@objectstack/core 1.0.4 → 1.0.5

package/dist/qa/runner.js

@@ -1,157 +0,0 @@
-export class TestRunner {
-    constructor(adapter) {
-        this.adapter = adapter;
-    }
-    async runSuite(suite) {
-        const results = [];
-        for (const scenario of suite.scenarios) {
-            results.push(await this.runScenario(scenario));
-        }
-        return results;
-    }
-    async runScenario(scenario) {
-        const startTime = Date.now();
-        const context = {}; // Variable context
-        // Initialize context from initial payload if needed? Currently schema doesn't have initial context prop on Scenario
-        // But we defined TestContextSchema separately.
-        // Setup
-        if (scenario.setup) {
-            for (const step of scenario.setup) {
-                try {
-                    await this.runStep(step, context);
-                }
-                catch (e) {
-                    return {
-                        scenarioId: scenario.id,
-                        passed: false,
-                        steps: [],
-                        error: `Setup failed: ${e instanceof Error ? e.message : String(e)}`,
-                        duration: Date.now() - startTime
-                    };
-                }
-            }
-        }
-        const stepResults = [];
-        let scenarioPassed = true;
-        let scenarioError = undefined;
-        // Main Steps
-        for (const step of scenario.steps) {
-            const stepStartTime = Date.now();
-            try {
-                const output = await this.runStep(step, context);
-                stepResults.push({
-                    stepName: step.name,
-                    passed: true,
-                    output,
-                    duration: Date.now() - stepStartTime
-                });
-            }
-            catch (e) {
-                scenarioPassed = false;
-                scenarioError = e;
-                stepResults.push({
-                    stepName: step.name,
-                    passed: false,
-                    error: e,
-                    duration: Date.now() - stepStartTime
-                });
-                break; // Stop on first failure
-            }
-        }
-        // Teardown (run even if failed)
-        if (scenario.teardown) {
-            for (const step of scenario.teardown) {
-                try {
-                    await this.runStep(step, context);
-                }
-                catch (e) {
-                    // Log teardown failure but don't override main failure if it exists
-                    if (scenarioPassed) {
-                        scenarioPassed = false;
-                        scenarioError = `Teardown failed: ${e instanceof Error ? e.message : String(e)}`;
-                    }
-                }
-            }
-        }
-        return {
-            scenarioId: scenario.id,
-            passed: scenarioPassed,
-            steps: stepResults,
-            error: scenarioError,
-            duration: Date.now() - startTime
-        };
-    }
-    async runStep(step, context) {
-        // 1. Resolve Variables with Context (Simple interpolation or just pass context?)
-        // For now, assume adpater handles context resolution or we do basic replacement
-        const resolvedAction = this.resolveVariables(step.action, context);
-        // 2. Execute Action
-        const result = await this.adapter.execute(resolvedAction, context);
-        // 3. Capture Outputs
-        if (step.capture) {
-            for (const [varName, path] of Object.entries(step.capture)) {
-                context[varName] = this.getValueByPath(result, path);
-            }
-        }
-        // 4. Run Assertions
-        if (step.assertions) {
-            for (const assertion of step.assertions) {
-                this.assert(result, assertion, context);
-            }
-        }
-        return result;
-    }
-    resolveVariables(action, _context) {
-        // TODO: Implement JSON path variable substitution stringify/parse
-        // For now returning as is
-        return action;
-    }
-    getValueByPath(obj, path) {
-        if (!path)
-            return obj;
-        const parts = path.split('.');
-        let current = obj;
-        for (const part of parts) {
-            if (current === null || current === undefined)
-                return undefined;
-            current = current[part];
-        }
-        return current;
-    }
-    assert(result, assertion, _context) {
-        const actual = this.getValueByPath(result, assertion.field);
-        // Resolve expected value if it's a variable ref? 
-        const expected = assertion.expectedValue; // Simplify for now
-        switch (assertion.operator) {
-            case 'equals':
-                if (actual !== expected)
-                    throw new Error(`Assertion failed: ${assertion.field} expected ${expected}, got ${actual}`);
-                break;
-            case 'not_equals':
-                if (actual === expected)
-                    throw new Error(`Assertion failed: ${assertion.field} expected not ${expected}, got ${actual}`);
-                break;
-            case 'contains':
-                if (Array.isArray(actual)) {
-                    if (!actual.includes(expected))
-                        throw new Error(`Assertion failed: ${assertion.field} array does not contain ${expected}`);
-                }
-                else if (typeof actual === 'string') {
-                    if (!actual.includes(String(expected)))
-                        throw new Error(`Assertion failed: ${assertion.field} string does not contain ${expected}`);
-                }
-                break;
-            case 'not_null':
-                if (actual === null || actual === undefined)
-                    throw new Error(`Assertion failed: ${assertion.field} is null`);
-                break;
-            case 'is_null':
-                if (actual !== null && actual !== undefined)
-                    throw new Error(`Assertion failed: ${assertion.field} is not null`);
-                break;
-            // ... Add other operators
-            default:
-                throw new Error(`Unknown assertion operator: ${assertion.operator}`);
-        }
-    }
-}

