@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/sharing/access/access-rules.d.ts

@@ -0,0 +1,199 @@
+import { type Principal } from '../../core/index';
+import type { ResourceOwner } from '../ownership';
+import type { SqlKit } from './accessible';
+import type { ResolvedResourceType } from './resource-types';
+/**
+ * What a rule decides about one record.
+ *
+ * @stability experimental
+ */
+export type AccessRuleVerdict = 'allow' | 'deny' | 'abstain';
+/**
+ * Where a rule's allow sits among the sources of a role: before the grants
+ * (step 6 of the decision order) or after them (step 8). A deny ends the
+ * decision wherever it sits.
+ *
+ * @stability experimental
+ */
+export type AccessRulePosition = 'before-grants' | 'after-grants';
+/**
+ * What a rule sees of one record.
+ *
+ * @stability experimental
+ */
+export interface AccessRuleContext {
+    /** The caller, enriched with its groups. */
+    readonly principal: Principal;
+    /** The action asked, or `null` when the role (not an action) is being computed. */
+    readonly action: string | null;
+    /** The record. `orgId` is the caller's active organization (a record elsewhere is decided before the rules). */
+    readonly resource: {
+        /** The resource type. */
+        readonly type: string;
+        /** The record id. */
+        readonly id: string;
+        /** The record's organization. */
+        readonly orgId: string;
+        /** Who owns it. */
+        readonly owner: ResourceOwner;
+    };
+    /**
+     * The transaction the decision runs in, scoped to the caller's
+     * organization (row-level security confines every query on an `org`
+     * table). Read only: a rule decides, it never writes. Cast it to the app's Prisma transaction client.
+     */
+    readonly tx: unknown;
+    /** Scratch shared by every record of one decision call: load a project's members once, not per record. */
+    readonly cache: Map<string, unknown>;
+}
+/**
+ * What a rule's `sql` receives: the record's table and the builders.
+ *
+ * @typeParam S - the app's `Prisma.Sql`.
+ *
+ * @stability experimental
+ */
+export interface AccessRuleSqlContext<S> {
+    /** The caller, enriched with its groups. */
+    readonly principal: Principal;
+    /** The resource type being listed. */
+    readonly resourceType: string;
+    /** The caller's active organization: bind it in every sub-select of an organization table. */
+    readonly orgId: string;
+    /** The app's SQL builders. Every value is a bind parameter; never interpolate input. */
+    readonly kit: SqlKit<S>;
+    /** A column of the record's table, qualified by its alias (a checked identifier). */
+    column(name: string): S;
+    /** The record id column (uuid). */
+    readonly idColumn: S;
+}
+/**
+ * The two conditions a rule contributes to "resources I can see".
+ *
+ * @typeParam S - the app's `Prisma.Sql`.
+ *
+ * @stability experimental
+ */
+export interface AccessRuleSql<S> {
+    /** Records the rule allows (confers `role` on). */
+    readonly allow?: S;
+    /** Records the rule denies (hidden from everyone but the record's user owner). */
+    readonly deny?: S;
+}
+/**
+ * One access rule.
+ *
+ * @example
+ * ```ts
+ * registerAccessRule({
+ *   id: 'project-member',
+ *   position: 'before-grants',
+ *   resourceTypes: ['project_document'],
+ *   async evaluate(ctx) { return (await isProjectMember(ctx)) ? 'allow' : 'abstain'; },
+ *   sql: (ctx) => ({ allow: ctx.kit.sql`EXISTS (SELECT 1 FROM project_members pm WHERE ...)` }),
+ * });
+ * ```
+ *
+ * @stability experimental
+ */
+export interface AccessRuleDef {
+    /** Stable id (`GRANTEE_KIND_ID_PATTERN`: lower-case letters, digits, hyphens); it is `AccessDecision.via` of an allow. */
+    readonly id: string;
+    /** Where its allow sits among the sources of a role. */
+    readonly position: AccessRulePosition;
+    /** The resource types it applies to. Default: every type. */
+    readonly resourceTypes?: readonly string[];
+    /** The role an allow confers: one of the type's roles, or `'owner'`. Default: the type's weakest role. */
+    readonly role?: string;
+    /**
+     * Whether the rule can return `deny`. A rule that can deny must provide `sql` so lists hide what it denies;
+     * a `deny` from a rule that did not declare it is a configuration error (still a deny, flagged `ruleFailure`).
