@lucern/sdk 0.2.0-alpha.6 → 0.2.0-alpha.8

package/dist/policyClient.js

@@ -0,0 +1,625 @@
+// src/coreClient.ts
+var LucernApiError = class extends Error {
+  code;
+  status;
+  invariant;
+  suggestion;
+  details;
+  requestId;
+  correlationId;
+  policyTraceId;
+  constructor(args) {
+    super(args.message);
+    this.name = "LucernApiError";
+    this.code = args.code;
+    this.status = args.status;
+    this.invariant = args.invariant;
+    this.suggestion = args.suggestion;
+    this.details = args.details;
+    this.requestId = args.requestId;
+    this.correlationId = args.correlationId;
+    this.policyTraceId = args.policyTraceId;
+  }
+};
+function toQueryString(scope) {
+  const params = new URLSearchParams();
+  if (scope.tenantId) {
+    params.set("tenantId", scope.tenantId);
+  }
+  if (scope.workspaceId) {
+    params.set("workspaceId", scope.workspaceId);
+  }
+  for (const [key, value] of Object.entries(scope)) {
+    if (key === "tenantId" || key === "workspaceId") {
+      continue;
+    }
+    if (value === void 0) {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const serialized = params.toString();
+  return serialized.length > 0 ? `?${serialized}` : "";
+}
+function fillRandomBytes(length) {
+  const bytes = new Uint8Array(length);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+  }
+  for (let index = 0; index < length; index += 1) {
+    bytes[index] = Math.floor(Math.random() * 256);
+  }
+  return bytes;
+}
+function generatePortableRequestId() {
+  if (typeof globalThis.crypto?.randomUUID === "function") {
+    return globalThis.crypto.randomUUID();
+  }
+  const bytes = fillRandomBytes(16);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0"));
+  return `${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex.slice(
+    6,
+    8
+  ).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
+}
+function randomIdempotencyKey() {
+  return generatePortableRequestId();
+}
+function isRetryableStatus(status) {
+  return status >= 500 || status === 408 || status === 429;
+}
+function fallbackErrorCode(status) {
+  if (status === 401) {
+    return "AUTHENTICATION_REQUIRED";
+  }
+  if (status === 403) {
+    return "FORBIDDEN";
+  }
+  if (status === 404) {
+    return "NOT_FOUND";
+  }
+  if (status === 408) {
+    return "UPSTREAM_ERROR";
+  }
+  if (status === 409) {
+    return "CONFLICT";
+  }
+  if (status === 429) {
+    return "RATE_LIMIT_EXCEEDED";
+  }
+  if (status >= 500) {
+    return "UPSTREAM_ERROR";
+  }
+  return "INTERNAL_ERROR";
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseRetryAfterMs(value) {
+  if (!value) {
+    return null;
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const numeric = Number(trimmed);
+  if (Number.isFinite(numeric)) {
+    return Math.max(0, Math.round(numeric * 1e3));
+  }
+  const parsedDate = Date.parse(trimmed);
+  if (Number.isFinite(parsedDate)) {
+    return Math.max(0, parsedDate - Date.now());
+  }
+  return null;
+}
+function computeRetryDelayMs(args) {
+  const baseDelay = args.status === 429 ? Math.max(
+    args.retryAfterMs ?? 0,
+    Math.min(1e3 * 2 ** args.attempt, 1e4)
+  ) : Math.min(1e3 * 2 ** args.attempt, 4e3);
+  if (args.status !== 429) {
+    return baseDelay;
+  }
+  const jitterWindow = Math.max(250, Math.round(baseDelay * 0.25));
+  return baseDelay + Math.round(Math.random() * jitterWindow);
+}
+function timeoutError(timeoutMs) {
+  const error = new Error(`Request timed out after ${timeoutMs}ms`);
+  error.name = "AbortError";
+  return error;
+}
+function readPolicySummaryFromDetails(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return null;
+  }
+  const directSummary = details.summary;
+  if (typeof directSummary === "string" && directSummary.trim().length > 0) {
+    return directSummary.trim();
+  }
+  const policy = details.policy;
+  if (!policy || typeof policy !== "object" || Array.isArray(policy)) {
+    return null;
+  }
+  const explanation = policy.explanation;
+  if (!explanation || typeof explanation !== "object" || Array.isArray(explanation)) {
+    return null;
+  }
+  const nestedSummary = explanation.summary;
+  if (typeof nestedSummary === "string" && nestedSummary.trim().length > 0) {
+    return nestedSummary.trim();
+  }
+  return null;
+}
+function createGatewayRequestClient(config = {}) {
+  const fetchImpl = config.fetchImpl ?? fetch;
+  const baseUrl = config.baseUrl?.replace(/\/+$/, "") ?? "";
+  const maxRetries = config.maxRetries ?? 2;
+  const requestIdFactory = config.requestIdFactory ?? (() => generatePortableRequestId());
