@jwilleke/ngdpbase-types 0.0.0 → 5.18.0

package/lib/src/security/PolicyInformationPoint.d.ts

@@ -0,0 +1,448 @@
+import BaseManager from '../managers/BaseManager.js';
+import { WikiEngine } from '../types/WikiEngine.js';
+import type { AgentTokenGrant, ProxyClaim } from '../managers/UserManager.js';
+import type { Request } from 'express';
+import type { PageFrontmatter } from '../types/Page.js';
+import { type ShareGrant } from '../types/Share.js';
+import type { MediaItem } from '../providers/BaseMediaProvider.js';
+/**
+ * Minimal WikiContext interface for type safety
+ * TODO: Convert WikiContext.js to TypeScript and import proper type
+ */
+interface WikiContext {
+    pageName: string;
+    content: string;
+    context?: Record<string, unknown>;
+    userContext?: UserContext;
+    pageMetadata?: PageFrontmatter | null;
+}
+/**
+ * User context for permission checks
+ * Note: Index signature required for PolicyEvaluator compatibility
+ */
+interface UserContext {
+    /** #1212: the three authorisation fields are required; `null` is the anonymous visitor. */
+    username: string;
+    name?: string;
+    roles: string[];
+    isAuthenticated: boolean;
+    /** The delegations a request carries; declared so the index signature does not erase their type. */
+    viaToken?: AgentTokenGrant;
+    viaShare?: ShareGrant;
+    viaProxy?: ProxyClaim;
+    [key: string]: unknown;
+}
+/**
+ * Access decision log entry
+ */
+interface AccessDecisionLog {
+    user?: UserContext;
+    pageName?: string;
+    action?: string;
+    allowed?: boolean;
+    reason?: string;
+    context?: Record<string, unknown>;
+}
+/**
+ * PolicyInformationPoint — what a page decision needs to know about the page
+ * (#1431; was ACLManager until step 8).
+ *
+ * In the model the access subject follows (docs/managers/Manager-SOT.md):
+ *
+ * - the __PEPs__ are the doors — routes, manager doors, the availability gate;
+ * - the __PDP__ (`PolicyDecisionPoint`) answers "may this subject do this", with
+ *   the delegation ceilings, over the policies;
+ * - __this__ supplies the page's own attributes and walks the page's own rules
+ *   in order, asking the PDP where global policy decides;
+ * - the __PAP__ is ConfigurationManager plus the admin screens.
+ *
+ * What it holds, all of it about a PAGE (or a private container, or media
+ * linked to one):
+ *
+ * - `walkPageTiers` — the one implementation of the page's rules: private
+ *   (owner or delegate, never a role), author-lock (`edit` only; the override
+ *   is the `admin-system` permission), frontmatter `audience` / `access`, then
+ *   the share or global policy. Shared by every entry point below (#1431 7c).
+ * - `checkPagePermissionWithContext` / `evaluatePagePermission` — one page, for
+ *   a request that already holds it; the latter returns the reason. These are
+ *   the doors: asked before acting, and every decision is recorded.
+ * - `pageAffordance` / `pageAffordanceFor` — the same evaluator (this page /
+ *   another page), asked only to decide whether to show a control; records
+ *   nothing (#1668).
+ * - `canUserAccessPage` — another page, loaded as this subject (cross-page:
+ *   inserts, includes, attachments).
+ * - `filterAccessiblePages` — many pages, over the index, with no per-page
+ *   disk read, log line or audit record; agrees with the single-page answer in
+ *   both directions (#1219).
+ * - `canUserAccessMediaItem` / `canAccessPrivateContainer` — media and store
+ *   files, by the same rules.
+ * - `logAccessDecision` — every single-page door decision is recorded; a
+ *   denial becomes an `authorization-deny` record carrying the request's
+ *   address. An affordance is not recorded.
+ *
+ * What it no longer holds, so nobody goes looking: JSPWiki's page-body ACL
+ * markup (#1431 7a — imports convert it to audience terms, #1446); the
+ * availability checks (#1432); a policy cache (#1431 step 4); any role-name
+ * gate (#1431 7b).
