@nxgt/janus-graphql 0.1.0

package/dist/index.js

@@ -0,0 +1,645 @@
+// src/directives/apply.ts
+import { MapperKind, mapSchema } from "@graphql-tools/utils";
+import { defaultFieldResolver } from "graphql";
+
+// src/memo.ts
+var NOTATION = /[@#]/;
+function keyOf(subject, permission, object, options) {
+  if (subject === null || options?.ctx !== undefined)
+    return null;
+  if (NOTATION.test(object.id) || NOTATION.test(subject.id))
+    return null;
+  const set = typeof subject.relation === "string" ? `#${subject.relation}` : "";
+  return `${object.type}:${object.id}#${permission}@${subject.type}:${subject.id}${set}`;
+}
+function memoized(access) {
+  const can = access.can;
+  const answers = new Map;
+  const ask = async (subject, permission, object, options) => can.call(access, subject, permission, object, options);
+  return (subject, permission, object, options) => {
+    const key = keyOf(subject, permission, object, options);
+    if (key === null)
+      return ask(subject, permission, object, options);
+    const known = answers.get(key);
+    if (known !== undefined)
+      return known;
+    const answer = ask(subject, permission, object, options);
+    answers.set(key, answer);
+    answer.then(undefined, () => answers.delete(key));
+    return answer;
+  };
+}
+
+// src/context.ts
+var checks = new WeakMap;
+function createJanusContext(request, options) {
+  const { auth, access, type } = options;
+  let answer;
+  let asked = false;
+  const authenticated = () => {
+    if (!asked) {
+      asked = true;
+      answer = request === undefined ? Promise.reject(new TypeError("useJanus(): the GraphQL context has no request to authenticate — build the context from an HTTP request")) : auth.authenticate(request, type === undefined ? undefined : { type });
+    }
+    return answer;
+  };
+  const janus = Object.freeze({
+    user: () => authenticated().then((current) => current?.user ?? null),
+    session: () => authenticated().then((current) => current?.session ?? null),
+    ...access === undefined ? {} : { access }
+  });
+  if (access !== undefined) {
+    const can = access.can;
+    checks.set(janus, {
+      memo: memoized(access),
+      fresh: (...args) => can.apply(access, args)
+    });
+  }
+  return janus;
+}
+function checkOf(janus, fresh = false) {
+  const built = checks.get(janus);
+  if (built !== undefined)
+    return fresh ? built.fresh : built.memo;
+  const access = janus.access;
+  return typeof access?.can === "function" ? access.can : null;
+}
+function janusOf(ctx, caller) {
+  const janus = ctx?.janus;
+  if (janus === undefined || typeof janus.user !== "function") {
+    throw new TypeError(`${caller}: ctx.janus is not set — add useJanus({ auth }) to the plugins`);
+  }
+  return janus;
+}
+
+// src/errors.ts
+import { JanusError, statusOf } from "@nxgt/janus";
+import { GraphQLError } from "graphql";
+function denial(code, message) {
+  const [status, fallback] = denialOf(code);
+  return new GraphQLError(message ?? fallback, {
+    extensions: { code, http: { status } }
+  });
+}
+function denialOf(code) {
+  switch (code) {
+    case "UNAUTHENTICATED":
+      return [401, "Not signed in"];
+    case "FORBIDDEN":
+      return [403, "Forbidden"];
+    case "NOT_FOUND":
+      return [404, "Not found"];
+  }
+}
+function janusGraphQLError(error) {
+  const status = statusOf(error.code);
+  const code = error.code === "STORE_FAILED" ? "SERVICE_UNAVAILABLE" : error.code;
+  return new GraphQLError(messageOf(status), {
+    originalError: error,
+    extensions: { code, http: { status }, ...actionable(error) }
+  });
+}
+function messageOf(status) {
+  switch (status) {
+    case 400:
+      return "Invalid request";
+    case 401:
