@liveblocks/core 3.20.0-perm3 → 3.20.0-perm5

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-perm3";
+var PKG_VERSION = "3.20.0-perm5";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -5170,40 +5170,37 @@ function createReceivingToolInvocation(invocationId, name, partialArgsText = "")
 // src/protocol/Permissions.ts
 var Permission = {
   /**
-   * Default permission for a room
+   * Default permission for a room.
    */
-  RoomWrite: "room:write",
-  RoomRead: "room:read",
+  Read: "*:read",
+  Write: "*:write",
   /**
-   * Presence (LiveRoom Websocket access)
+   * Legacy aliases for default room permissions.
    */
-  RoomPresenceRead: "room:presence:read",
-  RoomPresenceNone: "room:presence:none",
+  RoomWrite: "room:write",
+  RoomRead: "room:read",
   /**
    * Storage
    */
-  RoomStorageRead: "room:storage:read",
-  RoomStorageWrite: "room:storage:write",
-  RoomStorageNone: "room:storage:none",
+  StorageRead: "storage:read",
+  StorageWrite: "storage:write",
+  StorageNone: "storage:none",
   /**
    * Comments
    */
-  RoomCommentsWrite: "room:comments:write",
-  RoomCommentsRead: "room:comments:read",
-  RoomCommentsNone: "room:comments:none",
+  CommentsWrite: "comments:write",
+  CommentsRead: "comments:read",
+  CommentsNone: "comments:none",
   /**
    * Feeds
    */
-  RoomFeedsRead: "room:feeds:read",
-  RoomFeedsWrite: "room:feeds:write",
-  RoomFeedsNone: "room:feeds:none",
+  FeedsRead: "feeds:read",
+  FeedsWrite: "feeds:write",
+  FeedsNone: "feeds:none",
   /**
    * Legacy
    */
-  LegacyRoomPresenceWrite: "room:presence:write",
-  LegacyCommentsWrite: "comments:write",
-  LegacyCommentsRead: "comments:read",
-  LegacyFeedsWrite: "feeds:write"
+  LegacyRoomPresenceWrite: "room:presence:write"
 };
 var ACCESS_LEVELS = [
   "none",
@@ -5215,46 +5212,39 @@ var ACCESS_RANKS = {
   read: 1,
   write: 2
 };
-var NO_PERMISSION_CAPABILITIES = {
-  creation: "none",
-  presence: "none",
+var NO_PERMISSION_MATRIX = {
+  room: "none",
   storage: "none",
   comments: "none",
   feeds: "none",
   personal: "write"
 };
 var RESOURCE_PERMISSIONS = {
-  creation: {
-    read: [Permission.RoomRead],
-    write: [Permission.RoomWrite]
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
   },
   personal: {
     write: []
   },
-  presence: {
-    write: [Permission.LegacyRoomPresenceWrite],
-    read: [Permission.RoomPresenceRead],
-    none: [Permission.RoomPresenceNone]
-  },
   storage: {
-    write: [Permission.RoomStorageWrite],
-    read: [Permission.RoomStorageRead],
-    none: [Permission.RoomStorageNone]
+    write: [Permission.StorageWrite],
+    read: [Permission.StorageRead],
+    none: [Permission.StorageNone]
   },
   comments: {
-    write: [Permission.RoomCommentsWrite, Permission.LegacyCommentsWrite],
-    read: [Permission.RoomCommentsRead, Permission.LegacyCommentsRead],
-    none: [Permission.RoomCommentsNone]
+    write: [Permission.CommentsWrite],
+    read: [Permission.CommentsRead],
+    none: [Permission.CommentsNone]
   },
   feeds: {
-    write: [Permission.RoomFeedsWrite, Permission.LegacyFeedsWrite],
-    read: [Permission.RoomFeedsRead],
-    none: [Permission.RoomFeedsNone]
+    write: [Permission.FeedsWrite],
+    read: [Permission.FeedsRead],
+    none: [Permission.FeedsNone]
   }
 };
-var DEFAULT_PERMISSION_RESOURCE = "creation";
+var DEFAULT_PERMISSION_RESOURCE = "room";
 var ROOM_PERMISSION_RESOURCES = [
-  "presence",
   "storage",
   "comments",
   "feeds"
@@ -5270,51 +5260,45 @@ function resolveResourceAccess(scopes, resource) {
   }
   return resourceAccess;
 }
-function resolveFullPermissionCapabilities(resolved) {
+function resolveFullPermissionMatrix(resolved) {
   if (!resolved.hasDefaultPermission) {
-    return { ...NO_PERMISSION_CAPABILITIES, ...resolved.capabilities };
+    return NO_PERMISSION_MATRIX;
   }
-  const capabilities = {
-    ...NO_PERMISSION_CAPABILITIES,
+  const matrix = {
