@ontrails/permits 1.0.0-beta.15 → 1.0.0-beta.16

package/src/__tests__/testing.test.ts

@@ -1,57 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-
-import { createPermitForTrail, createTestPermit } from '../testing';
-
-describe('createTestPermit()', () => {
-  test('returns a Permit with the given scopes', () => {
-    const permit = createTestPermit({ scopes: ['user:read', 'user:write'] });
-    expect(permit.scopes).toEqual(['user:read', 'user:write']);
-  });
-
-  test('generates a unique id when not specified', () => {
-    const a = createTestPermit();
-    const b = createTestPermit();
-    expect(a.id).not.toBe(b.id);
-  });
-
-  test('uses the provided id when specified', () => {
-    const permit = createTestPermit({ id: 'custom-id' });
-    expect(permit.id).toBe('custom-id');
-  });
-
-  test('returns empty scopes when no options provided', () => {
-    const permit = createTestPermit();
-    expect(permit.scopes).toEqual([]);
-  });
-
-  test('includes roles when provided', () => {
-    const permit = createTestPermit({ roles: ['admin', 'editor'] });
-    expect(permit.roles).toEqual(['admin', 'editor']);
-  });
-
-  test('includes tenantId when provided', () => {
-    const permit = createTestPermit({ tenantId: 'tenant_abc' });
-    expect(permit.tenantId).toBe('tenant_abc');
-  });
-});
-
-describe('createPermitForTrail()', () => {
-  test('extracts scopes from trail permit requirement', () => {
-    const trail = { permit: { scopes: ['entity:read', 'entity:write'] } };
-    const permit = createPermitForTrail(trail);
-    expect(permit).toBeDefined();
-    expect(permit?.scopes).toEqual(['entity:read', 'entity:write']);
-  });
-
-  test('returns undefined for public trails', () => {
-    const trail = { permit: 'public' as const };
-    const permit = createPermitForTrail(trail);
-    expect(permit).toBeUndefined();
-  });
-
-  test('returns undefined when no permit declared', () => {
-    const trail = {};
-    const permit = createPermitForTrail(trail);
-    expect(permit).toBeUndefined();
-  });
-});

package/src/auth-layer.ts

@@ -1,80 +0,0 @@
-import { Result } from '@ontrails/core';
-import type { Layer } from '@ontrails/core';
-
-import { PermitError } from './errors.js';
-import { getPermit } from './permit.js';
-
-// ---------------------------------------------------------------------------
-// Helpers (defined before callers — no use-before-define)
-// ---------------------------------------------------------------------------
-
-/**
- * Returns `true` when the permit requirement means "no enforcement needed."
- * Either the trail hasn't declared a permit posture or has explicitly
- * opted out with `'public'`.
- */
-const isPassThrough = (
-  requirement: unknown
-): requirement is undefined | 'public' =>
-  requirement === undefined || requirement === 'public';
-
-/** Returns scopes present in `required` but absent from `held`. */
-const findMissing = (
-  required: readonly string[],
-  held: readonly string[]
-): readonly string[] => required.filter((s) => !held.includes(s));
-
-// ---------------------------------------------------------------------------
-// Auth layer
-// ---------------------------------------------------------------------------
-
-/**
- * A {@link Layer} that enforces permit scopes declared on trails.
- *
- * The layer reads the trail's `permit` field (a `PermitRequirement`):
- *
- * - If `permit` is `'public'` or `undefined` the layer passes through.
- * - If `permit` has `scopes`, the layer checks that `ctx.permit` contains
- *   all required scopes. A superset is fine; missing scopes produce a
- *   `PermitError`.
- *
- * Because `ctx.cross()` re-enters `executeTrail` (which applies layers),
- * this layer automatically re-checks on every invocation in a crossing chain.
- * No special crossing-chain handling is needed — it is built into the
- * architecture.
- */
-export const authLayer: Layer = {
-  description: 'Enforces permit scopes declared on trails',
-  name: 'auth',
-  wrap: (_trail, impl) => {
-    const requirement = _trail.permit;
-
-    if (isPassThrough(requirement)) {
-      return impl;
-    }
-
-    return (input, ctx) => {
-      const permit = getPermit(ctx);
-
-      if (!permit) {
-        return Promise.resolve(
-          Result.err(new PermitError('No permit provided'))
-        );
-      }
-
-      const missing = findMissing(requirement.scopes, permit.scopes);
-
-      if (missing.length > 0) {
-        return Promise.resolve(
-          Result.err(
-            new PermitError(`Missing scopes: ${missing.join(', ')}`, {
-              context: { missing, required: requirement.scopes },
-            })
-          )
-        );
-      }
-
-      return Promise.resolve(impl(input, ctx));
-    };
-  },
-};

package/src/connectors/connector.ts

@@ -1,35 +0,0 @@
-import type { Result } from '@ontrails/core';
-
-import type { PermitExtractionInput } from '../extraction.js';
-import type { Permit } from '../permit.js';
-
-/**
- * @deprecated Use {@link PermitExtractionInput} instead. Kept as an alias
- * for backward compatibility during migration.
- */
-export type AuthCredentials = PermitExtractionInput;
-
-/** Errors from auth connectors. */
-export interface AuthError {
-  readonly code:
-    | 'expired_token'
-    | 'insufficient_scope'
-    | 'invalid_token'
-    | 'missing_credentials';
-  readonly message: string;
-}
-
-/**
- * Auth connector port. Given extraction input, produce a permit or an error.
- *
- * The connector receives the full {@link PermitExtractionInput} — trailhead,
- * headers, requestId, and credential fields — so it can make richer
- * decisions (e.g., rate-limit by trailhead or correlate via requestId).
- *
- * Deliberately narrow — no session management, no token refresh.
- */
-export interface AuthConnector {
-  readonly authenticate: (
-    input: PermitExtractionInput
-  ) => Promise<Result<Permit | null, AuthError>>;
-}

package/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src"],
-  "exclude": ["**/__tests__/**", "**/*.test.ts", "dist"]
-}

package/tsconfig.tests.json

@@ -1,10 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "noEmit": true,
-    "rootDir": "./src",
-    "types": ["bun"]
-  },
-  "include": ["src/**/*.test.ts", "src/__tests__/**/*.ts"],
-  "exclude": []
-}

package/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["./src/auth-layer.ts","./src/auth-resource.ts","./src/errors.ts","./src/extraction.ts","./src/index.ts","./src/permit.ts","./src/rules.ts","./src/testing.ts","./src/connectors/connector.ts","./src/connectors/jwt.ts","./src/trails/auth-verify.ts"],"version":"5.9.3"}