@intutic/gate 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/gate.d.ts +2 -1
- package/dist/gate.d.ts.map +1 -1
- package/dist/gate.js +18 -1
- package/dist/gate.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/dist/snapshot.d.ts +8 -0
- package/dist/snapshot.d.ts.map +1 -1
- package/dist/snapshot.js +17 -1
- package/dist/snapshot.js.map +1 -1
- package/dist/ssoGroups.d.ts +44 -0
- package/dist/ssoGroups.d.ts.map +1 -0
- package/dist/ssoGroups.js +81 -0
- package/dist/ssoGroups.js.map +1 -0
- package/package.json +1 -1
package/dist/gate.d.ts
CHANGED
|
@@ -9,8 +9,9 @@
|
|
|
9
9
|
* PreToolUse hook for them. This package is that enforcement point: the
|
|
10
10
|
* missing adapter, written against Intutic's own published gate contract.
|
|
11
11
|
*
|
|
12
|
-
*
|
|
12
|
+
* Five tiers, in order — identical precedence to the Python SDK:
|
|
13
13
|
*
|
|
14
|
+
* A0 SSO group policy from the policy snapshot unknown groups refused
|
|
14
15
|
* A1 policy snapshot port of intuticGate() fails CLOSED
|
|
15
16
|
* A3 SOP rules authored in the product fails OPEN (A2 covers it)
|
|
16
17
|
* A2 image integrity local check fails CLOSED
|
package/dist/gate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;yDACyD;AACzD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAM9C,CAAA;AAEF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;CACrB;AAaD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,qBAAa,IAAI;IACf,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAsC;IACrD;8EAC0E;IAC1E,OAAO,CAAC,SAAS,CAAkC;gBAEvC,GAAG,GAAE,UAAe,EAAE,MAAM,GAAE,UAAU,GAAG,IAAW;IAKlE,OAAO,CAAC,YAAY;IAOpB,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAOhC;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,CAAC,WAAW;IAwBnC;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAwBlC,IAAI;IAalB;;;;OAIG;YACW,wBAAwB;IAWtC,sFAAsF;IAChF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAqHnE;AAwBD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}
|
package/dist/gate.js
CHANGED
|
@@ -9,8 +9,9 @@
|
|
|
9
9
|
* PreToolUse hook for them. This package is that enforcement point: the
|
|
10
10
|
* missing adapter, written against Intutic's own published gate contract.
|
|
11
11
|
*
|
|
12
|
-
*
|
|
12
|
+
* Five tiers, in order — identical precedence to the Python SDK:
|
|
13
13
|
*
|
|
14
|
+
* A0 SSO group policy from the policy snapshot unknown groups refused
|
|
14
15
|
* A1 policy snapshot port of intuticGate() fails CLOSED
|
|
15
16
|
* A3 SOP rules authored in the product fails OPEN (A2 covers it)
|
|
16
17
|
* A2 image integrity local check fails CLOSED
|
|
@@ -50,6 +51,7 @@ import { IntuticGateRefusal } from './errors.js';
|
|
|
50
51
|
import * as imagecheck from './imagecheck.js';
|
|
51
52
|
import * as snapshot from './snapshot.js';
|
|
52
53
|
import * as soprules from './soprules.js';
|
|
54
|
+
import { evaluateSsoGroupClearance } from './ssoGroups.js';
|
|
53
55
|
/** Tools that cannot change anything. They still get the local snapshot check
|
|
54
56
|
* (Tier A1), but skip the remote gate call (Tier B). */
|
|
55
57
|
export const READ_ONLY_TOOLS = new Set([
|
|
@@ -171,6 +173,21 @@ export class Gate {
|
|
|
171
173
|
const target = String(toolInput.path ?? toolInput.file_path ?? '');
|
|
172
174
|
const command = String(toolInput.command ?? '');
|
|
173
175
|
await this.reportSnapshotHealthOnce(toolName);
|
|
176
|
+
// ---- Tier A0: SSO group policy, from the snapshot ------------------
|
|
177
|
+
//
|
|
178
|
+
// The workspace's group policy decided for the member the snapshot was
|
|
179
|
+
// issued to — the same evaluator, and so the same answer, as the control
|
|
180
|
+
// plane's hook gate. Not skippable by INTUTIC_GUARD_DISABLE: it is the
|
|
181
|
+
// workspace's own policy, not the destructive family.
