@guardian/permissions-client 0.0.1 → 0.0.2

package/README.md

@@ -1,6 +1,6 @@
 # `@guardian/permissions-client`
 
-Client for reading Guardian user permissions data in Node.js backends
+Client for reading Guardian user permissions data in Node.js services
 
 ## Installation
 
@@ -19,12 +19,29 @@ pnpm add @guardian/permissions-client
 ## Usage
 
 ```js
-import { init } from "@guardian/permissions-client";
+import { init } from '@guardian/permissions-client';
 
 const { hasPermission } = init({ isRunningLocally: true });
 
 const doesLiamHaveGridAccess = await hasPermission(
-  "grid_access",
-  "liam.duffy@guardian.co.uk",
+	'grid_access',
+	'liam.duffy@guardian.co.uk',
 );
 ```
+
+## Releasing
+
+The Node client library is published to NPM using [Changesets](https://changesets.dev/)
+
+- Please follow [semver](https://semver.org/) principles:
+  - **Patch**: bug fixes and backwards-compatible changes.
+  - **Minor**: backwards-compatible new features.
+  - **Major**: breaking changes.
+
+- Run `npx changeset` to create a changeset when you make changes that should be included in a release.
+  - Follow the prompts to describe your changes, ensuring you choose `node-client` as the package being release, and select the appropriate version bump (patch, minor, major).
+  - This will generate a markdown file in the `.changeset` directory.
+  - Commit the changeset file along with your code changes.
+
+- Once your changes are merged into the `main` branch, the changeset will be picked up in the next release cycle, and the version will be bumped accordingly and the package released once the generated `🦋 Release package updates` PR is merged.
+- You can also create a canary release from a branch by opening a PR and adding the `🐥 Canaries` label, this can be useful for testing your changes with a downstream project before creating a production-ready release.

package/dist/cjs/index.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const normalise_ts_1 = require("./normalise.js");
+let permissionsResult = {
+    allPermissions: {},
+    loadTime: null,
+};
+let permissionsRequest = Promise.resolve(permissionsResult);
+const permissionValidForUser = (userEntry) => !!(userEntry.active && !userEntry.isCasualNotOnShift);
+function init({ stage = 'CODE', region = 'eu-west-1', bucket = 'permissions-cache', file = 'permissions.json', cacheIntervalMs = 60_000, // 1 minute,
+isRunningLocally = false, localProfile = 'workflow', } = {}) {
+    const awsConfig = {
+        region,
+        credentials: isRunningLocally
+            ? (0, credential_providers_1.fromIni)({ profile: localProfile })
+            : (0, credential_providers_1.fromNodeProviderChain)(),
+    };
+    const s3 = new client_s3_1.S3(awsConfig);
+    async function loadPermissions() {
+        const { Body } = await s3.getObject({
+            Bucket: bucket,
+            Key: `${stage}/${file}`,
+        });
+        if (!Body) {
+            throw Error('Could not fetch permissions');
+        }
+        const transformedBody = await Body.transformToString();
+        const permissionsCache = JSON.parse(transformedBody);
+        const allPermissions = (0, normalise_ts_1.normalisePermissionsCache)(permissionsCache);
+        return { allPermissions, loadTime: Date.now() };
+    }
+    async function getOrRefresh() {
+        const latestResult = await permissionsRequest;
+        const cacheExpired = latestResult.loadTime !== null
+            ? Date.now() > latestResult.loadTime + cacheIntervalMs
+            : true;
+        if (cacheExpired) {
+            try {
+                permissionsRequest = loadPermissions();
+                permissionsResult = await permissionsRequest;
+            }
+            catch (error) {
+                console.error('Refreshing permissions cache failed with error, so keeping stale cache...', error);
+            }
+        }
+        return permissionsResult.allPermissions;
+    }
+    async function hasPermission(permissionName, userId) {
+        const permissionsCache = await getOrRefresh();
+        const userEntry = permissionsCache[userId]?.[permissionName];
+        return userEntry ? permissionValidForUser(userEntry) : false;
+    }
+    async function listUserPermissions(userId) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache[userId] ?? {})
+            .filter(([, userEntry]) => permissionValidForUser(userEntry))
+            .flatMap(([permissionName]) => permissionName);
+    }
+    async function listUsersWithPermission(permissionName) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache)
+            .filter(([, userPermissions]) => {
+            const userEntry = userPermissions[permissionName];
+            return userEntry && permissionValidForUser(userEntry);
+        })
+            .flatMap(([userId]) => userId);
+    }
+    function storeIsEmpty() {
+        return permissionsResult.loadTime === null;
+    }
+    // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
+    void getOrRefresh();
+    return {
+        hasPermission,
+        listUserPermissions,
+        listUsersWithPermission,
+        storeIsEmpty,
+    };
+}

