@innovatorstack/harness 0.0.0-stage → 0.1.0

package/src/platform/security/identities.ts

@@ -0,0 +1,136 @@
+import { spendContext } from "../../core/context.js";
+import { dataNodesMax } from "../../core/limits.js";
+import type { ExecutionContext } from "../../core/types.js";
+import type { MethodIdentity } from "../../methods/types.js";
+import type { HarnessStorage, StoredItem } from "../../storage/types.js";
+import { PlatformError } from "../errors.js";
+import { systemIdentityId } from "./system-identities.js";
+import { effective } from "./time.js";
+
+export class Identities {
+    constructor(
+        private readonly storage: HarnessStorage,
+        private readonly userId: (() => string) | undefined,
+        private readonly now: () => Date,
+    ) {}
+
+    user(): StoredItem {
+        const id = this.userId?.();
+        const user = id ? this.storage.getItem("User", id) : undefined;
+
+        if (!user) {
+            throw new PlatformError(
+                "SessionRequired",
+                "Native identity checks require an imported User session.",
+            );
+        }
+
+        return user;
+    }
+
+    byName(name: string, context: ExecutionContext): MethodIdentity | undefined {
+        const identities = this.storage.listItems("Identity");
+        spendContext(context, identities.length);
+        const records = identities.filter(
+            (record) => String(record.properties.name).toLowerCase() === name.toLowerCase(),
+        );
+
+        if (records.length > 1) {
+            throw new PlatformError("AmbiguousIdentity", `Identity '${name}' is not unique.`);
+        }
+
+        const record = records[0];
+
+        return record ? this.describe(record) : undefined;
+    }
+
+    byId(id: string): MethodIdentity {
+        const record = this.storage.getItem("Identity", id);
+
+        if (!record) {
+            throw new PlatformError("MissingIdentity", `Import Identity '${id}' before using it.`);
+        }
+
+        return this.describe(record);
+    }
+
+    current(granted: Iterable<string>, context: ExecutionContext): readonly string[] {
+        const user = this.user();
+        const worldId = systemIdentityId("World");
+        const world = worldId ? this.byId(worldId) : undefined;
+
+        if (!world) {
+            throw new PlatformError("MissingIdentity", "The World Identity is required.");
+        }
+
+        const ids = new Map<string, string>([[world.id.toLowerCase(), world.id]]);
+
+        for (const alias of this.storage.listItems("Alias")) {
+            spendContext(context);
+
+            if (String(alias.properties.source_id).toLowerCase() === user.id.toLowerCase()) {
+                const identity = this.byId(String(alias.properties.related_id));
+                ids.set(identity.id.toLowerCase(), identity.id);
+            }
+        }
+
+        for (const id of granted) {
+            const identity = this.byId(id);
+            ids.set(identity.id.toLowerCase(), identity.id);
+        }
+
+        return this.expand(ids, context);
+    }
+
+    private expand(ids: Map<string, string>, context: ExecutionContext): readonly string[] {
+        const parents = new Map<string, string[]>();
+
+        for (const member of this.storage.listItems("Member")) {
+            spendContext(context);
+
+            if (effective(member, this.now())) {
+                const child = String(member.properties.related_id).toLowerCase();
+                const values = parents.get(child) ?? [];
+                values.push(String(member.properties.source_id));
+                parents.set(child, values);
+            }
+        }
+
+        const pending = [...ids.values()];
+        let visited = 0;
+
+        while (pending.length > 0) {
+            const id = pending.pop();
+
+            if (!id || ++visited > dataNodesMax) {
+                throw new PlatformError(
+                    "ProtocolLimit",
+                    "Identity membership exceeds its graph budget.",
+                );
+            }
+
+            for (const parent of parents.get(id.toLowerCase()) ?? []) {
+                spendContext(context);
+                const identity = this.byId(parent);
+                const key = identity.id.toLowerCase();
+
+                if (!ids.has(key)) {
+                    ids.set(key, identity.id);
