@jini-ai/cms 0.3.10 → 0.4.0

package/dist/identity/password-policy.js

@@ -1,66 +0,0 @@
-/**
- * @file Password policy: no minimum length, no composition rules — presence and an upper bound only.
- *
- * Owner decision: the previous NIST SP 800-63B-aligned 12-character minimum has been removed.
- * This module no longer enforces composition rules (mandatory uppercase, digit, or symbol) either
- * — that predates this change and remains deliberate, since composition rules measurably push
- * people toward predictable, guessable patterns ("Password1!") rather than genuinely stronger
- * secrets. What remains is the minimum a credential system can enforce at all: a password must be
- * non-empty, and is capped at `MAX_PASSWORD_LENGTH` as a defense-in-depth bound (see that
- * constant's own doc).
- *
- * `createUser` (`grant-service.ts`) and `resetUserPassword` (`admin-crud-service.ts`) are the
- * identity system's only two write paths that ever set a password, confirmed by tracing the
- * whole call graph — both call this module.
- *
- * Two things this deliberately does NOT do, both load-bearing:
- * - Never reaches `seed.ts`'s first-boot owner password. `seedIdentity` hashes it directly
- *   (`deps.hasher.hash(ownerPassword)`, `seed.ts:317`) and calls neither `createUser` nor
- *   `resetUserPassword` — confirmed before writing this module. That separation is intentional
- *   to preserve here: the host chooses the first-boot owner password (`SeedIdentityInput` requires
- *   it and supplies no default), and an existing installation is already authenticating with
- *   whatever it chose. Enforcing this policy on that path would lock out every such installation
- *   whose chosen value predates the policy.
- * - Never re-validates at login. This is a write-time policy — `login`/`verify` never call it.
- *   An account whose password predates this policy (or was seeded) must keep authenticating.
- */
-/**
- * Generous upper bound — not itself a security requirement (argon2id's cost is tuned by its
- * `memoryCost`/`timeCost`/`parallelism` parameters, not by input size — see `hasher.ts`'s own
- * `@complexity` note), but a defense-in-depth cap on how large a string this service will accept
- * and pass to the hasher at all, independent of whatever limit (if any) sits in front of it at
- * the HTTP layer. Comfortably above any realistic human-typed passphrase.
- */
-export const MAX_PASSWORD_LENGTH = 512;
-/**
- * Validates `password` against the presence-and-upper-bound-only policy.
- *
- * Measures length in Unicode CODE POINTS (`[...password].length`), not UTF-16 code units
- * (`password.length`): a passphrase built from astral-plane characters (many emoji, some
- * CJK/historic scripts) is represented as a surrogate pair per character in a JS string, so plain
- * `.length` overcounts those characters relative to what a human typing them perceives — the same
- * reasoning that applies to `MAX_PASSWORD_LENGTH` below applies to the emptiness check here, since
- * both compare this same code-point count. No trimming, no character allowlist: every printable
- * character, including leading/trailing spaces and full Unicode, is accepted as typed. Silently
- * altering the input (trimming, stripping) would make the stored credential differ from the
- * secret the operator actually chose.
- *
- * @returns `null` if `password` satisfies the policy, otherwise an operator-facing message
- * stating the requirement plainly — used verbatim as the thrown `IdentityValidationError`'s
- * message by both call sites, and rendered as-is through the admin's `describeApiError` layer.
- *
- * @complexity O(n) in the password's length — spreading a string into code points is a single
- * linear pass, which is the minimum work a correct (non-UTF-16-code-unit) count requires.
- * @overallScore 100
- */
-export function validatePasswordPolicy(password) {
-    const length = [...password].length;
-    if (length === 0) {
-        return "Password is required.";
-    }
-    if (length > MAX_PASSWORD_LENGTH) {
-        return `Password must be no more than ${MAX_PASSWORD_LENGTH} characters.`;
-    }
-    return null;
-}
-//# sourceMappingURL=password-policy.js.map