+     */
+    readonly mayDeny?: boolean;
+    /**
+     * The verdict for one record. A rejection or an unknown value is a deny.
+     *
+     * @param ctx - the caller, the action, the record and the transaction.
+     */
+    evaluate(ctx: AccessRuleContext): Promise<AccessRuleVerdict>;
+    /**
+     * The same decision as SQL over the record's table, for "resources I can
+     * see". Return `null` for "nothing to add for this caller". Parameterise
+     * every value and bind `ctx.orgId` in every sub-select of an organization table.
+     *
+     * @param ctx - the caller, the table and the builders.
+     */
+    sql?<S>(ctx: AccessRuleSqlContext<S>): AccessRuleSql<S> | null;
+}
+/**
+ * The access rules, in registration order. String ids, a duplicate-id error,
+ * frozen after bootstrap (the core registry primitive).
+ *
+ * @stability experimental
+ */
+export declare const accessRuleRegistry: import("../../core/index").Registry<AccessRuleDef>;
+/**
+ * Registers one access rule. Call it at import time, before the application
+ * bootstraps (an app's `app-registrations` module).
+ *
+ * @param def - the rule (the object is shallow-frozen).
+ * @throws RegistryError `INVALID_ID`, `INVALID_ENTRY` (the message names the
+ *   rule and the problem), `DUPLICATE_ID` or `FROZEN` (after bootstrap).
+ *
+ * @example
+ * ```ts
+ * registerAccessRule(createProjectMemberAccessRule({ resourceType: 'project_document', table: 'project_documents' }));
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerAccessRule(def: AccessRuleDef): void;
+/** The rules that apply to `type`, in registration order. */
+export declare function accessRulesFor(type: string): AccessRuleDef[];
+/**
+ * The role an allow of `rule` confers on records of `rt`, or `null` when the
+ * rule names a role the type does not have (a misconfiguration: fail closed).
+ */
+export declare function accessRuleRole(rt: ResolvedResourceType, rule: AccessRuleDef): string | null;
+/** One role a rule offers. */
+export interface RuleOffer {
+    readonly role: string;
+    readonly via: string;
+}
+/** What the rules decided about one record. */
+export interface RuleOutcome {
+    /** Some rule denied (or failed): the record is denied. */
+    readonly denied: boolean;
+    /** The denial is a rule FAILURE or a misconfiguration (a throw, an unknown verdict, a deny the rule did not declare), not a decision. */
+    readonly failed?: boolean;
+    /** Allows of `before-grants` rules. */
+    readonly before: readonly RuleOffer[];
+    /** Allows of `after-grants` rules. */
+    readonly after: readonly RuleOffer[];
+}
+export declare const NO_RULE_OUTCOME: RuleOutcome;
+/**
+ * Evaluates every applicable rule for one record. Fail closed: a throw, a
+ * rejection, an unknown verdict, a misconfigured role or a `deny` from a rule
+ * that did not declare `mayDeny` (its list SQL would not hide the record) is a
+ * deny, flagged `failed`. `context.recover` runs after a rule threw, so a
+ * failed statement of the shared transaction does not poison the next rule.
+ */
+export declare function evaluateAccessRules(rt: ResolvedResourceType, context: AccessRuleContext & {
+    recover?: () => Promise<void>;
+}): Promise<RuleOutcome>;
+/** The SQL conditions the rules contribute for one listing. */
+export interface RuleSqlParts<S> {
+    /** `allow` conditions of rules whose role reaches `minRank`. */
+    readonly allow: S[];
+    /** `deny` conditions. */
+    readonly deny: S[];
+}
+/**
+ * Collects the SQL of every applicable rule. A rule whose `sql` throws is
+ * failed closed: a rule that can deny hides every record it could deny
+ * (`deny` = TRUE), any other rule contributes nothing.
