@objectstack/core 14.8.0 → 15.1.0

package/dist/index.cjs

@@ -30,6 +30,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ANONYMOUS_DENY_BODY: () => ANONYMOUS_DENY_BODY,
+  ANONYMOUS_DENY_CODE: () => ANONYMOUS_DENY_CODE,
+  ANONYMOUS_DENY_MESSAGE: () => ANONYMOUS_DENY_MESSAGE,
+  ANONYMOUS_DENY_STATUS: () => ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX: () => API_KEY_PREFIX,
   ApiRegistry: () => ApiRegistry,
   CORE_FALLBACK_FACTORIES: () => CORE_FALLBACK_FACTORIES,
@@ -40,6 +44,9 @@ __export(index_exports, {
   ObjectKernel: () => ObjectKernel,
   ObjectKernelBase: () => ObjectKernelBase,
   ObjectLogger: () => ObjectLogger,
+  POSTURE_INJECTION_RULE: () => POSTURE_INJECTION_RULE,
+  POSTURE_LADDER: () => POSTURE_LADDER,
+  POSTURE_RANK: () => POSTURE_RANK,
   PluginConfigValidator: () => PluginConfigValidator,
   PluginHealthMonitor: () => PluginHealthMonitor,
   PluginLoader: () => PluginLoader,
@@ -69,6 +76,7 @@ __export(index_exports, {
   createPluginPermissionEnforcer: () => createPluginPermissionEnforcer,
   deepMerge: () => deepMerge,
   defaultIsTransientError: () => defaultIsTransientError,
+  derivePosture: () => derivePosture,
   evaluateAuthGate: () => evaluateAuthGate,
   extractApiKey: () => extractApiKey,
   generateApiKey: () => generateApiKey,
@@ -83,12 +91,14 @@ __export(index_exports, {
   isNode: () => isNode,
   parseScopes: () => parseScopes,
   parseSignature: () => parseSignature,
+  postureVisibleRows: () => postureVisibleRows,
   readAuthoredTranslationLayer: () => readAuthoredTranslationLayer,
   resolveApiKeyPrincipal: () => resolveApiKeyPrincipal,
   resolveAuthzContext: () => resolveAuthzContext,
   resolveLocale: () => resolveLocale,
   resolveLocalizationContext: () => resolveLocalizationContext,
   safeExit: () => safeExit,
+  shouldDenyAnonymous: () => shouldDenyAnonymous,
   signPayload: () => signPayload,
   verifyPayload: () => verifyPayload,
   verifyPlatformSignature: () => verifyPlatformSignature,
@@ -1637,6 +1647,8 @@ var ObjectKernel = class {
       this.validateSystemRequirements();
       this.logger.debug("Triggering kernel:ready hook");
       await this.context.trigger("kernel:ready");
+      this.logger.debug("Triggering kernel:bootstrapped hook");
+      await this.context.trigger("kernel:bootstrapped");
       this.logger.debug("Triggering kernel:listening hook");
       await this.context.trigger("kernel:listening");
       this.logger.info("\u2705 Bootstrap complete");
@@ -1920,6 +1932,7 @@ var LiteKernel = class extends ObjectKernelBase {
       await this.runPluginStart(plugin);
     }
     await this.triggerHook("kernel:ready");
+    await this.triggerHook("kernel:bootstrapped");
     await this.triggerHook("kernel:listening");
     this.logger.info("\u2705 Bootstrap complete", {
       pluginCount: this.plugins.size
@@ -4243,6 +4256,62 @@ function isGrantExpired(row, nowMs) {
   return !(nowMs < until);
 }
 