+                    pending.push(identity.id);
+                }
+            }
+        }
+
+        return [...ids.values()].sort((left, right) => left.localeCompare(right));
+    }
+
+    private describe(record: StoredItem): MethodIdentity {
+        const name = record.properties.name;
+
+        if (typeof name !== "string" || name.length === 0) {
+            throw new PlatformError("InvalidIdentity", `Identity '${record.id}' needs a name.`);
+        }
+
+        return Object.freeze({ id: record.id, name });
+    }
+}

package/src/platform/security/inherited-relationships.ts

@@ -0,0 +1,103 @@
+import { spendContext } from "../../core/context.js";
+import { dataNodesMax } from "../../core/limits.js";
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, ItemTypeDefinition, StoredItem } from "../../storage/types.js";
+import { PlatformError } from "../errors.js";
+import type { SourceAccess } from "./source-access.js";
+
+/** Ownership is stable during synchronous ACL propagation; index each relevant table once. */
+export class InheritedRelationships {
+    private readonly types = new Map<string, ItemTypeDefinition[]>();
+    private readonly records = new Map<string, ReadonlyMap<string, readonly StoredItem[]>>();
+    private indexed = 0;
+
+    constructor(
+        private readonly storage: HarnessStorage,
+        sources: SourceAccess,
+        private readonly context: ExecutionContext,
+    ) {
+        for (const definition of storage.listItemTypes()) {
+            spendContext(context, definition.properties.length + 1);
+
+            if (!definition.isRelationship || !sources.inherited(definition)) {
+                continue;
+            }
+
+            const source = definition.properties.find((property) => property.name === "source_id");
+            const sourceType =
+                source?.dataType === "item" ? (source.dataSource?.toLowerCase() ?? "") : "";
+            const siblings = this.types.get(sourceType) ?? [];
+            siblings.push(definition);
+            this.types.set(sourceType, siblings);
+        }
+    }
+
+    *children(parent: StoredItem): Generator<StoredItem, void, void> {
+        const owner = this.storage.getItemType(parent.type);
+
+        if (!owner) {
+            throw new PlatformError(
+                "MissingItemType",
+                `Permission source '${parent.type}' has no schema.`,
+            );
+        }
+
+        const types = [
+            ...(this.types.get(owner.id.toLowerCase()) ?? []),
+            ...(this.types.get("") ?? []),
+        ];
+
+        for (const definition of types) {
+            spendContext(this.context);
+            const records = this.bySource(definition).get(parent.id.toLowerCase()) ?? [];
+            const source = definition.properties.find((property) => property.name === "source_id");
+
+            if (records.length > 0 && (source?.dataType !== "item" || !source.dataSource)) {
+                throw new PlatformError(
+                    "UnsupportedSourceAccess",
+                    `Propagating permissions to '${definition.name}' requires for_all source-type resolution.`,
+                    definition.source ? { source: definition.source } : undefined,
+                );
+            }
+
+            yield* records;
+        }
+    }
+
+    private bySource(definition: ItemTypeDefinition): ReadonlyMap<string, readonly StoredItem[]> {
+        const cached = this.records.get(definition.id);
+
+        if (cached) {
+            return cached;
+        }
+
+        const index = new Map<string, StoredItem[]>();
+
+        for (const record of this.storage.listItems(definition.name)) {
+            spendContext(this.context);
+            this.indexed += 1;
+
+            if (this.indexed > dataNodesMax) {
+                throw new PlatformError(
+                    "ProtocolLimit",
+                    "Inherited permissions exceed their ownership index limit.",
+                );
+            }
+
+            const source = record.properties.source_id;
+
+            if (typeof source !== "string" || !source) {
+                continue;
+            }
+
+            const key = source.toLowerCase();
+            const siblings = index.get(key) ?? [];
+            siblings.push(record);
+            index.set(key, siblings);
+        }
+