|
|
182
|
+
const sso = this.getSnapshot().ssoGroups;
|
|
183
|
+
if (sso) {
|
|
184
|
+
const d = evaluateSsoGroupClearance(sso.policy, toolName, sso.member ? sso.member.ssoGroups : null);
|
|
185
|
+
if (d.clearance !== 'GRANTED') {
|
|
186
|
+
const reason = `${d.reason} [${d.ruleId}]`;
|
|
187
|
+
await this.emit('tool_blocked', toolName, reason, toolInput);
|
|
188
|
+
throw new IntuticGateRefusal(reason, 'SSO_GROUP');
|
|
189
|
+
}
|
|
190
|
+
}
|
|
174
191
|
// ---- Tier A1: policy snapshot -------------------------------------
|
|
175
192
|
const disabled = snapshot.guardDisabledFromEnv();
|
|
176
193
|
if (disabled) {
|
package/dist/gate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAE1D;yDACyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,WAAW;IACX,YAAY;IACZ,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAA;AAoBF,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,+BAA+B;QACnE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;KACrC,CAAA;AACH,CAAC;AAID,MAAM,OAAO,IAAI;IACN,GAAG,CAAgB;IACnB,MAAM,CAAmB;IAC1B,SAAS,GAA6B,IAAI,CAAA;IAC1C,iBAAiB,GAAG,KAAK,CAAA;IACzB,OAAO,GAAkC,IAAI,CAAA;IACrD;8EAC0E;IAClE,SAAS,GAA8B,IAAI,CAAA;IAEnD,YAAY,MAAkB,EAAE,EAAE,SAA4B,IAAI;QAChE,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,YAAY;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;QAChC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,uEAAuE;IAEvE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,iCAAiC;oBACrF,GAAG,IAAI,qEAAqE,EAC9E,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA2B,CAAA;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;gBAClE,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,wBAAwB,IAAI,MAAM;oBACtF,eAAe,IAAI,GAAG,EACxB,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,GAA8B,IAAI,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpG,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,WAAW,EACX,qEAAqE;oBACnE,oCAAoC,CACvC,CAAA;gBACD,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,wEAAwE;IAEhE,KAAK,CAAC,IAAI,CAChB,KAAa,EACb,IAAY,EACZ,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,IAAY;QACjD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAM;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,SAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAM;QAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAE/C,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAE7C,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAA;QACxC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAA;gBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,EAAE,CAAA;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CACb,iBAAiB,EACjB,QAAQ,EACR,4FAA4F,CAC7F,CAAA;QACH,CAAC;QAED,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACpE,CAAC;QAED,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;oBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAClD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;oBAC7C,kEAAkE;oBAClE,qCAAqC;oBACrC,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,MAAM,wDAAwD,EACjE,SAAS,CACV,CAAA;oBACD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAA;gBACxF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oDAAoD,EAClF,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAA;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClF,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IACpD,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}
|
package/dist/index.d.ts
CHANGED
|
@@ -19,6 +19,7 @@ export { checkCommand, checkImages, checkWrittenManifest, isDeployCommand, isPin
|
|
|
19
19
|
export type { ImagePolicy, ImageRef, Verdict as ImageVerdict } from './imagecheck.js';
|
|
20
20
|
export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
|
|
21
21
|
export type { Decision, Rule, RuleSubject, Severity, SnapshotState } from './snapshot.js';
|
|
22
|
+
export type { SsoGroupClearance, SsoGroupPolicy, SsoGroupRecord } from './ssoGroups.js';
|
|
22
23
|
export { firstMatch, parseRules, ruleMatches, serialiseToolInput, supportsArgPatterns, fetchRules, ACTION_BLOCK, ACTION_WARN, ACTION_APPROVAL, } from './soprules.js';
|
|
23
24
|
export type { SopRule } from './soprules.js';
|
|
24
25
|
export { wrapTool, wrapTools } from './wrapTools.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAErF,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEzF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAErF,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEzF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AAKtB,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}
|
package/dist/snapshot.d.ts
CHANGED
|
@@ -71,6 +71,7 @@
|
|
|
71
71
|
* here — this reader compiles them as native JS `RegExp`, the dialect they
|
|
72
72
|
* were authored in.