+// src/security/posture-ladder.ts
+var POSTURE_LADDER = [
+  "PLATFORM_ADMIN",
+  "TENANT_ADMIN",
+  "MEMBER",
+  "EXTERNAL"
+];
+var POSTURE_RANK = {
+  PLATFORM_ADMIN: 3,
+  TENANT_ADMIN: 2,
+  MEMBER: 1,
+  EXTERNAL: 0
+};
+var POSTURE_INJECTION_RULE = {
+  PLATFORM_ADMIN: "Layer 0 exemption where the object posture permits (private / platform-global / better-auth-managed) \u2014 crosses the tenant wall; org-scoped like TENANT_ADMIN on ordinary tenant business objects.",
+  TENANT_ADMIN: "All rows within the active organization (organization_id == ctx.tenantId); no ownership / depth / sharing narrowing.",
+  MEMBER: "Business RLS within the organization \u2014 ownership (owner / unit depth), the OWD baseline, and explicit sharing.",
+  EXTERNAL: "Explicitly shared rows ONLY \u2014 OWD baselines and sharing rules never apply; a misconfiguration can only shrink visibility, never widen it."
+};
+function derivePosture(evidence) {
+  if (evidence.isPlatformAdmin) return "PLATFORM_ADMIN";
+  if (evidence.isTenantAdmin) return "TENANT_ADMIN";
+  return "MEMBER";
+}
+function isSharedTo(row, userId) {
+  return (row.sharedTo ?? []).includes(userId);
+}
+function externalVisible(rows, p) {
+  return rows.filter((r) => isSharedTo(r, p.userId));
+}
+function memberVisible(rows, p) {
+  const shared = new Set(externalVisible(rows, p));
+  return rows.filter(
+    (r) => shared.has(r) || r.organization_id === p.organizationId && (r.owner_id === p.userId || r.owdVisible === true)
+  );
+}
+function tenantAdminVisible(rows, p) {
+  const member = new Set(memberVisible(rows, p));
+  return rows.filter((r) => member.has(r) || r.organization_id === p.organizationId);
+}
+function platformAdminVisible(rows) {
+  return [...rows];
+}
+function postureVisibleRows(posture, rows, principal) {
+  switch (posture) {
+    case "PLATFORM_ADMIN":
+      return platformAdminVisible(rows);
+    case "TENANT_ADMIN":
+      return tenantAdminVisible(rows, principal);
+    case "MEMBER":
+      return memberVisible(rows, principal);
+    case "EXTERNAL":
+      return externalVisible(rows, principal);
+  }
+}
+
 // src/security/resolve-authz-context.ts
 function safeJsonParse2(s, fallback) {
   try {
@@ -4389,6 +4458,10 @@ async function resolveAuthzContext(input) {
   if (hasPlatformAdminGrant && !ctx.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
     ctx.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
+  ctx.posture = derivePosture({
+    isPlatformAdmin: hasPlatformAdminGrant,
+    isTenantAdmin: ctx.permissions.includes(import_spec.ORGANIZATION_ADMIN)
+  });
   if (!ctx.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
@@ -4474,6 +4547,26 @@ function evaluateAuthGate(sessionUser, path) {
   };
 }
 
+// src/security/anonymous-deny.ts
+var ANONYMOUS_DENY_STATUS = 401;
+var ANONYMOUS_DENY_CODE = "unauthenticated";
+var ANONYMOUS_DENY_MESSAGE = "Authentication is required to access this endpoint.";
+var ANONYMOUS_DENY_BODY = {
+  error: ANONYMOUS_DENY_CODE,
+  message: ANONYMOUS_DENY_MESSAGE
+};
+function shouldDenyAnonymous(input) {
+  if (!input.requireAuth) return false;
+  if (typeof input.method === "string" && input.method.toUpperCase() === "OPTIONS") {
+    return false;
+  }
+  if (input.userId || input.isSystem) return false;
+  if (typeof input.path === "string" && input.path.length > 0 && isAuthGateAllowlisted(input.path)) {
+    return false;
+  }
+  return true;
+}
+
 // src/utils/datetime.ts
 function calendarPartsInTz(d, tz) {
   const parts = new Intl.DateTimeFormat("en-US", {
@@ -5495,6 +5588,10 @@ var NamespaceResolver = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ANONYMOUS_DENY_BODY,
+  ANONYMOUS_DENY_CODE,
+  ANONYMOUS_DENY_MESSAGE,
+  ANONYMOUS_DENY_STATUS,
   API_KEY_PREFIX,
   ApiRegistry,
   CORE_FALLBACK_FACTORIES,
@@ -5505,6 +5602,9 @@ var NamespaceResolver = class {
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
+  POSTURE_INJECTION_RULE,
+  POSTURE_LADDER,
+  POSTURE_RANK,
   PluginConfigValidator,
   PluginHealthMonitor,
   PluginLoader,
@@ -5534,6 +5634,7 @@ var NamespaceResolver = class {
   createPluginPermissionEnforcer,
   deepMerge,
   defaultIsTransientError,
+  derivePosture,
   evaluateAuthGate,
   extractApiKey,
   generateApiKey,
@@ -5548,12 +5649,14 @@ var NamespaceResolver = class {
   isNode,
   parseScopes,
   parseSignature,
+  postureVisibleRows,
   readAuthoredTranslationLayer,
   resolveApiKeyPrincipal,
   resolveAuthzContext,
   resolveLocale,
   resolveLocalizationContext,
   safeExit,
+  shouldDenyAnonymous,
   signPayload,
   verifyPayload,
   verifyPlatformSignature,