+ *
+ * @class PolicyInformationPoint
+ * @extends BaseManager
+ *
+ * @see {@link PolicyDecisionPoint} for the decision over the policies
+ * @see {@link PolicyEvaluator} for policy matching
+ * @see {@link AuditManager} for the access record
+ *
+ * @example
+ * const pip = engine.getManager('PolicyInformationPoint');
+ * if (await pip.checkPagePermissionWithContext(wikiContext, 'edit')) { ... }
+ */
+declare class PolicyInformationPoint extends BaseManager {
+    /** Read at the moment of use: this manager starts before PolicyEvaluator (#1431 step 13). */
+    private get policyEvaluator();
+    /**
+     * Creates a new PolicyInformationPoint instance
+     *
+     * @constructor
+     * @param {WikiEngine} engine - The wiki engine instance
+     */
+    constructor(engine: WikiEngine);
+    /**
+     * Initializes the PolicyInformationPoint by loading policies and configurations
+     *
+     * Loads access policies from configuration and initializes the policy
+     * evaluator for context-aware permission evaluation.
+     *
+     * @async
+     * @returns {Promise<void>}
+     *
+     * @example
+     * await policyInformationPoint.initialize();
+     * console.log('ACL system ready');
+     */
+    initialize(): Promise<void>;
+    /** The anonymous visitor. Lowercase `anonymous` is the role the policies name (#1059). */
+    anonymousSubject(): UserContext;
+    /**
+     * The name of the system principal — the server acting for itself at boot
+     * and from timers (#631).
+     *
+     * Owned by the environment: `ngdpbase.system.principal` ships as the bare
+     * env-ref `$NGDPBASE_SYSTEM_USER`, which THROWS when the variable is unset,
+     * so an instance with no named principal refuses to boot rather than
+     * acting as a default nobody chose. `.env` is not reachable from the admin
+     * UI, so the identity cannot be renamed through a form.
+     */
+    systemPrincipalName(): string;
+    /** Whether `username` names the system principal. Case-insensitive, like the user store. */
+    isSystemPrincipal(username: string): boolean;
+    /**
+     * The system principal as a permission subject (#631).
+     *
+     * Identity from `.env`; authority from the role catalog — `ngdpbase.system.roles`,
+     * `["admin"]` by default — evaluated by policy through the same door as any
+     * request (P2). Nothing here is a grant: the roles are read, not asserted.
+     * The name is reserved in `UserManager.createUser`, so no person can hold it.
+     */
+    systemSubject(): UserContext;
+    /**
+     * An active account as a subject: its record, and the roles it holds NOW.
+     * `null` when there is no such account or it is inactive — the caller
+     * decides what that means (usually the anonymous subject).
+     */
+    subjectFor(username: string): Promise<UserContext | null>;
+    /**
+     * Resolve a named user's CURRENT roles for a permission decision (#631).
+     *
+     * Used when a subject arrives without roles — a background job asking
+     * "what may my requester do, now?". An unknown, inactive or absent user
+     * resolves to the anonymous subject: the job then holds exactly what a
+     * visitor holds, which is the safe answer for someone who no longer exists.
+     */
+    resolveSubjectNow(username: string | undefined): Promise<UserContext>;
+    /**
+     * Who is making this request: the subject the session middleware resolved,
+     * else the session's account resolved now, else the anonymous visitor.
+     * It was `UserManager.getCurrentUser` until #1431 step 13.
+     *
+     * __This returned Anonymous for every authenticated user, always (#1165).__
+     * It read `req.session.user.isAuthenticated`, and nothing in the codebase
+     * ever writes `req.session.user` — every login path writes the flat
+     * `req.session.username` + `req.session.isAuthenticated`
+     * (`WikiRoutes.ts:6786`, `:7002`, `:7081`, `app.ts:657`), which is also what
+     * the session middleware reads. `session.user` is a declared field with no
+     * writer, so the condition was never true.
+     *
+     * It went unnoticed because the one hot caller guards against it:
+     * `getCommonTemplateData` uses `req.userContext || getCurrentUser(req)`, so
+     * every rendered page took the first branch and looked correct. The audit
+     * routes call this directly, which is why they were the ones to break —
+     * `AuditManager` refused the query as 'Anonymous' on a request the route had
+     * just authorised as an admin.
