@pikku/core 0.11.0 → 0.11.2

package/src/permissions.test.ts

@@ -1,22 +1,39 @@
 import { describe, test, beforeEach } from 'node:test'
 import * as assert from 'node:assert'
+import { addPermission, runPermissions } from './permissions.js'
+import { pikkuState, resetPikkuState } from './pikku-state.js'
+import { CoreServices, CoreUserSession } from './types/core.types.js'
 import {
-  addPermission,
-  getPermissionsForTags,
-  runPermissions,
-} from './permissions.js'
-import { resetPikkuState } from './pikku-state.js'
-import {
-  CoreServices,
-  CoreUserSession,
-  PikkuWiringTypes,
-} from './types/core.types.js'
-import { CorePermissionGroup } from './function/functions.types.js'
+  CorePermissionGroup,
+  CorePikkuPermission,
+} from './function/functions.types.js'
 
 beforeEach(() => {
   resetPikkuState()
 })
 
+// Test helper to get permissions for tags (not exported from core to keep it lean)
+const getPermissionsForTags = (
+  tags?: string[]
+): (CorePermissionGroup | CorePikkuPermission)[] => {
+  if (!tags || tags.length === 0) {
+    return []
+  }
+  const permissionsStore = pikkuState(null, 'permissions', 'tagGroup')
+  const result: (CorePermissionGroup | CorePikkuPermission)[] = []
+  for (const tag of new Set(tags)) {
+    const tagPermissions = permissionsStore[tag]
+    if (tagPermissions) {
+      if (Array.isArray(tagPermissions)) {
+        result.push(...tagPermissions)
+      } else {
+        result.push(tagPermissions)
+      }
+    }
+  }
+  return result
+}
+
 const mockServices: CoreServices = {
   logger: {
     info: () => {},
@@ -82,92 +99,13 @@ describe('addPermission', () => {
   })
 })
 
-describe('getPermissionsForTags', () => {
-  test('should return empty array when no tags provided', () => {
-    const permissions = getPermissionsForTags([])
-    assert.deepEqual(permissions, [])
-  })
-
-  test('should return empty array when tags is undefined', () => {
-    const permissions = getPermissionsForTags(undefined)
-    assert.deepEqual(permissions, [])
-  })
-
-  test('should return permissions for single tag', () => {
-    const mockPermission = async () => true
-    addPermission('singleTestTag', [mockPermission])
-
-    const permissions = getPermissionsForTags(['singleTestTag'])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermission)
-  })
-
-  test('should return permissions for multiple tags', () => {
-    const mockPermission1 = async () => true
-    const mockPermission2 = async () => false
-
-    addPermission('tag1', [mockPermission1])
-    addPermission('tag2', [mockPermission2])
-
-    const permissions = getPermissionsForTags(['tag1', 'tag2'])
-    assert.equal(permissions.length, 2)
-    assert.equal(permissions[0], mockPermission1)
-    assert.equal(permissions[1], mockPermission2)
-  })
-
-  test('should handle array permissions correctly', () => {
-    const mockPermission1 = async () => true
-    const mockPermission2 = async () => false
-
-    addPermission('arrayHandleTestTag', [mockPermission1, mockPermission2])
-
-    const permissions = getPermissionsForTags(['arrayHandleTestTag'])
-    assert.equal(permissions.length, 2)
-    assert.equal(permissions[0], mockPermission1)
-    assert.equal(permissions[1], mockPermission2)
-  })
-
-  test('should handle non-array permissions correctly', () => {
-    const mockPermissionGroup: CorePermissionGroup = {
-      permissions: [async () => true],
-    }
-
-    addPermission('objectHandleTestTag', mockPermissionGroup)
-
-    const permissions = getPermissionsForTags(['objectHandleTestTag'])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermissionGroup)
-  })
-
-  test('should deduplicate tags', () => {
-    const mockPermission = async () => true
-    addPermission('dedupeTestTag', [mockPermission])
-
-    const permissions = getPermissionsForTags([
-      'dedupeTestTag',
-      'dedupeTestTag',
-    ])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermission)
-  })
-
-  test('should ignore non-existent tags', () => {
-    const mockPermission = async () => true
-    addPermission('existingTag', [mockPermission])
-
-    const permissions = getPermissionsForTags(['existingTag', 'nonExistentTag'])
-    assert.equal(permissions.length, 1)
-    assert.equal(permissions[0], mockPermission)
-  })
-})
-
 describe('runPermissions', () => {
   test('should pass when no permissions are defined', async () => {
     // Should not throw
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
-      allServices: mockServices,
+    await runPermissions('rpc', Math.random().toString(), {
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
   })
 
@@ -180,11 +118,11 @@ describe('runPermissions', () => {
 
     addPermission('wiringTag', [wiringTagPermission])
 