+      return "Invalid credentials";
+    case 403:
+      return "Forbidden";
+    case 404:
+      return "Not found";
+    case 409:
+      return "Conflict";
+    case 503:
+      return "The service is unavailable, retry later";
+    case 500:
+    case 501:
+      return "Internal server error";
+  }
+}
+function actionable(error) {
+  switch (error.code) {
+    case "USER_INVALID":
+      return { issues: error.issues ?? [] };
+    case "PASSWORD_TOO_SHORT":
+      return error.minLength === undefined ? {} : { minLength: error.minLength };
+    case "CODE_INVALID":
+      return error.attemptsLeft === undefined ? {} : { attemptsLeft: error.attemptsLeft };
+    default:
+      return {};
+  }
+}
+function rethrown(error) {
+  throw error instanceof JanusError ? janusGraphQLError(error) : error;
+}
+function janusMaskError(fallback = masked) {
+  return (error, message, isDev) => {
+    const original = error instanceof GraphQLError ? error.originalError : error;
+    if (original instanceof JanusError) {
+      const answer = janusGraphQLError(original);
+      return error instanceof GraphQLError ? new GraphQLError(answer.message, {
+        nodes: error.nodes ?? null,
+        path: error.path ?? null,
+        originalError: original,
+        extensions: answer.extensions
+      }) : answer;
+    }
+    return fallback(error, message, isDev);
+  };
+}
+function masked(error, message) {
+  if (error instanceof GraphQLError) {
+    const original = error.originalError;
+    if (original === undefined || original instanceof GraphQLError) {
+      return error;
+    }
+    return new GraphQLError(message, {
+      nodes: error.nodes ?? null,
+      path: error.path ?? null,
+      extensions: { code: "INTERNAL_SERVER_ERROR" }
+    });
+  }
+  return new GraphQLError(message, {
+    extensions: { code: "INTERNAL_SERVER_ERROR" }
+  });
+}
+
+// src/directives/permission/path.ts
+var NAME = /^[_A-Za-z][_0-9A-Za-z]*$/;
+function parsePath(text) {
+  const [root, ...segments] = text.split(".");
+  if (root !== "args" && root !== "parent")
+    return null;
+  if (segments.length === 0 || !segments.every((name) => NAME.test(name))) {
+    return null;
+  }
+  return { text, root, segments };
+}
+function targetsOf(path, parent, args) {
+  const containers = walk([path.root === "args" ? args : parent], path.segments.slice(0, -1));
+  if (containers === null)
+    return null;
+  const last = path.segments[path.segments.length - 1];
+  const held = path.root === "parent" && last === "id";
+  const targets = [];
+  for (const container of containers) {
+    for (const value of spread(container[last])) {
+      const id = idOf(value);
+      if (id === null)
+        return null;
+      targets.push({ id, holder: held ? container : null });
+    }
+  }
+  return path.root === "parent" && targets.length === 0 ? null : targets;
+}
+function walk(values, segments) {
+  let current = values;
+  for (const segment of segments) {
+    const next = [];
+    for (const value of current) {
+      if (typeof value !== "object" || value === null)
+        return null;
+      next.push(...spread(value[segment]));
+    }
+    current = next;
+  }
+  return current.every((value) => typeof value === "object" && value !== null) ? current : null;
+}
+function spread(value) {
+  return Array.isArray(value) ? value.flat(Number.POSITIVE_INFINITY) : [value];
+}
+function idOf(value) {
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) {
+    return String(value);
+  }
+  return null;
+}
+
+// src/directives/permission/enforce.ts
+async function enforcePermission(permission, asking) {
+  const targets = targetsOf(permission.path, asking.parent, asking.args);
+  if (targets === null) {