|
|
73
73
|
*/
|
|
74
|
+
import { type SsoGroupRecord } from './ssoGroups.js';
|
|
74
75
|
export declare const SNAPSHOT_STALE_AFTER_DAYS = 7;
|
|
75
76
|
/** Severity tiers, in the order the shipped gate handles them. */
|
|
76
77
|
export declare const SEV_SHADOW: "shadow";
|
|
@@ -95,6 +96,13 @@ export declare class Snapshot {
|
|
|
95
96
|
ageDays: number;
|
|
96
97
|
/** Regexes that would not compile. */
|
|
97
98
|
droppedRules: number;
|
|
99
|
+
/**
|
|
100
|
+
* The workspace's SSO-group policy and the member this snapshot was issued
|
|
101
|
+
* to, or null when the workspace has no group policy. On a snapshot that
|
|
102
|
+
* fails its integrity check the member is null — groups unknown — so an
|
|
103
|
+
* edited group list in the file clears nothing.
|
|
104
|
+
*/
|
|
105
|
+
ssoGroups: SsoGroupRecord | null;
|
|
98
106
|
get healthMessage(): string;
|
|
99
107
|
}
|
|
100
108
|
export interface Decision {
|
package/dist/snapshot.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;
|
|
1
|
+
{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAMH,OAAO,EAA8C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEhG,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,kEAAkE;AAClE,eAAO,MAAM,UAAU,EAAG,QAAiB,CAAA;AAC3C,eAAO,MAAM,QAAQ,EAAG,MAAe,CAAA;AACvC,eAAO,MAAM,SAAS,EAAG,OAAgB,CAAA;AAEzC,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,GAAG,OAAO,QAAQ,GAAG,OAAO,SAAS,CAAA;AAC7E,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAC/D,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE3E,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,QAAQ;IACnB,KAAK,EAAE,IAAI,EAAE,CAAK;IAClB,MAAM,SAAS;IACf,KAAK,EAAE,aAAa,CAAW;IAC/B,WAAW,SAAK;IAChB,WAAW,SAAK;IAChB,OAAO,SAAI;IACX,sCAAsC;IACtC,YAAY,SAAI;IAChB;;;;;OAKG;IACH,SAAS,EAAE,cAAc,GAAG,IAAI,CAAO;IAEvC,IAAI,aAAa,IAAI,MAAM,CAa1B;CACF;AAED,MAAM,WAAW,QAAQ;IACvB,0BAA0B;IAC1B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAMD,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAaD,wBAAgB,YAAY,CAAC,WAAW,SAAK,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAuFtE;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,QAAQ,EACd,aAAa,UAAQ,GACpB,QAAQ,CA0CV;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C"}
|
package/dist/snapshot.js
CHANGED
|
@@ -75,6 +75,7 @@ import { createHash } from 'node:crypto';
|
|
|
75
75
|
import { readFileSync } from 'node:fs';
|
|
76
76
|
import { homedir } from 'node:os';
|
|
77
77
|
import { join } from 'node:path';
|
|
78
|
+
import { decodeSsoGroupRecord, SSO_GROUP_RECORD_TAG } from './ssoGroups.js';
|
|
78
79
|
export const SNAPSHOT_STALE_AFTER_DAYS = 7;
|
|
79
80
|
/** Severity tiers, in the order the shipped gate handles them. */
|
|
80
81
|
export const SEV_SHADOW = 'shadow';
|
|
@@ -89,12 +90,19 @@ export class Snapshot {
|
|
|
89
90
|
ageDays = 0;
|
|
90
91
|
/** Regexes that would not compile. */
|
|
91
92
|
droppedRules = 0;
|
|
93
|
+
/**
|
|
94
|
+
* The workspace's SSO-group policy and the member this snapshot was issued
|
|
95
|
+
* to, or null when the workspace has no group policy. On a snapshot that
|
|
96
|
+
* fails its integrity check the member is null — groups unknown — so an
|
|
97
|
+
* edited group list in the file clears nothing.