+ */
+export declare function collectRuleSql<S>(rt: ResolvedResourceType, base: Omit<AccessRuleSqlContext<S>, 'resourceType'>, minRank: number): RuleSqlParts<S>;
+//# sourceMappingURL=access-rules.d.ts.map

package/dist/sharing/access/access-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-rules.d.ts","sourceRoot":"","sources":["../../../src/sharing/access/access-rules.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,cAAc,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE;QACjB,yBAAyB;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,qBAAqB;QACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,iCAAiC;QACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,mBAAmB;QACnB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;KAC/B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,0GAA0G;IAC1G,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACrC,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,qFAAqF;IACrF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,aAAa;IAC5B,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CAChE;AA8BD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oDAK7B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAI3D;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAE5D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAG3F;AAED,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,yIAAyI;IACzI,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CACtC;AAED,eAAO,MAAM,eAAe,EAAE,WAAqE,CAAC;AAapG;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,oBAAoB,EACxB,OAAO,EAAE,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IACpB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,EAAE,EAAE,oBAAoB,EACxB,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EACnD,OAAO,EAAE,MAAM,GACd,YAAY,CAAC,CAAC,CAAC,CA0BjB"}

package/dist/sharing/access/access-rules.js

@@ -0,0 +1,230 @@
+"use strict";
+// =============================================================================
+// The access-rule registry (PP-14.16): rung 2 of the extension contract
+// =============================================================================
+//
+// An ACCESS RULE is an app's own opinion about who may touch a record, added
+// to `AccessPolicy` without replacing it: "members of the record's project may
+// read it", "nobody may edit a record in a closed period". It joins the
+// decision at a documented place and may only ever ADD an allow or a deny:
+//
+//   THE DECISION ORDER (the order of the offers; the strongest role wins, a tie
+//   goes to the earlier source)
+//
+//     1. unknown resource type or action ........... programming error (500)
+//     2. record missing / in another organization ... deny
+//     3. a required `actionPermissions` entry missing  deny (even for the owner)
+//     4. a held bypass permission .................... allow  (`bypass`) } rules are not
+//     5. the record's USER OWNER ..................... allow  (`owner`)  } consulted (both: `bypass`)
+//     --- from here the caller is subject to the rules ---
+//     6. rules `before-grants`: ANY deny ends it (deny); an allow offers its role
+//     7. group owner, then the strongest ACTIVE, UNEXPIRED grant (user, group, ...)
+//     8. rules `after-grants`: ANY deny ends it (deny); an allow offers its role
+//     9. the type's `defaultVisibility: 'org'` role
+//    10. otherwise deny
+//
+//   A `deny` from any rule wins over every allow of steps 6 to 9. The user
+//   owner and a bypass holder are decided BEFORE the rules, so a faulty rule
+//   cannot lock an owner or an administrator out of their own record. A
+//   group owner is an ordinary source (step 7) and IS subject to a deny.
+//
+// FAIL CLOSED. A rule that throws, rejects, returns anything but `'allow'`,
+// `'deny'` or `'abstain'`, names a role the resource type does not have, or
+// returns `'deny'` without declaring `mayDeny` (its list SQL would not hide the
+// record), counts as a `deny` flagged `ruleFailure`, and the failure is logged
+// with the rule's id and the error's class only (no message, no principal, no
+// record id). A statement that fails inside a rule aborts the shared
+// transaction, so `AccessPolicy` takes a SAVEPOINT per call and rolls back to
+// it after a failing rule.
+//
+// ALLOW CONFERS A ROLE. `role` is the role an allow gives (default: the type's
+// weakest role, so a rule that only opens a record to read cannot, by default,
+// open it to write). The action is allowed when that role reaches the action's
+// minimum, as for a grant. `AccessDecision.via` is the rule's id.