package/dist/security/index.d.ts

@@ -1,17 +0,0 @@
-/**
- * Security Module
- *
- * Provides security features for the ObjectStack microkernel:
- * - Plugin signature verification
- * - Plugin configuration validation
- * - Permission and capability enforcement
- *
- * @module @objectstack/core/security
- */
-export { PluginSignatureVerifier, type PluginSignatureConfig, type SignatureVerificationResult, } from './plugin-signature-verifier.js';
-export { PluginConfigValidator, createPluginConfigValidator, } from './plugin-config-validator.js';
-export { PluginPermissionEnforcer, SecurePluginContext, createPluginPermissionEnforcer, type PluginPermissions, type PermissionCheckResult, } from './plugin-permission-enforcer.js';
-export { PluginPermissionManager, type PermissionGrant, type PermissionCheckResult as PluginPermissionCheckResult, } from './permission-manager.js';
-export { PluginSandboxRuntime, type SandboxContext, type ResourceUsage, } from './sandbox-runtime.js';
-export { PluginSecurityScanner, type ScanTarget, type SecurityIssue, } from './security-scanner.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,IAAI,2BAA2B,GAC1D,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC"}

package/dist/security/index.js

@@ -1,17 +0,0 @@
-/**
- * Security Module
- *
- * Provides security features for the ObjectStack microkernel:
- * - Plugin signature verification
- * - Plugin configuration validation
- * - Permission and capability enforcement
- *
- * @module @objectstack/core/security
- */
-export { PluginSignatureVerifier, } from './plugin-signature-verifier.js';
-export { PluginConfigValidator, createPluginConfigValidator, } from './plugin-config-validator.js';
-export { PluginPermissionEnforcer, SecurePluginContext, createPluginPermissionEnforcer, } from './plugin-permission-enforcer.js';
-// Advanced security components (Phase 2)
-export { PluginPermissionManager, } from './permission-manager.js';
-export { PluginSandboxRuntime, } from './sandbox-runtime.js';
-export { PluginSecurityScanner, } from './security-scanner.js';

package/dist/security/permission-manager.d.ts

@@ -1,96 +0,0 @@
-import type { Permission, PermissionSet, PermissionAction, ResourceType } from '@objectstack/spec/kernel';
-import type { ObjectLogger } from '../logger.js';
-/**
- * Permission Grant
- * Represents a granted permission at runtime
- */
-export interface PermissionGrant {
-    permissionId: string;
-    pluginId: string;
-    grantedAt: Date;
-    grantedBy?: string;
-    expiresAt?: Date;
-    conditions?: Record<string, any>;
-}
-/**
- * Permission Check Result
- */
-export interface PermissionCheckResult {
-    allowed: boolean;
-    reason?: string;
-    requiredPermission?: string;
-    grantedPermissions?: string[];
-}
-/**
- * Plugin Permission Manager
- *
- * Manages fine-grained permissions for plugin security and access control
- */
-export declare class PluginPermissionManager {
-    private logger;
-    private permissionSets;
-    private grants;
-    private grantDetails;
-    constructor(logger: ObjectLogger);
-    /**
-     * Register permission requirements for a plugin
-     */
-    registerPermissions(pluginId: string, permissionSet: PermissionSet): void;
-    /**
-     * Grant a permission to a plugin
-     */
-    grantPermission(pluginId: string, permissionId: string, grantedBy?: string, expiresAt?: Date): void;
-    /**
-     * Revoke a permission from a plugin
-     */
-    revokePermission(pluginId: string, permissionId: string): void;
-    /**
-     * Grant all permissions for a plugin
-     */
-    grantAllPermissions(pluginId: string, grantedBy?: string): void;
-    /**
-     * Check if a plugin has a specific permission
-     */
-    hasPermission(pluginId: string, permissionId: string): boolean;
-    /**
-     * Check if plugin can perform an action on a resource
-     */
-    checkAccess(pluginId: string, resource: ResourceType, action: PermissionAction, resourceId?: string): PermissionCheckResult;
-    /**
-     * Get all permissions for a plugin
-     */
-    getPluginPermissions(pluginId: string): Permission[];
-    /**
-     * Get granted permissions for a plugin
-     */
-    getGrantedPermissions(pluginId: string): string[];
-    /**
-     * Get required but not granted permissions
-     */
-    getMissingPermissions(pluginId: string): Permission[];
-    /**
-     * Check if all required permissions are granted
-     */
-    hasAllRequiredPermissions(pluginId: string): boolean;
-    /**
-     * Get permission grant details
-     */
-    getGrantDetails(pluginId: string, permissionId: string): PermissionGrant | undefined;
-    /**
-     * Validate permission against scope constraints
-     */
-    validatePermissionScope(permission: Permission, context: {
-        tenantId?: string;
-        userId?: string;
-        resourceId?: string;
-    }): boolean;
-    /**
-     * Clear all permissions for a plugin
-     */
-    clearPluginPermissions(pluginId: string): void;
-    /**
-     * Shutdown permission manager
-     */
-    shutdown(): void;
-}
-//# sourceMappingURL=permission-manager.d.ts.map

