@owlmeans/iam 0.1.18-rc.41 → 0.1.18-rc.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/iam/SKILL.md +11 -4
- package/build/types.d.ts +6 -0
- package/build/types.d.ts.map +1 -1
- package/build/utils.d.ts +4 -1
- package/build/utils.d.ts.map +1 -1
- package/build/utils.js +14 -0
- package/build/utils.js.map +1 -1
- package/package.json +2 -2
- package/src/types.ts +6 -0
- package/src/utils.ts +20 -1
package/README.md
CHANGED
|
@@ -13,7 +13,7 @@ Provider-agnostic IAM abstraction for the OwlMeans framework — `IamService` in
|
|
|
13
13
|
## Installation
|
|
14
14
|
|
|
15
15
|
```bash
|
|
16
|
-
bun add @owlmeans/iam@^0.1.18-rc.
|
|
16
|
+
bun add @owlmeans/iam@^0.1.18-rc.43
|
|
17
17
|
```
|
|
18
18
|
|
|
19
19
|
## Usage
|
|
@@ -36,7 +36,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
36
36
|
your project's skill store (`.agents/skills/`):
|
|
37
37
|
|
|
38
38
|
```sh
|
|
39
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
39
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.41
|
|
40
40
|
```
|
|
41
41
|
|
|
42
42
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/iam",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-09-
|
|
4
|
+
"version": "0.1.18-rc.43",
|
|
5
|
+
"generatedAt": "2026-09-28T02:06:37.876Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ metadata:
|
|
|
8
8
|
|
|
9
9
|
# Using `@owlmeans/iam`
|
|
10
10
|
|
|
11
|
-
**Install:** `"@owlmeans/iam": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/iam": "^0.1.18-rc.43"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
Provider-agnostic IAM abstraction: the `IamService` interface, the permission and grant shapes, the
|
|
14
14
|
gate-param grammar, and `hasPermission`. It contains no implementation and talks to no provider —
|
|
@@ -51,12 +51,12 @@ this package's screens hand out. Permission decisions are made there, never in t
|
|
|
51
51
|
| `IamClient` | type | Provisioned OIDC client `{ id?, clientId, secret?, name?, realm? }` |
|
|
52
52
|
| `IamClientOptions` | type | `{ redirectUris? }` — explicit `ensureClient` hardening; omitting is a keycloak-only legacy shape (see below) |
|
|
53
53
|
| `IamCredentialsPair` | type | `{ token: string; realm: string }` |
|
|
54
|
-
| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title?, area?, managed? }` — `permission` absent means unscoped resource name |
|
|
54
|
+
| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title?, area?, managed?, defaultEnabled? }` — `permission` absent means unscoped resource name |
|
|
55
55
|
| `IamResourceSpec` | type | `{ name: string; displayName?: string }` |
|
|
56
|
-
| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title?, area?, managed? }` |
|
|
56
|
+
| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title?, area?, managed?, defaultEnabled? }` |
|
|
57
57
|
| `IamPermissionFilter` | type | `{ areas?, managed?, resourceScoped? }` — narrows `listPermissions`; an `areas` entry of `null` matches untagged definitions |
|
|
58
58
|
| `IamGrantArgs` | type | `{ resources?: string[], mode? }` |
|
|
59
|
-
| `IamGrant` | type | `{ profileId, clientId, permission, resources?, mode? }` |
|
|
59
|
+
| `IamGrant` | type | `{ profileId, clientId, permission, resources?, mode?, inherited? }` |
|
|
60
60
|
| `IamGrantMode` | enum | `Blanket` / `Resources` / `All` — which FORM of a grant an operation addresses |
|
|
61
61
|
| `IamGrantBundle` | type | `{ filter?, permissions?, mode?, resources? }` — what `grantBundle` hands out |
|
|
62
62
|
| `IamRemovalPolicy` | enum | `Cascade` / `Refuse` — what to do about grants of a definition being deleted |
|
|
@@ -113,6 +113,13 @@ nothing at request time. `managed: true` marks a definition the platform owns: a
|
|
|
113
113
|
revoke it from an undifferentiated list, and a repair that deletes "definitions no declaration names"
|
|
114
114
|
must not reach one.