|
|
98
|
+
*/
|
|
99
|
+
ssoGroups = null;
|
|
92
100
|
get healthMessage() {
|
|
93
101
|
switch (this.state) {
|
|
94
102
|
case 'absent':
|
|
95
103
|
return 'No policy snapshot — built-in protections only';
|
|
96
104
|
case 'invalid':
|
|
97
|
-
return 'Policy snapshot failed its digest or workspace check — dynamic rules dropped';
|
|
105
|
+
return 'Policy snapshot failed its digest or workspace check — dynamic rules dropped except SSO-group refusals';
|
|
98
106
|
case 'empty':
|
|
99
107
|
return 'Policy snapshot contains no rules — the compile produced nothing';
|
|
100
108
|
case 'stale':
|
|
@@ -147,6 +155,10 @@ export function loadSnapshot(workspaceId = '', path) {
|
|
|
147
155
|
}
|
|
148
156
|
if (!line || line.startsWith('#'))
|
|
149
157
|
continue;
|
|
158
|
+
if (line.startsWith(`${SSO_GROUP_RECORD_TAG}\t`)) {
|
|
159
|
+
snap.ssoGroups = decodeSsoGroupRecord(line);
|
|
160
|
+
continue;
|
|
161
|
+
}
|
|
150
162
|
const f = line.split('\t');
|
|
151
163
|
// Column order: id, severity, flags, subject, reason, source(regex), [argPatternB64].
|
|
152
164
|
if (f.length < 6 || !f[5])
|
|
@@ -185,6 +197,10 @@ export function loadSnapshot(workspaceId = '', path) {
|
|
|
185
197
|
}
|
|
186
198
|
if (snap.state === 'invalid') {
|
|
187
199
|
snap.rules = []; // additive tier — dropping it returns to yesterday's behaviour
|
|
200
|
+
// Except the group policy, which only ever refuses: it still applies, to a
|
|
201
|
+
// member whose groups this gate can no longer vouch for.