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
 
     assert.deepEqual(executionOrder, ['wiringTag'])
@@ -223,14 +161,14 @@ describe('runPermissions', () => {
       ],
     }
 
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'wiringTag' }],
       wirePermissions,
       funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
       funcPermissions,
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
 
     // Order: wireInheritedPermissions (wiringTag) → wirePermissions → funcInheritedPermissions (funcTag) → funcPermissions
@@ -249,11 +187,11 @@ describe('runPermissions', () => {
     addPermission('atLeastOneTestTag', [failingPermission, passingPermission])
 
     // Should not throw because at least one permission passes
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'atLeastOneTestTag' }],
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
   })
 
@@ -264,11 +202,11 @@ describe('runPermissions', () => {
     addPermission('allFailTestTag', [failingPermission1, failingPermission2])
 
     await assert.rejects(
-      runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+      runPermissions('rpc', Math.random().toString(), {
         wireInheritedPermissions: [{ type: 'tag', tag: 'allFailTestTag' }],
-        allServices: mockServices,
+        services: mockServices,
+        wire: {},
         data: {},
-        session: mockSession,
       }),
       {
         message: 'Permission denied',
@@ -282,11 +220,11 @@ describe('runPermissions', () => {
     }
 
     await assert.rejects(
-      runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+      runPermissions('rpc', Math.random().toString(), {
         wirePermissions,
-        allServices: mockServices,
+        services: mockServices,
+        wire: {},
         data: {},
-        session: mockSession,
       }),
       {
         message: 'Permission denied',
@@ -300,11 +238,11 @@ describe('runPermissions', () => {
     addPermission('funcTag', [failingPermission])
 
     await assert.rejects(
-      runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+      runPermissions('rpc', Math.random().toString(), {
         funcInheritedPermissions: [{ type: 'tag', tag: 'funcTag' }],
-        allServices: mockServices,
+        services: mockServices,
+        wire: {},
         data: {},
-        session: mockSession,
       }),
       {
         message: 'Permission denied',
@@ -318,11 +256,11 @@ describe('runPermissions', () => {
     }
 
     await assert.rejects(
-      runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+      runPermissions('rpc', Math.random().toString(), {
         funcPermissions,
-        allServices: mockServices,
+        services: mockServices,
+        wire: {},
         data: {},
-        session: mockSession,
       }),
       {
         message: 'Permission denied',
@@ -350,12 +288,12 @@ describe('runPermissions', () => {
     }
 
     // Should NOT throw because at least one permission (wirePermissions) passes
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'failingWiringTag' }],
       wirePermissions,
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
 
     // Both permissions should be evaluated
@@ -368,11 +306,11 @@ describe('runPermissions', () => {
     addPermission('arrayTestTag', arrayPermission)
 
     // Should not throw because verifyPermissions handles array properly
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'arrayTestTag' }],
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
   })
 
@@ -384,23 +322,23 @@ describe('runPermissions', () => {
     addPermission('objectTestTag', permissionGroup)
 
     // Should not throw because verifyPermissions handles objects properly
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'objectTestTag' }],
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: {},
-      session: mockSession,
     })
   })
 
   test('should pass correct parameters to permission functions', async () => {
     let receivedServices: any
+    let receivedWire: any
     let receivedData: any
-    let receivedSession: any
 
-    const testPermission = async (services: any, data: any, session: any) => {
+    const testPermission = async (services: any, data: any, wire: any) => {
       receivedServices = services
       receivedData = data
-      receivedSession = session
+      receivedWire = wire
       return true
     }
 
@@ -408,15 +346,15 @@ describe('runPermissions', () => {
 
     addPermission('paramTestTag', [testPermission])
 
-    await runPermissions(PikkuWiringTypes.rpc, Math.random().toString(), {
+    await runPermissions('rpc', Math.random().toString(), {
       wireInheritedPermissions: [{ type: 'tag', tag: 'paramTestTag' }],
-      allServices: mockServices,
+      services: mockServices,
+      wire: {},
       data: testData,
-      session: mockSession,
     })
 
     assert.equal(receivedServices, mockServices)
     assert.equal(receivedData, testData)
-    assert.equal(receivedSession, mockSession)
+    assert.deepEqual(receivedWire, {})
   })
 })

