@karmaniverous/jeeves-server 3.1.1 → 3.1.3

package/src/config/resolve.ts

@@ -27,13 +27,22 @@ import type {
  */
 export function normalizeScopes(raw: unknown): NormalizedScopes | null {
   if (raw === undefined || raw === null) return null;
-  if (typeof raw === 'string') return { allow: [raw], deny: [] };
-  if (Array.isArray(raw)) return { allow: raw as string[], deny: [] };
+  if (typeof raw === 'string')
+    return { allow: [raw], deny: [], explicitAllow: [], explicitDeny: [] };
+  if (Array.isArray(raw))
+    return {
+      allow: raw as string[],
+      deny: [],
+      explicitAllow: [],
+      explicitDeny: [],
+    };
   if (typeof raw === 'object') {
     const obj = raw as { allow?: string[]; deny?: string[] };
     return {
       allow: obj.allow ?? ['/**'],
       deny: obj.deny ?? [],
+      explicitAllow: [],
+      explicitDeny: [],
     };
   }
   return null;
@@ -56,6 +65,8 @@ export function resolveNamedScopes(
       return {
         allow: overrides.allow ?? ['/**'],
         deny: overrides.deny ?? [],
+        explicitAllow: overrides.allow ?? [],
+        explicitDeny: overrides.deny ?? [],
       };
     }
     return null;
@@ -91,6 +102,8 @@ export function resolveNamedScopes(
     return {
       allow: allow.length > 0 ? allow : ['/**'],
       deny,
+      explicitAllow: overrides?.allow ?? [],
+      explicitDeny: overrides?.deny ?? [],
     };
   }
 
@@ -99,6 +112,8 @@ export function resolveNamedScopes(
   if (!normalized) return null;
   if (overrides?.allow) normalized.allow.push(...overrides.allow);
   if (overrides?.deny) normalized.deny.push(...overrides.deny);
+  normalized.explicitAllow = overrides?.allow ?? [];
+  normalized.explicitDeny = overrides?.deny ?? [];
   return normalized;
 }
 

package/src/config/types.ts

@@ -11,10 +11,19 @@ export type { AuthMode, JeevesConfig };
 /**
  * Normalized scopes — always resolved to \{ allow, deny \} form.
  * null = unrestricted access.
+ *
+ * Explicit overrides take precedence over named scope patterns:
+ * 1. If explicitDeny matches → DENIED (overrides named allow)
+ * 2. If explicitAllow matches → ALLOWED (overrides named deny)
+ * 3. Otherwise: normal allow AND NOT deny evaluation
  */
 export interface NormalizedScopes {
   allow: string[];
   deny: string[];
+  /** Explicit allow patterns from the insider/key entry — override named scope denies. */
+  explicitAllow: string[];
+  /** Explicit deny patterns from the insider/key entry — override named scope allows. */
+  explicitDeny: string[];
 }
 
 /**

package/src/services/markdown.ts

@@ -4,6 +4,7 @@
 
 import fs from 'node:fs';
 
+import type { Token } from 'marked';
 import { marked } from 'marked';
 
 import { registerDiagram } from './embeddedDiagrams.js';
@@ -105,12 +106,25 @@ export function parseMarkdown(
   const renderer = new marked.Renderer();
 
   renderer.heading = function (
-    args: string | { text: string; raw?: string; depth: number },
+    args:
+      | string
+      | {
+          text: string;
+          raw?: string;
+          depth: number;
+          tokens?: Token[];
+        },
   ) {
     const text = typeof args === 'object' ? args.text : args;
     const raw = typeof args === 'object' && args.raw ? args.raw : text;
     const level = typeof args === 'object' ? args.depth : 1;
 
+    // Parse inline tokens to render code spans, bold, italic, links, etc.
+    const renderedText =
+      typeof args === 'object' && args.tokens
+        ? this.parser.parseInline(args.tokens)
+        : text;
+
     const slug = raw
       .toLowerCase()
       .replace(/<[^>]+>/g, '')
@@ -119,9 +133,13 @@ export function parseMarkdown(
       .replace(/-+/g, '-')
       .replace(/^-|-$/g, '');
 
-    headings.push({ level, text: text.replace(/<[^>]+>/g, ''), slug });
+    headings.push({
+      level,
+      text: renderedText.replace(/<[^>]+>/g, ''),
+      slug,
+    });
 
-    return `<h${String(level)} id="${slug}">${text} <a href="#${slug}" class="anchor">#</a></h${String(level)}>\n`;
+    return `<h${String(level)} id="${slug}">${renderedText} <a href="#${slug}" class="anchor">#</a></h${String(level)}>\n`;
   };
 
   // Rewrite relative image src to /path/ URLs