+        this.records.set(definition.id, index);
+
+        return index;
+    }
+}

package/src/platform/security/method-execution.ts

@@ -0,0 +1,34 @@
+import { assertActiveContext, hasContextAncestor } from "../../core/context.js";
+import type { ExecutionContext } from "../../core/types.js";
+
+interface MethodExecutionScope extends Disposable {
+    readonly checkExecutionIdentity: boolean;
+}
+
+/** Native NoCheck follows a bound Method's call chain without adding an Identity grant. */
+export class MethodExecutionScopes {
+    private roots = new WeakSet<ExecutionContext>();
+
+    enter(context: ExecutionContext, platformBound: boolean): MethodExecutionScope {
+        assertActiveContext(context);
+        const inherited = hasContextAncestor(context, (ancestor) => this.roots.has(ancestor));
+
+        if (platformBound) {
+            this.roots.add(context);
+        }
+
+        return {
+            checkExecutionIdentity: !platformBound && !inherited,
+
+            [Symbol.dispose]: () => {
+                if (platformBound) {
+                    this.roots.delete(context);
+                }
+            },
+        };
+    }
+
+    reset(): void {
+        this.roots = new WeakSet();
+    }
+}

package/src/platform/security/permissions.ts

@@ -0,0 +1,337 @@
+import { spendContext } from "../../core/context.js";
+import type { ExecutionContext } from "../../core/types.js";
+import { Item } from "../../items/item.js";
+import type {
+    HarnessStorage,
+    ItemTypeDefinition,
+    StorageValue,
+    StoredItem,
+} from "../../storage/types.js";
+import type { Classifications } from "../classifications.js";
+import { ApplicationError, PlatformError } from "../errors.js";
+import type { IdentityGrants } from "./grants.js";
+import type { Identities } from "./identities.js";
+import { SourceAccess } from "./source-access.js";
+import { inheritedSecurity } from "./source-inheritance.js";
+import { systemIdentity } from "./system-identities.js";
+import { TeamRoles } from "./teams.js";
+import { effective } from "./time.js";
+
+export enum AccessRight {
+    Get = "can_get",
+    Update = "can_update",
+    Delete = "can_delete",
+    ChangeAccess = "can_change_access",
+}
+
+interface Actor {
+    readonly user: StoredItem;
+    readonly identities: ReadonlySet<string>;
+    readonly teams: TeamRoles;
+}
+
+export class ItemPermissions {
+    private readonly sources: SourceAccess;
+
+    constructor(
+        private readonly storage: HarnessStorage,
+        private readonly identities: Identities,
+        private readonly grants: IdentityGrants,
+        private readonly now: () => Date,
+        private readonly classifications: Classifications,
+    ) {
+        this.sources = new SourceAccess(storage);
+    }
+
+    readable(
+        definition: ItemTypeDefinition,
+        records: readonly StoredItem[],
+        context: ExecutionContext,
+    ): readonly StoredItem[] {
+        const actor = this.actor(context);
+        this.sources.inherited(definition);
+
+        return records.filter((record) =>
+            this.allowed(definition, record, AccessRight.Get, actor, context),
+        );
+    }
+
+    assert(
+        definition: ItemTypeDefinition,
+        record: StoredItem,
+        right: AccessRight,
+        context: ExecutionContext,
+    ): void {
+        if (!this.allowed(definition, record, right, this.actor(context), context)) {
+            throw new ApplicationError(
+                Item.error(
+                    `Permission denied for '${definition.name}:${record.id}' (${right}).`,
+                    "PermissionDenied",
+                ),
+            );
+        }
+    }
+
+    creation(
+        definition: ItemTypeDefinition,
+        values: Readonly<Record<string, StorageValue>>,
+        context: ExecutionContext,
+    ): Readonly<Record<string, StorageValue>> {
+        const actor = this.actor(context);
+        const audit = { created_by_id: actor.user.id, created_on: this.now().toISOString() };
+        const classification = String(values.classification ?? "");
+
+        if (this.sources.inherited(definition)) {
+            if (!this.classifications.paths(definition, context).has(classification)) {
+                throw new ApplicationError(
+                    Item.error(
+                        `Cannot add unknown class '${classification}' on '${definition.name}'.`,