package/dist/security/permission-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-manager.d.ts","sourceRoot":"","sources":["../../src/security/permission-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;GAIG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAAe;IAG7B,OAAO,CAAC,cAAc,CAAoC;IAG1D,OAAO,CAAC,MAAM,CAAkC;IAGhD,OAAO,CAAC,YAAY,CAAsC;gBAE9C,MAAM,EAAE,YAAY;IAIhC;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,IAAI;IASzE;;OAEG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,IAAI,GACf,IAAI;IAmCP;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAY9D;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAa/D;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAsB9D;;OAEG;IACH,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,gBAAgB,EACxB,UAAU,CAAC,EAAE,MAAM,GAClB,qBAAqB;IAyDxB;;OAEG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE;IAKpD;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAKjD;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE;IAarD;;OAEG;IACH,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpD;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAKpF;;OAEG;IACH,uBAAuB,CACrB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO;IAsBV;;OAEG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAe9C;;OAEG;IACH,QAAQ,IAAI,IAAI;CAOjB"}

package/dist/security/permission-manager.js

@@ -1,235 +0,0 @@
-/**
- * Plugin Permission Manager
- *
- * Manages fine-grained permissions for plugin security and access control
- */
-export class PluginPermissionManager {
-    constructor(logger) {
-        // Plugin permission definitions
-        this.permissionSets = new Map();
-        // Granted permissions (pluginId -> Set of permission IDs)
-        this.grants = new Map();
-        // Permission grant details
-        this.grantDetails = new Map();
-        this.logger = logger.child({ component: 'PermissionManager' });
-    }
-    /**
-     * Register permission requirements for a plugin
-     */
-    registerPermissions(pluginId, permissionSet) {
-        this.permissionSets.set(pluginId, permissionSet);
-        this.logger.info('Permissions registered for plugin', {
-            pluginId,
-            permissionCount: permissionSet.permissions.length
-        });
-    }
-    /**
-     * Grant a permission to a plugin
-     */
-    grantPermission(pluginId, permissionId, grantedBy, expiresAt) {
-        // Verify permission exists in plugin's declared permissions
-        const permissionSet = this.permissionSets.get(pluginId);
-        if (!permissionSet) {
-            throw new Error(`No permissions registered for plugin: ${pluginId}`);
-        }
-        const permission = permissionSet.permissions.find(p => p.id === permissionId);
-        if (!permission) {
-            throw new Error(`Permission ${permissionId} not declared by plugin ${pluginId}`);
-        }
-        // Create grant
-        if (!this.grants.has(pluginId)) {
-            this.grants.set(pluginId, new Set());
-        }
-        this.grants.get(pluginId).add(permissionId);
-        // Store grant details
-        const grantKey = `${pluginId}:${permissionId}`;
-        this.grantDetails.set(grantKey, {
-            permissionId,
-            pluginId,
-            grantedAt: new Date(),
-            grantedBy,
-            expiresAt,
-        });
-        this.logger.info('Permission granted', {
-            pluginId,
-            permissionId,
-            grantedBy
-        });
-    }
-    /**
-     * Revoke a permission from a plugin
-     */
-    revokePermission(pluginId, permissionId) {
-        const grants = this.grants.get(pluginId);
-        if (grants) {
-            grants.delete(permissionId);
-            const grantKey = `${pluginId}:${permissionId}`;
-            this.grantDetails.delete(grantKey);
-            this.logger.info('Permission revoked', { pluginId, permissionId });
-        }
-    }
-    /**
-     * Grant all permissions for a plugin
-     */
-    grantAllPermissions(pluginId, grantedBy) {
-        const permissionSet = this.permissionSets.get(pluginId);
-        if (!permissionSet) {
-            throw new Error(`No permissions registered for plugin: ${pluginId}`);
-        }
-        for (const permission of permissionSet.permissions) {
-            this.grantPermission(pluginId, permission.id, grantedBy);
-        }
-        this.logger.info('All permissions granted', { pluginId, grantedBy });
-    }
-    /**
-     * Check if a plugin has a specific permission
-     */
-    hasPermission(pluginId, permissionId) {
-        const grants = this.grants.get(pluginId);
-        if (!grants) {
-            return false;
-        }
-        // Check if granted
-        if (!grants.has(permissionId)) {
-            return false;
-        }
-        // Check expiration
-        const grantKey = `${pluginId}:${permissionId}`;
-        const grantDetails = this.grantDetails.get(grantKey);
