@happyvertical/smrt-app-runtime 0.53.4 → 0.53.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +47 -4
- package/README.md +28 -18
- package/dist/chunks/{src-DZGOVGsU.js → src-D7cM0zHW.js} +347 -53
- package/dist/chunks/src-D7cM0zHW.js.map +1 -0
- package/dist/direct-membership.d.ts +39 -0
- package/dist/direct-membership.d.ts.map +1 -0
- package/dist/index.d.ts +28 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/local-mcp-tokens.d.ts +123 -0
- package/dist/local-mcp-tokens.d.ts.map +1 -0
- package/dist/manifest.json +1 -1
- package/dist/plain-data.d.ts +27 -0
- package/dist/plain-data.d.ts.map +1 -0
- package/dist/smrt-knowledge.json +5 -5
- package/dist/state-root.d.ts +11 -0
- package/dist/state-root.d.ts.map +1 -1
- package/dist/sveltekit/index.d.ts +1 -1
- package/dist/sveltekit/index.d.ts.map +1 -1
- package/dist/sveltekit/owner-setup.d.ts +10 -3
- package/dist/sveltekit/owner-setup.d.ts.map +1 -1
- package/dist/sveltekit/runtime.d.ts +99 -13
- package/dist/sveltekit/runtime.d.ts.map +1 -1
- package/dist/sveltekit.js +119 -16
- package/dist/sveltekit.js.map +1 -1
- package/package.json +9 -9
- package/dist/chunks/src-DZGOVGsU.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/sveltekit/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,0BAA0B,
|
|
1
|
+
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/sveltekit/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAarC,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,iBAAiB,EAAe,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKxD,OAAO,EACL,KAAK,0BAA0B,EAE/B,oCAAoC,EAGrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iCAAiC,EAEjC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAGnC,MAAM,aAAa,CAAC;AAMrB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,kEAAkE;AAClE,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD;;;OAGG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oEAAoE;IACpE,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED,4EAA4E;AAC5E,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,0BAA0B,EACrC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC7D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzB,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,gFAAgF;IAChF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACxE,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;KACvB,EAAE,CAAC;CACL;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wDAAwD;AACxD,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC1C,qBAAqB,EACrB,oBAAoB,CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,0BAA0B,GAC1B,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,CAAC,OAAO,EAAE,kBAAkB,KAAK,WAAW,CAAC,GAC9C,KAAK,CAAC;IACV;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9E,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,UAAU,EAAE,6BAA6B,EACzC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACnC,IAAI,CAAC;IACV,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,8EAA8E;AAC9E,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACnE,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC1D,CAAC,CAAC;AAER;;;;GAIG;AACH,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI,uBAAuB,CACxE,IAAI,CAAC,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC,CACpC,GAAG;IACF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,qEAAqE;IACrE,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,gCAAgC;IAChC,aAAa,IAAI,MAAM,CAAC;IACxB;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,wBAAwB,IAAI,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAClD;;;;;OAKG;IACH,aAAa,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CACZ,CAAC,EACD,CAAC,SAAS,yBAAyB,GAAG,yBAAyB,EAE/D,SAAS,EAAE,CAAC,EACZ,EAAE,EAAE,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9D,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;;;OAOG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;;;OAQG;IACH,mBAAmB,CACjB,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC;IAClD,8DAA8D;IAC9D,YAAY,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjD,4DAA4D;IAC5D,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,2DAA2D;IAC3D,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrC;;;OAGG;IACH,eAAe,CACb,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,iCAAiC,CAAC;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,oCAAoC,CAAC;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,CAEtB;AAED,gBAAgB;AAChB,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,EACpC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAqrBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CASb;AAyCD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAe1C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBpE"}