package/dist/cjs/model.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/normalise.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalisePermissionsCache = void 0;
+// Invert shape of permissions cache, so we can look up permissions data without looping
+const normalisePermissionsCache = (permissionsCache) => {
+    return permissionsCache.reduce((acc, p) => {
+        const { permission, overrides } = p;
+        overrides.forEach(({ userId, active, isCasualNotOnShift }) => {
+            acc[userId] ??= {};
+            acc[userId][permission.name] = {
+                permission,
+                active,
+                isCasualNotOnShift,
+            };
+        });
+        return acc;
+    }, {});
+};
+exports.normalisePermissionsCache = normalisePermissionsCache;

package/dist/declaration/index.d.ts

@@ -0,0 +1,17 @@
+interface ClientConfig {
+    stage?: string;
+    region?: string;
+    bucket?: string;
+    file?: string;
+    cacheIntervalMs?: number;
+    isRunningLocally?: boolean;
+    localProfile?: string;
+}
+export declare function init({ stage, region, bucket, file, cacheIntervalMs, // 1 minute,
+isRunningLocally, localProfile, }?: ClientConfig): {
+    hasPermission: (permissionName: string, userId: string) => Promise<boolean>;
+    listUserPermissions: (userId: string) => Promise<string[]>;
+    listUsersWithPermission: (permissionName: string) => Promise<string[]>;
+    storeIsEmpty: () => boolean;
+};
+export {};

package/dist/declaration/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/{src/model.ts → dist/declaration/model.d.ts}

@@ -1,30 +1,23 @@
-// Types from S3
 interface UserOverride {
-  userId: string;
-  active: boolean;
-  isCasualNotOnShift: boolean;
+    userId: string;
+    active: boolean;
+    isCasualNotOnShift: boolean;
 }
-
 interface PermissionDefinition {
-  name: string;
-  app: string;
-  defaultValue: boolean;
+    name: string;
+    app: string;
+    defaultValue: boolean;
 }
-
 interface PermissionWithOverrides {
-  permission: PermissionDefinition;
-  overrides: UserOverride[];
+    permission: PermissionDefinition;
+    overrides: UserOverride[];
 }
-
 export type PermissionsCache = PermissionWithOverrides[];
-
-// Normalised types
 export interface UserEntry {
-  permission: PermissionDefinition;
-  active: boolean;
-  isCasualNotOnShift: boolean;
+    permission: PermissionDefinition;
+    active: boolean;
+    isCasualNotOnShift: boolean;
 }
-
 /**
  * I would find an interface more readable here than a record, but @typescript-eslint/consistent-indexed-object-style says no
  * Here's what it would look like as an interface, with named types for the keys
@@ -34,7 +27,5 @@ export interface UserEntry {
  *   }
  * }
  */
-export type NormalisedPermissionsCache = Record<
-  string,
-  Record<string, UserEntry>
->;
+export type NormalisedPermissionsCache = Record<string, Record<string, UserEntry>>;
+export {};

package/dist/declaration/normalise.d.ts

@@ -0,0 +1,2 @@
+import type { NormalisedPermissionsCache, PermissionsCache } from './model.ts';
+export declare const normalisePermissionsCache: (permissionsCache: PermissionsCache) => NormalisedPermissionsCache;

