@o3co/create-auth-policy-verifier 0.11.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-policy-verifier",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Scaffold a new o3co/auth.policy-verifier project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",

package/templates/standalone/README.ja.md

@@ -50,6 +50,7 @@ OAUTH_JWT_SECRET=$(openssl rand -hex 32) \
 | `RULE_ON_EMPTY_RULE_SET` | `deny` | ルールが 1 つも集まらなかったときの決定（`deny` \| `allow`） |
 | `VERIFY_MAX_BATCH_SIZE` | `50` | `POST /verify/batch` の件数上限 |
 | `VERIFY_CREDENTIAL_TO_COLLECTORS` | `never` | `expose` は生の資格情報を `context.credential` として collector に渡す — subject として下流 API を呼ぶ collector のためだけの設定。既定では collector は検証済みクレームだけを扱う。資格情報はリプレイ可能であり、context がログに出ればそれが漏れる |
+| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` にすると、policy を背後に持つ各 Rule の `evaluation`（status と、評価した policy revision。#244）を決定の response に載せる。どの revision が操作を許可したかを記録する呼び出し側サービス向け。`decision` ログイベントにはどちらの設定でも載る。受理される token の保持者全員に「policy set がいつ変わったか」を伝えることになるので、それが問題になる環境では `HTTP_CALLER_AUTH_TOKEN` と併用する |
 | `LOG_LEVEL` | `info` | 出力する最低レベル: `trace`\|`debug`\|`info`\|`warn`\|`error`\|`fatal`\|`silent`。decision ログのスイッチも兼ねる — [可観測性](#可観測性)を参照 |
 
 ## HS256 シークレットの強度

package/templates/standalone/README.md

@@ -50,6 +50,7 @@ Individual values can also be overridden with environment variables.
 | `RULE_ON_EMPTY_RULE_SET` | `deny` | Decision when no rule is collected (`deny` \| `allow`) |
 | `VERIFY_MAX_BATCH_SIZE` | `50` | Cap on `POST /verify/batch` entries |
 | `VERIFY_CREDENTIAL_TO_COLLECTORS` | `never` | `expose` hands collectors the raw credential as `context.credential` — only for a collector that calls a downstream API as the subject. The default keeps collectors on verified claims; the credential is replayable and a logged context would leak it |
+| `VERIFY_EVALUATION_IN_RESPONSE` | `omit` | `include` puts each policy-backed rule's `evaluation` — its status and the policy revision it evaluated (#244) — on the decision response, for a calling service that records which revision authorized an operation. The `decision` log event carries it either way. It tells any holder of an accepted token when the policy set changed, so pair it with `HTTP_CALLER_AUTH_TOKEN` where that matters |
 | `LOG_LEVEL` | `info` | Minimum level emitted: `trace`\|`debug`\|`info`\|`warn`\|`error`\|`fatal`\|`silent`. Also the switch for the decision log — see [Observability](#observability) |
 
 ## HS256 secret strength

package/templates/standalone/config/application.conf

@@ -369,4 +369,15 @@ verify {
   # then the greppable record of that decision. Never log the field.
   credentialToCollectors = "never"
   credentialToCollectors = ${?VERIFY_CREDENTIAL_TO_COLLECTORS}
+
+  # Whether a decision RESPONSE carries what each policy-backed rule reported
+  # about the evaluation behind its answer — its status, and the policy revision
+  # it evaluated (#244). The `decision` log event always carries it; this is
+  # only about the wire. "omit" (the default): the response is key-for-key what
+  # it was. Set "include" when the calling service records which policy
+  # revision authorized an operation. It tells any holder of an accepted token
+  # when the policy set changed and whether a denial was a policy's or the
+  # engine failing, so pair it with `http.callerAuth` where that matters.
+  evaluationInResponse = "omit"
+  evaluationInResponse = ${?VERIFY_EVALUATION_IN_RESPONSE}
 }

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-policy-verifier-standalone",
-	"version": "0.11.0",
+	"version": "0.12.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"packageManager": "pnpm@10.29.3",

package/templates/standalone/src/__tests__/loadConfig.test.mts

@@ -389,7 +389,7 @@ rule { collectors = [ { collector = ResourceActionScopeRuleCollector } ] }
 
 		const config = loadAppConfig(withoutVerify(), "development");
 
-		// All twelve, spelled out. A knob that reached the shape but not the
+		// Every one, spelled out. A knob that reached the shape but not the
 		// block's `.default()` literal is `undefined` here, and `toEqual` says
 		// which one.
 		expect(config.verify).toEqual({
@@ -406,6 +406,7 @@ rule { collectors = [ { collector = ResourceActionScopeRuleCollector } ] }
 			collectorConcurrency: 8,
 			batchConcurrency: 8,
 			credentialToCollectors: "never",
+			evaluationInResponse: "omit",
 		});
 	});
 

package/templates/versions.json

@@ -1,5 +1,5 @@
 {
-	"@o3co/auth.policy-verifier.core": "0.11.0",
-	"@o3co/auth.policy-verifier.builtins": "0.11.0",
-	"@o3co/auth.policy-verifier.server": "0.11.0"
+	"@o3co/auth.policy-verifier.core": "0.12.0",
+	"@o3co/auth.policy-verifier.builtins": "0.12.0",
+	"@o3co/auth.policy-verifier.server": "0.12.0"
 }