|
package/dist/sveltekit.js
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import { loadConfig,
|
|
3
|
-
import {
|
|
4
|
-
import {
|
|
1
|
+
import { B as deepFrozenPlainCopy, G as initializeDeployedApplicationRuntime, H as resolveBoundMembershipPermissions, K as isSessionTenantAuthorized, M as runtimeConfigurationFingerprint, R as isLocalMcpTokenPrincipal, V as ownValue, b as projectRuntimeDiagnostics, c as validateApplicationId, h as resolveApplicationStateRoot, i as initializeLocalApplicationRuntime, j as resolveApplicationId, m as removeOnboardingHandoff, p as prepareApplicationStateRoot, s as resolveLocalRuntimePaths, u as acquireWriterLease, z as PlainDataError } from "./chunks/src-D7cM0zHW.js";
|
|
2
|
+
import { loadConfig, resolveEffectiveApplicationRuntime } from "@happyvertical/smrt-config";
|
|
3
|
+
import { OidcIdentityCollection } from "@happyvertical/smrt-profiles";
|
|
4
|
+
import { enableTenancy, getCurrentTenant, isTenancyEnabled, withSystemContext } from "@happyvertical/smrt-tenancy";
|
|
5
|
+
import { MembershipCollection, PermissionResolver, RoleCollection, SessionService, TenantCollection, TenantStatus, UserCollection, UserStatus, getCurrentSessionPermissionContext, getRequestScopedDatabase, withPrincipalPermissionContext, withSessionPermissionContext } from "@happyvertical/smrt-users";
|
|
5
6
|
import { getDatabase } from "@happyvertical/sql";
|
|
6
7
|
import { fail, json, redirect } from "@sveltejs/kit";
|
|
8
|
+
import { ObjectRegistry } from "@happyvertical/smrt-core";
|
|
7
9
|
//#region src/sveltekit/handlers.ts
|
|
8
10
|
var RUNTIME_DIAGNOSTICS_READ_PERMISSION = "runtime_diagnostics.read";
|
|
9
11
|
function createRuntimeHealthHandler(runtime) {
|
|
@@ -148,6 +150,9 @@ function createOwnerSetupPage(runtime, options = {}) {
|
|
|
148
150
|
} catch {
|
|
149
151
|
return failure(400, "setup_invalid");
|
|
150
152
|
}
|
|
153
|
+
if (options.removeOnboardingHandoff !== false && runtime.applicationStateRoot) try {
|
|
154
|
+
removeOnboardingHandoff(runtime.applicationStateRoot());
|
|
155
|
+
} catch {}
|
|
151
156
|
const cookie = runtime.sessionCookie;
|
|
152
157
|
event.cookies.set(cookie.name, result.sessionId, {
|
|
153
158
|
path: cookie.path,
|
|
@@ -329,6 +334,8 @@ function composeSmrtSvelteKitRuntime(options, seams) {
|
|
|
329
334
|
db: requestDb
|
|
330
335
|
} : base;
|
|
331
336
|
};
|
|
337
|
+
const getCollection = (className) => ObjectRegistry.getCollection(className, classOptions(className));
|
|
338
|
+
const writerLease = options.acquireWriterLease === false ? void 0 : options.acquireWriterLease ?? ((context) => defaultWriterLease(context, env));
|
|
332
339
|
let localPromise;
|
|
333
340
|
let localLease;
|
|
334
341
|
const localRuntime = async () => {
|
|
@@ -338,7 +345,7 @@ function composeSmrtSvelteKitRuntime(options, seams) {
|
|
|
338
345
|
const bindHost = options.bindHost || env.HOST || (env.NODE_ENV === "development" ? "127.0.0.1" : null);
|
|
339
346
|
if (!bindHost) throw new Error("Local production startup requires an explicit loopback HOST; use pnpm app:start.");
|
|
340
347
|
const id = applicationId();
|
|
341
|
-
localLease ??=
|
|
348
|
+
localLease ??= writerLease?.({
|
|
342
349
|
appId: id,
|
|
343
350
|
dataDirectory,
|
|
344
351
|
sourceRoot
|
|
@@ -550,13 +557,29 @@ function composeSmrtSvelteKitRuntime(options, seams) {
|
|
|
550
557
|
return permissionResolverPromise;
|
|
551
558
|
};
|
|
552
559
|
const runAsPrincipal = async (principal, fn) => {
|
|
553
|
-
|
|
554
|
-
const
|
|
560
|
+
if (!principal || typeof principal !== "object") throw new Error("A bound principal is required.");
|
|
561
|
+
const snapshot = snapshotBoundPrincipal(principal);
|
|
562
|
+
const tokenDerived = isLocalMcpTokenPrincipal(snapshot);
|
|
563
|
+
