@liveblocks/core 3.20.0-perm2 → 3.20.0-perm4

package/dist/index.cjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-perm2";
+var PKG_VERSION = "3.20.0-perm4";
 var PKG_FORMAT = "cjs";
 
 // src/dupe-detection.ts
@@ -5215,8 +5215,8 @@ var ACCESS_RANKS = {
   read: 1,
   write: 2
 };
-var NO_PERMISSION_CAPABILITIES = {
-  creation: "none",
+var NO_PERMISSION_MATRIX = {
+  room: "none",
   presence: "none",
   storage: "none",
   comments: "none",
@@ -5224,7 +5224,7 @@ var NO_PERMISSION_CAPABILITIES = {
   personal: "write"
 };
 var RESOURCE_PERMISSIONS = {
-  creation: {
+  room: {
     read: [Permission.RoomRead],
     write: [Permission.RoomWrite]
   },
@@ -5252,7 +5252,7 @@ var RESOURCE_PERMISSIONS = {
     none: [Permission.RoomFeedsNone]
   }
 };
-var DEFAULT_PERMISSION_RESOURCE = "creation";
+var DEFAULT_PERMISSION_RESOURCE = "room";
 var ROOM_PERMISSION_RESOURCES = [
   "presence",
   "storage",
@@ -5270,75 +5270,60 @@ function resolveResourceAccess(scopes, resource) {
   }
   return resourceAccess;
 }
-function resolveFullPermissionCapabilities(resolved) {
+function resolveFullPermissionMatrix(resolved) {
   if (!resolved.hasDefaultPermission) {
-    return { ...NO_PERMISSION_CAPABILITIES, ...resolved.capabilities };
+    return { ...NO_PERMISSION_MATRIX, ...resolved.matrix };
   }
-  const capabilities = {
-    ...NO_PERMISSION_CAPABILITIES,
+  const matrix = {
+    ...NO_PERMISSION_MATRIX,
     [DEFAULT_PERMISSION_RESOURCE]: resolved.baseAccess
   };
   for (const resource of ROOM_PERMISSION_RESOURCES) {
-    capabilities[resource] = _nullishCoalesce(resolved.capabilities[resource], () => ( resolved.baseAccess));
+    matrix[resource] = _nullishCoalesce(resolved.matrix[resource], () => ( resolved.baseAccess));
   }
-  return capabilities;
+  return matrix;
 }
-function permissionCapabilitiesFromScopes(scopes) {
-  return resolveFullPermissionCapabilities(
-    resolvePermissionCapabilities(scopes)
-  );
+function permissionMatrixFromScopes(scopes) {
+  return resolveFullPermissionMatrix(resolvePermissionMatrix(scopes));
 }
-function resolvePermissionCapabilities(scopes) {
+function resolvePermissionMatrix(scopes) {
   const hasDefaultPermission = scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
   const baseAccess = scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.RoomRead) ? "read" : "none";
-  const capabilities = {};
+  const matrix = {};
   for (const resource of ROOM_PERMISSION_RESOURCES) {
     const access = resolveResourceAccess(scopes, resource);
     if (access !== void 0) {
-      capabilities[resource] = access;
+      matrix[resource] = access;
     }
   }
-  return { hasDefaultPermission, baseAccess, capabilities };
+  return { hasDefaultPermission, baseAccess, matrix };
 }
-function hasPermissionCapability(scopes, resource, requiredAccess) {
-  const access = permissionCapabilitiesFromScopes(scopes)[resource];
+function hasPermissionAccess(source, resource, requiredAccess) {
+  const matrix = isPermissionScopes(source) ? permissionMatrixFromScopes(source) : source;
+  const access = _nullishCoalesce(matrix[resource], () => ( "none"));
   return ACCESS_RANKS[access] >= ACCESS_RANKS[requiredAccess];
 }
-function hasPermissionCapabilityAccess(capabilities, resource, requiredAccess) {
-  const access = _nullishCoalesce(capabilities[resource], () => ( "none"));
-  return ACCESS_RANKS[access] >= ACCESS_RANKS[requiredAccess];
+function isPermissionScopes(source) {
+  return Array.isArray(source);
 }
 