|
|
202
|
+
if (snap.ssoGroups)
|
|
203
|
+
snap.ssoGroups = { ...snap.ssoGroups, member: null };
|
|
188
204
|
}
|
|
189
205
|
if (snap.state === 'ok' && snap.generatedAt) {
|
|
190
206
|
const t = Date.parse(snap.generatedAt);
|
package/dist/snapshot.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;
|
|
1
|
+
{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../src/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,gBAAgB,CAAA;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAE1C,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAiB,CAAA;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAA;AACvC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAgB,CAAA;AAczC,MAAM,OAAO,QAAQ;IACnB,KAAK,GAAW,EAAE,CAAA;IAClB,MAAM,GAAG,MAAM,CAAA;IACf,KAAK,GAAkB,QAAQ,CAAA;IAC/B,WAAW,GAAG,EAAE,CAAA;IAChB,WAAW,GAAG,EAAE,CAAA;IAChB,OAAO,GAAG,CAAC,CAAA;IACX,sCAAsC;IACtC,YAAY,GAAG,CAAC,CAAA;IAChB;;;;;OAKG;IACH,SAAS,GAA0B,IAAI,CAAA;IAEvC,IAAI,aAAa;QACf,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,OAAO,gDAAgD,CAAA;YACzD,KAAK,SAAS;gBACZ,OAAO,wGAAwG,CAAA;YACjH,KAAK,OAAO;gBACV,OAAO,kEAAkE,CAAA;YAC3E,KAAK,OAAO;gBACV,OAAO,sBAAsB,IAAI,CAAC,OAAO,8BAA8B,CAAA;YACzE;gBACE,OAAO,EAAE,CAAA;QACb,CAAC;IACH,CAAC;CACF;AASD,SAAS,KAAK;IACZ,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAC9D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAW,GAAG,EAAE,EAAE,IAAa;IAC1D,MAAM,CAAC,GAAG,IAAI,IAAI,YAAY,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAE3B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA,CAAC,uBAAuB;IACrC,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,oBAAoB,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;YAC3C,SAAQ;QACV,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,sFAAsF;QACtF,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE;gBACT,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE;gBACf,OAAO,EAAG,CAAC,CAAC,CAAC,CAAiB,IAAI,KAAK;gBACvC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE;gBACb,OAAO,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA;IACtB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA,CAAC,+DAA+D;QAC/E,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAA;YACrE,IAAI,IAAI,CAAC,OAAO,GAAG,yBAAyB,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAA,CAAC,8CAA8C;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CACtB,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,IAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACtB,IAAI,aAAa,EAAE,CAAC;QAClB,sEAAsE;QACtE,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,KAAK,MAAM;YACrB,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;gBAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACZ,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ;oBACzB,CAAC,CAAC,CAAC,OAAO,CAAC;oBACX,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChD,OAAO;oBACL,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,UAAU,IAAI,EAAE;oBAClD,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAA;YACH,CAAC;YACD,uEAAuE;YACvE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;QACxF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAA;AAClD,CAAC"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SSO-group tool clearance, read from the policy snapshot.
|
|
3
|
+
*
|
|
4
|
+
* Port of `evaluateSsoGroupClearance` and the `@sso_groups` record in
|
|
5
|
+
* `packages/shared-types/src/ssoGroupClearance.ts` — the evaluator the control
|
|
6
|
+
* plane's hook gate, the MCP proxy and the sync daemon's snapshot compiler
|
|
7
|
+
* share. This package has no workspace dependencies, so it carries a copy, and
|
|
8
|
+
* `src/__tests__/ssoGroups.test.ts` runs the shared vectors
|
|
9
|
+
* (`packages/shared-types/fixtures/sso-group-clearance-vectors.json`) through
|
|
10
|
+
* it so the copy cannot drift. `intutic_clawde/gate/sso_groups.py` is the
|
|
11
|
+
* Python port of the same thing.
|
|
12
|
+
*
|
|
13
|
+
* The snapshot's record carries the workspace's policy and the member the
|
|
14
|
+
* snapshot was issued to, with their groups as the control plane resolved
|
|
15
|
+
* them. It sits inside the snapshot's digest; when the digest fails, the gate
|
|
16
|
+
* still applies the policy but treats the member's groups as unknown, so an
|
|
17
|
+
* edited group list clears nothing.