+     *
+     * __`req.userContext` is preferred over the session now__, rather than only
+     * repairing the field name. It is the identity the middleware already
+     * resolved and validated, enriched with roles from RoleManager, and it is
+     * what the policy engine authorises against — so this method and every
+     * permission check now answer from the same place instead of two. It is also
+     * the only identity a bearer-token request has (#818): those carry no
+     * session at all, so the session path alone would still have said Anonymous.
+     */
+    currentSubject(req: Request): Promise<UserContext>;
+    private userManager;
+    private roleManager;
+    /**
+     * Initialize audit logging system based on configuration.
+     */
+    initializeAuditLogging(): Promise<void>;
+    /**
+     * The PDP this manager asks for the delegation ceilings and, in the next
+     * step, for the policy decision itself. Registered on the engine; built here
+     * only when it is not, so tests that stand an PolicyInformationPoint up alone still
+     * exercise the real ordering rather than skipping it (#1431).
+     */
+    private policyDecisionPoint;
+    private _pdp?;
+    /**
+     * Check page permission using WikiContext — rich-return form (#714 Slice F).
+     *
+     * Same evaluator as {@link checkPagePermissionWithContext} but returns a
+     * `{ allowed, reason }` object instead of a bare boolean. Lets callers
+     * specialise their 403 response on the reason — e.g. an editPage route
+     * handler can detect `reason === 'author_lock_deny'` and render the
+     * specific "This page is author-locked" message rather than the generic
+     * "no permission to edit" 403.
+     *
+     * `reason` values currently emitted (from `logAccessDecision` call sites):
+     *   - `token_scope_deny`                         (Tier -1, the PDP's ceiling)
+     *   - `share_action_deny` / `share_expired` / `share_resource_deny` /
+     *     `share_issuer_deny`                        (Tier -1, the PDP's ceiling)
+     *   - `private_match` / `private_deny`           (Tier 0)
+     *   - `author_lock_deny`                         (Tier 0.5 — Slice A)
+     *   - `frontmatter_principal_<p>` / `frontmatter_deny`  (Tier 1)
+     *   - `<policyName>` / `global_policy`           (Tier 2)
+     *   - `default_deny`                             (no tier decided)
+     *
+     * @async
+     * @param {WikiContext} wikiContext - The wiki context containing page and user info
+     * @param {string} action - Action to check (view, edit, delete, rename, upload)
+     * @returns {Promise<{ allowed: boolean; reason: string }>} Rich decision
+     */
+    evaluatePagePermission(wikiContext: WikiContext, action: string): Promise<{
+        allowed: boolean;
+        reason: string;
+    }>;
+    /**
+     * Check page permission using WikiContext — boolean (back-compat) form.
+     *
+     * Thin wrapper around {@link evaluatePagePermission} (#714 Slice F) that
+     * discards the `reason` and returns just `allowed`. Existing callers
+     * (which only care about allow/deny) keep working without change.
+     *
+     * @async
+     * @param {WikiContext} wikiContext - The wiki context containing page and user info
+     * @param {string} action - Action to check (view, edit, delete, rename, upload)
+     * @returns {Promise<boolean>} True if permission granted
+     *
+     * @example
+     * const canEdit = await policyInformationPoint.checkPagePermissionWithContext(wikiContext, 'edit');
+     * if (canEdit) console.log('User can edit page');
+     */
+    checkPagePermissionWithContext(wikiContext: WikiContext, action: string): Promise<boolean>;
+    /**
+     * Would the page door allow this action — asked only to decide whether to
+     * SHOW a control (the view's Edit button), never before performing it
+     * (#1668). The page analogue of `holdsPermission` / `pdp.holds`: an
+     * affordance, which a door never asks.
+     *
+     * The same evaluator as {@link checkPagePermissionWithContext}, so the two
+     * always agree on allow/deny for the same subject and page. What it does not
+     * do is record: no audit record and no info log line. Showing a control is
+     * not an attempt, and recording it wrote an `authorization-deny` for every
+     * anonymous page view. Acting on the control goes through the door, which
+     * records a refusal.