package/dist/esm/index.js

@@ -0,0 +1,79 @@
+import { S3 } from '@aws-sdk/client-s3';
+import { fromIni, fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { normalisePermissionsCache } from "./normalise.js";
+let permissionsResult = {
+    allPermissions: {},
+    loadTime: null,
+};
+let permissionsRequest = Promise.resolve(permissionsResult);
+const permissionValidForUser = (userEntry) => !!(userEntry.active && !userEntry.isCasualNotOnShift);
+export function init({ stage = 'CODE', region = 'eu-west-1', bucket = 'permissions-cache', file = 'permissions.json', cacheIntervalMs = 60_000, // 1 minute,
+isRunningLocally = false, localProfile = 'workflow', } = {}) {
+    const awsConfig = {
+        region,
+        credentials: isRunningLocally
+            ? fromIni({ profile: localProfile })
+            : fromNodeProviderChain(),
+    };
+    const s3 = new S3(awsConfig);
+    async function loadPermissions() {
+        const { Body } = await s3.getObject({
+            Bucket: bucket,
+            Key: `${stage}/${file}`,
+        });
+        if (!Body) {
+            throw Error('Could not fetch permissions');
+        }
+        const transformedBody = await Body.transformToString();
+        const permissionsCache = JSON.parse(transformedBody);
+        const allPermissions = normalisePermissionsCache(permissionsCache);
+        return { allPermissions, loadTime: Date.now() };
+    }
+    async function getOrRefresh() {
+        const latestResult = await permissionsRequest;
+        const cacheExpired = latestResult.loadTime !== null
+            ? Date.now() > latestResult.loadTime + cacheIntervalMs
+            : true;
+        if (cacheExpired) {
+            try {
+                permissionsRequest = loadPermissions();
+                permissionsResult = await permissionsRequest;
+            }
+            catch (error) {
+                console.error('Refreshing permissions cache failed with error, so keeping stale cache...', error);
+            }
+        }
+        return permissionsResult.allPermissions;
+    }
+    async function hasPermission(permissionName, userId) {
+        const permissionsCache = await getOrRefresh();
+        const userEntry = permissionsCache[userId]?.[permissionName];
+        return userEntry ? permissionValidForUser(userEntry) : false;
+    }
+    async function listUserPermissions(userId) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache[userId] ?? {})
+            .filter(([, userEntry]) => permissionValidForUser(userEntry))
+            .flatMap(([permissionName]) => permissionName);
+    }
+    async function listUsersWithPermission(permissionName) {
+        const permissionsCache = await getOrRefresh();
+        return Object.entries(permissionsCache)
+            .filter(([, userPermissions]) => {
+            const userEntry = userPermissions[permissionName];
+            return userEntry && permissionValidForUser(userEntry);
+        })
+            .flatMap(([userId]) => userId);
+    }
+    function storeIsEmpty() {
+        return permissionsResult.loadTime === null;
+    }
+    // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
+    void getOrRefresh();
+    return {
+        hasPermission,
+        listUserPermissions,
+        listUsersWithPermission,
+        storeIsEmpty,
+    };
+}

