@patronage/factory-ci 1.0.0-alpha.35 → 1.0.0-alpha.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/alchemy/index.js
CHANGED
|
@@ -247,6 +247,7 @@ const permissionGroupsFromPolicies = (policies, resourcesFor) => {
|
|
|
247
247
|
const found = [];
|
|
248
248
|
for (const policy of policies) {
|
|
249
249
|
if (!isPolicyShaped(policy)) throw new Error("Cloudflare token policy has an invalid shape.");
|
|
250
|
+
if (policy.permission_groups.length === 0) throw new Error("Cloudflare token policy has no permission groups.");
|
|
250
251
|
if (policy.effect !== "allow") throw new Error("Cloudflare token must carry allow policies only.");
|
|
251
252
|
if (Object.values(policy.resources).some((selection) => selection !== "*")) throw new Error("Cloudflare token policy has an invalid resource value.");
|
|
252
253
|
const scope = new Set(Object.keys(policy.resources));
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@patronage/factory-ci",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.36",
|
|
4
4
|
"description": "Deep CI and deploy building blocks for Patronage factory projects: workflow source artifacts, hosted diff classification, Alchemy entry execution, and disposable-stage semantics",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"alchemy",
|
|
@@ -237,6 +237,12 @@ const permissionGroupsFromPolicies = (
|
|
|
237
237
|
if (!isPolicyShaped(policy)) {
|
|
238
238
|
throw new Error("Cloudflare token policy has an invalid shape.");
|
|
239
239
|
}
|
|
240
|
+
if (policy.permission_groups.length === 0) {
|
|
241
|
+
// A group-less policy has no scope to compare through `resourcesFor`.
|
|
242
|
+
// Even when other policies satisfy the exact group list, this policy
|
|
243
|
+
// must not bypass resource validation.
|
|
244
|
+
throw new Error("Cloudflare token policy has no permission groups.");
|
|
245
|
+
}
|
|
240
246
|
if (policy.effect !== "allow") {
|
|
241
247
|
throw new Error("Cloudflare token must carry allow policies only.");
|
|
242
248
|
}
|