+    warnNoId(permission);
+    throw denial("NOT_FOUND");
+  }
+  const objects = await Promise.all(targets.map((target) => objectOf(permission, target, asking.ctx))).then(undefined, rethrown);
+  const found = objects.filter((object) => object !== null);
+  if (found.length < objects.length)
+    throw denial("NOT_FOUND");
+  const answers = await Promise.all(found.map((object) => ask(permission, object, asking))).then(undefined, rethrown);
+  if (answers.includes(false))
+    throw denial(permission.onDeny);
+}
+async function ask(permission, object, { check, user, ctx }) {
+  const options = permission.condition === null ? undefined : { ctx: await permission.condition(object, ctx) };
+  return check(user, permission.name, object, options);
+}
+var UNNAMEABLE = /^$|[@#()]/;
+var isNameable = (id) => !UNNAMEABLE.test(id) && !id.includes("\x00") && id.isWellFormed();
+async function objectOf(permission, { id, holder }, ctx) {
+  const { type, load } = permission;
+  if (!isNameable(id))
+    return null;
+  if (holder !== null)
+    return view(holder, type, id);
+  if (load === null)
+    return { type, id };
+  const loaded = await load(id, ctx);
+  if (loaded === null)
+    return null;
+  if (typeof loaded !== "object") {
+    throw new TypeError(`${permission.label}: loaders.${type} answered ${typeof loaded} — answer the object, or null when there is none`);
+  }
+  return view(loaded, type, id);
+}
+function view(object, type, id) {
+  return new Proxy(Object.create(null), {
+    get: (_, key) => key === "type" ? type : key === "id" ? id : Reflect.get(object, key),
+    has: (_, key) => key === "type" || Reflect.has(object, key)
+  });
+}
+var warned = new WeakSet;
+function warnNoId(permission) {
+  if (warned.has(permission))
+    return;
+  warned.add(permission);
+  process.emitWarning(`${permission.label} resolved no object id from ${permission.path.text} — answered NOT_FOUND`, { code: "JANUS_GRAPHQL_NO_OBJECT_ID" });
+}
+
+// src/directives/guard.ts
+async function enforce(requirement, { parent, args, ctx, fresh }) {
+  const janus = janusOf(ctx, requirement.label);
+  const user = await janus.user().then(undefined, rethrown);
+  if (user === null)
+    throw denial("UNAUTHENTICATED");
+  if (requirement.types !== null && !requirement.types.has(user.type)) {
+    throw denial("FORBIDDEN");
+  }
+  const [first] = requirement.permissions;
+  if (first === undefined)
+    return;
+  const check = checkOf(janus, fresh);
+  if (check === null) {
+    throw new TypeError(`${first.label}: ctx.janus.access is not set — pass { access } to useJanus()`);
+  }
+  for (const permission of requirement.permissions) {
+    await enforcePermission(permission, { check, user, parent, args, ctx });
+  }
+}
+function guarded(resolve, requirement) {
+  return async (source, args, ctx, info) => {
+    await enforce(requirement, {
+      parent: source,
+      args,
+      ctx,
+      fresh: info.operation.operation === "subscription"
+    });
+    return resolve(source, args, ctx, info);
+  };
+}
+
+// src/directives/read.ts
+import { getDirective } from "@graphql-tools/utils";
+function locations(schema, field, fieldName, typeName) {
+  const type = schema.getType(typeName);
+  const faces = type.getInterfaces();
+  const fields = [];
+  for (const face of faces) {
+    const own = face.getFields()[fieldName];
+    if (own !== undefined) {
+      fields.push({
+        where: `${face.name}.${fieldName}`,
+        onType: false,
+        node: own
+      });
+    }
+  }
+  return [
+    ...faces.map((face) => ({ where: face.name, onType: true, node: face })),
+    { where: typeName, onType: true, node: type },
+    ...fields,
+    { where: `${typeName}.${fieldName}`, onType: false, node: field }
