@kindgi/api 0.1.5-rc.0 → 0.1.5

package/src/routes/memory-access.ts

@@ -20,10 +20,11 @@ import type { Context } from 'hono';
 import { type Principal, ref } from '@kindgi/authz';
 import type { MemoryReaders, MemoryScope } from '@kindgi/memory';
 import type { ProjectBinding } from '@kindgi/platform';
-import type { OrgId, ProjectId, TenantId, UserId } from '@kindgi/types';
+import type { OrgId, ProjectId, UserId } from '@kindgi/types';
 
 import type { Authorizer } from '../middleware/authorize.js';
 import type { AppEnv } from '../types.js';
+import { type ProjectRow, allProjects } from './readable-projects.js';
 
 export interface MemoryAccessDeps {
   readonly authorizer?: Authorizer;
@@ -31,8 +32,6 @@ export interface MemoryAccessDeps {
   readonly projects?: Pick<ProjectBinding, 'list'>;
 }
 
-const PROJECT_PAGE = 200;
-
 /** The caller's user id, when the caller is a Kindgi user. */
 function callerUserId(c: Context<AppEnv>): UserId | undefined {
   const actor = (c.get('principal') as Principal | undefined)?.actor;
@@ -60,51 +59,33 @@ async function isTenantAdmin(c: Context<AppEnv>, authorizer: Authorizer): Promis
   return authorizer.can(c, 'admin', ref('tenant', c.get('tenantId') as unknown as string));
 }
 
-type ProjectRow = { readonly id: ProjectId; readonly orgId?: OrgId };
-
-/** The tenant's projects, every page. */
-async function allProjects(c: Context<AppEnv>, deps: MemoryAccessDeps): Promise<ProjectRow[]> {
-  if (deps.projects === undefined) return [];
-  const tenantId = c.get('tenantId') as TenantId;
-  const all: ProjectRow[] = [];
-  let cursor: Parameters<ProjectBinding['list']>[1]['cursor'];
-  for (;;) {
-    const page = await deps.projects.list(tenantId, {
-      limit: PROJECT_PAGE,
-      ...(cursor !== undefined && { cursor }),
-    });
-    all.push(
-      ...page.items.map((p) => ({ id: p.id, ...(p.orgId !== undefined && { orgId: p.orgId }) })),
-    );
-    if (page.nextCursor === undefined) break;
-    cursor = page.nextCursor;
-  }
-  return all;
-}
-
 /**
  * The projects the caller may `action`, and the orgs whose org-wide facts
  * it reads: listed by the authorizer (`read` on the org), else the
- * projects checked one by one and the orgs of those it may read.
+ * projects checked one by one and the orgs of those it may read. A key
+ * limited to a project is always checked: the listing gives every org its
+ * user may read, and the key reaches only its own project's.
  */
 async function readerContainers(
   c: Context<AppEnv>,
   deps: MemoryAccessDeps & { readonly authorizer: Authorizer },
 ): Promise<{ readable: ProjectId[]; writable: ProjectId[]; orgs: OrgId[] }> {
   const { authorizer } = deps;
-  const [readable, writable, orgs] = await Promise.all([
-    authorizer.listObjects?.(c, 'read', 'project'),
-    authorizer.listObjects?.(c, 'write', 'project'),
-    authorizer.listObjects?.(c, 'read', 'org'),
-  ]);
-  if (readable !== undefined && writable !== undefined && orgs !== undefined) {
-    return {
-      readable: readable.map((id) => id as ProjectId),
-      writable: writable.map((id) => id as ProjectId),
-      orgs: orgs.map((id) => id as OrgId),
-    };
+  if (c.get('tokenProjectId') === undefined) {
+    const [readable, writable, orgs] = await Promise.all([
+      authorizer.listObjects?.(c, 'read', 'project'),
+      authorizer.listObjects?.(c, 'write', 'project'),
+      authorizer.listObjects?.(c, 'read', 'org'),
+    ]);
+    if (readable !== undefined && writable !== undefined && orgs !== undefined) {
+      return {
+        readable: readable.map((id) => id as ProjectId),
+        writable: writable.map((id) => id as ProjectId),
+        orgs: orgs.map((id) => id as OrgId),
+      };
+    }
   }
-  const all = await allProjects(c, deps);
+  const all = await allProjects(c, deps.projects);
   const projectRef = (p: ProjectRow) => ref('project', p.id as unknown as string);
   const [canRead, canWrite] = await Promise.all([
     authorizer.filterByCan(c, 'read', all, projectRef),

package/src/routes/readable-projects.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * The projects a caller may act on, for a route that hands them to its
+ * binding to apply inside the query (memory reads, the cost aggregate)
+ * rather than filtering a page after it: the authorizer's list when it can
+ * list (`listObjects`), else the tenant's projects checked one by one.
+ */
+
+import type { Context } from 'hono';
+
+import { type Action, ref } from '@kindgi/authz';
+import type { ProjectBinding } from '@kindgi/platform';
+import type { OrgId, ProjectId, TenantId } from '@kindgi/types';
+
+import type { Authorizer } from '../middleware/authorize.js';
+import type { AppEnv } from '../types.js';
+
+const PROJECT_PAGE = 200;
+
+export type ProjectRow = { readonly id: ProjectId; readonly orgId?: OrgId };
+
+/** The tenant's projects, every page; none without a project binding. */
+export async function allProjects(
+  c: Context<AppEnv>,
+  projects: Pick<ProjectBinding, 'list'> | undefined,
+): Promise<ProjectRow[]> {
+  if (projects === undefined) return [];
+  const tenantId = c.get('tenantId') as TenantId;
+  const all: ProjectRow[] = [];
+  let cursor: Parameters<ProjectBinding['list']>[1]['cursor'];
+  for (;;) {
+    const page = await projects.list(tenantId, {
+      limit: PROJECT_PAGE,
+      ...(cursor !== undefined && { cursor }),
+    });
+    all.push(
+      ...page.items.map((p) => ({ id: p.id, ...(p.orgId !== undefined && { orgId: p.orgId }) })),
+    );
+    if (page.nextCursor === undefined) break;
+    cursor = page.nextCursor;
+  }
+  return all;
+}
+
+/**
+ * The ids of the projects the caller may `action`: listed by the
+ * authorizer, else the tenant's projects checked one by one. `undefined`
+ * when neither can say (the authorizer can't list, and there's no project
+ * binding to check against).
+ */
+export async function projectIdsCallerMay(
+  c: Context<AppEnv>,
+  authorizer: Authorizer,
+  projects: Pick<ProjectBinding, 'list'> | undefined,
+  action: Action,
+): Promise<ProjectId[] | undefined> {
+  const listed = await authorizer.listObjects?.(c, action, 'project');
+  if (listed !== undefined) return listed.map((id) => id as ProjectId);
+  if (projects === undefined) return undefined;
+  const may = await authorizer.filterByCan(c, action, await allProjects(c, projects), (p) =>
+    ref('project', p.id as unknown as string),
+  );
+  return may.map((p) => p.id);
+}