+    ...NO_PERMISSION_MATRIX,
     [DEFAULT_PERMISSION_RESOURCE]: resolved.baseAccess
   };
   for (const resource of ROOM_PERMISSION_RESOURCES) {
-    capabilities[resource] = resolved.capabilities[resource] ?? resolved.baseAccess;
+    matrix[resource] = resolved.matrix[resource] ?? resolved.baseAccess;
   }
-  return capabilities;
+  return matrix;
 }
-function permissionCapabilitiesFromScopes(scopes) {
-  return resolveFullPermissionCapabilities(
-    resolvePermissionCapabilities(scopes)
-  );
+function permissionMatrixFromScopes(scopes) {
+  return resolveFullPermissionMatrix(resolvePermissionMatrix(scopes));
 }
-function resolvePermissionCapabilities(scopes) {
-  const hasDefaultPermission = scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
-  const baseAccess = scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.RoomRead) ? "read" : "none";
-  const capabilities = {};
+function resolvePermissionMatrix(scopes) {
+  const hasDefaultPermission = scopes.includes(Permission.Write) || scopes.includes(Permission.Read) || scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
+  const baseAccess = scopes.includes(Permission.Write) || scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.Read) || scopes.includes(Permission.RoomRead) ? "read" : "none";
+  const matrix = {};
   for (const resource of ROOM_PERMISSION_RESOURCES) {
     const access = resolveResourceAccess(scopes, resource);
     if (access !== void 0) {
-      capabilities[resource] = access;
+      matrix[resource] = access;
     }
   }
-  return { hasDefaultPermission, baseAccess, capabilities };
+  return { hasDefaultPermission, baseAccess, matrix };
 }
-function hasPermissionCapability(scopes, resource, requiredAccess) {
-  const access = permissionCapabilitiesFromScopes(scopes)[resource];
+function hasPermissionAccess(source, resource, requiredAccess) {
+  const matrix = isPermissionScopes(source) ? permissionMatrixFromScopes(source) : source;
+  const access = matrix[resource] ?? "none";
   return ACCESS_RANKS[access] >= ACCESS_RANKS[requiredAccess];
 }
-function hasPermissionCapabilityAccess(capabilities, resource, requiredAccess) {
-  const access = capabilities[resource] ?? "none";
-  return ACCESS_RANKS[access] >= ACCESS_RANKS[requiredAccess];
+function isPermissionScopes(source) {
+  return Array.isArray(source);
 }
 
 // src/permissions.ts
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
-var ROOM_PERMISSION_OBJECT_KEYS = /* @__PURE__ */ new Set([
-  "default",
-  ...ROOM_PERMISSION_RESOURCES
-]);
 function permissionForAccessLevel(resource, access, field = resource) {
   const levels = RESOURCE_PERMISSIONS[resource];
   const permissions = levels[access];
@@ -5325,7 +5309,7 @@ function permissionForAccessLevel(resource, access, field = resource) {
   }
   return permissions[0];
 }
-function resolveRoomPermissionCapabilities(permissions, roomId) {
+function resolveRoomPermissionMatrix(permissions, roomId) {
   const matchedPermissions = permissions.filter(
     (permission) => resourceMatchesRoomId(permission.resource, roomId)
   );
@@ -5334,69 +5318,47 @@ function resolveRoomPermissionCapabilities(permissions, roomId) {
   }
   let hasDefaultPermission = false;
   let baseAccess = "none";
-  const explicitCapabilities = {};
+  const explicitMatrix = {};
+  const explicitSpecificity = {};
   for (const permission of matchedPermissions) {
-    const resolved = resolvePermissionCapabilities(permission.scopes);
+    const resolved = resolvePermissionMatrix(permission.scopes);
+    const specificity = getResourceSpecificity(permission.resource);
     if (resolved.hasDefaultPermission) {
       hasDefaultPermission = true;
       baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
     }
     for (const resource of ROOM_PERMISSION_RESOURCES) {
-      const access = resolved.capabilities[resource];
+      const access = resolved.matrix[resource];