package/src/permissions.ts

@@ -1,8 +1,8 @@
 import {
   CoreServices,
-  CoreUserSession,
   PikkuWiringTypes,
   PermissionMetadata,
+  PikkuWire,
 } from './types/core.types.js'
 import {
   CorePermissionGroup,
@@ -16,14 +16,14 @@ import { freezeDedupe } from './utils.js'
  * This function validates permissions by iterating over permission groups and executing the corresponding permission functions. If all functions in at least one group return true, the permission is considered valid.
  * @param services - The core services required for permission validation.
  * @param data - The data to be used in the permission validation functions.
- * @param session - An optional user session for permission validation.
+ * @param wire - The wire object containing request/response context and session.
  * @returns A promise that resolves to void.
  */
-export const verifyPermissions = async (
+const verifyPermissions = async <Out = any>(
   permissions: CorePermissionGroup,
   services: CoreServices,
   data: any,
-  session?: CoreUserSession
+  wire: PikkuWire<any, never, any, never, never, never>
 ): Promise<boolean> => {
   if (!permissions) {
     return true
@@ -38,13 +38,13 @@ export const verifyPermissions = async (
   for (const funcs of permissionGroups) {
     if (funcs instanceof Array) {
       const permissioned = await Promise.all(
-        funcs.map((func) => func(services, data, session))
+        funcs.map((func) => func(services, data, wire))
       )
       if (permissioned.every((result) => result)) {
         valid = true
       }
     } else {
-      valid = await funcs(services, data, session)
+      valid = await funcs(services, data, wire as any)
     }
     if (valid) {
       return true
@@ -53,31 +53,6 @@ export const verifyPermissions = async (
   return false
 }
 
-/**
- * Registers a single permission function by name in the global permission store.
- *
- * This function is used by CLI-generated code to register permission functions
- * that can be referenced by name in metadata. It stores permissions in a special
- * namespace to avoid conflicts with tag-based permissions.
- *
- * @param {string} name - The unique name (pikkuFuncName) of the permission function.
- * @param {CorePikkuPermission} permission - The permission function to register.
- *
- * @example
- * ```typescript
- * // Called by CLI-generated pikku-permissions.gen.ts
- * registerPermission('adminPermission_src_permissions_ts_10_5', adminPermission)
- * registerPermission('readPermission_src_permissions_ts_20_10', readPermission)
- * ```
- */
-export const registerPermission = (
-  name: string,
-  permission: CorePikkuPermission<any>
-) => {
-  const permissionStore = pikkuState('misc', 'permissions')
-  permissionStore[name] = [permission]
-}
-
 /**
  * Retrieves a registered permission function by its name.
  *
@@ -89,10 +64,8 @@ export const registerPermission = (
  *
  * @internal
  */
-export const getPermissionByName = (
-  name: string
-): CorePikkuPermission | undefined => {
-  const permissionStore = pikkuState('misc', 'permissions')
+const getPermissionByName = (name: string): CorePikkuPermission | undefined => {
+  const permissionStore = pikkuState(null, 'misc', 'permissions')
   const permission = permissionStore[name]
   if (Array.isArray(permission) && permission.length === 1) {
     return permission[0]
@@ -130,9 +103,10 @@ export const getPermissionByName = (
  */
 export const addPermission = (
   tag: string,
-  permissions: CorePermissionGroup | CorePikkuPermission[]
+  permissions: CorePermissionGroup | CorePikkuPermission[],
+  packageName: string | null = null
 ): CorePermissionGroup | CorePikkuPermission[] => {
-  const tagGroups = pikkuState('permissions', 'tagGroup')
+  const tagGroups = pikkuState(packageName, 'permissions', 'tagGroup')
   if (tagGroups[tag]) {
     throw new Error(
       `Permissions for tag '${tag}' already exist. Use a different tag or remove the existing permissions first.`
@@ -142,62 +116,18 @@ export const addPermission = (
   return permissions
 }
 
-const EMPTY: readonly (CorePermissionGroup | CorePikkuPermission)[] = []
-
-/**
- * Retrieves permissions for a given set of tags.
- *
- * This function looks up all permissions registered for any of the provided tags
- * and returns them as a flattened array.
- *
- * @param {string[]} tags - Array of tags to look up permissions for.
- * @returns {any[]} Array of permission functions that apply to the given tags.
- *
- * @example
- * ```typescript
- * // Get all permissions for tags 'api' and 'auth'
- * const permissions = getPermissionsForTags(['api', 'auth'])
- * ```
- */
-export const getPermissionsForTags = (
-  tags?: string[]
-): readonly (CorePermissionGroup | CorePikkuPermission)[] => {
-  if (!tags || tags.length === 0) {
-    return EMPTY
-  }
-
-  const permissionsStore = pikkuState('permissions', 'tagGroup')
-  const applicablePermissions: Array<
-    CorePermissionGroup | CorePikkuPermission
-  > = []
-
-  // Collect permissions for all matching tags
-  for (const tag of new Set(tags)) {
-    const tagPermissions = permissionsStore[tag]
-    if (tagPermissions) {
-      if (Array.isArray(tagPermissions)) {
-        applicablePermissions.push(...tagPermissions)
-      } else {
-        applicablePermissions.push(tagPermissions)
-      }
-    }
-  }
-
-  return applicablePermissions
-}
-
 const combinedPermissionsCache: Record<
   PikkuWiringTypes,
   Record<string, readonly (CorePermissionGroup | CorePikkuPermission)[]>
 > = {
-  [PikkuWiringTypes.http]: {},
-  [PikkuWiringTypes.rpc]: {},
-  [PikkuWiringTypes.channel]: {},
-  [PikkuWiringTypes.queue]: {},
-  [PikkuWiringTypes.scheduler]: {},
-  [PikkuWiringTypes.mcp]: {},
-  [PikkuWiringTypes.cli]: {},
-  [PikkuWiringTypes.workflow]: {},
+  http: {},
+  rpc: {},
+  channel: {},
+  queue: {},
+  scheduler: {},
+  mcp: {},
+  cli: {},
+  workflow: {},
 }
 