|
|
115
115
|
|
|
116
|
+
`defaultEnabled: true` makes an unmanaged `user`-area permission effective for every end user of
|
|
117
|
+
that client. `mergePermissionDefaults` adds inherited blanket grants when reading grants or
|
|
118
|
+
building OIDC claims; it never writes a grant to every profile. The first explicit blanket change
|
|
119
|
+
stores `true` or `false` on that profile, and a stored `false` suppresses the inherited grant.
|
|
120
|
+
Resource-specific grants remain independent. Integrated IAM supports this contract; Keycloak
|
|
121
|
+
refuses a default-enabled definition with `IamUnsupported`.
|
|
122
|
+
|
|
116
123
|
## `IamService` interface
|
|
117
124
|
|
|
118
125
|
```ts
|
package/build/types.d.ts
CHANGED
|
@@ -127,6 +127,8 @@ export interface IamPermissionArgs {
|
|
|
127
127
|
* so its absence from the declarations is not evidence that it is unused.
|
|
128
128
|
*/
|
|
129
129
|
managed?: boolean;
|
|
130
|
+
/** Blanket permission inherited by end users until they receive an explicit per-user value. */
|
|
131
|
+
defaultEnabled?: boolean;
|
|
130
132
|
}
|
|
131
133
|
export interface IamResourceSpec {
|
|
132
134
|
name: string;
|
|
@@ -144,6 +146,8 @@ export interface IamPermissionDefinition {
|
|
|
144
146
|
area?: string;
|
|
145
147
|
/** Owned by the platform rather than declared by the application. See `IamPermissionArgs.managed`. */
|
|
146
148
|
managed?: boolean;
|
|
149
|
+
/** Effective for end users without an explicit blanket value for this permission. */
|
|
150
|
+
defaultEnabled?: boolean;
|
|
147
151
|
}
|
|
148
152
|
/** Narrows a definition listing. An `areas` entry of `null` matches definitions carrying no tag. */
|
|
149
153
|
export interface IamPermissionFilter {
|
|
@@ -180,6 +184,8 @@ export interface IamGrant {
|
|
|
180
184
|
resources?: string[];
|
|
181
185
|
/** Which form this record is. Derived from `resources`, not new information. */
|
|
182
186
|
mode?: IamGrantMode;
|
|
187
|
+
/** This blanket grant comes from the definition, not the user's stored profile. */
|
|
188
|
+
inherited?: boolean;
|
|
183
189
|
}
|
|
184
190
|
/** Grants every definition a filter selects, plus any named outright. */
|
|
185
191
|
export interface IamGrantBundle {
|
package/build/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EACV,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,gBAAgB,EAC3F,MAAM,aAAa,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAC/B;AAED,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,KAAK,EACV,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,gBAAgB,EAC3F,MAAM,aAAa,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAC/B;AAED,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6FAA6F;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sGAAsG;IACtG,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qFAAqF;IACrF,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACzB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,YAAY,CAAA;CACpB;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,gFAAgF;IAChF,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,6BAA6B;IAC7B,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAA;IACd,8CAA8C;IAC9C,OAAO,EAAE,QAAQ,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC5D,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC7D,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,yGAAyG;AACzG,MAAM,WAAW,UAAW,SAAQ,kBAAkB;IAEpD,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAErE;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAInD;;;;;;;;OAQG;IACH,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IAEpG;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAErE;;;OAGG;IACH,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,iBAAiB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAA;IAEpB;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,EAC7B,IAAI,CAAC,EAAE,uBAAuB,KAC3B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAEpC;;;;;;;;;;;OAWG;IACH,oBAAoB,EAAE,CACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,gBAAgB,KACpB,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAEpC;;;OAGG;IACH,uBAAuB,EAAE,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,eAAe,KACtB,OAAO,CAAC,IAAI