 // src/permissions.ts
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
-var DEFAULT_PERMISSIONS = [
-  Permission.RoomRead,
-  Permission.RoomWrite
-];
 var ROOM_PERMISSION_OBJECT_KEYS = /* @__PURE__ */ new Set([
   "default",
   ...ROOM_PERMISSION_RESOURCES
 ]);
-var RESOURCE_SPECIFIC_PERMISSIONS_BY_RESOURCE = {
-  presence: Object.values(RESOURCE_PERMISSIONS.presence).flat(),
-  storage: Object.values(RESOURCE_PERMISSIONS.storage).flat(),
-  comments: Object.values(RESOURCE_PERMISSIONS.comments).flat(),
-  feeds: Object.values(RESOURCE_PERMISSIONS.feeds).flat()
-};
-var RESOURCE_SPECIFIC_PERMISSIONS = ROOM_PERMISSION_RESOURCES.flatMap(
-  (resource) => RESOURCE_SPECIFIC_PERMISSIONS_BY_RESOURCE[resource]
-);
-function permissionForAccessLevel(resource, access) {
+function permissionForAccessLevel(resource, access, field = resource) {
   const levels = RESOURCE_PERMISSIONS[resource];
   const permissions = levels[access];
   if (permissions === void 0 || permissions.length === 0) {
     throw new Error(
-      `Invalid permission level for ${resource}: ${String(access)}`
+      `Invalid permission level for ${field}: ${_nullishCoalesce(JSON.stringify(access), () => ( String(access)))}`
     );
   }
   return permissions[0];
 }
-function resolveRoomPermissionCapabilities(permissions, roomId) {
+function resolveRoomPermissionMatrix(permissions, roomId) {
   const matchedPermissions = permissions.filter(
     (permission) => resourceMatchesRoomId(permission.resource, roomId)
   );
@@ -5347,27 +5332,27 @@ function resolveRoomPermissionCapabilities(permissions, roomId) {
   }
   let hasDefaultPermission = false;
   let baseAccess = "none";
-  const explicitCapabilities = {};
+  const explicitMatrix = {};
   for (const permission of matchedPermissions) {
-    const resolved = resolvePermissionCapabilities(permission.scopes);
+    const resolved = resolvePermissionMatrix(permission.scopes);
     if (resolved.hasDefaultPermission) {
       hasDefaultPermission = true;
       baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
     }
     for (const resource of ROOM_PERMISSION_RESOURCES) {
-      const access = resolved.capabilities[resource];
+      const access = resolved.matrix[resource];
       if (access !== void 0) {
-        explicitCapabilities[resource] = strongestAccess(
-          _nullishCoalesce(explicitCapabilities[resource], () => ( "none")),
+        explicitMatrix[resource] = strongestAccess(
+          _nullishCoalesce(explicitMatrix[resource], () => ( "none")),
           access
         );
       }
     }
   }
-  return resolveFullPermissionCapabilities({
+  return resolveFullPermissionMatrix({
     hasDefaultPermission,
     baseAccess,
-    capabilities: explicitCapabilities
+    matrix: explicitMatrix
   });
 }
 function isRoomPermissionArray(input) {
@@ -5393,7 +5378,11 @@ function normalizeRoomPermissionObject(objectInput) {
   const permissions = [];
   if (objectInput.default !== void 0) {
     permissions.push(
-      permissionForAccessLevel(DEFAULT_PERMISSION_RESOURCE, objectInput.default)
+      permissionForAccessLevel(
+        DEFAULT_PERMISSION_RESOURCE,
+        objectInput.default,
+        "default"
+      )
     );
   }
   for (const resource of ROOM_PERMISSION_RESOURCES) {
@@ -5429,17 +5418,37 @@ function normalizeRoomAccessesUpdateInput(input) {
     ])
   );
 }
-function getRoomPermissionConflicts(permission) {
-  if (DEFAULT_PERMISSIONS.includes(permission)) {
-    return [...DEFAULT_PERMISSIONS, ...RESOURCE_SPECIFIC_PERMISSIONS];
+function mergePermissionMatrices(sources) {
+  return {
+    room: strongestMatrixAccess(sources, "room"),
+    presence: strongestMatrixAccess(sources, "presence"),
+    storage: strongestMatrixAccess(sources, "storage"),
+    comments: strongestMatrixAccess(sources, "comments"),
+    feeds: strongestMatrixAccess(sources, "feeds"),
+    personal: "write"
+  };
+}
+function permissionMatrixToScopes(matrix) {
+  const scopes = [];
+  const baseAccess = matrix.room;
+  if (baseAccess !== "none") {
+    scopes.push(
+      permissionForAccessLevel(DEFAULT_PERMISSION_RESOURCE, baseAccess)
+    );
   }
   for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const permissions = RESOURCE_SPECIFIC_PERMISSIONS_BY_RESOURCE[resource];
-    if (permissions.includes(permission)) {
-      return permissions;
+    const access = matrix[resource];
+    if (access !== baseAccess) {
+      scopes.push(permissionForAccessLevel(resource, access));
     }
   }
-  return [];
+  return scopes;
+}
+function strongestMatrixAccess(sources, resource) {
+  return sources.reduce(
+    (strongest, source) => strongestAccess(strongest, source[resource]),
+    "none"
+  );
 }
 function strongestAccess(left, right) {
   return ACCESS_RANKS[right] > ACCESS_RANKS[left] ? right : left;
@@ -5630,15 +5639,11 @@ function cachedTokenSatisfiesRequest(cachedToken, request) {
   if (request.roomId === void 0) {
     return false;
   }
-  const capabilities = resolveRoomPermissionCapabilities(
+  const matrix = resolveRoomPermissionMatrix(
     _nullishCoalesce(cachedToken.permissions, () => ( [])),
     request.roomId
   );
-  return capabilities !== void 0 && hasPermissionCapabilityAccess(
-    capabilities,
-    request.resource,
-    request.access
-  );
+  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
 }
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
@@ -9530,14 +9535,14 @@ var ClientMsgCode = Object.freeze({
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
   const { connectionId, id, info } = conn;
-  const canWrite = hasPermissionCapability(conn.scopes, "storage", "write");
+  const canWrite = hasPermissionAccess(conn.scopes, "storage", "write");
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: hasPermissionCapability(conn.scopes, "comments", "write"),
+      canComment: hasPermissionAccess(conn.scopes, "comments", "write"),
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9994,7 +9999,7 @@ function createRoom(options, config) {
   }
   function isStorageWritable() {
     const scopes = _optionalChain([context, 'access', _224 => _224.dynamicSessionInfoSig, 'access', _225 => _225.get, 'call', _226 => _226(), 'optionalAccess', _227 => _227.scopes]);
-    return scopes !== void 0 ? hasPermissionCapability(scopes, "storage", "write") : true;
+    return scopes !== void 0 ? hasPermissionAccess(scopes, "storage", "write") : true;
   }
   const eventHub = {
     status: makeEventSource(),
@@ -10055,7 +10060,7 @@ function createRoom(options, config) {
       if (staticSession === null || dynamicSession === null) {
         return null;
       } else {
-        const canWrite = hasPermissionCapability(
+        const canWrite = hasPermissionAccess(
           dynamicSession.scopes,
           "storage",
           "write"
@@ -10066,7 +10071,7 @@ function createRoom(options, config) {
           info: staticSession.userInfo,
           presence: myPresence,
           canWrite,
-          canComment: hasPermissionCapability(
+          canComment: hasPermissionAccess(
             dynamicSession.scopes,
             "comments",
             "write"
@@ -12730,5 +12735,5 @@ detectDupes(PKG_NAME, PKG_VERSION, PKG_FORMAT);
 