       if (access !== void 0) {
-        explicitCapabilities[resource] = strongestAccess(
-          explicitCapabilities[resource] ?? "none",
-          access
-        );
+        const currentSpecificity = explicitSpecificity[resource] ?? -1;
+        if (specificity > currentSpecificity) {
+          explicitMatrix[resource] = access;
+          explicitSpecificity[resource] = specificity;
+        } else if (specificity === currentSpecificity) {
+          explicitMatrix[resource] = strongestAccess(
+            explicitMatrix[resource] ?? "none",
+            access
+          );
+        }
       }
     }
   }
-  return resolveFullPermissionCapabilities({
+  return resolveFullPermissionMatrix({
     hasDefaultPermission,
     baseAccess,
-    capabilities: explicitCapabilities
+    matrix: explicitMatrix
   });
 }
-function isRoomPermissionArray(input) {
-  return Array.isArray(input);
-}
 function normalizeRoomPermissionInput(input) {
-  if (isRoomPermissionArray(input)) {
-    return input.map((permission) => {
-      if (!VALID_PERMISSIONS.has(permission)) {
-        throw new Error(`Not a valid permission: ${permission}`);
-      }
-      return permission;
-    });
+  if (!Array.isArray(input)) {
+    throw new Error("Permission list must be an array");
   }
-  return normalizeRoomPermissionObject(input);
-}
-function normalizeRoomPermissionObject(objectInput) {
-  for (const key of Object.keys(objectInput)) {
-    if (!ROOM_PERMISSION_OBJECT_KEYS.has(key)) {
-      throw new Error(`Unknown permission field: ${key}`);
+  return input.map((permission) => {
+    if (!VALID_PERMISSIONS.has(permission)) {
+      throw new Error(`Not a valid permission: ${permission}`);
     }
-  }
-  const permissions = [];
-  if (objectInput.default !== void 0) {
-    permissions.push(
-      permissionForAccessLevel(
-        DEFAULT_PERMISSION_RESOURCE,
-        objectInput.default,
-        "default"
-      )
-    );
-  }
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const access = objectInput[resource];
-    if (access !== void 0) {
-      permissions.push(permissionForAccessLevel(resource, access));
-    }
-  }
-  if (permissions.length === 0) {
-    throw new Error("Permission object cannot be empty");
-  }
-  return permissions;
+    return permission;
+  });
 }
 function normalizeRoomAccessesInput(input) {
   if (input === void 0) {
@@ -5420,33 +5382,32 @@ function normalizeRoomAccessesUpdateInput(input) {
     ])
   );
 }
-function mergePermissionCapabilities(sources) {
+function mergePermissionMatrices(sources) {
   return {
-    creation: strongestCapabilityAccess(sources, "creation"),
-    presence: strongestCapabilityAccess(sources, "presence"),
-    storage: strongestCapabilityAccess(sources, "storage"),
-    comments: strongestCapabilityAccess(sources, "comments"),
-    feeds: strongestCapabilityAccess(sources, "feeds"),
+    room: strongestMatrixAccess(sources, "room"),
+    storage: strongestMatrixAccess(sources, "storage"),
+    comments: strongestMatrixAccess(sources, "comments"),
+    feeds: strongestMatrixAccess(sources, "feeds"),
     personal: "write"
   };
 }
-function permissionCapabilitiesToScopes(capabilities) {
+function permissionMatrixToScopes(matrix) {
   const scopes = [];
-  const baseAccess = capabilities.creation;
+  const baseAccess = matrix.room;
   if (baseAccess !== "none") {
     scopes.push(
       permissionForAccessLevel(DEFAULT_PERMISSION_RESOURCE, baseAccess)
     );
   }
-  for (const capability of ROOM_PERMISSION_RESOURCES) {
-    const access = capabilities[capability];
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = matrix[resource];
     if (access !== baseAccess) {
-      scopes.push(permissionForAccessLevel(capability, access));
+      scopes.push(permissionForAccessLevel(resource, access));
     }
   }
   return scopes;
 }
-function strongestCapabilityAccess(sources, resource) {