+  async function resolveAuthHeaders() {
+    if (!config.getAuthHeaders) {
+      return {};
+    }
+    return await config.getAuthHeaders();
+  }
+  async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetchImpl(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (controller.signal.aborted) {
+        throw timeoutError(timeoutMs);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function parsePayload(response) {
+    const text = await response.text();
+    if (!text) {
+      return null;
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  }
+  function resolveTimeoutMs(method, requestTimeoutMs) {
+    if (typeof requestTimeoutMs === "number") {
+      return requestTimeoutMs;
+    }
+    const methodTimeoutMs = config.timeoutMsByMethod?.[method];
+    if (typeof methodTimeoutMs === "number") {
+      return methodTimeoutMs;
+    }
+    return config.timeoutMs ?? 15e3;
+  }
+  function buildApiError(args) {
+    const failure = args.failure;
+    const legacyError = failure && typeof failure.error === "object" && failure.error !== null ? failure.error : failure?.legacyError;
+    const correlationId = failure?.correlationId ?? args.response.headers.get("x-lucern-correlation-id")?.trim() ?? args.requestId;
+    const policyTraceId = failure?.policyTraceId ?? args.response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null;
+    const details = failure?.details ?? legacyError?.details;
+    const policySummary = readPolicySummaryFromDetails(details);
+    return new LucernApiError({
+      code: failure?.code ?? legacyError?.code ?? fallbackErrorCode(args.response.status),
+      message: policySummary ?? (typeof failure?.error === "string" ? failure.error : legacyError?.message ?? (args.response.ok ? "Platform API returned an invalid success payload." : "Platform API request failed.")),
+      status: args.response.status,
+      invariant: failure?.invariant,
+      suggestion: failure?.suggestion,
+      details,
+      requestId: args.requestId,
+      correlationId,
+      policyTraceId
+    });
+  }
+  async function request(args) {
+    const authHeaders = await resolveAuthHeaders();
+    const method = args.method ?? "GET";
+    const timeoutMs = resolveTimeoutMs(method, args.timeoutMs);
+    const headers = new Headers({
+      "content-type": "application/json",
+      ...authHeaders
+    });
+    if (args.idempotencyKey) {
+      headers.set("idempotency-key", args.idempotencyKey);
+    }
+    const requestId = headers.get("x-correlation-id")?.trim() || headers.get("x-request-id")?.trim() || args.requestId || requestIdFactory();
+    if (!headers.has("x-correlation-id") && !headers.has("x-request-id")) {
+      headers.set("x-correlation-id", requestId);
+    }
+    const url = `${baseUrl}${args.path}`;
+    const serializedBody = args.body ? JSON.stringify(args.body) : void 0;
+    const init = {
+      method,
+      headers,
+      body: serializedBody
+    };
+    let lastError;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const hookRequestContext = {
+        requestId,
+        attempt,
+        maxRetries,
+        method,
+        path: args.path,
+        url,
+        headers: new Headers(headers),
+        body: serializedBody,
+        timeoutMs
+      };
+      await config.onRequest?.(hookRequestContext);
+      const startedAt = Date.now();
+      try {
+        const response = await fetchWithTimeout(url, init, timeoutMs);
+        const responseClone = response.clone();
+        const payload = await parsePayload(response);
+        const retryAfterMs = parseRetryAfterMs(
+          response.headers.get("Retry-After")
+        );
+        if (!response.ok || !payload?.success) {
+          const failure = payload && !payload.success ? payload : null;
+          const apiError = buildApiError({
+            requestId,
+            response,
+            failure
+          });
+          const willRetry = attempt < maxRetries && isRetryableStatus(response.status);
+          await config.onResponse?.({
+            ...hookRequestContext,
+            durationMs: Date.now() - startedAt,
+            status: response.status,
+            response: responseClone,
+            error: apiError,
+            correlationId: apiError.correlationId ?? requestId,
+            policyTraceId: apiError.policyTraceId ?? null,
+            retryAfterMs,
+            willRetry
+          });
+          if (willRetry) {
+            lastError = apiError;
+            await delay(