package/dist/identity/permission-migrations.d.ts

@@ -1,86 +0,0 @@
-import type { IdGeneratorPort, UUID } from "../core/ports.js";
-import type { PolicyPermissionRepoPort, PolicyRepoPort } from "./ports.js";
-/**
- * @file Shared deprecate-old/grant-new permission migration mechanism
- * (generalized from the `settings.write` ->
- * `settings.definitions.manage` precedent already shipped ad hoc in
- * `identity/seed.ts`/`identity/permissions.ts`; see
- * `docs/decisions/permission-catalog-migration.md`).
- *
- * Purpose:
- * A permission-string rename/split after real grants exist is a breaking
- * migration. This module is
- * the one place that fan-out runs, so Menus/Members/Analytics/Integrations
- * remediation efforts each register their own `{from, to}` pair here instead of
- * hand-rolling a fourth divergent copy of the same fix.
- *
- * How it relates to the project:
- * - `registerPermissionMigration`/`listPermissionMigrations` are a small,
- *   in-process registry — pure metadata, no I/O, mirrors
- *   `permissions.ts`'s `PermissionCatalog.register` overwrite semantics.
- * - `migrateDeprecatedPermissionGrants` is the actual grant fan-out: for
- *   every registered pair, every policy holding `from` gets every string in
- *   `to` it doesn't already hold. It is deliberately, structurally
- *   additive-only (INV-NEW-01) — there is no delete/update call against
- *   `policy_permissions` anywhere in this file.
- * - Feature-agnostic by design: this module has zero knowledge of
- *   `navigation`/`settings`/any specific feature. Callers (e.g.
- *   `identity/permissions.ts`) register their own pairs.
- *
- * Architectural role:
- * Security-adjacent domain logic (a bug here could fail-open (grant more than
- * intended) or fail-closed (a policy silently missing a needed grant) across every
- * feature that reuses it). The additive-only design bounds the fail-closed
- * direction to "a required new permission is missing," never "an existing
- * permission is removed." See `__tests__/permission-migrations.test.ts` for
- * the dedicated fixture-driven certification required before any
- * caller wires this into a live boot path.
- */
-/** One registered deprecate-old/grant-new rename or split pair. */
-export interface PermissionMigration {
-    /** The deprecated permission string. Never deleted from the catalog by this mechanism. */
-    readonly from: string;
-    /** The replacement permission string(s) every `from`-holding policy should also gain. */
-    readonly to: readonly string[];
-    /** Human-readable rationale, surfaced in docs/reviews — not interpreted by this module. */
-    readonly reason: string;
-}
-export interface MigrateDeprecatedPermissionGrantsDeps {
-    policyPermissions: PolicyPermissionRepoPort;
-    policies: PolicyRepoPort;
-    idGen: IdGeneratorPort;
-    workspaceId: UUID;
-}
-export interface MigrateDeprecatedPermissionGrantsResult {
-    /** Total new `policy_permissions` rows written across every policy and every registered pair. */
-    migratedGrantCount: number;
-}
-/**
- * Register a `{from, to, reason}` rename/split pair for later fan-out.
- * Idempotent: re-registering the same `from` overwrites the prior entry
- * rather than duplicating it (matches `PermissionCatalog.register`'s
- * existing overwrite semantics, `identity/permissions.ts`).
- *
- * @complexity O(1).
- * @overallScore 100
- */
-export declare function registerPermissionMigration(migration: PermissionMigration): void;
-/** Enumerate every registered migration pair. */
-export declare function listPermissionMigrations(): PermissionMigration[];
-/**
- * For every registered `{from, to}` pair, for every policy in the workspace
- * holding `from`, ensure every string in `to` is also granted — adding only
- * the rows that are missing. Never removes or mutates `from` (or any other
- * existing row) — additive-only by construction (INV-NEW-01), so a failed or
- * partial run leaves the system in its previous, still-functioning state.
- *
- * Safe to call on every boot (idempotent): a rerun with nothing new to add
- * returns `migratedGrantCount: 0` (mirrors `migrateLegacyPresentationSettings`'s
- * boot-safety precedent).
- *
- * @complexity O(p * m) where p = policies in the workspace, m = registered
- * migration pairs; both are small, bounded collections in this app's shape.
- * @overallScore 100
- */
-export declare function migrateDeprecatedPermissionGrants(deps: MigrateDeprecatedPermissionGrantsDeps): Promise<MigrateDeprecatedPermissionGrantsResult>;
-//# sourceMappingURL=permission-migrations.d.ts.map