+                        "PermissionDenied",
+                    ),
+                );
+            }
+
+            const source = this.sources.owner(definition, values, context);
+            this.assert(source.definition, source.record, AccessRight.Update, context);
+
+            return {
+                ...this.sourceProperties(source.definition, source.record, context),
+                ...audit,
+            };
+        }
+
+        this.assertCanAdd(definition, classification, actor, context);
+        const permission = values.permission_id ?? this.defaultPermission(definition, context);
+
+        if (typeof permission !== "string" || !this.storage.getItem("Permission", permission)) {
+            throw new PlatformError(
+                "MissingPermission",
+                `Import a default Permission for '${definition.name}'.`,
+            );
+        }
+
+        this.assertSelectedPermission(definition, permission, context, values.current_state);
+
+        return {
+            permission_id: permission,
+            ...audit,
+        };
+    }
+
+    sourceProperties(
+        definition: ItemTypeDefinition,
+        record: StoredItem,
+        context: ExecutionContext,
+    ): Readonly<Record<string, StorageValue>> {
+        return {
+            ...inheritedSecurity(record),
+            permission_id: this.permissionId(definition, record, context),
+        };
+    }
+
+    assertCanReclassify(
+        definition: ItemTypeDefinition,
+        classification: string,
+        context: ExecutionContext,
+    ): void {
+        if (!this.sources.inherited(definition)) {
+            this.assertCanAdd(definition, classification, this.actor(context), context);
+        }
+    }
+
+    private assertCanAdd(
+        definition: ItemTypeDefinition,
+        classification: string,
+        actor: Actor,
+        context: ExecutionContext,
+    ): void {
+        const paths = this.classifications.paths(definition, context);
+        const rules = this.storage.listItems("Can Add");
+        spendContext(context, rules.length);
+        const permitted =
+            paths.has(classification) &&
+            rules.some((record) => {
+                const enabled = record.properties.can_add;
+                const path = String(record.properties.class_path ?? "");
+
+                return (
+                    (enabled === undefined || String(enabled) === "1") &&
+                    String(record.properties.source_id).toLowerCase() ===
+                        definition.id.toLowerCase() &&
+                    paths.has(path) &&
+                    (path === "" ||
+                        classification === path ||
+                        classification.startsWith(`${path}/`)) &&
+                    effective(record, this.now()) &&
+                    actor.identities.has(String(record.properties.related_id).toLowerCase())
+                );
+            });
+
+        if (!permitted) {
+            throw new ApplicationError(
+                Item.error(`Cannot add '${definition.name}' for this User.`, "PermissionDenied"),
+            );
+        }
+    }
+
+    private actor(context: ExecutionContext): Actor {
+        const identities = new Set(this.grants.current(context).map((id) => id.toLowerCase()));
+
+        return {
+            user: this.identities.user(),
+            identities,
+            teams: new TeamRoles(this.storage, identities, context),
+        };
+    }
+
+    private allowed(
+        definition: ItemTypeDefinition,
+        record: StoredItem,
+        right: AccessRight,
+        actor: Actor,
+        context: ExecutionContext,
+    ): boolean {
+        spendContext(context);
+
+        const inherited = this.sources.inherited(definition);
+
+        if (inherited) {
+            this.sources.resolve(definition, record, context);
+        }
+
+        const required = inherited && right === AccessRight.Delete ? AccessRight.Update : right;
+
+        const id = this.permissionId(definition, record, context);
+
+        for (const access of this.storage.listItems("Access")) {
+            spendContext(context);
+
+            if (
+                String(access.properties[required] ?? "0") !== "1" ||
+                String(access.properties.source_id).toLowerCase() !== id.toLowerCase() ||