+//
+// THE LIST MUST AGREE. `AccessPolicy` answers "may I open THIS record"; the
+// "resources I can see" helpers answer "WHICH records". A rule therefore
+// provides `sql` (an `allow` and/or a `deny` condition over the record's
+// table) and a rule that can deny (`mayDeny`) must. `describeAccessRuleConformance`
+// compares the two over a fixture matrix and across organizations.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_RULE_OUTCOME = exports.accessRuleRegistry = void 0;
+exports.registerAccessRule = registerAccessRule;
+exports.accessRulesFor = accessRulesFor;
+exports.accessRuleRole = accessRuleRole;
+exports.evaluateAccessRules = evaluateAccessRules;
+exports.collectRuleSql = collectRuleSql;
+const common_1 = require("@nestjs/common");
+const sharing_1 = require("@marinoscar/platform-contract/sharing");
+const index_1 = require("../../core/index");
+/**
+ * The ids no rule may take: `AccessVia` values of the platform's own sources
+ * and the metric labels `none` (a denial) and `app` (a rule or kind). The other
+ * platform vias and every grantee kind's `via` contain an underscore, which a
+ * rule id (hyphenated) never does.
+ */
+const RESERVED_RULE_IDS = ['owner', 'bypass', 'none', 'app'];
+function check(condition, id, why) {
+    if (!condition)
+        throw new Error(`access rule "${id}": ${why}`);
+}
+function validateRule(def) {
+    const id = typeof def?.id === 'string' ? def.id : '?';
+    check(!RESERVED_RULE_IDS.includes(id), id, `"${id}" is reserved for a platform source`);
+    check(def.position === 'before-grants' || def.position === 'after-grants', id, "`position` must be 'before-grants' or 'after-grants'");
+    check(typeof def.evaluate === 'function', id, '`evaluate` must be a function');
+    check(def.sql === undefined || typeof def.sql === 'function', id, '`sql` must be a function');
+    check(def.mayDeny === undefined || typeof def.mayDeny === 'boolean', id, '`mayDeny` must be a boolean');
+    check(def.mayDeny !== true || typeof def.sql === 'function', id, '`mayDeny` needs `sql`: a list must hide what the rule denies');
+    check(def.role === undefined || (typeof def.role === 'string' && def.role.length > 0), id, '`role` must be a role name');
+    check(def.resourceTypes === undefined || (Array.isArray(def.resourceTypes) && def.resourceTypes.every((type) => typeof type === 'string' && type.length > 0)), id, '`resourceTypes` must be an array of resource type ids');
+}
+/**
+ * The access rules, in registration order. String ids, a duplicate-id error,
+ * frozen after bootstrap (the core registry primitive).
+ *
+ * @stability experimental
+ */
+exports.accessRuleRegistry = (0, index_1.defineRegistry)({
+    name: 'sharing-access-rules',
+    idOf: (def) => def.id,
+    idPattern: sharing_1.GRANTEE_KIND_ID_PATTERN,
+    validate: (def) => validateRule(def),
+});
+/**
+ * Registers one access rule. Call it at import time, before the application
+ * bootstraps (an app's `app-registrations` module).
+ *
+ * @param def - the rule (the object is shallow-frozen).
+ * @throws RegistryError `INVALID_ID`, `INVALID_ENTRY` (the message names the
+ *   rule and the problem), `DUPLICATE_ID` or `FROZEN` (after bootstrap).
+ *
+ * @example
+ * ```ts
+ * registerAccessRule(createProjectMemberAccessRule({ resourceType: 'project_document', table: 'project_documents' }));
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerAccessRule(def) {
+    // Shallow-frozen: a registered rule is the app's decision at start-up, not a live object
+    // that code holding a reference can change later (this freezes the object you pass).
+    exports.accessRuleRegistry.register(Object.freeze(def));
+}
+/** The rules that apply to `type`, in registration order. */
+function accessRulesFor(type) {
+    return exports.accessRuleRegistry.list().filter((rule) => rule.resourceTypes === undefined || rule.resourceTypes.includes(type));
+}
+/**
+ * The role an allow of `rule` confers on records of `rt`, or `null` when the
+ * rule names a role the type does not have (a misconfiguration: fail closed).