-        if (grantDetails?.expiresAt && grantDetails.expiresAt < new Date()) {
-            this.revokePermission(pluginId, permissionId);
-            return false;
-        }
-        return true;
-    }
-    /**
-     * Check if plugin can perform an action on a resource
-     */
-    checkAccess(pluginId, resource, action, resourceId) {
-        const permissionSet = this.permissionSets.get(pluginId);
-        if (!permissionSet) {
-            return {
-                allowed: false,
-                reason: 'No permissions registered for plugin',
-            };
-        }
-        // Find matching permissions
-        const matchingPermissions = permissionSet.permissions.filter(p => {
-            // Check resource type
-            if (p.resource !== resource) {
-                return false;
-            }
-            // Check action
-            if (!p.actions.includes(action)) {
-                return false;
-            }
-            // Check resource filter if specified
-            if (resourceId && p.filter?.resourceIds) {
-                if (!p.filter.resourceIds.includes(resourceId)) {
-                    return false;
-                }
-            }
-            return true;
-        });
-        if (matchingPermissions.length === 0) {
-            return {
-                allowed: false,
-                reason: `No permission found for ${action} on ${resource}`,
-            };
-        }
-        // Check if any matching permission is granted
-        const grantedPermissions = matchingPermissions.filter(p => this.hasPermission(pluginId, p.id));
-        if (grantedPermissions.length === 0) {
-            return {
-                allowed: false,
-                reason: 'Required permissions not granted',
-                requiredPermission: matchingPermissions[0].id,
-            };
-        }
-        return {
-            allowed: true,
-            grantedPermissions: grantedPermissions.map(p => p.id),
-        };
-    }
-    /**
-     * Get all permissions for a plugin
-     */
-    getPluginPermissions(pluginId) {
-        const permissionSet = this.permissionSets.get(pluginId);
-        return permissionSet?.permissions || [];
-    }
-    /**
-     * Get granted permissions for a plugin
-     */
-    getGrantedPermissions(pluginId) {
-        const grants = this.grants.get(pluginId);
-        return grants ? Array.from(grants) : [];
-    }
-    /**
-     * Get required but not granted permissions
-     */
-    getMissingPermissions(pluginId) {
-        const permissionSet = this.permissionSets.get(pluginId);
-        if (!permissionSet) {
-            return [];
-        }
-        const granted = this.grants.get(pluginId) || new Set();
-        return permissionSet.permissions.filter(p => p.required && !granted.has(p.id));
-    }
-    /**
-     * Check if all required permissions are granted
-     */
-    hasAllRequiredPermissions(pluginId) {
-        return this.getMissingPermissions(pluginId).length === 0;
-    }
-    /**
-     * Get permission grant details
-     */
-    getGrantDetails(pluginId, permissionId) {
-        const grantKey = `${pluginId}:${permissionId}`;
-        return this.grantDetails.get(grantKey);
-    }
-    /**
-     * Validate permission against scope constraints
-     */
-    validatePermissionScope(permission, context) {
-        switch (permission.scope) {
-            case 'global':
-                return true;
-            case 'tenant':
-                return !!context.tenantId;
-            case 'user':
-                return !!context.userId;
-            case 'resource':
-                return !!context.resourceId;
-            case 'plugin':
-                return true;
-            default:
-                return false;
-        }
-    }
-    /**
-     * Clear all permissions for a plugin
-     */
-    clearPluginPermissions(pluginId) {
-        this.permissionSets.delete(pluginId);
-        const grants = this.grants.get(pluginId);
-        if (grants) {
-            for (const permissionId of grants) {
-                const grantKey = `${pluginId}:${permissionId}`;
-                this.grantDetails.delete(grantKey);
-            }
-            this.grants.delete(pluginId);
-        }
-        this.logger.info('All permissions cleared', { pluginId });
-    }
-    /**
-     * Shutdown permission manager
-     */
-    shutdown() {
-        this.permissionSets.clear();
-        this.grants.clear();
-        this.grantDetails.clear();
-        this.logger.info('Permission manager shutdown complete');
-    }
-}

package/dist/security/permission-manager.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permission-manager.test.d.ts.map

package/dist/security/permission-manager.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-manager.test.d.ts","sourceRoot":"","sources":["../../src/security/permission-manager.test.ts"],"names":[],"mappings":""}