,CAAC,CAAA;IAIlB,4FAA4F;IAC5F,eAAe,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,mBAAmB,KACzB,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAEvC;;;OAGG;IACH,eAAe,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,QAAQ,CAAC,CAAA;IAEtB;;;OAGG;IACH,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,YAAY,KAChB,OAAO,CAAC,IAAI,CAAC,CAAA;IAElB;;;;;;;;;OASG;IACH,WAAW,EAAE,CACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,EACpB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IAExB,6EAA6E;IAC7E,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IAI3F;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAEtE,kEAAkE;IAClE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAEzE,iFAAiF;IACjF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAEzE,mEAAmE;IACnE,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAE5F,uEAAuE;IACvE,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE"}
|
package/build/utils.d.ts
CHANGED
|
@@ -1,4 +1,7 @@
|
|
|
1
|
-
import type { Authorization } from '@owlmeans/auth';
|
|
1
|
+
import type { Authorization, PermissionSet } from '@owlmeans/auth';
|
|
2
|
+
import type { IamPermissionDefinition } from './types.js';
|
|
3
|
+
/** Resolve inherited blanket permissions without writing them onto a person's profile. */
|
|
4
|
+
export declare const mergePermissionDefaults: (stored: PermissionSet[], clientId: string, definitions: IamPermissionDefinition[]) => PermissionSet[];
|
|
2
5
|
export interface HasPermissionOptions {
|
|
3
6
|
/** Restrict the check to PermissionSets of this scope (the project's clientId). */
|
|
4
7
|
scope?: string;
|
package/build/utils.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAEzD,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,WAC1B,aAAa,EAAE,YAAY,MAAM,eAAe,uBAAuB,EAAE,KAChF,aAAa,EAaf,CAAA;AAED,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,aAAa,cACP,MAAM,SACX,oBAAoB,KAC1B,OAIO,CAAA"}
|
package/build/utils.js
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
/** Resolve inherited blanket permissions without writing them onto a person's profile. */
|
|
2
|
+
export const mergePermissionDefaults = (stored, clientId, definitions) => {
|
|
3
|
+
const scoped = stored.filter(set => set.scope === clientId);
|
|
4
|
+
const explicit = new Set(scoped
|
|
5
|
+
.filter(set => set.title == null && set.resources == null)
|
|
6
|
+
.flatMap(set => Object.keys(set.permissions)));
|
|
7
|
+
const inherited = definitions
|
|
8
|
+
.filter(def => def.defaultEnabled === true && !explicit.has(def.name))
|
|
9
|
+
.map(def => def.name);
|
|
10
|
+
return inherited.length === 0 ? scoped : [
|
|
11
|
+
...scoped,
|
|
12
|
+
{ scope: clientId, permissions: Object.fromEntries(inherited.map(name => [name, true])) },
|
|
13
|
+
];
|
|
14
|
+
};
|
|
1
15
|
/**
|
|
2
16
|
* True when any PermissionSet grants `permission`. An unscoped set (no resources)
|
|
3
17
|
* satisfies a resourceId check too — a project-wide grant covers every resource.
|
package/build/utils.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAuB,EAAE,QAAgB,EAAE,WAAsC,EAChE,EAAE;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM;SAC5B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;SACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,WAAW;SAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACrE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAEvB,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,GAAG,MAAM;QACT,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE;KAC1F,CAAA;AACH,CAAC,CAAA;AASD;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAmB,EACnB,UAAkB,EAClB,IAA2B,EAClB,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CACzC,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;OAC9C,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI;OACpC,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAClG,IAAI,KAAK,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/iam",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.43",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
"@owlmeans/auth": "^0.1.18-rc.36",
|
|
26
26
|
"@owlmeans/context": "^0.1.18-rc.32",
|
|
27
27
|
"@owlmeans/error": "^0.1.18-rc.36",
|
|
28
|
-
"@owlmeans/oidc": "^0.1.18-rc.