package/dist/esm/index.test.js

@@ -0,0 +1,165 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import assert from 'node:assert';
+import { randomUUID } from 'node:crypto';
+import { mock, test } from 'node:test';
+const mockPermissionsCache = [
+    {
+        permission: {
+            name: 'permission1',
+            app: 'app1',
+            defaultValue: false,
+        },
+        overrides: [
+            {
+                userId: 'user1',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user2',
+                active: false,
+                isCasualNotOnShift: true,
+            },
+            {
+                userId: 'user3',
+                active: true,
+                isCasualNotOnShift: true,
+            },
+        ],
+    },
+    {
+        permission: {
+            name: 'permission2',
+            app: 'app1',
+            defaultValue: false,
+        },
+        overrides: [
+            {
+                userId: 'user1',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user2',
+                active: true,
+                isCasualNotOnShift: false,
+            },
+            {
+                userId: 'user3',
+                active: false,
+                isCasualNotOnShift: false,
+            },
+        ],
+    },
+];
+let currentMockPermissionsCache = mockPermissionsCache;
+const originalCredentialProviders = await import('@aws-sdk/credential-providers');
+mock.module('@aws-sdk/credential-providers', {
+    exports: {
+        ...originalCredentialProviders,
+        fromNodeProviderChain: () => () => Promise.resolve({}),
+    },
+});
+const originalClientS3 = await import('@aws-sdk/client-s3');
+mock.module('@aws-sdk/client-s3', {
+    exports: {
+        ...originalClientS3,
+        S3: class {
+            getObject() {
+                return Promise.resolve({
+                    Body: {
+                        transformToString: () => Promise.resolve(JSON.stringify(currentMockPermissionsCache)),
+                    },
+                });
+            }
+        },
+    },
+});
+const getClient = async () => {
+    // This is required to get a fresh instance of the module for each test, with a new cache state.
+    const { init } = (await import(__rewriteRelativeImportExtension(`./index.ts?cache-bust=${randomUUID()}`)));
+    return init();
+};
+test('hasPermission() returns true for a user with active: true in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user1');
+    assert.equal(result, true);
+});
+test('hasPermission() returns false for a user with active: false in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user2');
+    assert.equal(result, false);
+});
+test('hasPermission() returns false for a user who is not present in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user9001');
+    assert.equal(result, false);
+});
+test('hasPermission() returns false for a user with active: true but isCasualNotOnShift: true in overrides', async () => {
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user3');
+    assert.equal(result, false);
+});
+test('hasPermission() returns the latest permission information when the cache expires', async () => {
+    mock.timers.enable();
+    const client = await getClient();
+    const result = await client.hasPermission('permission1', 'user1');
+    assert.equal(result, true);
+    const updatedPermissionsCache = [
+        {
+            permission: {
+                name: 'permission1',
+                app: 'app1',
+                defaultValue: false,
+            },
+            overrides: [
+                {
+                    userId: 'user1',
+                    active: false,
+                    isCasualNotOnShift: false,
+                },
+            ],
+        },
+    ];
+    currentMockPermissionsCache = updatedPermissionsCache;
+    mock.timers.tick(30_000);
+    const resultAfter30Seconds = await client.hasPermission('permission1', 'user1');
+    assert.equal(resultAfter30Seconds, true);
+    mock.timers.tick(30_001);
+    const resultAfter60Seconds = await client.hasPermission('permission1', 'user1');
+    assert.equal(resultAfter60Seconds, false);
+    // Reset to original state
+    currentMockPermissionsCache = mockPermissionsCache;
+});
+test('listUserPermissions() returns list of valid permissions for user', async () => {
+    const client = await getClient();
+    const user1Result = await client.listUserPermissions('user1');
+    assert.deepEqual(user1Result, ['permission1', 'permission2']);
+    const user2Result = await client.listUserPermissions('user2');
+    assert.deepEqual(user2Result, ['permission2']);
+    const user3Result = await client.listUserPermissions('user3');
+    assert.deepEqual(user3Result, []);
+});
+test('listUsersWithPermission() returns list of users validated for a given permission', async () => {
+    const client = await getClient();
+    const permission1Result = await client.listUsersWithPermission('permission1');
+    assert.deepEqual(permission1Result, ['user1']);
+    const permission2Result = await client.listUsersWithPermission('permission2');
+    assert.deepEqual(permission2Result, ['user1', 'user2']);
+});
+test('storeIsEmpty() returns true when cache is empty, and false when cache is populated', async (t) => {
+    const client = await getClient();
+    const initialResult = client.storeIsEmpty();
+    assert.equal(initialResult, true);
+    t.waitFor(() => {
+        const laterResult = client.storeIsEmpty();
+        assert.equal(laterResult, false);
+    });
+});

package/dist/esm/model.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/normalise.js