+  ];
+}
+function readField(schema, field, fieldName, typeName) {
+  const authenticated = [];
+  const permission = [];
+  for (const { where, onType, node } of locations(schema, field, fieldName, typeName)) {
+    for (const args of getDirective(schema, node, "authenticated") ?? []) {
+      const types = args.type;
+      authenticated.push({ where, types: types ?? null });
+    }
+    for (const args of getDirective(schema, node, "permission") ?? []) {
+      permission.push({
+        where,
+        onType,
+        name: args.name,
+        type: args.type,
+        id: args.id ?? null,
+        onDeny: args.onDeny === "FORBIDDEN" ? "FORBIDDEN" : "NOT_FOUND"
+      });
+    }
+  }
+  return { authenticated, permission };
+}
+
+// src/directives/words.ts
+var PREFIX = "applyJanusDirectives()";
+function on(where, field) {
+  return where === field ? field : `${where} (read by ${field})`;
+}
+function list(names) {
+  return names.map((name) => `'${name}'`).join(", ");
+}
+
+// src/directives/permission/model.ts
+function modelOf(access) {
+  const model = access?.model;
+  if (!Array.isArray(model?.types) || model.definition?.types === undefined) {
+    return null;
+  }
+  return model;
+}
+function namesOf(model, type) {
+  const def = model.definition.types[type];
+  return [
+    ...Object.keys(def?.related ?? {}),
+    ...Object.keys(def?.permits ?? {})
+  ];
+}
+function isFromField(value) {
+  return value?.kind === "fromField";
+}
+function fieldsOf(model, type) {
+  const related = model.definition.types[type]?.related ?? {};
+  return Object.values(related).filter(isFromField).map((def) => def.field);
+}
+function reachesCondition(model, type, name, seen = new Set) {
+  const key = `${type}.${name}`;
+  if (seen.has(key))
+    return false;
+  seen.add(key);
+  const def = model.definition.types[type];
+  for (const rule of def?.permits?.[name] ?? []) {
+    if (typeof rule !== "string")
+      return true;
+    const [relation, target] = rule.split("->");
+    if (target === undefined) {
+      if (reachesCondition(model, type, rule, seen))
+        return true;
+      continue;
+    }
+    for (const next of arrowTargets(def?.related?.[relation])) {
+      if (reachesCondition(model, next, target, seen))
+        return true;
+    }
+  }
+  return false;
+}
+function arrowTargets(relation) {
+  if (isFromField(relation)) {
+    return [relation.subject];
+  }
+  if (!Array.isArray(relation))
+    return [];
+  return relation.filter((holder) => typeof holder === "string").map((holder) => holder.split("#")[0]);
+}
+
+// src/directives/permission/validate.ts
+function permissionCheckOf(use, field, wiring) {
+  const label = `@permission on ${on(use.where, field.name)}`;
+  const refuse = (why) => new TypeError(`${PREFIX}: ${label} ${why}`);
+  const model = modelOf(wiring.access);
+  if (model === null) {
+    throw refuse("needs the permissions() instance — pass useJanus({ auth, access }), with access what permissions() answered");
+  }
+  checkNames(model, use, refuse);
+  const text = use.id ?? (use.onType ? "parent.id" : "args.id");
+  const path = parsePath(text);
+  if (path === null) {
+    throw refuse(`reads its id from '${text}', which is not args.<name> or parent.<name>`);
+  }
+  const [first] = path.segments;
+  if (path.root === "args" && !field.args.includes(first)) {
+    throw refuse(`reads ${path.root}.${first}, and ${field.name} takes no argument ${first}${use.id === null && use.onType === false ? ' — name the id with id: "parent.<field>" or id: "args.<name>"' : ""}`);
+  }
+  return {
+    label,
+    name: use.name,
+    type: use.type,
+    onDeny: use.onDeny,
+    path,
+    load: loaderOf(model, use.type, path, wiring, refuse),