+              computeRetryDelayMs({
+                attempt,
+                status: response.status,
+                retryAfterMs
+              })
+            );
+            continue;
+          }
+          throw apiError;
+        }
+        const successPayload = payload;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          status: response.status,
+          response: responseClone,
+          correlationId: successPayload.correlationId ?? response.headers.get("x-lucern-correlation-id")?.trim() ?? requestId,
+          policyTraceId: successPayload.policyTraceId ?? response.headers.get("x-lucern-policy-trace-id")?.trim() ?? null,
+          idempotentReplay: successPayload.idempotentReplay,
+          retryAfterMs,
+          willRetry: false
+        });
+        return successPayload;
+      } catch (fetchError) {
+        if (fetchError instanceof LucernApiError) {
+          throw fetchError;
+        }
+        const willRetry = attempt < maxRetries;
+        await config.onResponse?.({
+          ...hookRequestContext,
+          durationMs: Date.now() - startedAt,
+          error: fetchError,
+          correlationId: requestId,
+          policyTraceId: null,
+          willRetry
+        });
+        lastError = fetchError;
+        if (willRetry) {
+          await delay(computeRetryDelayMs({ attempt }));
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Platform API request failed after retries.");
+  }
+  return {
+    request
+  };
+}
+
+// src/sdkSurface.ts
+function createListResult(items, legacyKey) {
+  const result = {
+    items,
+    total: items.length
+  };
+  {
+    result[legacyKey] = items;
+  }
+  return result;
+}
+function mapGatewayData(response, mapper) {
+  return {
+    ...response,
+    data: mapper(response.data)
+  };
+}
+
+// src/policyClient.ts
+function asTopicArray(data) {
+  if (Array.isArray(data)) {
+    return data.filter(
+      (row) => Boolean(row) && typeof row === "object"
+    );
+  }
+  return [];
+}
+function asWritePolicyRecord(data) {
+  if (!data || typeof data !== "object") {
+    return null;
+  }
+  return data;
+}
+function asWritePolicyArray(data) {
+  if (!Array.isArray(data)) {
+    return [];
+  }
+  return data.map(asWritePolicyRecord).filter((row) => Boolean(row));
+}
+function asRolePolicyRecord(data) {
+  if (!data || typeof data !== "object") {
+    return null;
+  }
+  return data;
+}
+function asRolePolicyArray(data) {
+  if (!Array.isArray(data)) {
+    return [];
+  }
+  return data.map(asRolePolicyRecord).filter((row) => Boolean(row));
+}
+function createPolicyClient(config = {}) {
+  const gateway = createGatewayRequestClient(config);
+  return {
+    /**
+     * List policy decisions in the current scope.
+     */
+    async listDecisions(query = {}) {
+      return gateway.request({
+        path: `/api/platform/v1/policy/decisions${toQueryString(query)}`
+      }).then(
+        (response) => mapGatewayData(
+          response,
+          (data) => createListResult(Array.isArray(data) ? data : [], "decisions")
+        )
+      );
+    },
+    /**
+     * Create a permission grant.
+     */
+    async grant(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/policy/grant",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Delete a permission grant by revoking it.
+     */
+    async revoke(input, idempotencyKey) {
+      return gateway.request({
+        path: "/api/platform/v1/policy/revoke",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List write policy rules for the current scope.
+     */
+    async listWritePolicies(query = {}) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/policy/write-policies${toQueryString(query)}`
+      });
+      const rawPolicies = response.data && typeof response.data === "object" ? response.data.policies : response.data;
+      return {
+        ...response,
+        data: {
+          policies: asWritePolicyArray(rawPolicies)
+        }
+      };
+    },
+    /**
+     * Create a write policy rule.
+     */
+    async createWritePolicy(input, idempotencyKey) {
+      const response = await gateway.request({
+        path: "/api/platform/v1/policy/write-policies",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          id: typeof response.data?.id === "string" ? response.data.id : void 0,
+          created: response.data?.created === true,
+          policy: asWritePolicyRecord(response.data?.policy)
+        }
+      };
+    },
+    /**
+     * Update an existing write policy rule by identifier.