+ */
+function accessRuleRole(rt, rule) {
+    const role = rule.role ?? rt.roles[0];
+    return rt.rank(role) > 0 ? role : null;
+}
+exports.NO_RULE_OUTCOME = Object.freeze({ denied: false, before: [], after: [] });
+const log = new common_1.Logger('SharingAccessRules');
+/** Logs a rule failure without leaking: the rule id and the error's class, never a message or a record. */
+function logFailure(rule, reason, error) {
+    const name = error instanceof Error ? error.constructor.name : typeof error;
+    try {
+        log.warn(`access rule "${rule.id}" ${reason}${error === undefined ? '' : ` (${name})`}; treating it as a deny`);
+    }
+    catch {
+        // Logging never changes a decision.
+    }
+}
+/**
+ * Evaluates every applicable rule for one record. Fail closed: a throw, a
+ * rejection, an unknown verdict, a misconfigured role or a `deny` from a rule
+ * that did not declare `mayDeny` (its list SQL would not hide the record) is a
+ * deny, flagged `failed`. `context.recover` runs after a rule threw, so a
+ * failed statement of the shared transaction does not poison the next rule.
+ */
+async function evaluateAccessRules(rt, context) {
+    const rules = accessRulesFor(rt.type);
+    if (rules.length === 0)
+        return exports.NO_RULE_OUTCOME;
+    const { recover, ...ruleContext } = context;
+    const failed = { denied: true, failed: true, before: [], after: [] };
+    const before = [];
+    const after = [];
+    for (const rule of rules) {
+        let verdict;
+        try {
+            verdict = await rule.evaluate(ruleContext);
+        }
+        catch (error) {
+            logFailure(rule, 'failed', error);
+            try {
+                await recover?.();
+            }
+            catch {
+                // The transaction is gone; the caller's next statement reports it.
+            }
+            return failed;
+        }
+        if (verdict === 'abstain')
+            continue;
+        if (verdict === 'deny') {
+            if (rule.mayDeny === true)
+                return { denied: true, before: [], after: [] };
+            // A configuration error: the list SQL of a rule that did not declare `mayDeny` does not hide the record.
+            logFailure(rule, 'returned deny without declaring mayDeny');
+            return failed;
+        }
+        if (verdict !== 'allow') {
+            logFailure(rule, 'returned an unknown verdict');
+            return failed;
+        }
+        const role = accessRuleRole(rt, rule);
+        if (role === null) {
+            logFailure(rule, 'confers a role the resource type does not have');
+            return failed;
+        }
+        (rule.position === 'before-grants' ? before : after).push({ role, via: rule.id });
+    }
+    return { denied: false, before, after };
+}
+/**
+ * Collects the SQL of every applicable rule. A rule whose `sql` throws is
+ * failed closed: a rule that can deny hides every record it could deny
+ * (`deny` = TRUE), any other rule contributes nothing.
+ */
+function collectRuleSql(rt, base, minRank) {
+    const parts = { allow: [], deny: [] };
+    for (const rule of accessRulesFor(rt.type)) {
+        if (typeof rule.sql !== 'function')
+            continue;
+        let result;
+        try {
+            result = rule.sql({ ...base, resourceType: rt.type });
+        }
+        catch (error) {
+            logFailure(rule, 'could not build its SQL', error);
+            if (rule.mayDeny)
+                parts.deny.push(base.kit.sql `TRUE`);
+            continue;
+        }
+        if (!result)
+            continue;
+        if (result.deny !== undefined)
+            parts.deny.push(result.deny);
+        if (result.allow !== undefined) {
+            const role = accessRuleRole(rt, rule);
+            if (role === null) {
+                // The in-memory side denies a rule that confers a role the type lacks; the list agrees.
