@iii-dev/helpers 0.22.1 → 0.23.0-rc.2

package/dist/worker-connection-manager/index.d.cts

@@ -15,7 +15,17 @@ type AuthInput = {
  * middleware.
  */
 type AuthResult = {
-  /** Additional function IDs to allow beyond the `expose_functions` config. Defaults to `[]` if omitted. */allowed_functions?: string[]; /** Function IDs to deny even if they match `expose_functions`. Takes precedence over allowed. Defaults to `[]` if omitted. */
+  /**
+   * Grants scoped to one namespace each: `{ orders: ['svc::*'] }`. A value is an
+   * exact function ID or a wildcard, in either the bare (`svc::*`) or the
+   * `match("svc::*")` spelling.
+   *
+   * The keys are also the namespaces the session may declare on
+   * `engine::workers::register`. Omit to scope nothing: the session declares any
+   * namespace, and only `allowed_functions` and `expose_functions` apply.
+   */
+  namespaces?: Record<string, string[]>; /** Additional function IDs to allow beyond the `expose_functions` config, in the `default` namespace only. Put per-namespace grants in `namespaces`. Defaults to `[]` if omitted. */
+  allowed_functions?: string[]; /** Function IDs to deny even if they match `expose_functions`. Takes precedence over allowed. Defaults to `[]` if omitted. */
   forbidden_functions?: string[]; /** Trigger type IDs the worker may register triggers for. When omitted, all types are allowed. */
   allowed_trigger_types?: string[]; /** Whether the worker may register new trigger types. Defaults to `false` if omitted. */
   allow_trigger_type_registration?: boolean; /** Whether the worker may register new functions. Defaults to `true` if omitted. */
@@ -54,7 +64,13 @@ type OnTriggerRegistrationInput = {
   trigger_type: string; /** ID of the function this trigger is bound to. */
   function_id: string; /** Trigger-specific configuration. */
   config: unknown; /** Arbitrary metadata attached to the trigger. */
-  metadata?: Record<string, unknown>; /** Auth context from `AuthResult.context` for this session. */
+  metadata?: Record<string, unknown>;
+  /**
+   * Namespace the trigger's target resolves in (explicit, or `default` when
+   * absent). The same function id can exist in several namespaces, so the hook
+   * needs this to authorize per target namespace.
+   */
+  namespace?: string; /** Auth context from `AuthResult.context` for this session. */
   context: Record<string, unknown>;
 };
 /**
@@ -77,7 +93,12 @@ type OnTriggerRegistrationResult = {
 type OnFunctionRegistrationInput = {
   /** ID of the function being registered. */function_id: string; /** Human-readable description of the function. */
   description?: string; /** Arbitrary metadata attached to the function. */
-  metadata?: Record<string, unknown>; /** Auth context from `AuthResult.context` for this session. */
+  metadata?: Record<string, unknown>;
+  /**
+   * Namespace the function registers in. The same id can exist in several
+   * namespaces, so the hook needs this to authorize per namespace.
+   */
+  namespace?: string; /** Auth context from `AuthResult.context` for this session. */
   context: Record<string, unknown>;
 };
 /**

package/dist/worker-connection-manager/index.d.mts

@@ -15,7 +15,17 @@ type AuthInput = {
  * middleware.
  */
 type AuthResult = {
-  /** Additional function IDs to allow beyond the `expose_functions` config. Defaults to `[]` if omitted. */allowed_functions?: string[]; /** Function IDs to deny even if they match `expose_functions`. Takes precedence over allowed. Defaults to `[]` if omitted. */
+  /**
+   * Grants scoped to one namespace each: `{ orders: ['svc::*'] }`. A value is an
+   * exact function ID or a wildcard, in either the bare (`svc::*`) or the
+   * `match("svc::*")` spelling.
+   *
+   * The keys are also the namespaces the session may declare on
+   * `engine::workers::register`. Omit to scope nothing: the session declares any
+   * namespace, and only `allowed_functions` and `expose_functions` apply.
+   */
+  namespaces?: Record<string, string[]>; /** Additional function IDs to allow beyond the `expose_functions` config, in the `default` namespace only. Put per-namespace grants in `namespaces`. Defaults to `[]` if omitted. */
+  allowed_functions?: string[]; /** Function IDs to deny even if they match `expose_functions`. Takes precedence over allowed. Defaults to `[]` if omitted. */
   forbidden_functions?: string[]; /** Trigger type IDs the worker may register triggers for. When omitted, all types are allowed. */
   allowed_trigger_types?: string[]; /** Whether the worker may register new trigger types. Defaults to `false` if omitted. */
   allow_trigger_type_registration?: boolean; /** Whether the worker may register new functions. Defaults to `true` if omitted. */
@@ -54,7 +64,13 @@ type OnTriggerRegistrationInput = {
   trigger_type: string; /** ID of the function this trigger is bound to. */
   function_id: string; /** Trigger-specific configuration. */
   config: unknown; /** Arbitrary metadata attached to the trigger. */
-  metadata?: Record<string, unknown>; /** Auth context from `AuthResult.context` for this session. */
+  metadata?: Record<string, unknown>;
+  /**
+   * Namespace the trigger's target resolves in (explicit, or `default` when
+   * absent). The same function id can exist in several namespaces, so the hook
+   * needs this to authorize per target namespace.
+   */
+  namespace?: string; /** Auth context from `AuthResult.context` for this session. */
   context: Record<string, unknown>;
 };
 /**
@@ -77,7 +93,12 @@ type OnTriggerRegistrationResult = {
 type OnFunctionRegistrationInput = {
   /** ID of the function being registered. */function_id: string; /** Human-readable description of the function. */
   description?: string; /** Arbitrary metadata attached to the function. */
-  metadata?: Record<string, unknown>; /** Auth context from `AuthResult.context` for this session. */
+  metadata?: Record<string, unknown>;
+  /**
+   * Namespace the function registers in. The same id can exist in several
+   * namespaces, so the hook needs this to authorize per namespace.
+   */
+  namespace?: string; /** Auth context from `AuthResult.context` for this session. */
   context: Record<string, unknown>;
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iii-dev/helpers",
-  "version": "0.22.1",
+  "version": "0.23.0-rc.2",
   "private": false,
   "publishConfig": {
     "access": "public"