+     */
+    async updateWritePolicy(id, input, idempotencyKey) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/policy/write-policies/${encodeURIComponent(id)}`,
+        method: "PATCH",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          id: typeof response.data?.id === "string" ? response.data.id : void 0,
+          updated: response.data?.updated === true,
+          policy: asWritePolicyRecord(response.data?.policy)
+        }
+      };
+    },
+    /**
+     * Delete a write policy rule by identifier.
+     */
+    async deleteWritePolicy(id, scope = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/policy/write-policies/${encodeURIComponent(
+          id
+        )}${toQueryString(scope)}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * List tenant role policies for the current scope.
+     */
+    async listRolePolicies(query = {}) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/policy/roles${toQueryString(query)}`
+      });
+      return {
+        ...response,
+        data: {
+          policies: asRolePolicyArray(response.data?.policies)
+        }
+      };
+    },
+    /**
+     * Create a tenant role policy.
+     */
+    async createRolePolicy(input, idempotencyKey) {
+      const response = await gateway.request({
+        path: "/api/platform/v1/policy/roles",
+        method: "POST",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          policy: asRolePolicyRecord(response.data?.policy)
+        }
+      };
+    },
+    /**
+     * Update a tenant role policy by identifier.
+     */
+    async updateRolePolicy(id, input, idempotencyKey) {
+      const response = await gateway.request({
+        path: `/api/platform/v1/policy/roles/${encodeURIComponent(id)}`,
+        method: "PATCH",
+        body: input,
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+      return {
+        ...response,
+        data: {
+          policy: asRolePolicyRecord(response.data?.policy)
+        }
+      };
+    },
+    /**
+     * Delete a tenant role policy by identifier.
+     */
+    async deleteRolePolicy(id, scope = {}, idempotencyKey) {
+      return gateway.request({
+        path: `/api/platform/v1/policy/roles/${encodeURIComponent(id)}${toQueryString(
+          scope
+        )}`,
+        method: "DELETE",
+        idempotencyKey: idempotencyKey ?? randomIdempotencyKey()
+      });
+    },
+    /**
+     * Check a permission decision for a topic or project scope.
+     */
+    async checkPermission(query) {
+      if (!query.topicId) {
+        throw new Error("topicId is required");
+      }
+      return gateway.request({
+        path: `/api/platform/v1/policy/check${toQueryString(query)}`
+      });
+    },
+    /**
+     * List accessible topics for a principal.
+     */
+    async listAccessibleTopics(query = {}) {
+      const permission = query.permission ?? "read";
+      const principal = query.principal ?? query.principalId;
+      const response = await gateway.request({
+        path: `/api/platform/v1/policy/topics${toQueryString({
+          tenantId: query.tenantId,
+          workspaceId: query.workspaceId,
+          permission,
+          includeShared: query.includeShared,
+          principal,
+          limit: query.limit
+        })}`
+      });
+      return {
+        ...response,
+        data: {
+          permission,
+          topics: asTopicArray(response.data?.topics),
+          total: typeof response.data?.total === "number" ? response.data.total : asTopicArray(response.data?.topics).length,
+          deniedTopics: Array.isArray(response.data?.deniedTopics) ? response.data.deniedTopics : []
+        }
+      };
+    },
+    /**
+     * Filter topic identifiers by permission.
+     */
+    async filterByPermission(input) {
+      const permission = input.permission ?? "read";
+      const principal = input.principal ?? input.principalId;
+      const uniqueTopicIds = [...new Set(input.topicIds ?? [])].filter(
+        (topicId) => typeof topicId === "string" && topicId.trim().length > 0
+      );
+      const response = await gateway.request({
+        path: "/api/platform/v1/policy/filter",
+        method: "POST",
+        body: {
+          tenantId: input.tenantId,
+          workspaceId: input.workspaceId,
+          topicIds: uniqueTopicIds,
+          permission,
+          principal
+        }
+      });
+      const allowedTopicIds = Array.isArray(response.data?.allowedTopicIds) ? response.data.allowedTopicIds : [];
+      const deniedTopics = Array.isArray(response.data?.deniedTopics) ? response.data.deniedTopics : [];
+      return {
+        success: true,
+        data: {
+          permission,
+          allowedTopicIds,
+          deniedTopics,
+          count: typeof response.data?.count === "number" ? response.data.count : allowedTopicIds.length
+        }
+      };
+    }
+  };
+}
+
+export { LucernApiError, createPolicyClient };
+//# sourceMappingURL=policyClient.js.map
+//# sourceMappingURL=policyClient.js.map