 /**
@@ -224,7 +154,7 @@ const combinedPermissionsCache: Record<
  * })
  * ```
  */
-export const combinePermissions = (
+const combinePermissions = (
   wireType: PikkuWiringTypes,
   uid: string,
   {
@@ -232,11 +162,13 @@ export const combinePermissions = (
     wirePermissions,
     funcInheritedPermissions,
     funcPermissions,
+    packageName = null,
   }: {
     wireInheritedPermissions?: PermissionMetadata[]
     wirePermissions?: CorePermissionGroup | CorePikkuPermission[]
     funcInheritedPermissions?: PermissionMetadata[]
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[]
+    packageName?: string | null
   } = {}
 ): readonly (CorePermissionGroup | CorePikkuPermission)[] => {
   if (combinedPermissionsCache[wireType][uid]) {
@@ -250,7 +182,9 @@ export const combinePermissions = (
     for (const meta of wireInheritedPermissions) {
       if (meta.type === 'http') {
         // Look up HTTP permission group from pikkuState
-        const group = pikkuState('permissions', 'httpGroup')[meta.route]
+        const group = pikkuState(packageName, 'permissions', 'httpGroup')[
+          meta.route
+        ]
         if (group) {
           if (Array.isArray(group)) {
             resolved.push(...group)
@@ -260,7 +194,9 @@ export const combinePermissions = (
         }
       } else if (meta.type === 'tag') {
         // Look up tag permission group from pikkuState
-        const group = pikkuState('permissions', 'tagGroup')[meta.tag]
+        const group = pikkuState(packageName, 'permissions', 'tagGroup')[
+          meta.tag
+        ]
         if (group) {
           if (Array.isArray(group)) {
             resolved.push(...group)
@@ -292,7 +228,9 @@ export const combinePermissions = (
     for (const meta of funcInheritedPermissions) {
       if (meta.type === 'tag') {
         // Look up tag permission group from pikkuState
-        const group = pikkuState('permissions', 'tagGroup')[meta.tag]
+        const group = pikkuState(packageName, 'permissions', 'tagGroup')[
+          meta.tag
+        ]
         if (group) {
           if (Array.isArray(group)) {
             resolved.push(...group)
@@ -335,17 +273,19 @@ export const runPermissions = async (
     wirePermissions,
     funcInheritedPermissions,
     funcPermissions,
-    allServices,
+    services,
+    wire,
     data,
-    session,
+    packageName = null,
   }: {
     wireInheritedPermissions?: PermissionMetadata[]
     wirePermissions?: CorePermissionGroup | CorePikkuPermission[]
     funcInheritedPermissions?: PermissionMetadata[]
     funcPermissions?: CorePermissionGroup | CorePikkuPermission[]
-    allServices: CoreServices
+    services: CoreServices
+    wire: PikkuWire<any, never, any, never, never, never>
     data: any
-    session?: CoreUserSession
+    packageName?: string | null
   }
 ) => {
   // Combine all permissions: wireInheritedPermissions → wirePermissions → funcInheritedPermissions → funcPermissions
@@ -354,6 +294,7 @@ export const runPermissions = async (
     wirePermissions,
     funcInheritedPermissions,
     funcPermissions,
+    packageName,
   })
 
   // Check all combined permissions - at least one must pass if any exist
@@ -362,9 +303,9 @@ export const runPermissions = async (
     for (const permission of allPermissions) {
       const result = await verifyPermissions(
         typeof permission === 'function' ? { permission } : permission,
-        allServices,
+        services,
         data,
-        session
+        wire
       )
       if (result) {
         permissioned = true
@@ -372,7 +313,7 @@ export const runPermissions = async (
       }
     }
     if (!permissioned) {
-      allServices.logger.debug('Permission denied - combined permissions')
+      services.logger.debug('Permission denied - combined permissions')
       throw new ForbiddenError('Permission denied')
     }
   }