+    condition: conditionOf(model, use, wiring, refuse)
+  };
+}
+function checkNames(model, use, refuse) {
+  if (!model.types.includes(use.type)) {
+    throw refuse(`names the object type '${use.type}', which is not one of ${list(model.types)}`);
+  }
+  const names = namesOf(model, use.type);
+  if (!names.includes(use.name)) {
+    throw refuse(`asks '${use.name}', which ${use.type} does not declare — it declares ${list(names)}`);
+  }
+}
+function loaderOf(model, type, path, wiring, refuse) {
+  const load = wiring.loaders?.[type];
+  if (load !== undefined && typeof load !== "function") {
+    throw refuse(`finds loaders.${type}, which is not a function`);
+  }
+  const held = path.root === "parent" && path.segments.at(-1) === "id";
+  if (held)
+    return null;
+  if (load !== undefined)
+    return load;
+  const fields = fieldsOf(model, type);
+  if (fields.length > 0) {
+    throw refuse(`reads the ${type}'s id from ${path.text}, and ${type} reads ${list(fields)} of the object itself (fromField) — pass useJanus({ loaders: { ${type}: (id, ctx) => … } })`);
+  }
+  return null;
+}
+function conditionOf(model, use, wiring, refuse) {
+  if (!reachesCondition(model, use.type, use.name))
+    return null;
+  const condition = wiring.conditions?.[use.type];
+  if (typeof condition !== "function") {
+    throw refuse(`asks '${use.name}' of ${use.type}, which reaches a when() — pass useJanus({ conditions: { ${use.type}: (object, ctx) => … } })`);
+  }
+  return condition;
+}
+
+// src/directives/validate.ts
+function requirementOf(field, directives, known, wiring) {
+  const { authenticated, permission } = directives;
+  if (authenticated.length === 0 && permission.length === 0)
+    return null;
+  const [first] = authenticated.length > 0 ? authenticated : permission;
+  const name = authenticated.length > 0 ? "@authenticated" : "@permission";
+  return {
+    where: field.name,
+    label: `${name} on ${on(first?.where ?? field.name, field.name)}`,
+    types: typesOf(field.name, authenticated, known),
+    permissions: permission.map((use) => permissionCheckOf(use, field, wiring))
+  };
+}
+function typesOf(field, uses, known) {
+  let types = null;
+  for (const { where, types: named } of uses) {
+    if (named === null)
+      continue;
+    if (named.length === 0) {
+      throw new TypeError(`${PREFIX}: @authenticated on ${on(where, field)} names no user type — leave type: out to admit any signed-in user`);
+    }
+    for (const name of named) {
+      if (!known.types.includes(name)) {
+        throw new TypeError(`${PREFIX}: @authenticated on ${on(where, field)} names the user type '${name}', which is not one of ${list(known.types)}`);
+      }
+    }
+    types = types === null ? new Set(named) : new Set(named.filter((name) => types?.has(name)));
+  }
+  if (types !== null && types.size === 0) {
+    throw new TypeError(`${PREFIX}: the @authenticated on ${field} and on its type or interfaces admit no user type in common`);
+  }
+  return types;
+}
+
+// src/directives/apply.ts
+function applyJanusDirectives(schema, options) {
+  const known = knownOf(options);
+  return mapSchema(schema, {
+    [MapperKind.OBJECT_FIELD]: (field, fieldName, typeName) => {
+      const requirement = requirementOf({
+        name: `${typeName}.${fieldName}`,
+        args: Object.keys(field.args ?? {})
+      }, readField(schema, field, fieldName, typeName), known, options);
+      if (requirement === null)
+        return field;
+      return {
+        ...field,
+        resolve: guarded(field.resolve ?? defaultFieldResolver, requirement),
+        ...field.subscribe === undefined ? {} : { subscribe: guarded(field.subscribe, requirement) }
+      };
+    }
+  });