@@ -0,0 +1,15 @@
+// Invert shape of permissions cache, so we can look up permissions data without looping
+export const normalisePermissionsCache = (permissionsCache) => {
+    return permissionsCache.reduce((acc, p) => {
+        const { permission, overrides } = p;
+        overrides.forEach(({ userId, active, isCasualNotOnShift }) => {
+            acc[userId] ??= {};
+            acc[userId][permission.name] = {
+                permission,
+                active,
+                isCasualNotOnShift,
+            };
+        });
+        return acc;
+    }, {});
+};

package/package.json

@@ -1,18 +1,23 @@
 {
   "name": "@guardian/permissions-client",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Client for Guardian's permissions service",
   "repository": {
     "url": "https://github.com/guardian/permissions",
     "directory": "node-client"
   },
   "type": "module",
+  "main": "./dist/cjs/index.js",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js",
       "types": "./dist/declaration/index.d.ts"
     }
   },
+  "files": [
+    "dist"
+  ],
   "devDependencies": {
     "@aws-sdk/client-s3": "3.1090.0",
     "@aws-sdk/credential-providers": "^3.1090.0"
@@ -21,9 +26,10 @@
     "@aws-sdk/client-s3": "^3.1090.0",
     "@aws-sdk/credential-providers": "^3.1090.0"
   },
+  "prettier": "@guardian/prettier",
   "scripts": {
-    "build": "tsc --project tsconfig.emit.json",
-    "test": "node --test --experimental-test-module-mocks src/**/*.test.ts",
+    "build": "tsc --project tsconfig.emit.json && tsc --project tsconfig.emit-cjs.json",
+    "test": "node --test --test-timeout=500 --experimental-test-module-mocks src/**/*.test.ts",
     "format": "prettier --write \"src/**/*.ts\"",
     "format:ci": "prettier --check \"src/**/*.ts\"",
     "lint": "eslint src/** --ext .ts"

package/CHANGELOG.md

@@ -1,7 +0,0 @@
-# @guardian/permissions-client
-
-## 0.0.1
-
-### Patch Changes
-
-- fbf5e70: Initial release for @guardian/permissions-client