+function strongestMatrixAccess(sources, resource) {
   return sources.reduce(
     (strongest, source) => strongestAccess(strongest, source[resource]),
     "none"
@@ -5461,6 +5422,9 @@ function resourceMatchesRoomId(resource, roomId) {
   }
   return resource === roomId;
 }
+function getResourceSpecificity(resource) {
+  return resource.replace("*", "").length;
+}
 
 // src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
@@ -5641,15 +5605,11 @@ function cachedTokenSatisfiesRequest(cachedToken, request) {
   if (request.roomId === void 0) {
     return false;
   }
-  const capabilities = resolveRoomPermissionCapabilities(
+  const matrix = resolveRoomPermissionMatrix(
     cachedToken.permissions ?? [],
     request.roomId
   );
-  return capabilities !== void 0 && hasPermissionCapabilityAccess(
-    capabilities,
-    request.resource,
-    request.access
-  );
+  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
 }
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
@@ -9541,14 +9501,14 @@ var ClientMsgCode = Object.freeze({
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
   const { connectionId, id, info } = conn;
-  const canWrite = hasPermissionCapability(conn.scopes, "storage", "write");
+  const canWrite = hasPermissionAccess(conn.scopes, "storage", "write");
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: hasPermissionCapability(conn.scopes, "comments", "write"),
+      canComment: hasPermissionAccess(conn.scopes, "comments", "write"),
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -10005,7 +9965,7 @@ function createRoom(options, config) {
   }
   function isStorageWritable() {
     const scopes = context.dynamicSessionInfoSig.get()?.scopes;
-    return scopes !== void 0 ? hasPermissionCapability(scopes, "storage", "write") : true;
+    return scopes !== void 0 ? hasPermissionAccess(scopes, "storage", "write") : true;
   }
   const eventHub = {
     status: makeEventSource(),
@@ -10066,7 +10026,7 @@ function createRoom(options, config) {
       if (staticSession === null || dynamicSession === null) {
         return null;
       } else {
-        const canWrite = hasPermissionCapability(
+        const canWrite = hasPermissionAccess(
           dynamicSession.scopes,
           "storage",
           "write"
@@ -10077,7 +10037,7 @@ function createRoom(options, config) {
           info: staticSession.userInfo,
           presence: myPresence,
           canWrite,
-          canComment: hasPermissionCapability(
+          canComment: hasPermissionAccess(
             dynamicSession.scopes,
             "comments",
             "write"
@@ -11488,7 +11448,9 @@ function createRoom(options, config) {
       _dump: () => {
         const n = context.pool.nodes.size;
         return `Room "${roomId}" (${n} node${n === 1 ? "" : "s"}):
-${dumpPool(context.pool)}`;
+${dumpPool(
+          context.pool
+        )}`;
       },
       destroy: () => {
         pendingFeedsRequests.forEach(
@@ -11683,7 +11645,7 @@ function makeAuthDelegateForRoom(roomId, authManager) {
   return async () => {
     return authManager.getAuthValue({
       roomId,
-      resource: "presence",
+      resource: "room",
       access: "read"
     });
   };
@@ -12686,8 +12648,7 @@ export {
   generateUrl,
   getMentionsFromCommentBody,
   getSubscriptionKey,
-  hasPermissionCapability,
-  hasPermissionCapabilityAccess,
+  hasPermissionAccess,
   html,
   htmlSafe,
   isCommentBodyLink,
@@ -12715,7 +12676,7 @@ export {
   makePosition,
   mapValues,
   memoizeOnSuccess,
-  mergePermissionCapabilities,
+  mergePermissionMatrices,
   nanoid,
   nn,
   nodeStreamToCompactNodes,
@@ -12724,8 +12685,8 @@ export {
   normalizeRoomPermissionInput,
   objectToQuery,
   patchNotificationSettings,
-  permissionCapabilitiesFromScopes,
-  permissionCapabilitiesToScopes,
+  permissionMatrixFromScopes,
+  permissionMatrixToScopes,
   raise,
   resolveMentionsInCommentBody,
   sanitizeUrl,