const userId = ownValue(snapshot, "id");
|
|
564
|
+
const tenantId = ownValue(snapshot, "tenantId");
|
|
565
|
+
const snapshotScopes = ownValue(snapshot, "scopes");
|
|
566
|
+
const requestedTenantBinding = ownValue(snapshot, "tenantBinding");
|
|
567
|
+
const requestedScopes = snapshotScopes === void 0 ? void 0 : Object.freeze([...snapshotScopes]);
|
|
568
|
+
if (requestedScopes !== void 0 && !requestedScopes.every((scope) => typeof scope === "string")) throw new Error("A bound principal has malformed scopes.");
|
|
555
569
|
if (typeof userId !== "string" || userId.length === 0) throw new Error("A bound principal requires a user id.");
|
|
556
570
|
if (typeof tenantId !== "string" || tenantId.length === 0) throw new Error("A bound principal requires a tenant.");
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
571
|
+
if (tokenDerived && requestedTenantBinding !== void 0 && requestedTenantBinding !== "direct") throw new Error("A local MCP token principal binds only through its direct membership.");
|
|
572
|
+
const binding = tokenDerived ? "direct" : requestedTenantBinding ?? "direct-or-inherited";
|
|
573
|
+
if (binding !== "direct" && binding !== "direct-or-inherited") throw new Error("Unknown tenant binding mode for a bound principal.");
|
|
574
|
+
const resolved2 = await resolveBoundMembershipPermissions({
|
|
575
|
+
memberships: await MembershipCollection.create(baseClassOptions("Membership")),
|
|
576
|
+
resolver: await permissionResolver(),
|
|
577
|
+
userId,
|
|
578
|
+
tenantId,
|
|
579
|
+
binding
|
|
580
|
+
});
|
|
581
|
+
if (!resolved2) throw new Error(binding === "direct" ? "The bound principal has no active direct membership in its tenant." : "The bound principal has no authorized membership in its tenant.");
|
|
582
|
+
const cap = requestedScopes ? new Set(requestedScopes) : void 0;
|
|
560
583
|
const permissions = [...resolved2.permissions].filter((permission) => !cap || cap.has(permission));
|
|
561
584
|
return withPrincipalPermissionContext({
|
|
562
585
|
...baseClassOptions("Session"),
|
|
@@ -565,10 +588,49 @@ function composeSmrtSvelteKitRuntime(options, seams) {
|
|
|
565
588
|
permissions,
|
|
566
589
|
enterTenantContext: true,
|
|
567
590
|
postgresRls: postgresRls()
|
|
568
|
-
}, () => fn({
|
|
569
|
-
|
|
570
|
-
|
|
571
|
-
|
|
591
|
+
}, () => fn(Object.freeze(Object.assign(/* @__PURE__ */ Object.create(null), snapshot, {
|
|
592
|
+
id: userId,
|
|
593
|
+
tenantId,
|
|
594
|
+
tenantBinding: binding,
|
|
595
|
+
scopes: Object.freeze([...permissions])
|
|
596
|
+
}))));
|
|
597
|
+
};
|
|
598
|
+
const verifyLocalMcpToken = async (token) => {
|
|
599
|
+
if ((await resolvedRuntime()).profile !== "local") return null;
|
|
600
|
+
return await (await localRuntime()).mcpTokens?.verify(token) ?? null;
|
|
601
|
+
};
|
|
602
|
+
const resolveMcpPrincipal = async (identity) => {
|
|
603
|
+
if ((await resolvedRuntime()).profile === "local") return null;
|
|
604
|
+
if (!identity || typeof identity !== "object") return null;
|
|
605
|
+
const issuer = ownValue(identity, "issuer");
|
|
606
|
+
const subject = ownValue(identity, "subject");
|
|
607
|
+
if (typeof issuer !== "string" || issuer.length === 0 || typeof subject !== "string" || subject.length === 0) return null;
|
|
608
|
+
return withSystemContext(async () => {
|
|
609
|
+
const identities = await OidcIdentityCollection.create(baseClassOptions("OidcIdentity"));
|
|
610
|
+
let linked;
|
|
611
|
+
try {
|
|
612
|
+
linked = await identities.findBySubject(issuer, subject);
|
|
613
|
+
} catch {
|
|
614
|
+
return null;
|
|
615
|
+
}
|
|
616
|
+
if (!linked?.profileId) return null;
|
|
617
|
+
const owners = await (await UserCollection.create(baseClassOptions("User"))).list({
|
|
618
|
+
where: { profileId: linked.profileId },
|
|
619
|
+
limit: 2
|
|
620
|
+
});
|
|
621
|
+
const user = owners.length === 1 ? owners[0] : void 0;
|
|
622
|
+
if (typeof user?.id !== "string" || user.id.length === 0 || user.status !== UserStatus.ACTIVE) return null;
|
|
623
|
+
const memberships = await MembershipCollection.create(baseClassOptions("Membership"));
|
|
624
|
+
const tenants = new Set((await memberships.findActiveByUser(user.id)).map((membership) => membership.tenantId).filter((tenantId2) => typeof tenantId2 === "string" && tenantId2.length > 0));