+                logFailure(rule, 'confers a role the resource type does not have');
+                parts.deny.push(base.kit.sql `TRUE`);
+            }
+            else if (rt.rank(role) >= minRank) {
+                parts.allow.push(result.allow);
+            }
+        }
+    }
+    return parts;
+}
+//# sourceMappingURL=access-rules.js.map

package/dist/sharing/access/access-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-rules.js","sourceRoot":"","sources":["../../../src/sharing/access/access-rules.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,2EAA2E;AAC3E,EAAE;AACF,gFAAgF;AAChF,gCAAgC;AAChC,EAAE;AACF,6EAA6E;AAC7E,2DAA2D;AAC3D,iFAAiF;AACjF,yFAAyF;AACzF,sGAAsG;AACtG,2DAA2D;AAC3D,kFAAkF;AAClF,oFAAoF;AACpF,iFAAiF;AACjF,oDAAoD;AACpD,wBAAwB;AACxB,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,oFAAoF;AACpF,mEAAmE;AACnE,gFAAgF;;;AAoMhF,gDAIC;AAGD,wCAEC;AAMD,wCAGC;AAwCD,kDA0CC;AAeD,wCA8BC;AAnVD,2CAAwC;AACxC,mEAAgF;AAEhF,4CAAkE;AAsIlE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEhF,SAAS,KAAK,CAAC,SAAkB,EAAE,EAAU,EAAE,GAAW;IACxD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,MAAM,EAAE,GAAG,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,qCAAqC,CAAC,CAAC;IACxF,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,EAAE,EAAE,sDAAsD,CAAC,CAAC;IACvI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,EAAE,EAAE,+BAA+B,CAAC,CAAC;IAC/E,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAC9F,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACxG,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACjI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACzH,KAAK,CACH,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACvJ,EAAE,EACF,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,kBAAkB,GAAG,IAAA,sBAAc,EAAgB;IAC9D,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE;IACrB,SAAS,EAAE,iCAAuB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,kBAAkB,CAAC,GAAkB;IACnD,yFAAyF;IACzF,qFAAqF;IACrF,0BAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,0BAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,EAAwB,EAAE,IAAmB;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;IACvC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAoBY,QAAA,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACpG,MAAM,GAAG,GAAG,IAAI,eAAM,CAAC,oBAAoB,CAAC,CAAC;AAE7C,2GAA2G;AAC3G,SAAS,UAAU,CAAC,IAAmB,EAAE,MAAc,EAAE,KAAe;IACtE,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;IAC5E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,EAAE,KAAK,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,yBAAyB,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,mBAAmB,CACvC,EAAwB,EACxB,OAA8D;IAE9D,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,uBAAe,CAAC;IAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAClF,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC1E,yGAAyG;YACzG,UAAU,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,CAAC,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAUD;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,EAAwB,EACxB,IAAmD,EACnD,OAAe;IAEf,MAAM,KAAK,GAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU;YAAE,SAAS;QAC7C,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,GAAG,CAAI,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,wFAAwF;gBACxF,UAAU,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/sharing/access/accessible.d.ts

@@ -0,0 +1,197 @@
+import type { AccessScope } from '@marinoscar/platform-contract/sharing';
+import type { Principal } from '../../core/index';
+/**
+ * Above this many shared ids, `accessibleWhere` switches to the EXISTS form
+ * instead of inlining an id list.
+ *
+ * @stability stable
+ */
+export declare const SHARED_IDS_INLINE_LIMIT = 1000;
+/**
+ * The app's raw-SQL builders, structurally: pass the generated `Prisma`
+ * namespace (`Prisma.sql`, `Prisma.join`, `Prisma.raw`, `Prisma.empty`). Every
+ * value goes through `sql` as a bind parameter; `raw` only ever receives
+ * validated identifiers.
+ *
+ * @typeParam S - the app's `Prisma.Sql`.
+ *
+ * @stability stable
+ */
+export interface SqlKit<S> {
+    /** The tagged template (`Prisma.sql`): every interpolation is a bind parameter or a nested fragment. */
+    sql(strings: readonly string[], ...values: unknown[]): S;
+    /** Joins values or fragments with a separator (`Prisma.join`). */
+    join(values: readonly unknown[], separator?: string): S;
+    /** A fragment of literal SQL (`Prisma.raw`); here only for checked identifiers. */
+    raw(text: string): S;
+    /** The empty fragment (`Prisma.empty`). */
+    readonly empty: S;
+}
+/**
+ * The Prisma fields `accessibleWhere` filters on.