+}
+function knownOf({ auth, type }) {
+  if (type === undefined)
+    return { types: auth.types };
+  if (!auth.types.includes(type)) {
+    throw new TypeError(`${PREFIX}: type '${type}' is not a user type of auth — it knows ${list(auth.types)}`);
+  }
+  return { types: [type] };
+}
+// src/helpers.ts
+async function requireUser(ctx, options = {}) {
+  const { type } = options;
+  const allowed = typeof type === "string" ? [type] : type;
+  if (allowed?.length === 0) {
+    throw new TypeError("requireUser(): type is an empty list, which no user could pass — name at least one user type, or leave type out");
+  }
+  const user = await janusOf(ctx, "requireUser()").user().then(undefined, rethrown);
+  if (user === null)
+    throw denial("UNAUTHENTICATED");
+  if (allowed !== undefined && !allowed.includes(user.type)) {
+    throw denial("FORBIDDEN");
+  }
+  return user;
+}
+async function can(ctx, permission, object, ...options) {
+  const janus = janusOf(ctx, "can()");
+  const check = checkOf(janus);
+  if (check === null) {
+    throw new TypeError("can(): ctx.janus.access is not set — pass { access } to useJanus()");
+  }
+  const subject = await janus.user().then(undefined, rethrown);
+  return check(subject, permission, object, options[0]).then(undefined, rethrown);
+}
+// src/plugin.ts
+function useJanus(options) {
+  const { auth, access, type, loaders, conditions } = options;
+  if (typeof auth?.authenticate !== "function") {
+    throw new TypeError("useJanus(): auth is not what janus() answered — pass { auth }");
+  }
+  if (access !== undefined && typeof access?.can !== "function") {
+    throw new TypeError("useJanus(): access is not what permissions() answered — pass { auth, access }");
+  }
+  const applied = new WeakSet;
+  return {
+    onContextBuilding: ({ context, extendContext }) => {
+      const { request } = context;
+      const janus = createJanusContext(request, {
+        auth,
+        access,
+        type
+      });
+      extendContext({ janus });
+    },
+    onSchemaChange: ({ schema, replaceSchema }) => {
+      if (applied.has(schema))
+        return;
+      const next = applyJanusDirectives(schema, {
+        auth,
+        ...type === undefined ? {} : { type },
+        access,
+        loaders,
+        conditions
+      });
+      applied.add(next);
+      replaceSchema(next);
+    }
+  };
+}
+// src/sdl.ts
+var janusTypeDefs = `"""
+Only a signed-in user reaches this field, or every field of this type or
+interface. With \`type\`, only a user of one of these user types: any other is
+answered FORBIDDEN.
+"""
+directive @authenticated(
+	type: [String!]
+) on OBJECT | INTERFACE | FIELD_DEFINITION
+
+"""
+What a denied \`@permission\` answers.
+"""
+enum JanusPermissionDenial {
+	"""
+	404: the object is not told to exist. The default.
+	"""
+	NOT_FOUND
+	"""
+	403: the object exists, and this user may not do this to it.
+	"""
+	FORBIDDEN
+}
+
+"""
+Only a user holding permission \`name\` on the object of \`type\` whose id \`id\`
+reads reaches this field, or every field of this type or interface. \`id\` is
+\`args.<path>\` or \`parent.<path>\`: \`args.id\` on a field and \`parent.id\` on a
+type or an interface when absent. A list of ids requires the permission on
+every one. Repeated, every one must hold, in the order written.
+"""
+directive @permission(
+	name: String!
+	type: String!
+	id: String
+	onDeny: JanusPermissionDenial! = NOT_FOUND
+) repeatable on OBJECT | INTERFACE | FIELD_DEFINITION
+`;
+export {
+  applyJanusDirectives,
+  can,
+  denial,
+  janusGraphQLError,
+  janusMaskError,
+  janusTypeDefs,
+  requireUser,
+  useJanus
+};
+
+//# debugId=D0DEC0D35AFB92A464756E2164756E21
+//# sourceMappingURL=index.js.map