@liveblocks/core 3.20.0-perm6 → 3.20.0-perm8

package/dist/index.cjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-perm6";
+var PKG_VERSION = "3.20.0-perm8";
 var PKG_FORMAT = "cjs";
 
 // src/dupe-detection.ts
@@ -5203,6 +5203,12 @@ var Permission = {
   LegacyRoomPresenceWrite: "room:presence:write"
 };
 var ACCESS_LEVELS = ["none", "read", "write"];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
 var ACCESS_LEVEL_RANKS = {
   none: 0,
   read: 1,
@@ -5246,6 +5252,9 @@ var ROOM_PERMISSION_RESOURCES = [
   "feeds"
 ];
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
 function resolveResourceAccess(scopes, resource) {
   const permissions = PERMISSIONS_BY_RESOURCE[resource];
   let resourceAccess;
@@ -5330,46 +5339,46 @@ function resolveRoomPermissionMatrix(permissions, roomId) {
     matrix: explicitMatrix
   });
 }
-function normalizeRoomPermissionInput(input) {
-  if (!Array.isArray(input)) {
+function normalizeRoomPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
     throw new Error("Permission list must be an array");
   }
-  return input.map((permission) => {
-    if (!VALID_PERMISSIONS.has(permission)) {
+  return permissions.map((permission) => {
+    if (!isPermission(permission)) {
       throw new Error(`Not a valid permission: ${permission}`);
     }
     return permission;
   });
 }
-function normalizeRoomAccessesInput(input) {
-  if (input === void 0) {
+function normalizeRoomAccesses(accesses) {
+  if (accesses === void 0) {
     return void 0;
   }
   return Object.fromEntries(
-    Object.entries(input).map(([id, permissions]) => [
+    Object.entries(accesses).map(([id, permissions]) => [
       id,
-      normalizeRoomPermissionInput(permissions)
+      normalizeRoomPermissions(permissions)
     ])
   );
 }
-function normalizeRoomAccessesUpdateInput(input) {
-  if (input === void 0) {
+function normalizeUpdateRoomAccesses(accesses) {
+  if (accesses === void 0) {
     return void 0;
   }
   return Object.fromEntries(
-    Object.entries(input).map(([id, permissions]) => [
+    Object.entries(accesses).map(([id, permissions]) => [
       id,
-      permissions === null ? null : normalizeRoomPermissionInput(permissions)
+      permissions === null ? null : normalizeRoomPermissions(permissions)
     ])
   );
 }
-function mergePermissionMatrices(sources) {
+function mergePermissionMatrices(matrices) {
   return {
-    room: strongestMatrixAccess(sources, "room"),
-    storage: strongestMatrixAccess(sources, "storage"),
-    comments: strongestMatrixAccess(sources, "comments"),
-    feeds: strongestMatrixAccess(sources, "feeds"),
-    personal: strongestMatrixAccess(sources, "personal")
+    room: strongestMatrixAccess(matrices, "room"),
+    storage: strongestMatrixAccess(matrices, "storage"),
+    comments: strongestMatrixAccess(matrices, "comments"),
+    feeds: strongestMatrixAccess(matrices, "feeds"),
+    personal: strongestMatrixAccess(matrices, "personal")
   };
 }
 function permissionMatrixToScopes(matrix) {
@@ -5392,11 +5401,53 @@ function mergeRoomPermissionScopes({
   userAccesses
 }) {
   const sources = [
-    permissionMatrixFromScopes(defaultAccesses),
-    ...groupsAccesses.map((scopes) => permissionMatrixFromScopes(scopes)),
-    ...userAccesses !== void 0 ? [permissionMatrixFromScopes(userAccesses)] : []
+    resolvePermissionScopes(defaultAccesses),
+    mergeResolvedScopesByHighestAccess(
+      groupsAccesses.map(resolvePermissionScopes)
+    ),
+    resolvePermissionScopes(userAccesses)
   ];
-  return permissionMatrixToScopes(mergePermissionMatrices(sources));
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = source.baseAccess;
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = access;
+      }
+    }
+  }
+  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
+}
+function mergeResolvedScopesByHighestAccess(sources) {
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = strongestAccess(merged.baseAccess, source.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = strongestAccess(
+          _nullishCoalesce(merged.matrix[resource], () => ( "none")),
+          access
+        );
+      }
+    }
+  }
+  return merged;
 }
 function permissionForAccessLevel(resource, access, field = resource) {
   const levels = PERMISSIONS_BY_RESOURCE[resource];
@@ -5408,9 +5459,9 @@ function permissionForAccessLevel(resource, access, field = resource) {
   }
   return permissions[0];
 }
-function strongestMatrixAccess(sources, resource) {
-  return sources.reduce(
-    (strongest, source) => strongestAccess(strongest, source[resource]),
+function strongestMatrixAccess(matrices, resource) {
+  return matrices.reduce(
+    (strongest, matrix) => strongestAccess(strongest, matrix[resource]),
     "none"
   );
 }
@@ -5426,6 +5477,28 @@ function resourceMatchesRoomId(resource, roomId) {
 function getResourceSpecificity(resource) {
   return resource.replace("*", "").length;
 }
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = scope.slice(0, scope.indexOf(":"));
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
+}
 
