0,0 @@
-{
-  "extends": "@guardian/tsconfig/tsconfig.json",
-  "allowImportingTsExtensions": true,
-  "compilerOptions": {
-    "module": "esnext",
-    "types": [
-      "vitest/globals",
-      "node"
-    ],
-    "declaration": true,
-    "rootDir": "./src",
-    "outDir": "dist",
-    "declarationDir": "dist/declaration",
-  },
-  "include": ["src/**/*"],
-}