+ *
+ * @stability stable
+ */
+export interface AccessibleFieldOptions {
+    /** The owner user field. Default `'ownerUserId'`. */
+    ownerUserField?: string;
+    /** The owner group field. Default `'ownerGroupId'`. */
+    ownerGroupField?: string;
+    /** The record id field. Default `'id'`. */
+    idField?: string;
+    /** The organization field, or `null` to leave the organization to RLS. Default `'orgId'`. */
+    orgField?: string | null;
+    /** Which records. Default `'all'`. */
+    scope?: AccessScope;
+    /** The least role the caller must hold (`'owner'` allowed). Default: any role. */
+    minRole?: string;
+}
+/**
+ * The options of {@link accessibleWhere}.
+ *
+ * @stability stable
+ */
+export interface AccessibleWhereOptions<S = unknown> extends AccessibleFieldOptions {
+    /** The app's transaction client, scoped to the caller's active organization. */
+    tx: unknown;
+    /** The app's `Prisma` namespace, for the EXISTS form above the threshold. */
+    sqlKit: SqlKit<S>;
+    /**
+     * The SQL shape of the table, for the EXISTS form above the threshold:
+     * its alias and columns. Default: alias `r`, columns `owner_user_id`,
+     * `owner_group_id`, `id`, `org_id`.
+     */
+    sql?: {
+        /** The table's alias in the caller's query. Default `r`. */
+        alias?: string;
+    } & AccessibleColumnOptions;
+    /** The threshold. Default {@link SHARED_IDS_INLINE_LIMIT}; lower it in tests only. */
+    inlineLimit?: number;
+}
+/**
+ * The SQL columns `accessibleSql` filters on.
+ *
+ * @stability stable
+ */
+export interface AccessibleColumnOptions {
+    /** The owner user column. Default `'owner_user_id'`. */
+    ownerUserColumn?: string;
+    /** The owner group column. Default `'owner_group_id'`. */
+    ownerGroupColumn?: string;
+    /** The record id column (uuid). Default `'id'`. */
+    idColumn?: string;
+    /** The organization column (uuid), or `null` to leave the organization to RLS. Default `'org_id'`. */
+    orgColumn?: string | null;
+}
+/**
+ * The options of {@link accessibleSql}.
+ *
+ * @stability stable
+ */
+export interface AccessibleSqlOptions<S = unknown> extends AccessibleColumnOptions {
+    /** The app's `Prisma` namespace (`sql`, `join`, `raw`, `empty`). */
+    sqlKit: SqlKit<S>;
+    /** Which records. Default `'all'`. */
+    scope?: AccessScope;
+    /** The least role the caller must hold. Default: any role. */
+    minRole?: string;
+}
+/**
+ * What {@link accessibleWhere} returns: a Prisma `where` fragment, or, when
+ * more than {@link SHARED_IDS_INLINE_LIMIT} records are shared with the
+ * caller, the EXISTS form to run with `$queryRaw` (the same rows).
+ *
+ * @stability stable
+ */
+export type AccessibleWhere<S = unknown> = {
+    /** A Prisma `where` fragment. */
+    readonly form: 'where';
+    /** Pass it to `findMany`/`count` (AND it with your own filters). */
+    readonly where: Record<string, unknown>;
+} | {
+    /** The EXISTS form: too many shared records to inline. */
+    readonly form: 'exists';
+    /** An SQL condition on `alias` for `$queryRaw` (`accessibleSql`): the app's `Prisma.Sql`. */
+    readonly sql: S;
+};
+/**
+ * A Prisma `where` fragment selecting the records of `type` the caller may
+ * see in `opts.scope`: ONE bounded grant query (at most
+ * {@link SHARED_IDS_INLINE_LIMIT} + 1 ids) inside `opts.tx`, none at all when
+ * the scope needs no grant. Above the threshold it switches to the EXISTS
+ * form ({@link accessibleSql}) and returns `{ form: 'exists', sql }`.
+ *
+ * @param principal - the caller, enriched with its groups (`PrincipalGroupsProvider.enrich`).
+ * @param type - a registered resource type.