package/src/index.test.ts

@@ -1,181 +0,0 @@
-import assert from "node:assert";
-import { randomUUID } from "node:crypto";
-import { mock, test } from "node:test";
-import type * as ClientModule from "./index.ts";
-import type { PermissionsCache } from "./model.ts";
-
-const mockPermissionsCache: PermissionsCache = [
-  {
-    permission: {
-      name: "permission1",
-      app: "app1",
-      defaultValue: false,
-    },
-    overrides: [
-      {
-        userId: "user1",
-        active: true,
-        isCasualNotOnShift: false,
-      },
-      {
-        userId: "user2",
-        active: false,
-        isCasualNotOnShift: true,
-      },
-      {
-        userId: "user3",
-        active: true,
-        isCasualNotOnShift: true,
-      },
-    ],
-  },
-  {
-    permission: {
-      name: "permission2",
-      app: "app1",
-      defaultValue: false,
-    },
-    overrides: [
-      {
-        userId: "user1",
-        active: true,
-        isCasualNotOnShift: false,
-      },
-      {
-        userId: "user2",
-        active: true,
-        isCasualNotOnShift: false,
-      },
-      {
-        userId: "user3",
-        active: false,
-        isCasualNotOnShift: false,
-      },
-    ],
-  },
-];
-
-let currentMockPermissionsCache = mockPermissionsCache;
-
-const originalCredentialProviders =
-  await import("@aws-sdk/credential-providers");
-
-mock.module("@aws-sdk/credential-providers", {
-  exports: {
-    ...originalCredentialProviders,
-    fromNodeProviderChain: () => () => Promise.resolve({}),
-  },
-});
-
-const originalClientS3 = await import("@aws-sdk/client-s3");
-
-mock.module("@aws-sdk/client-s3", {
-  exports: {
-    ...originalClientS3,
-    S3: class {
-      getObject() {
-        return Promise.resolve({
-          Body: {
-            transformToString: () =>
-              Promise.resolve(JSON.stringify(currentMockPermissionsCache)),
-          },
-        });
-      }
-    },
-  },
-});
-
-// This is required to get a fresh instance of the module for each test, with a new cache state.
-const importIndex = () =>
-  import(`./index.ts?cache-bust=${randomUUID()}`) as Promise<
-    typeof ClientModule
-  >;
-
-test("hasPermission() returns true for a user with active: true in overrides", async () => {
-  const { init } = await importIndex();
-  const client = init();
-  const result = await client.hasPermission("permission1", "user1");
-
-  assert.equal(result, true);
-});
-
-test("hasPermission() returns false for a user with active: false in overrides", async () => {
-  const { init } = await importIndex();
-  const client = init();
-  const result = await client.hasPermission("permission1", "user2");
-
-  assert.equal(result, false);
-});
-
-test("hasPermission() returns false for a user who is not present in overrides", async () => {
-  const { init } = await importIndex();
-  const client = init();
-  const result = await client.hasPermission("permission1", "user9001");
-
-  assert.equal(result, false);
-});
-
-test("hasPermission() returns false for a user with active: true but isCasualNotOnShift: true in overrides", async () => {
-  const { init } = await importIndex();
-  const client = init();
-  const result = await client.hasPermission("permission1", "user3");
-
-  assert.equal(result, false);
-});
-
-test("hasPermission() returns the latest permission information when the cache expires", async () => {
-  mock.timers.enable();
-
-  const { init } = await importIndex();
-  const client = init();
-  const result = await client.hasPermission("permission1", "user1");
-  assert.equal(result, true);
-
-  const updatedPermissionsCache: PermissionsCache = [
-    {
-      permission: {
-        name: "permission1",
-        app: "app1",
-        defaultValue: false,
-      },
-      overrides: [
-        {
-          userId: "user1",
-          active: false,
-          isCasualNotOnShift: false,
-        },
-      ],
-    },
-  ];
-
-  currentMockPermissionsCache = updatedPermissionsCache;
-
-  mock.timers.tick(30_000);
-
-  const resultAfter30Seconds = await client.hasPermission(
-    "permission1",
-    "user1",
-  );
-  assert.equal(resultAfter30Seconds, true);
-
-  mock.timers.tick(30_001);
-  const resultAfter60Seconds = await client.hasPermission(
-    "permission1",
-    "user1",
-  );
-  assert.equal(resultAfter60Seconds, false);
-
-  // Reset to original state
-  currentMockPermissionsCache = mockPermissionsCache;
-});
-
-test("listPermissions() returns list of valid permissions for user", async () => {
-  const { init } = await importIndex();
-  const client = init();
-  const user1Result = await client.listPermissions("user1");
-  assert.deepEqual(user1Result, ["permission1", "permission2"]);
-  const user2Result = await client.listPermissions("user2");
-  assert.deepEqual(user2Result, ["permission2"]);
-  const user3Result = await client.listPermissions("user3");
-  assert.deepEqual(user3Result, []);
-});

