@jungjaehoon/mama-core 2.2.0 → 2.2.1

package/db/migrations/065-create-principal-scope-grants.sql

@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS principal_scope_grants (
+  principal_id TEXT NOT NULL REFERENCES principals(principal_id),
+  grant_kind TEXT NOT NULL CHECK (grant_kind IN ('source', 'memory')),
+  scope_kind TEXT NOT NULL CHECK (
+    length(trim(scope_kind)) > 0
+    AND scope_kind <> '*'
+    AND (grant_kind = 'source' OR scope_kind IN ('project', 'channel', 'global'))
+  ),
+  scope_id TEXT NOT NULL CHECK (length(trim(scope_id)) > 0 AND scope_id <> '*'),
+  granted_by_principal_id TEXT NOT NULL REFERENCES principals(principal_id),
+  created_at INTEGER NOT NULL,
+  revoked_at INTEGER CHECK (revoked_at IS NULL OR revoked_at >= created_at)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_principal_scope_grants_one_active
+  ON principal_scope_grants(principal_id, grant_kind, scope_kind, scope_id)
+  WHERE revoked_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_principal_scope_grants_active_listing
+  ON principal_scope_grants(principal_id, created_at, grant_kind, scope_kind, scope_id)
+  WHERE revoked_at IS NULL;
+
+INSERT OR IGNORE INTO schema_version (version, description)
+VALUES (65, 'Create principal scope grants for human-team access');

package/dist/identity/principal-repository.d.ts

@@ -4,6 +4,29 @@ export interface PrincipalRow {
     kind: 'owner' | 'member';
     status: 'active' | 'suspended' | 'offboarded';
 }
+export declare const SHARED_MEMORY_SCOPE_KINDS: readonly ["project", "channel", "global"];
+export type SharedMemoryScopeKind = (typeof SHARED_MEMORY_SCOPE_KINDS)[number];
+export type PrincipalScopeGrantRef = {
+    kind: 'source';
+    connector: string;
+    channelId: string;
+} | {
+    kind: 'memory';
+    scopeKind: SharedMemoryScopeKind;
+    scopeId: string;
+};
+export interface PrincipalScopeGrantRecord {
+    targetPrincipalId: string;
+    scope: PrincipalScopeGrantRef;
+    grantedByPrincipalId: string;
+    createdAt: number;
+}
+export interface PrincipalScopeGrantMutationInput {
+    targetPrincipalId: string;
+    ownerPrincipalId: string;
+    scope: PrincipalScopeGrantRef;
+    now: number;
+}
 export interface PrincipalRepository {
     resolveByExternal(connector: string, namespace: string, externalId: string): PrincipalRow | null;
     registerMember(input: {
@@ -27,11 +50,19 @@ export interface PrincipalRepository {
         displayName?: string;
         status: string;
     }>;
+    grantScope(input: PrincipalScopeGrantMutationInput): 'created' | 'exists';
+    revokeScope(input: PrincipalScopeGrantMutationInput): 'revoked' | 'absent';
+    listActiveGrants(principalId: string): PrincipalScopeGrantRecord[];
 }
 export type PrincipalRegistrationErrorCode = 'identity_bound_to_owner' | 'member_not_active';
 export declare class PrincipalRegistrationError extends Error {
     readonly code: PrincipalRegistrationErrorCode;
     constructor(code: PrincipalRegistrationErrorCode, message: string);
 }
+export type PrincipalScopeGrantErrorCode = 'target_not_active_member' | 'grantor_not_active_owner' | 'invalid_scope';
+export declare class PrincipalScopeGrantError extends Error {
+    readonly code: PrincipalScopeGrantErrorCode;
+    constructor(code: PrincipalScopeGrantErrorCode, message: string);
+}
 export declare function createPrincipalRepository(adapter: Pick<DBManagerAdapter, 'prepare' | 'transaction'>): PrincipalRepository;
 //# sourceMappingURL=principal-repository.d.ts.map