|
|
18
|
+
*/
|
|
19
|
+
export type SsoGroupClearance = 'GRANTED' | 'DENIED' | 'REQUIRES_OBO';
|
|
20
|
+
export interface SsoGroupPolicy {
|
|
21
|
+
highRiskTools: string[];
|
|
22
|
+
requiredGroups: string[];
|
|
23
|
+
requireOboFor: string[];
|
|
24
|
+
}
|
|
25
|
+
export interface SsoGroupRecord {
|
|
26
|
+
policy: SsoGroupPolicy;
|
|
27
|
+
member: {
|
|
28
|
+
memberId: string;
|
|
29
|
+
ssoGroups: string[];
|
|
30
|
+
} | null;
|
|
31
|
+
issuedAt: string;
|
|
32
|
+
}
|
|
33
|
+
export interface SsoGroupDecision {
|
|
34
|
+
clearance: SsoGroupClearance;
|
|
35
|
+
ruleId: string | null;
|
|
36
|
+
reason: string;
|
|
37
|
+
}
|
|
38
|
+
export declare const SSO_GROUP_RECORD_TAG = "@sso_groups";
|
|
39
|
+
export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | null;
|
|
40
|
+
/** `memberGroups` null means the groups are unknown — a high-risk tool is then refused. */
|
|
41
|
+
export declare function evaluateSsoGroupClearance(policy: SsoGroupPolicy | null, toolName: string, memberGroups: readonly string[] | null): SsoGroupDecision;
|
|
42
|
+
/** Reads the snapshot's record line; null for any other line or a damaged one. */
|
|
43
|
+
export declare function decodeSsoGroupRecord(line: string): SsoGroupRecord | null;
|
|
44
|
+
//# sourceMappingURL=ssoGroups.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ssoGroups.d.ts","sourceRoot":"","sources":["../src/ssoGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAA;AAErE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAMjD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAQzE;AAMD,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CAqBlB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SSO-group tool clearance, read from the policy snapshot.
|
|
3
|
+
*
|
|
4
|
+
* Port of `evaluateSsoGroupClearance` and the `@sso_groups` record in
|
|
5
|
+
* `packages/shared-types/src/ssoGroupClearance.ts` — the evaluator the control
|
|
6
|
+
* plane's hook gate, the MCP proxy and the sync daemon's snapshot compiler
|
|
7
|
+
* share. This package has no workspace dependencies, so it carries a copy, and
|
|
8
|
+
* `src/__tests__/ssoGroups.test.ts` runs the shared vectors
|
|
9
|
+
* (`packages/shared-types/fixtures/sso-group-clearance-vectors.json`) through
|
|
10
|
+
* it so the copy cannot drift. `intutic_clawde/gate/sso_groups.py` is the
|
|
11
|
+
* Python port of the same thing.
|
|
12
|
+
*
|
|
13
|
+
* The snapshot's record carries the workspace's policy and the member the
|
|
14
|
+
* snapshot was issued to, with their groups as the control plane resolved
|
|
15
|
+
* them. It sits inside the snapshot's digest; when the digest fails, the gate
|
|
16
|
+
* still applies the policy but treats the member's groups as unknown, so an
|
|
17
|
+
* edited group list clears nothing.