+     *
+     * @param wikiContext - The request's context, holding the page and its metadata
+     * @param action - Page action (view, edit, delete, rename, upload)
+     * @returns True if the door would allow the action
+     */
+    pageAffordance(wikiContext: WikiContext, action: string): Promise<boolean>;
+    /**
+     * Internal evaluator — walks the tiers in order (Tier -1 delegation
+     * ceilings → Tier 0 private → Tier 0.5 author-lock → Tier 1
+     * audience/access → Tier 2 global policies → default deny) and returns the
+     * rich `{ allowed, reason }` decision. First tier to answer wins.
+     *
+     * `evaluatePagePermission` (rich) and `checkPagePermissionWithContext`
+     * (boolean) both delegate here — the doors, which record every decision.
+     * `pageAffordance` delegates here with `record` false (#1668): the same
+     * walk, with no audit record and its trace at debug, because it only decides
+     * whether to show a control.
+     */
+    private _runEvaluator;
+    /**
+     * The page's own tiers, walked in order, for ONE page (#1431 step 7c).
+     *
+     * The single implementation of the sequence. The decider and the list filter
+     * each used to carry their own copy of it, and "a listing can never name a
+     * page its reader cannot open, nor hide one they can" (#1219) held only for
+     * as long as someone remembered to change both. Now there is one to change.
+     *
+     * It decides and does nothing else — no log line, no audit record — because
+     * the filter runs it over thousands of pages. Each caller supplies what it
+     * can afford: how to ask policy (per page, or compiled once), and how to ask
+     * the author-lock override (lazily, or once per subject).
+     *
+     * Runs AFTER the delegation ceilings, which bound the subject rather than
+     * the page and so are each caller's to ask first. First tier to answer wins:
+     *
+     * - __Tier 0, private.__ Through `PageManager.checkPrivatePageAccess` — the
+     *   page-index creator, owner or delegate, never a role (#711). Frontmatter
+     *   `private` + `author` is the fallback where there is no PageManager.
+     *   It only REFUSES (#1539): a subject it admits still faces policy, asked
+     *   with the page's `vault`, so the owner's rights in their own vaults come
+     *   from a policy on the `vault` resource type — the same door as any page.
+     *   Tier 1 is skipped for a vault page: `audience` grants nothing there.
+     * - __Tier 0.5, author-lock__, `edit` only. It only denies: an author, or a
+     *   subject holding `admin-system` (#1431 7b), falls through to Tier 1+.
+     * - __Tier 1, frontmatter__ `access[action]` / `audience`. Page-level, and
+     *   overrides global policy when it states a rule (#1054).
+     * - __Tier 2.__ For a share visitor the share IS the policy (#1222); for
+     *   anyone else, global policy.
+     * - __Default deny.__ Nothing below Tier 2 grants — JSPWiki's page-body ACL
+     *   markup was removed (#1431 7a); an imported page's ACL is converted to
+     *   audience terms by the NCM funnel (#1446).
+     */
+    private walkPageTiers;
+    /**
+     * The private-container decision for something that is not a page — a file
+     * in a store (docs/private-stores.md, Access). The same rule a
+     * private page gets at Tier 0: the owner, or a delegate of the owner; never
+     * a role. A refusal is recorded like any page refusal (`authorization-deny`).
+     *
+     * @param userContext - the request's subject, as given (null = anonymous)
+     * @param owner - the container's owner (a private file's `creator`)
+     * @param resource - what is being reached, for the record (e.g. `attachment:<id>`)
+     * @param action - the action asked for (e.g. `view`)
+     * @param vault - the vault inside the container, when the question is about one:
+     *   a share link the owner issued gets in only for a vault it names (#1388)
+     */
+    canAccessPrivateContainer(userContext: UserContext | null | undefined, owner: string, resource: string, action: string, vault?: string): boolean;
+    /**
+     * Check whether a user can access a given page — for cross-page checks where
+     * the current WikiContext describes a DIFFERENT page than the one being
+     * checked (#714 Slice B).