package/dist/identity/principal-repository.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrincipalRegistrationError = void 0;
+exports.PrincipalScopeGrantError = exports.PrincipalRegistrationError = exports.SHARED_MEMORY_SCOPE_KINDS = void 0;
 exports.createPrincipalRepository = createPrincipalRepository;
 const node_crypto_1 = require("node:crypto");
+exports.SHARED_MEMORY_SCOPE_KINDS = ['project', 'channel', 'global'];
 class PrincipalRegistrationError extends Error {
     code;
     constructor(code, message) {
@@ -12,6 +13,90 @@ class PrincipalRegistrationError extends Error {
     }
 }
 exports.PrincipalRegistrationError = PrincipalRegistrationError;
+class PrincipalScopeGrantError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'PrincipalScopeGrantError';
+        this.code = code;
+    }
+}
+exports.PrincipalScopeGrantError = PrincipalScopeGrantError;
+const MAX_SCOPE_COMPONENT_LENGTH = 512;
+function containsControlCharacter(value) {
+    return Array.from(value).some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint < 32 || codePoint === 127;
+    });
+}
+function canonicalizeScopeComponent(value, label, lowercase = false) {
+    if (typeof value !== 'string') {
+        throw new PrincipalScopeGrantError('invalid_scope', `${label} must be a string`);
+    }
+    const trimmed = value.trim();
+    const canonical = lowercase ? trimmed.toLowerCase() : trimmed;
+    if (canonical.length === 0 ||
+        canonical.length > MAX_SCOPE_COMPONENT_LENGTH ||
+        canonical === '*' ||
+        containsControlCharacter(canonical)) {
+        throw new PrincipalScopeGrantError('invalid_scope', `${label} is not a canonical scope value`);
+    }
+    return canonical;
+}
+function canonicalizeGrantScope(scope) {
+    if (typeof scope !== 'object' || scope === null) {
+        throw new PrincipalScopeGrantError('invalid_scope', 'Grant scope must be an object');
+    }
+    const candidate = scope;
+    if (candidate.kind === 'source') {
+        return {
+            kind: 'source',
+            connector: canonicalizeScopeComponent(candidate.connector, 'Source connector', true),
+            channelId: canonicalizeScopeComponent(candidate.channelId, 'Source channel ID'),
+        };
+    }
+    if (candidate.kind === 'memory') {
+        if (typeof candidate.scopeKind !== 'string' ||
+            !exports.SHARED_MEMORY_SCOPE_KINDS.includes(candidate.scopeKind)) {
+            throw new PrincipalScopeGrantError('invalid_scope', 'Memory grant kind must be project, channel, or global');
+        }
+        return {
+            kind: 'memory',
+            scopeKind: candidate.scopeKind,
+            scopeId: canonicalizeScopeComponent(candidate.scopeId, 'Memory scope ID'),
+        };
+    }
+    throw new PrincipalScopeGrantError('invalid_scope', 'Grant kind must be source or memory');
+}
+function scopeColumns(scope) {
+    if (scope.kind === 'source') {
+        return {
+            grantKind: 'source',
+            scopeKind: scope.connector,
+            scopeId: scope.channelId,
+        };
+    }
+    return {
+        grantKind: 'memory',
+        scopeKind: scope.scopeKind,
+        scopeId: scope.scopeId,
+    };
+}
+function mapPrincipalScopeGrant(row) {
+    const scope = row.grant_kind === 'source'
+        ? { kind: 'source', connector: row.scope_kind, channelId: row.scope_id }
+        : {
+            kind: 'memory',
+            scopeKind: row.scope_kind,
+            scopeId: row.scope_id,
+        };
+    return {
+        targetPrincipalId: row.principal_id,
+        scope,
+        grantedByPrincipalId: row.granted_by_principal_id,
+        createdAt: row.created_at,
+    };
+}
 function mintPrincipalId(kind, connector, namespace, externalId) {
     const identityKey = JSON.stringify([kind, connector, namespace, externalId]);
     const digest = (0, node_crypto_1.createHash)('sha256').update(identityKey, 'utf8').digest('hex');
@@ -42,6 +127,63 @@ function createPrincipalRepository(adapter) {
      FROM principals
      WHERE kind = 'member'
      ORDER BY created_at ASC, principal_id ASC`);
+    const selectActiveMemberStatement = adapter.prepare(`SELECT 1
+     FROM principals
+     WHERE principal_id = ? AND kind = 'member' AND status = 'active'`);
+    const selectActiveGrantorStatement = adapter.prepare(`SELECT 1
+     FROM principals
+     WHERE principal_id = ? AND kind = 'owner' AND status = 'active'`);
+    const insertGrantStatement = adapter.prepare(`INSERT INTO principal_scope_grants (