package/dist/identity/permission-migrations.js

@@ -1,67 +0,0 @@
-/** Module-singleton registry — keyed by `from` so re-registration overwrites (idempotent, matches `PermissionCatalog.register`). */
-const registry = new Map();
-/**
- * Register a `{from, to, reason}` rename/split pair for later fan-out.
- * Idempotent: re-registering the same `from` overwrites the prior entry
- * rather than duplicating it (matches `PermissionCatalog.register`'s
- * existing overwrite semantics, `identity/permissions.ts`).
- *
- * @complexity O(1).
- * @overallScore 100
- */
-export function registerPermissionMigration(migration) {
-    registry.set(migration.from, migration);
-}
-/** Enumerate every registered migration pair. */
-export function listPermissionMigrations() {
-    return [...registry.values()];
-}
-/**
- * For every registered `{from, to}` pair, for every policy in the workspace
- * holding `from`, ensure every string in `to` is also granted — adding only
- * the rows that are missing. Never removes or mutates `from` (or any other
- * existing row) — additive-only by construction (INV-NEW-01), so a failed or
- * partial run leaves the system in its previous, still-functioning state.
- *
- * Safe to call on every boot (idempotent): a rerun with nothing new to add
- * returns `migratedGrantCount: 0` (mirrors `migrateLegacyPresentationSettings`'s
- * boot-safety precedent).
- *
- * @complexity O(p * m) where p = policies in the workspace, m = registered
- * migration pairs; both are small, bounded collections in this app's shape.
- * @overallScore 100
- */
-export async function migrateDeprecatedPermissionGrants(deps) {
-    const migrations = listPermissionMigrations();
-    if (migrations.length === 0)
-        return { migratedGrantCount: 0 };
-    const policies = await deps.policies.list({ workspaceId: deps.workspaceId });
-    let migratedGrantCount = 0;
-    for (const policy of policies) {
-        const existing = await deps.policyPermissions.listByPolicyId({
-            workspaceId: deps.workspaceId,
-            policyId: policy.id,
-        });
-        const held = new Set(existing.map((row) => row.permission));
-        for (const migration of migrations) {
-            if (!held.has(migration.from))
-                continue;
-            for (const toPermission of migration.to) {
-                if (held.has(toPermission))
-                    continue;
-                await deps.policyPermissions.save({
-                    id: deps.idGen.newId(),
-                    workspaceId: deps.workspaceId,
-                    policyId: policy.id,
-                    permission: toPermission,
-                    resourceType: null,
-                    constraintJson: null,
-                });
-                held.add(toPermission);
-                migratedGrantCount += 1;
-            }
-        }
-    }
-    return { migratedGrantCount };
-}
-//# sourceMappingURL=permission-migrations.js.map

package/dist/identity/permissions.d.ts

@@ -1,35 +0,0 @@
-/** One entry in the registered permission catalog. */
-export interface PermissionDescriptor {
-    /** Dotted permission string, e.g. `"content.write"`. */
-    id: string;
-    /** Registering module, e.g. `"core"` or a feature name. */
-    owner: string;
-    description: string;
-}
-/**
- * Code-side registry backing REQ-03's catalog validation and REQ-12's
- * enumeration. `"*"` (the owner wildcard, REQ-04) is deliberately not a
- * catalog entry — it is a distinct, built-in-only grant shape checked by
- * `authorize()`/seed, never a registrable permission string.
- *
- * @complexity O(1) amortized per lookup (Map-backed); O(n) to list all.
- * @overallScore 100
- */
-declare class PermissionCatalog {
-    private readonly byId;
-    constructor(initial: readonly PermissionDescriptor[]);
-    /** Idempotent: re-registering the same `id` (e.g. on a warm reload) is a no-op overwrite. */
-    register(descriptor: PermissionDescriptor): void;
-    has(id: string): boolean;
-    list(): PermissionDescriptor[];
-}
-/** Module-singleton catalog — core's base vocabulary, extended by feature registration. */
-export declare const permissionCatalog: PermissionCatalog;
-/** Register an additional permission at feature startup (REQ-03). */
-export declare function registerPermission(descriptor: PermissionDescriptor): void;
-/** Enumerate the full registered catalog (REQ-12 core capability; CLI wiring is N/A, see file header). */
-export declare function listPermissions(): PermissionDescriptor[];
-/** Whether `id` is a recognized catalog permission. `"*"` is intentionally excluded (see class doc). */
-export declare function isKnownPermission(id: string): boolean;
-export {};
-//# sourceMappingURL=permissions.d.ts.map