+     *
+     * Loads the target page's metadata internally (`PageManager.getPageMetadata`)
+     * and constructs a minimal WikiContext shape for the evaluator. This is the
+     * implementation that {@link WikiContext.canAccess} delegates to when its
+     * `pageNameOverride` parameter is set.
+     *
+     * Used today by:
+     *   - linked-page visibility filters (a list page wanting to drop entries
+     *     the user can't view)
+     *   - {@link WikiRoutes.serveAttachment}'s owning-page check (the page
+     *     hosting the attachment may be private; the request URL is the
+     *     attachment URL, not the page URL).
+     *
+     * Returns false when:
+     *   - the target page has no resolvable metadata (deleted, never existed,
+     *     or PageManager unavailable). This is the **conservative-on-security**
+     *     default — see #714 EPIC body's "Behavior decision point" for the
+     *     pre-#714 allow→deny shift for the private-attachment-no-page-name
+     *     case.
+     *   - any tier returns deny.
+     *
+     * @param userContext - The user requesting access (may be null / anonymous).
+     * @param pageName    - Target page to check.
+     * @param action      - Action verb (e.g., `'view'`, `'edit'`, `'delete'`).
+     * @param knownMetadata - The page's metadata when the caller has just
+     *   resolved it: the page door (#1622), which reads the page by the same
+     *   resolution it decides on. Omitted, it is loaded here.
+     */
+    canUserAccessPage(userContext: UserContext | null | undefined, pageName: string, action: string, knownMetadata?: PageFrontmatter): Promise<boolean>;
+    /**
+     * {@link canUserAccessPage} as an affordance (#1668): would the door allow
+     * this action on that page — asked only to decide whether to show a control
+     * (the journal entry view's Edit link, `<wiki:If exists:>`). The same
+     * cross-page path and the same evaluator, so it agrees with the door; it
+     * records nothing. Acting on the control asks the door.
+     *
+     * @param knownMetadata - As for {@link canUserAccessPage}: the page's
+     *   metadata when the caller has just resolved it (`PageManager.mayShowPage`).
+     */
+    pageAffordanceFor(userContext: UserContext | null | undefined, pageName: string, action: string, knownMetadata?: PageFrontmatter): Promise<boolean>;
+    /** The cross-page check, for the door (`record`) or an affordance (#1668). */
+    private crossPageDecision;
+    /**
+     * Which of these pages may this user perform `action` on? (#1219)
+     *
+     * Rule 10's `filter(ctx, action, query)`: the tiers `_runEvaluator` applies
+     * to ONE page, applied over the page index — no disk read (metadata comes
+     * from the provider's in-memory cache), no log line and no audit record per
+     * page. Listing many and deciding one are the same evaluator, so a listing
+     * can never name a page its reader cannot open, nor hide one they can.
+     *
+     * Tier by tier, mirroring `_runEvaluator`: the token and share ceilings
+     * (once for the subject, then the share's resource cover per page); tier 0
+     * private through `PageManager.checkPrivatePageAccess`; tier 0.5
+     * author-lock for `edit`; tier 1 frontmatter audience/access; tier 2 global
+     * policy, compiled once through `PolicyEvaluator.compile`, or the share
+     * standing in for it. There is no longer a tier below that: the deprecated
+     * page-ACL markup was deleted in #1431 step 7, which is what removed the one
+     * divergence this filter had from `canUserAccessPage` — it could not read
+     * page content, so a page granted only by that markup used to be hidden
+     * here and visible there.
+     *
+     * A candidate without metadata is not listed (#714's convention). Order is
+     * preserved. Returns titles.
+     */
+    filterAccessiblePages(userContext: UserContext | null | undefined, action: string, candidates: ReadonlyArray<{
+        title: string;
+        metadata: PageFrontmatter | null | undefined;
+    }>): Promise<string[]>;
+    /**
+     * May this user read this media item? (#1223, epic #1225)
+     *
+     * The media door's question, asked of the evaluator rather than answered
+     * in `MediaManager.getItem` and again in the share routes.
+     *
+     * __The share ceiling__, for a subject carrying `viaShare` — the twin of
+     * the page ceiling in `_runEvaluator`: `asset-read` must be delegated, the
+     * share unexpired, the item's keywords covered by the share's media
+     * resources (and not `owner-only`), and the issuer still holding
+     * `asset-read` live. An ordinary session is allowed: media items carry no
+     * per-item privacy and no page link (#1427).
