@objectstack/core 14.3.0 → 14.5.0

package/dist/index.d.cts

@@ -1808,6 +1808,25 @@ declare function isAuthGateAllowlisted(rawPath: string | undefined | null): bool
  */
 declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | null;
 
+/** The validity-window shape shared by both user-grant tables (ADR-0091 D1). */
+interface GrantValidityWindow {
+    valid_from?: unknown;
+    valid_until?: unknown;
+}
+/**
+ * True when a grant row is inside its validity window at `nowMs`.
+ * The single predicate every resolver uses (ADR-0091 D2):
+ * `(valid_from is null or valid_from <= now) and (valid_until is null or valid_until > now)`.
+ */
+declare function isGrantActive(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
+/**
+ * True when a grant row carries a `valid_until` that has already passed —
+ * i.e. it WAS active and expired (not merely not-yet-active). The explain
+ * engine uses this to report the dedicated "held until … — expired"
+ * contributor state (ADR-0091 D2).
+ */
+declare function isGrantExpired(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
+
 /**
  * Environment utilities for universal (Node/Browser) compatibility.
  */
@@ -2375,4 +2394,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, HotReloadManager, type KernelState, type KeyInput, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isNode, parseScopes, parseSignature, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };

package/dist/index.d.ts

@@ -1808,6 +1808,25 @@ declare function isAuthGateAllowlisted(rawPath: string | undefined | null): bool
  */
 declare function evaluateAuthGate(sessionUser: any, path: string): AuthGate | null;
 
+/** The validity-window shape shared by both user-grant tables (ADR-0091 D1). */
+interface GrantValidityWindow {
+    valid_from?: unknown;
+    valid_until?: unknown;
+}
+/**
+ * True when a grant row is inside its validity window at `nowMs`.
+ * The single predicate every resolver uses (ADR-0091 D2):
+ * `(valid_from is null or valid_from <= now) and (valid_until is null or valid_until > now)`.
+ */
+declare function isGrantActive(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
+/**
+ * True when a grant row carries a `valid_until` that has already passed —
+ * i.e. it WAS active and expired (not merely not-yet-active). The explain
+ * engine uses this to report the dedicated "held until … — expired"
+ * contributor state (ADR-0091 D2).
+ */
+declare function isGrantExpired(row: GrantValidityWindow | null | undefined, nowMs: number): boolean;
+
 /**
  * Environment utilities for universal (Node/Browser) compatibility.
  */
@@ -2375,4 +2394,4 @@ declare class NamespaceResolver {
     private suggestAlternative;
 }
 
-export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, HotReloadManager, type KernelState, type KeyInput, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isNode, parseScopes, parseSignature, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };
+export { API_KEY_PREFIX, type ApiKeyPrincipal, ApiRegistry, type ApiRegistryPluginConfig, type AuthGate, type BulkWriteOptions, type BulkWriteRowResult, CORE_FALLBACK_FACTORIES, type CalendarParts, DependencyResolver, type GeneratedApiKey, type GrantValidityWindow, HotReloadManager, type KernelState, type KeyInput, LiteKernel, type NamespaceCheckResult, type NamespaceConflict, type NamespaceEntry, NamespaceResolver, ObjectKernel, ObjectKernelBase, type ObjectKernelConfig, ObjectLogger, type ParsedSignature, type PermissionCheckResult$1 as PermissionCheckResult, type PermissionGrant, type Plugin, type PluginArtifactVerifyResult, PluginConfigValidator, type PluginContext, PluginHealthMonitor, type PluginHealthStatus, type PluginLoadResult, PluginLoader, type PluginMetadata, type PermissionCheckResult as PluginPermissionCheckResult, PluginPermissionEnforcer, PluginPermissionManager, type PluginPermissions, PluginSandboxRuntime, PluginSecurityScanner, type PluginSignatureConfig, PluginSignatureVerifier, type PluginStartupResult, type PublisherVerifyResult, index as QA, type ResolveAuthzInput, type ResolveLocalizationInput, type ResolvedAuthzContext, type ResourceUsage, type RetryOptions, SIGNATURE_ALG, type SandboxContext, type ScanTarget, SecurePluginContext, type SecurityIssue, SemanticVersionManager, type ServiceFactory, ServiceLifecycle, type ServiceRegistration, type SignatureVerificationResult, type VersionCompatibility, buildPermissionsFromGrants, bulkWrite, calendarPartsInTz, calendarPartsInTzOrUtc, counterSignPayload, createApiRegistryPlugin, createMemoryCache, createMemoryI18n, createMemoryJob, createMemoryMetadata, createMemoryQueue, createPluginConfigValidator, createPluginPermissionEnforcer, deepMerge, defaultIsTransientError, evaluateAuthGate, extractApiKey, generateApiKey, generateEd25519KeyPair, getEnv, getMemoryUsage, hashApiKey, isAuthGateAllowlisted, isExpired, isGrantActive, isGrantExpired, isNode, parseScopes, parseSignature, readAuthoredTranslationLayer, resolveApiKeyPrincipal, resolveAuthzContext, resolveLocale, resolveLocalizationContext, safeExit, signPayload, verifyPayload, verifyPlatformSignature, verifyPluginArtifact, verifyPublisherSignature, wireAuthoredTranslationSync, withTransientRetry };

package/dist/index.js

@@ -4138,6 +4138,33 @@ import {
   BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS
 } from "@objectstack/spec";
+
+// src/security/grant-validity.ts
+function toEpochMs(value) {
+  if (value == null || value === "") return void 0;
+  if (typeof value === "number") {
+    return value < 1e12 ? value * 1e3 : value;
+  }
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "string") return Date.parse(value);
+  return Number.NaN;
+}
+function isGrantActive(row, nowMs) {
+  if (!row) return false;
+  const from = toEpochMs(row.valid_from ?? row.validFrom);
+  if (from !== void 0 && !(nowMs >= from)) return false;
+  const until = toEpochMs(row.valid_until ?? row.validUntil);
+  if (until !== void 0 && !(nowMs < until)) return false;
+  return true;
+}
+function isGrantExpired(row, nowMs) {
+  if (!row) return false;
+  const until = toEpochMs(row.valid_until ?? row.validUntil);
+  if (until === void 0) return false;
+  return !(nowMs < until);
+}
+
+// src/security/resolve-authz-context.ts
 function safeJsonParse2(s, fallback) {
   try {
     return JSON.parse(s);
@@ -4211,10 +4238,12 @@ async function resolveAuthzContext(input) {
       }
     }
   }
+  const nowMs = input.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
+    if (!isGrantActive(ur, nowMs)) continue;
     const r = ur.position;
     if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
   }
@@ -4228,7 +4257,8 @@ async function resolveAuthzContext(input) {
   } else {
     ctx.org_user_ids = [userId];
   }
-  const upsRows = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
+  const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
+  const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
   const psIds = new Set(
     upsRows.filter((r) => {
       const org = r.organization_id ?? r.organizationId ?? null;
@@ -5433,6 +5463,8 @@ export {
   hashApiKey,
   isAuthGateAllowlisted,
   isExpired,
+  isGrantActive,
+  isGrantExpired,
   isNode,
   parseScopes,
   parseSignature,