 // src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
@@ -5593,7 +5666,7 @@ function makeCachedToken(token, expiresAt) {
 function getAuthTokenPermissionScopes(permissions) {
   return Object.entries(permissions).map(([resource, scopes]) => ({
     resource,
-    scopes
+    scopes: normalizeRoomPermissions(scopes)
   }));
 }
 function cachedTokenSatisfiesRequest(cachedToken, request) {
@@ -9501,23 +9574,15 @@ var ClientMsgCode = Object.freeze({
 
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
-  const { connectionId, id, info } = conn;
-  const canWrite = hasPermissionAccess(
-    conn.permissionMatrix,
-    "storage",
-    "write"
-  );
+  const { connectionId, id, info, access } = conn;
+  const { canWrite, canComment } = access;
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: hasPermissionAccess(
-        conn.permissionMatrix,
-        "comments",
-        "write"
-      ),
+      canComment,
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9588,7 +9653,7 @@ var ManagedOthers = class {
    * Records a known connection. This records the connection ID and the
    * associated metadata.
    */
-  setConnection(connectionId, metaUserId, metaUserInfo, scopes) {
+  setConnection(connectionId, metaUserId, metaUserInfo, access) {
     this.#internal.mutate((state) => {
       state.connections.set(
         connectionId,
@@ -9596,7 +9661,7 @@ var ManagedOthers = class {
           connectionId,
           id: metaUserId,
           info: metaUserInfo,
-          permissionMatrix: permissionMatrixFromScopes(scopes)
+          access
         })
       );
       if (!state.presences.has(connectionId)) {
@@ -9749,6 +9814,14 @@ function defaultMessageFromContext(context) {
 
 // src/room.ts
 var FEEDS_TIMEOUT = 5e3;
+function connectionAccessFromScopes(scopes) {
+  const roomPermissions = normalizeRoomPermissions(scopes);
+  const matrix = permissionMatrixFromScopes(roomPermissions);
+  return {
+    canWrite: hasPermissionAccess(matrix, "storage", "write"),
+    canComment: hasPermissionAccess(matrix, "comments", "write")
+  };
+}
 function makeIdFactory(connectionId) {
   let count = 0;
   return () => `${connectionId}:${count++}`;
@@ -10339,7 +10412,9 @@ function createRoom(options, config) {
     context.dynamicSessionInfoSig.set({
       actor: message.actor,
       nonce: message.nonce,
-      permissionMatrix: permissionMatrixFromScopes(message.scopes),
+      permissionMatrix: permissionMatrixFromScopes(
+        normalizeRoomPermissions(message.scopes)
+      ),
       meta: message.meta
     });
     context.idFactory = makeIdFactory(message.actor);
@@ -10360,7 +10435,7 @@ function createRoom(options, config) {
         connectionId,
         user.id,
         user.info,
-        user.scopes
+        connectionAccessFromScopes(user.scopes)
       );
     }
     return { type: "reset" };
@@ -10380,7 +10455,7 @@ function createRoom(options, config) {
       message.actor,
       message.id,
       message.info,
-      message.scopes
+      connectionAccessFromScopes(message.scopes)
     );
     context.buffer.messages.push({
       type: ClientMsgCode.UPDATE_PRESENCE,
@@ -11746,7 +11821,6 @@ function createClient(options) {
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
-          // TODO: Should we have permissions for AI Copilots?
           resource: "personal",
           access: "write"
         });
@@ -12713,5 +12787,6 @@ detectDupes(PKG_NAME, PKG_VERSION, PKG_FORMAT);
 
 
 
-exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.deepLiveify = deepLiveify; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getSubscriptionKey = getSubscriptionKey; exports.hasPermissionAccess = hasPermissionAccess; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.mergePermissionMatrices = mergePermissionMatrices; exports.mergeRoomPermissionScopes = mergeRoomPermissionScopes; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.normalizeRoomAccessesInput = normalizeRoomAccessesInput; exports.normalizeRoomAccessesUpdateInput = normalizeRoomAccessesUpdateInput; exports.normalizeRoomPermissionInput = normalizeRoomPermissionInput; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.permissionMatrixFromScopes = permissionMatrixFromScopes; exports.permissionMatrixToScopes = permissionMatrixToScopes; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
+
+exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.deepLiveify = deepLiveify; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getSubscriptionKey = getSubscriptionKey; exports.hasPermissionAccess = hasPermissionAccess; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.mergePermissionMatrices = mergePermissionMatrices; exports.mergeRoomPermissionScopes = mergeRoomPermissionScopes; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.normalizeRoomAccesses = normalizeRoomAccesses; exports.normalizeRoomPermissions = normalizeRoomPermissions; exports.normalizeUpdateRoomAccesses = normalizeUpdateRoomAccesses; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.permissionMatrixFromScopes = permissionMatrixFromScopes; exports.permissionMatrixToScopes = permissionMatrixToScopes; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.validatePermissionsSet = validatePermissionsSet; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
 //# sourceMappingURL=index.cjs.map