package/src/index.ts

@@ -1,118 +0,0 @@
-import { S3 } from "@aws-sdk/client-s3";
-import { fromIni, fromNodeProviderChain } from "@aws-sdk/credential-providers";
-import type {
-  NormalisedPermissionsCache,
-  PermissionsCache,
-  UserEntry,
-} from "./model.ts";
-import { normalisePermissionsCache } from "./normalise.ts";
-
-interface ClientConfig {
-  stage?: string;
-  region?: string;
-  bucket?: string;
-  file?: string;
-  cacheIntervalMs?: number;
-  isRunningLocally?: boolean;
-  localProfile?: string;
-}
-
-type PermissionsResult = {
-  allPermissions: NormalisedPermissionsCache;
-  loadTime: number | null;
-};
-
-let permissionsResult: PermissionsResult = {
-  allPermissions: {},
-  loadTime: null,
-};
-let permissionsRequest: Promise<PermissionsResult> =
-  Promise.resolve(permissionsResult);
-
-const permissionValidForUser = (userEntry: UserEntry) =>
-  !!(userEntry.active && !userEntry.isCasualNotOnShift);
-
-export function init({
-  stage = "CODE",
-  region = "eu-west-1",
-  bucket = "permissions-cache",
-  file = "permissions.json",
-  cacheIntervalMs = 60_000, // 1 minute,
-  isRunningLocally = false,
-  localProfile = "workflow",
-}: ClientConfig = {}) {
-  const awsConfig = {
-    region,
-    credentials: isRunningLocally
-      ? fromIni({ profile: localProfile })
-      : fromNodeProviderChain(),
-  };
-
-  const s3 = new S3(awsConfig);
-
-  async function loadPermissions() {
-    const { Body } = await s3.getObject({
-      Bucket: bucket,
-      Key: `${stage}/${file}`,
-    });
-
-    if (!Body) {
-      throw Error("Could not fetch permissions");
-    }
-
-    const transformedBody = await Body.transformToString();
-    const permissionsCache = JSON.parse(transformedBody) as PermissionsCache;
-    const allPermissions = normalisePermissionsCache(permissionsCache);
-
-    return { allPermissions, loadTime: Date.now() };
-  }
-
-  async function getOrRefresh() {
-    const latestResult = await permissionsRequest;
-    const cacheExpired =
-      latestResult.loadTime !== null
-        ? Date.now() > latestResult.loadTime + cacheIntervalMs
-        : true;
-
-    if (cacheExpired) {
-      try {
-        permissionsRequest = loadPermissions();
-        permissionsResult = await permissionsRequest;
-      } catch (error) {
-        console.error(
-          "Refreshing permissions cache failed with error, so keeping stale cache...",
-          error,
-        );
-      }
-    }
-
-    return permissionsResult.allPermissions;
-  }
-
-  async function hasPermission(permissionName: string, userId: string) {
-    const permissionsCache = await getOrRefresh();
-    const userEntry = permissionsCache[userId]?.[permissionName];
-
-    return userEntry ? permissionValidForUser(userEntry) : false;
-  }
-
-  async function listPermissions(userId: string) {
-    const permissionsCache = await getOrRefresh();
-    return Object.entries(permissionsCache[userId] ?? {})
-      .filter(([, userEntry]) => permissionValidForUser(userEntry))
-      .flatMap(([permissionName]) => permissionName);
-  }
-
-  function storeIsEmpty() {
-    return permissionsResult.loadTime === null;
-  }
-
-  // Run getOrRefresh() immediately after init so that the cache is populated and ready for use
-  void getOrRefresh();
-
-  return {
-    hasPermission,
-    listPermissions,
-    storeIsEmpty,
-  };
-}

package/src/normalise.ts

@@ -1,20 +0,0 @@
-import type { NormalisedPermissionsCache, PermissionsCache } from "./model.ts";
-
-// Invert shape of permissions cache, so we can look up permissions data without looping
-export const normalisePermissionsCache = (
-  permissionsCache: PermissionsCache,
-): NormalisedPermissionsCache => {
-  return permissionsCache.reduce<NormalisedPermissionsCache>((acc, p) => {
-    const { permission, overrides } = p;
-    overrides.forEach(({ userId, active, isCasualNotOnShift }) => {
-      acc[userId] ??= {};
-      acc[userId][permission.name] = {
-        permission,
-        active,
-        isCasualNotOnShift,
-      };
-    });
-
-    return acc;
-  }, {});
-};

package/tsconfig.emit.json

@@ -1,4 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "exclude": ["src/**/*.test.ts"]
-}

package/tsconfig.json

@@ -1,20 +0,0 @@
-{
-  "extends": "@guardian/tsconfig/tsconfig.json",
-  "allowImportingTsExtensions": true,
-  "compilerOptions": {
-    "target": "esnext",
-    "module": "nodenext",
-    "moduleResolution": "nodenext",
-    "types": [
-      "vitest/globals",
-      "node"
-    ],
-    "rootDir": "./src",
-    "outDir": "dist",
-    "declaration": true,
-    "declarationDir": "dist/declaration",
-    "rewriteRelativeImportExtensions": true,
-    "erasableSyntaxOnly": true,
-  },
-  "include": ["src/**/*"],
-}