+       principal_id, grant_kind, scope_kind, scope_id,
+       granted_by_principal_id, created_at, revoked_at
+     )
+     SELECT ?, ?, ?, ?, ?, ?, NULL
+     WHERE EXISTS (
+       SELECT 1 FROM principals
+       WHERE principal_id = ? AND kind = 'member' AND status = 'active'
+     )
+       AND EXISTS (
+         SELECT 1 FROM principals
+         WHERE principal_id = ? AND kind = 'owner' AND status = 'active'
+       )
+     ON CONFLICT (principal_id, grant_kind, scope_kind, scope_id)
+       WHERE revoked_at IS NULL
+     DO NOTHING`);
+    const revokeGrantStatement = adapter.prepare(`UPDATE principal_scope_grants
+     SET revoked_at = ?
+     WHERE principal_id = ? AND grant_kind = ? AND scope_kind = ? AND scope_id = ?
+       AND revoked_at IS NULL
+       AND EXISTS (
+         SELECT 1 FROM principals
+         WHERE principal_id = ? AND kind = 'member' AND status = 'active'
+       )
+       AND EXISTS (
+         SELECT 1 FROM principals
+         WHERE principal_id = ? AND kind = 'owner' AND status = 'active'
+       )`);
+    const listActiveGrantsStatement = adapter.prepare(`SELECT
+       grants.principal_id,
+       grants.grant_kind,
+       grants.scope_kind,
+       grants.scope_id,
+       grants.granted_by_principal_id,
+       grants.created_at
+     FROM principal_scope_grants AS grants
+     JOIN principals AS target ON target.principal_id = grants.principal_id
+     WHERE grants.principal_id = ?
+       AND grants.revoked_at IS NULL
+       AND target.kind = 'member'
+       AND target.status = 'active'
+     ORDER BY grants.created_at ASC, grants.grant_kind ASC,
+       grants.scope_kind ASC, grants.scope_id ASC`);
+    function assertGrantMutationPrincipals(targetPrincipalId, ownerPrincipalId) {
+        if (!selectActiveMemberStatement.get(targetPrincipalId)) {
+            throw new PrincipalScopeGrantError('target_not_active_member', 'Grant target must be an active member principal');
+        }
+        if (!selectActiveGrantorStatement.get(ownerPrincipalId)) {
+            throw new PrincipalScopeGrantError('grantor_not_active_owner', 'Grant mutation requires an active owner principal');
+        }
+    }
     function resolveByExternal(connector, namespace, externalId) {
         const row = resolveByExternalStatement.get(connector, namespace, externalId);
         return row ? mapPrincipal(row) : null;
@@ -101,6 +243,33 @@ function createPrincipalRepository(adapter) {
             return row.display_name === null ? member : { ...member, displayName: row.display_name };
         });
     }
+    function grantScope(input) {
+        const canonicalScope = canonicalizeGrantScope(input.scope);
+        const { grantKind, scopeKind, scopeId } = scopeColumns(canonicalScope);
+        return adapter.transaction(() => {
+            const result = insertGrantStatement.run(input.targetPrincipalId, grantKind, scopeKind, scopeId, input.ownerPrincipalId, input.now, input.targetPrincipalId, input.ownerPrincipalId);
+            if (result.changes === 1) {
+                return 'created';
+            }
+            assertGrantMutationPrincipals(input.targetPrincipalId, input.ownerPrincipalId);
+            return 'exists';
+        });
+    }
+    function revokeScope(input) {
+        const canonicalScope = canonicalizeGrantScope(input.scope);
+        const { grantKind, scopeKind, scopeId } = scopeColumns(canonicalScope);
+        return adapter.transaction(() => {
+            const result = revokeGrantStatement.run(input.now, input.targetPrincipalId, grantKind, scopeKind, scopeId, input.targetPrincipalId, input.ownerPrincipalId);
+            if (result.changes === 1) {
+                return 'revoked';
+            }
+            assertGrantMutationPrincipals(input.targetPrincipalId, input.ownerPrincipalId);
+            return 'absent';
+        });
+    }
+    function listActiveGrants(principalId) {
+        return listActiveGrantsStatement.all(principalId).map(mapPrincipalScopeGrant);
+    }
     return {
         resolveByExternal,
         registerMember,
@@ -113,6 +282,9 @@ function createPrincipalRepository(adapter) {
         },
         ensureOwner,
         listMembers,
+        grantScope,
+        revokeScope,
+        listActiveGrants,
     };
 }
 //# sourceMappingURL=principal-repository.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jungjaehoon/mama-core",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "MAMA Core - Shared modules for Memory-Augmented MCP Assistant",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",