@kindgi/authz 0.1.4 → 0.1.5-rc.0

package/dist/check.d.ts

@@ -64,5 +64,21 @@ export interface AuthzCheckBinding {
      * API layer to strip rows a caller can't read.
      */
     checkBatch(principal: Principal, action: Action, resources: readonly ResourceRef[], ctx?: AuthzCheckContext): Promise<readonly Decision[]>;
+    /**
+     * The ids of every object of `type` the principal may `action`, after
+     * its downscope, and only those its `onBehalfOf` may too (OpenFGA
+     * `ListObjects`). For a guard compiled into a query, such as which
+     * projects' memory a caller reads. Optional: without it, callers fall
+     * back to `checkBatch` over the objects they can enumerate.
+     */
+    listObjects?(principal: Principal, action: Action, type: ResourceRef['type'], ctx?: AuthzCheckContext): Promise<readonly string[]>;
+    /**
+     * Optional. Whether `resource` belongs to project `projectId` in the
+     * principal's tenant: its `parent` is that project (an agent, a flow, a
+     * run, …), or its `scope` is (a secret, an env). The API layer asks it
+     * to hold an API key limited to a project to that project's resources.
+     * Without it, such a key reaches only the project itself.
+     */
+    inProject?(principal: Principal, resource: ResourceRef, projectId: string, ctx?: AuthzCheckContext): Promise<boolean>;
 }
 //# sourceMappingURL=check.d.ts.map

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAC1F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CACH,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB;;;;OAIG;IACH,UAAU,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,WAAW,EAAE,EACjC,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;CACjC"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAC1F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CACH,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB;;;;OAIG;IACH,UAAU,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,WAAW,EAAE,EACjC,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAEhC;;;;;;OAMG;IACH,WAAW,CAAC,CACV,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,SAAS,CAAC,CACR,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/authz",
-  "version": "0.1.4",
+  "version": "0.1.5-rc.0",
   "description": "Kindgi™ authorization shape. The public vocabulary and interfaces of Kindgi's authorization stack: Action verbs (read/write/execute/…), ObjectType enum (agent/flow/tool/…), ResourceRef, Principal (who is calling, with delegation and downscoping), the AuthzCheckBinding decision-point interface and its Decision (allow/deny + reason), FGA tuple builders and the TupleEnqueueHook outbox contract, the 403 DenyPayload shape, and reviewer roles. Types and pure functions — no runtime state. The FGA store, the check implementation and the tuple worker are supplied by the deployment.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@kindgi/types": "0.1.4"
+    "@kindgi/types": "0.1.5-rc.0"
   },
   "engines": {
     "node": ">=22.12.0"

package/src/check.ts

@@ -93,4 +93,32 @@ export interface AuthzCheckBinding {
     resources: readonly ResourceRef[],
     ctx?: AuthzCheckContext,
   ): Promise<readonly Decision[]>;
+
+  /**
+   * The ids of every object of `type` the principal may `action`, after
+   * its downscope, and only those its `onBehalfOf` may too (OpenFGA
+   * `ListObjects`). For a guard compiled into a query, such as which
+   * projects' memory a caller reads. Optional: without it, callers fall
+   * back to `checkBatch` over the objects they can enumerate.
+   */
+  listObjects?(
+    principal: Principal,
+    action: Action,
+    type: ResourceRef['type'],
+    ctx?: AuthzCheckContext,
+  ): Promise<readonly string[]>;
+
+  /**
+   * Optional. Whether `resource` belongs to project `projectId` in the
+   * principal's tenant: its `parent` is that project (an agent, a flow, a
+   * run, …), or its `scope` is (a secret, an env). The API layer asks it
+   * to hold an API key limited to a project to that project's resources.
+   * Without it, such a key reaches only the project itself.
+   */
+  inProject?(
+    principal: Principal,
+    resource: ResourceRef,
+    projectId: string,
+    ctx?: AuthzCheckContext,
+  ): Promise<boolean>;
 }