|
|
28
|
+
"@owlmeans/oidc": "^0.1.18-rc.48",
|
|
29
29
|
"@owlmeans/route": "^0.1.18-rc.33"
|
|
30
30
|
},
|
|
31
31
|
"devDependencies": {
|
package/src/types.ts
CHANGED
|
@@ -141,6 +141,8 @@ export interface IamPermissionArgs {
|
|
|
141
141
|
* so its absence from the declarations is not evidence that it is unused.
|
|
142
142
|
*/
|
|
143
143
|
managed?: boolean
|
|
144
|
+
/** Blanket permission inherited by end users until they receive an explicit per-user value. */
|
|
145
|
+
defaultEnabled?: boolean
|
|
144
146
|
}
|
|
145
147
|
|
|
146
148
|
export interface IamResourceSpec {
|
|
@@ -160,6 +162,8 @@ export interface IamPermissionDefinition {
|
|
|
160
162
|
area?: string
|
|
161
163
|
/** Owned by the platform rather than declared by the application. See `IamPermissionArgs.managed`. */
|
|
162
164
|
managed?: boolean
|
|
165
|
+
/** Effective for end users without an explicit blanket value for this permission. */
|
|
166
|
+
defaultEnabled?: boolean
|
|
163
167
|
}
|
|
164
168
|
|
|
165
169
|
/** Narrows a definition listing. An `areas` entry of `null` matches definitions carrying no tag. */
|
|
@@ -199,6 +203,8 @@ export interface IamGrant {
|
|
|
199
203
|
resources?: string[]
|
|
200
204
|
/** Which form this record is. Derived from `resources`, not new information. */
|
|
201
205
|
mode?: IamGrantMode
|
|
206
|
+
/** This blanket grant comes from the definition, not the user's stored profile. */
|
|
207
|
+
inherited?: boolean
|
|
202
208
|
}
|
|
203
209
|
|
|
204
210
|
/** Grants every definition a filter selects, plus any named outright. */
|
package/src/utils.ts
CHANGED
|
@@ -1,4 +1,23 @@
|
|
|
1
|
-
import type { Authorization } from '@owlmeans/auth'
|
|
1
|
+
import type { Authorization, PermissionSet } from '@owlmeans/auth'
|
|
2
|
+
import type { IamPermissionDefinition } from './types.js'
|
|
3
|
+
|
|
4
|
+
/** Resolve inherited blanket permissions without writing them onto a person's profile. */
|
|
5
|
+
export const mergePermissionDefaults = (
|
|
6
|
+
stored: PermissionSet[], clientId: string, definitions: IamPermissionDefinition[]
|
|
7
|
+
): PermissionSet[] => {
|
|
8
|
+
const scoped = stored.filter(set => set.scope === clientId)
|
|
9
|
+
const explicit = new Set(scoped
|
|
10
|
+
.filter(set => set.title == null && set.resources == null)
|
|
11
|
+
.flatMap(set => Object.keys(set.permissions)))
|
|
12
|
+
const inherited = definitions
|
|
13
|
+
.filter(def => def.defaultEnabled === true && !explicit.has(def.name))
|
|
14
|
+
.map(def => def.name)
|
|
15
|
+
|
|
16
|
+
return inherited.length === 0 ? scoped : [
|
|
17
|
+
...scoped,
|
|
18
|
+
{ scope: clientId, permissions: Object.fromEntries(inherited.map(name => [name, true])) },
|
|
19
|
+
]
|
|
20
|
+
}
|
|
2
21
|
|
|
3
22
|
export interface HasPermissionOptions {
|
|
4
23
|
/** Restrict the check to PermissionSets of this scope (the project's clientId). */
|