 
 
-exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.deepLiveify = deepLiveify; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getRoomPermissionConflicts = getRoomPermissionConflicts; exports.getSubscriptionKey = getSubscriptionKey; exports.hasPermissionCapability = hasPermissionCapability; exports.hasPermissionCapabilityAccess = hasPermissionCapabilityAccess; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.normalizeRoomAccessesInput = normalizeRoomAccessesInput; exports.normalizeRoomAccessesUpdateInput = normalizeRoomAccessesUpdateInput; exports.normalizeRoomPermissionInput = normalizeRoomPermissionInput; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.permissionCapabilitiesFromScopes = permissionCapabilitiesFromScopes; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
+exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.deepLiveify = deepLiveify; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getSubscriptionKey = getSubscriptionKey; exports.hasPermissionAccess = hasPermissionAccess; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.mergePermissionMatrices = mergePermissionMatrices; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.normalizeRoomAccessesInput = normalizeRoomAccessesInput; exports.normalizeRoomAccessesUpdateInput = normalizeRoomAccessesUpdateInput; exports.normalizeRoomPermissionInput = normalizeRoomPermissionInput; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.permissionMatrixFromScopes = permissionMatrixFromScopes; exports.permissionMatrixToScopes = permissionMatrixToScopes; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
 //# sourceMappingURL=index.cjs.map