|
|
18
|
+
*/
|
|
19
|
+
export const SSO_GROUP_RECORD_TAG = '@sso_groups';
|
|
20
|
+
function stringList(value) {
|
|
21
|
+
return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
|
|
22
|
+
}
|
|
23
|
+
export function parseSsoGroupPolicy(value) {
|
|
24
|
+
if (typeof value !== 'object' || value === null || Array.isArray(value))
|
|
25
|
+
return null;
|
|
26
|
+
const p = value;
|
|
27
|
+
return {
|
|
28
|
+
highRiskTools: stringList(p['highRiskTools']),
|
|
29
|
+
requiredGroups: stringList(p['requiredGroups']),
|
|
30
|
+
requireOboFor: stringList(p['requireOboFor']),
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
function ruleId(kind, toolName) {
|
|
34
|
+
return `sso_group.${kind}.${toolName.replace(/[^A-Za-z0-9_.:-]/g, '_')}`;
|
|
35
|
+
}
|
|
36
|
+
/** `memberGroups` null means the groups are unknown — a high-risk tool is then refused. */
|
|
37
|
+
export function evaluateSsoGroupClearance(policy, toolName, memberGroups) {
|
|
38
|
+
if (!policy)
|
|
39
|
+
return { clearance: 'GRANTED', ruleId: null, reason: '' };
|
|
40
|
+
if (policy.requireOboFor.includes(toolName)) {
|
|
41
|
+
return {
|
|
42
|
+
clearance: 'REQUIRES_OBO',
|
|
43
|
+
ruleId: ruleId('require_obo', toolName),
|
|
44
|
+
reason: `SSO group policy: ${toolName} is on-behalf-of only, and a tool-call gate has no OBO token to present`,
|
|
45
|
+
};
|
|
46
|
+
}
|
|
47
|
+
if (!policy.highRiskTools.includes(toolName))
|
|
48
|
+
return { clearance: 'GRANTED', ruleId: null, reason: '' };
|
|
49
|
+
if (memberGroups && policy.requiredGroups.some((g) => memberGroups.includes(g))) {
|
|
50
|
+
return { clearance: 'GRANTED', ruleId: null, reason: '' };
|
|
51
|
+
}
|
|
52
|
+
const groups = policy.requiredGroups.length > 0 ? policy.requiredGroups.join(', ') : '(none configured)';
|
|
53
|
+
return {
|
|
54
|
+
clearance: 'DENIED',
|
|
55
|
+
ruleId: ruleId('high_risk', toolName),
|
|
56
|
+
reason: memberGroups
|
|
57
|
+
? `SSO group policy: ${toolName} requires one of the SSO groups ${groups}, and this member holds none of them`
|
|
58
|
+
: `SSO group policy: ${toolName} requires one of the SSO groups ${groups}, and this gate does not know the member's groups`,
|
|
59
|
+
};
|
|
60
|
+
}
|
|
61
|
+
/** Reads the snapshot's record line; null for any other line or a damaged one. */
|
|
62
|
+
export function decodeSsoGroupRecord(line) {
|
|
63
|
+
const [tag, b64, ...rest] = line.split('\t');
|
|
64
|
+
if (tag !== SSO_GROUP_RECORD_TAG || !b64 || rest.length > 0)
|
|
65
|
+
return null;
|
|
66
|
+
try {
|
|
67
|
+
const raw = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
|
|
68
|
+
const policy = parseSsoGroupPolicy(raw['policy']);
|
|
69
|
+
if (!policy || typeof raw['issuedAt'] !== 'string')
|
|
70
|
+
return null;
|
|
71
|
+
const m = raw['member'];
|
|
72
|
+
const member = m && typeof m === 'object' && typeof m['memberId'] === 'string'
|
|
73
|
+
? { memberId: m['memberId'], ssoGroups: stringList(m['ssoGroups']) }
|
|
74
|
+
: null;
|
|
75
|
+
return { policy, member, issuedAt: raw['issuedAt'] };
|
|
76
|
+
}
|
|
77
|
+
catch {
|
|
78
|
+
return null;
|
|
79
|
+
}
|
|
80
|
+
}
|
|
81
|
+
//# sourceMappingURL=ssoGroups.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ssoGroups.js","sourceRoot":"","sources":["../src/ssoGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7C,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC/C,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAiC,EAAE,QAAgB;IACjE,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,QAAgB,EAChB,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC;YACvC,MAAM,EAAE,qBAAqB,QAAQ,yEAAyE;SAC/G,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvG,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC;QACrC,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,QAAQ,mCAAmC,MAAM,sCAAsC;YAC9G,CAAC,CAAC,qBAAqB,QAAQ,mCAAmC,MAAM,mDAAmD;KAC9H,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;QAC9F,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intutic/gate",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.2.0",
|
|
4
4
|
"description": "Intutic pre-execution tool gate for JS/TS agent frameworks without a shipped Intutic harness (Mastra, the Vercel AI SDK, LangChain.js, dsh, and hand-rolled agent loops)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|