|
|
625
|
+
if (tenants.size !== 1) return null;
|
|
626
|
+
const [tenantId] = tenants;
|
|
627
|
+
return Object.freeze({
|
|
628
|
+
id: user.id,
|
|
629
|
+
tenantId,
|
|
630
|
+
kind: "human",
|
|
631
|
+
tenantBinding: "direct"
|
|
632
|
+
});
|
|
633
|
+
});
|
|
572
634
|
};
|
|
573
635
|
let sessionServicePromise;
|
|
574
636
|
const sessionService = () => {
|
|
@@ -640,16 +702,31 @@ function composeSmrtSvelteKitRuntime(options, seams) {
|
|
|
640
702
|
resolvedRuntime,
|
|
641
703
|
ready,
|
|
642
704
|
applicationId,
|
|
705
|
+
applicationStateRoot: () => resolveApplicationStateRoot({
|
|
706
|
+
appId: applicationId(),
|
|
707
|
+
dataDirectory,
|
|
708
|
+
sourceRoot
|
|
709
|
+
}),
|
|
643
710
|
configurationFingerprint,
|
|
644
711
|
databaseConfig,
|
|
645
712
|
classOptions,
|
|
713
|
+
getCollection,
|
|
646
714
|
runAsPrincipal,
|
|
715
|
+
verifyLocalMcpToken,
|
|
716
|
+
resolveMcpPrincipal,
|
|
647
717
|
localRuntime,
|
|
648
718
|
deployedRuntime,
|
|
649
719
|
health,
|
|
650
720
|
readDiagnostics
|
|
651
721
|
});
|
|
652
722
|
}
|
|
723
|
+
function defaultWriterLease(context, env = process.env) {
|
|
724
|
+
return acquireWriterLease(prepareApplicationStateRoot({
|
|
725
|
+
appId: context.appId,
|
|
726
|
+
dataDirectory: context.dataDirectory,
|
|
727
|
+
sourceRoot: context.sourceRoot
|
|
728
|
+
}), { operationInstance: env.SMRT_OPERATION_INSTANCE });
|
|
729
|
+
}
|
|
653
730
|
var verifiedSessionTenants = /* @__PURE__ */ new WeakMap();
|
|
654
731
|
var TenantAuthorizingSessionService = class extends SessionService {
|
|
655
732
|
tenantRequired;
|
|
@@ -696,9 +773,35 @@ function runtimeLocals(locals) {
|
|
|
696
773
|
return locals;
|
|
697
774
|
}
|
|
698
775
|
async function loadConfiguredRuntime() {
|
|
699
|
-
return (await loadConfig())
|
|
776
|
+
return resolveEffectiveApplicationRuntime(await loadConfig());
|
|
777
|
+
}
|
|
778
|
+
function snapshotBoundPrincipal(principal) {
|
|
779
|
+
if (!principal || typeof principal !== "object" || Array.isArray(principal)) throw new Error("A bound principal is required.");
|
|
780
|
+
let snapshot;
|
|
781
|
+
try {
|
|
782
|
+
snapshot = deepFrozenPlainCopy(principal);
|
|
783
|
+
} catch (error) {
|
|
784
|
+
if (error instanceof PlainDataError) throw new Error(`A bound principal ${error.message}.`);
|
|
785
|
+
throw error;
|
|
786
|
+
}
|
|
787
|
+
for (const key of [
|
|
788
|
+
"id",
|
|
789
|
+
"tenantId",
|
|
790
|
+
"kind",
|
|
791
|
+
"tenantBinding"
|
|
792
|
+
]) {
|
|
793
|
+
const value = ownValue(snapshot, key);
|
|
794
|
+
if (value !== void 0 && typeof value !== "string") throw new Error(`A bound principal has a malformed ${key}.`);
|
|
795
|
+
}
|
|
796
|
+
for (const key of ["scopes", "roles"]) {
|
|
797
|
+
const value = ownValue(snapshot, key);
|
|
798
|
+
if (value !== void 0 && (!Array.isArray(value) || !value.every((entry) => typeof entry === "string"))) throw new Error(`A bound principal has malformed ${key}.`);
|
|
799
|
+
}
|
|
800
|
+
const allowCrossTenant = ownValue(snapshot, "allowCrossTenant");
|
|
801
|
+
if (allowCrossTenant !== void 0 && typeof allowCrossTenant !== "boolean") throw new Error("A bound principal has a malformed allowCrossTenant.");
|
|
802
|
+
return snapshot;
|
|
700
803
|
}
|
|
701
804
|
//#endregion
|
|
702
|
-
export { DEFAULT_OWNER_SETUP_MESSAGES, OWNER_SETUP_FIELDS, RUNTIME_DIAGNOSTICS_READ_PERMISSION, authorizedTenantLocalsHandle, composeHandles, createOwnerSetupPage, createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, createSmrtSvelteKitRuntime, createSubdomainTenantSelector, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, normalizeTenantSelection, selectTenantSlug };
|
|
805
|
+
export { DEFAULT_OWNER_SETUP_MESSAGES, OWNER_SETUP_FIELDS, RUNTIME_DIAGNOSTICS_READ_PERMISSION, authorizedTenantLocalsHandle, composeHandles, createOwnerSetupPage, createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, createSmrtSvelteKitRuntime, createSubdomainTenantSelector, defaultWriterLease, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, normalizeTenantSelection, selectTenantSlug };
|
|
703
806
|
|
|
704
807
|
//# sourceMappingURL=sveltekit.js.map
|