+     *
+     * A refusal is audited as `authorization-deny` on the media resource, with
+     * the share attribution when there is one.
+     */
+    canUserAccessMediaItem(userContext: UserContext | null | undefined, item: MediaItem): Promise<boolean>;
+    /**
+     * Check front matter audience / access fields (Tier 1.5).
+     * Returns a decision object; decided=false means no front matter restriction — fall through.
+     */
+    private checkFrontmatterAccess;
+    /**
+     * Record/audit an access decision.
+     * Accepts either a single object or positional args for backward compatibility.
+     */
+    logAccessDecision(userOrObj: UserContext | AccessDecisionLog, pageName?: string, action?: string, allowed?: boolean, reason?: string, _context?: Record<string, unknown>): void;
+    /** The name a decision is recorded under: the subject's, or `anonymous`. */
+    private static recordedUser;
+    /**
+     * Record a denied access decision in the audit trail (#1115).
+     *
+     * Best-effort and never awaited by the decision path: the answer to "may
+     * this user do this" must not depend on the audit backend being healthy, and
+     * a slow sink must not delay a page render. `authorization-deny` is standard
+     * tier for that reason — the critical tier is destruction and credentials.
+     *
+     * Everything about who asked — the name, the request's address, a share —
+     * is read here from the subject the decision was made for, so every
+     * denial this manager records carries the same fields (#1668: the address
+     * was dropped, `ipAddress: undefined`, on every page and media denial). The
+     * session and bearer middleware put the request's address on the subject.
+     */
+    private auditDenial;
+}
+export default PolicyInformationPoint;

package/lib/src/security/pageActions.d.ts

@@ -0,0 +1,40 @@
+/**
+ * One vocabulary for page actions (#1431, step 5).
+ *
+ * A door asks for a PERMISSION, and every permission name is declared in
+ * `ngdpbase.permissions.definitions`. Page-level checks grew their own words
+ * anyway — `canAccess('view')`, `canAccess('edit')` — which are declared
+ * nowhere, and `PolicyInformationPoint.checkDefaultPermission` invented a third set with
+ * colons (`page:read`), declared nowhere either, so that check could only ever
+ * deny ([#1174](https://github.com/jwilleke/ngdpbase/issues/1174)).
+ *
+ * This is the one translation: the short word a caller passes, mapped to the
+ * registry name policy is written in. It exists so the mapping is not
+ * copied — it was already in `checkPagePermissionWithContext` twice, and in
+ * `checkDefaultPermission` in a different and broken form.
+ *
+ * New code should pass the registry name directly. The short forms stay
+ * because they are what a page author writes in `[{ALLOW view …}]` ACL markup,
+ * and that is a content syntax, not an internal vocabulary.
+ */
+/** The short words accepted at a page door, and in ACL markup. */
+export declare const PAGE_ACTION_ALIASES: {
+    readonly view: "page-read";
+    readonly read: "page-read";
+    readonly edit: "page-edit";
+    readonly delete: "page-delete";
+    readonly create: "page-create";
+    readonly rename: "page-rename";
+    readonly export: "page-export";
+    readonly upload: "asset-upload";
+};
+export type PageActionAlias = keyof typeof PAGE_ACTION_ALIASES;
+/**
+ * The registry permission a page action means.
+ *
+ * An unknown word is returned unchanged rather than guessed at: it is either
+ * already a registry name — which is what new code passes — or it is a typo,
+ * and the permission-registry invariant is what catches a typo, not a silent
+ * rewrite into `page:<whatever>` (which is what the deleted code did).