+                !effective(access, this.now()) ||
+                !this.matches(String(access.properties.related_id), record, actor)
+            ) {
+                continue;
+            }
+
+            return true;
+        }
+
+        return false;
+    }
+
+    private permissionId(
+        definition: ItemTypeDefinition,
+        record: StoredItem,
+        context: ExecutionContext,
+    ): string {
+        const id = record.properties.permission_id ?? this.defaultPermission(definition, context);
+
+        if (typeof id !== "string" || !this.storage.getItem("Permission", id)) {
+            throw new PlatformError(
+                "MissingPermission",
+                `Import Permission metadata for '${record.type}:${record.id}'.`,
+            );
+        }
+
+        return id;
+    }
+
+    private matches(id: string, record: StoredItem, actor: Actor): boolean {
+        if (actor.identities.has(id.toLowerCase())) {
+            return true;
+        }
+
+        this.identities.byId(id);
+
+        if (systemIdentity(id, "Creator")) {
+            return (
+                actor.user.id.toLowerCase() ===
+                String(record.properties.created_by_id).toLowerCase()
+            );
+        }
+
+        if (systemIdentity(id, "Owner")) {
+            return actor.identities.has(String(record.properties.owned_by_id).toLowerCase());
+        }
+
+        if (systemIdentity(id, "Manager")) {
+            return actor.identities.has(String(record.properties.managed_by_id).toLowerCase());
+        }
+
+        return actor.teams.matches(id, record);
+    }
+
+    assertIdentity(id: string, record: StoredItem, context: ExecutionContext): void {
+        if (!this.matches(id, record, this.actor(context))) {
+            throw new ApplicationError(
+                Item.error(
+                    `Identity does not permit the transition of '${record.type}'.`,
+                    "PermissionDenied",
+                ),
+            );
+        }
+    }
+
+    assertSelectedPermission(
+        definition: ItemTypeDefinition,
+        id: string,
+        context: ExecutionContext,
+        state?: StorageValue,
+    ): void {
+        const selected = this.storage.getItem("Permission", id);
+        const lifecycle =
+            typeof state === "string"
+                ? this.storage.getCatalogEntry("Life Cycle State", state)
+                : undefined;
+        const rules = this.storage.listItems("Allowed Permission");
+        spendContext(context, rules.length);
+        const allowed = rules.some(
+            (record) =>
+                String(record.properties.source_id).toLowerCase() === definition.id.toLowerCase() &&
+                String(record.properties.related_id).toLowerCase() === id.toLowerCase(),
+        );
+        const metadata = this.storage.getCatalogEntry("ItemType", definition.id);
+        const privateAllowed =
+            String(selected?.properties.is_private ?? "0") === "1" &&
+            String(metadata?.properties.allow_private_permission ?? "1") === "1";
+
+        if (
+            !selected ||
+            (!allowed &&
+                !privateAllowed &&
+                String(lifecycle?.properties.state_permission_id).toLowerCase() !==
+                    id.toLowerCase())
+        ) {
+            throw new ApplicationError(
+                Item.error(
+                    `Permission '${id}' is not allowed for '${definition.name}'.`,
+                    "PermissionDenied",
+                ),
+            );
+        }
+    }
+
+    private defaultPermission(
+        definition: ItemTypeDefinition,
+        context: ExecutionContext,
+    ): StorageValue | undefined {
+        const rules = this.storage.listItems("Allowed Permission");
+        spendContext(context, rules.length);
+        const candidates = rules.filter(
+            (record) =>
+                String(record.properties.source_id).toLowerCase() === definition.id.toLowerCase() &&
+                String(record.properties.is_default ?? "0") === "1",
+        );
+
+        if (candidates.length > 1) {
+            throw new PlatformError(
+                "AmbiguousPermission",
+                `ItemType '${definition.name}' has multiple default Permissions.`,
+            );
+        }
+
+        return candidates[0]?.properties.related_id;
+    }
+}