+ * @param opts - the transaction, the model's fields, the scope and the least role.
+ * @returns `{ form: 'where', where }`, or `{ form: 'exists', sql }` above the threshold.
+ * @throws Error for an unknown type or role.
+ *
+ * @example
+ * ```ts
+ * const me = await principalGroups.enrich(principal);
+ * await prisma.runInOrg(me.activeOrgId!, async (tx) => {
+ *   const access = await accessibleWhere(me, 'transcript', { tx, sqlKit: Prisma, scope: 'shared' });
+ *   if (access.form === 'where') return tx.transcript.findMany({ where: { AND: [access.where, filters] } });
+ *   const ids = await tx.$queryRaw<{ id: string }[]>`
+ *     SELECT r.id FROM transcripts r WHERE ${access.sql} ORDER BY r.created_at DESC LIMIT 50`;
+ *   return tx.transcript.findMany({ where: { id: { in: ids.map((row) => row.id) } } });
+ * });
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability stable
+ */
+export declare function accessibleWhere<S>(principal: Principal, type: string, opts: AccessibleWhereOptions<S>): Promise<AccessibleWhere<S>>;
+/**
+ * An SQL condition on the table aliased `alias` selecting the records of
+ * `type` the caller may see in `opts.scope`, with the grant check as an
+ * `EXISTS (SELECT 1 FROM grants ...)` correlated on the record id. Pure: no
+ * query. Every value is a bind parameter; the alias and the columns must be
+ * plain identifiers. The only sanctioned raw-SQL access path to `grants`.
+ *
+ * @param principal - the caller, enriched with its groups.
+ * @param type - a registered resource type.
+ * @param alias - the table's alias in the caller's query (`r` in `FROM transcripts r`).
+ * @param opts - the columns, the scope and the least role.
+ * @returns the app's `Prisma.Sql` condition, for `$queryRaw`.
+ * @throws Error for an unknown type or role, or a non-identifier alias or column.
+ *
+ * @example
+ * ```ts
+ * const rows = await tx.$queryRaw<{ id: string }[]>`
+ *   SELECT r.id FROM transcripts r
+ *   WHERE ${accessibleSql(me, 'transcript', 'r', { sqlKit: Prisma, scope: 'all' })}
+ *   ORDER BY r.created_at DESC LIMIT ${pageSize} OFFSET ${offset}`;
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability stable
+ */
+export declare function accessibleSql<S>(principal: Principal, type: string, alias: string, opts: AccessibleSqlOptions<S>): S;
+/**
+ * The ids of the records of `type` shared with the caller through an active,
+ * unexpired user or group grant (not ownership, not the org default),
+ * bounded: at most `opts.limit` (default {@link SHARED_IDS_INLINE_LIMIT},
+ * at most 10,000), by id.
+ *
+ * @param principal - the caller, enriched with its groups.
+ * @param type - a registered resource type.
+ * @param opts - the transaction, the least role and the limit.
+ * @returns the record ids.
+ * @throws Error for an unknown type or role.
+ *
+ * @example
+ * ```ts
+ * const ids = await sharedResourceIds(me, 'transcript', { tx, minRole: 'editor', limit: 200 });
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability stable
+ */
+export declare function sharedResourceIds(principal: Principal, type: string, opts: {
+    tx: unknown;
+    minRole?: string;
+    limit?: number;
+}): Promise<string[]>;
+//# sourceMappingURL=accessible.d.ts.map

package/dist/sharing/access/accessible.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessible.d.ts","sourceRoot":"","sources":["../../../src/sharing/access/accessible.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAOlD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,wGAAwG;IACxG,GAAG,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,kEAAkE;IAClE,IAAI,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;IACxD,mFAAmF;IACnF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB;AAQD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,sBAAsB;IACjF,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE;QACJ,4DAA4D;QAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,uBAAuB,CAAC;IAC5B,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,OAAO,CAAE,SAAQ,uBAAuB;IAChF,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClB,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IACnC;IACE,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC,GACD;IACE,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;CACjB,CAAC;AA0GN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAsDzI;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAkDpH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWtJ"}