+ */
+export declare function permissionForPageAction(action: string): string;

package/lib/src/security/permissions.generated.d.ts

@@ -0,0 +1,78 @@
+/** Every permission core declares. Addons generate their own union. */
+export type CorePermission = 
+/** Change what protects your own account — password, email, sign-in methods (passkeys), vault takeout and import, approving a device (#1525). Granted wherever profile-manage is; asks for a fresh sign-in when listed in ngdpbase.auth.step-up */
+'account-security'
+/** View administration screens (read-only, no changes) */
+ | 'admin-read'
+/** Role management */
+ | 'admin-roles'
+/** System administration */
+ | 'admin-system'
+/** Delete assets */
+ | 'asset-delete'
+/** Edit asset metadata (EXIF/IPTC/XMP) */
+ | 'asset-edit'
+/** View assets (attachments) */
+ | 'asset-read'
+/** Upload assets */
+ | 'asset-upload'
+/** Export the audit trail to a file (#1638) */
+ | 'audit-export'
+/** Add a comment, and delete your own; deleting anyone's is admin-system (#1198) */
+ | 'comment-create'
+/** Change any configuration setting, and download a backup (#1525). Admin only by default; asks for a fresh sign-in when listed in ngdpbase.auth.step-up */
+ | 'config-manage'
+/** Browse and view the media library (not delegated to anonymous visitors) */
+ | 'media-read'
+/** Create new pages */
+ | 'page-create'
+/** Delete pages */
+ | 'page-delete'
+/** Edit pages */
+ | 'page-edit'
+/** Export pages */
+ | 'page-export'
+/** Make a page public: move it out of its vault (checked by the page's system-category, #1504) */
+ | 'page-public'
+/** Edit a page's raw file in the admin raw editor — bypasses the page editor's checks (#1638) */
+ | 'page-raw-edit'
+/** View pages */
+ | 'page-read'
+/** Rename pages */
+ | 'page-rename'
+/** Manage your own account — profile, preferences, display theme, pinned pages and the /my/* pages (#1198). Every signed-in role; never anonymous */
+ | 'profile-manage'
+/** Let another person act for you, within permissions you hold, and revoke it (#1762). Every signed-in role except demo-admin; an administrator making or revoking a grant for someone else also needs user-edit, and that grant never carries a copy of the person's vault key. A grant that includes proxy-grant lets the proxy give others access too. Asks for a fresh sign-in */
+ | 'proxy-grant'
+/** Search pages */
+ | 'search-page'
+/** Search users */
+ | 'search-user'
+/** Unmask a configuration secret (#1525). Admin only by default; asks for a fresh sign-in when listed in ngdpbase.auth.step-up. Hashed credentials (agent tokens) and shown-once secrets can never be revealed */
+ | 'secret-reveal'
+/** End another person's signed-in session (#1638) */
+ | 'session-revoke'
+/** Create share links — hand out anonymous read access to content you may read — and see your own (#1224, #1638) */
+ | 'share-create'
+/** Extend your own share links (#1638) */
+ | 'share-extend'
+/** Revoke your own share links; revoking anyone's also needs admin-system (#1638) */
+ | 'share-revoke'
+/** Walk through a private store's door and create your own copy of it — with a user key and recovery words when the store kind is encrypted (#1414). Every signed-in role; never anonymous. The door also needs a password sign-in, so a token or share cannot use it */
+ | 'store-create'
+/** Extend your own live agent tokens instead of minting new ones, to at most max-ttl-hours from now; the token and its scopes stay the same (#1734). Admin only by default. A token can never carry this scope */
+ | 'token-extend'
+/** Mint, list and revoke your own agent tokens — a standing credential carrying a slice of your authority (#1198, #1178). Every signed-in role except demo-admin; never anonymous (#1734). A token can never carry this scope */
+ | 'token-mint'
+/** Create user accounts */
+ | 'user-create'
+/** Delete user accounts */
+ | 'user-delete'
+/** Edit user accounts */
+ | 'user-edit'
+/** View user list and profiles */
+ | 'user-read'
+/** Let a person acting for you into your vaults (#1762). Read only from a proxy grant: a grant that includes it lets the proxy act inside your vaults within the grant's other permissions; without it a proxy never reaches them. Encrypted vaults stay shut to a proxy until a vault key copy is supported (#1762 slice 5). Every signed-in role except demo-admin, beside proxy-grant. Never carried by an agent token or an app */
+ | 'vault-proxy';
+/** The same list at runtime, for a check that has to iterate. */
+export declare const CORE_PERMISSIONS: readonly CorePermission[];