@powerhousedao/powerhouse-vetra-packages 6.2.2-dev.49 → 6.2.2-dev.50

package/dist/node/{document-drive-DrBAR9as.mjs → document-drive-BgHPyTwW.mjs}

@@ -4369,10 +4369,35 @@ function evaluateNode(node, subject, request, conditions) {
 function evaluateCondition(condition, subject, request, conditions) {
 	return evaluateNode(condition, subject, request, conditions) === true;
 }
+/** Whether a capability's scope reaches the requested one. */
+function scopeCovers(scope, requested) {
+	return scope === void 0 || scope === "*" || scope === requested;
+}
+/**
+* Whether one grant answers this request.
+*
+* A grant allowing execute on a scope also allows reading it: executing an
+* operation means reading the state it applies to, so permitting the write while
+* withholding the read would describe an access nobody could use. The converse
+* does not hold -- a read grant confers no write.
+*
+* Only an allow carries across. A deny on execute withholds the write and says
+* nothing about the read, so a policy locking writes down does not silently
+* revoke a read grant sitting before it. The operation list is not consulted
+* either: it restricts which operations may be executed, not whether the scope
+* is visible, and a read carries no operation to match against.
+*
+* Reads are not consensus -- no replica records a read, and the two read call
+* sites are both inside the read gate -- so this rule is not part of what makes
+* an operation valid, and does not need a policy version of its own.
+*/
+function grantAnswers(grant, request) {
+	if (capabilityCovers(grant.capability, request)) return true;
+	return request.verb === "read" && grant.effect === "allow" && grant.capability.can === "execute" && scopeCovers(grant.capability.scope, request.scope);
+}
 function capabilityCovers(capability, request) {
 	if (capability.can !== request.verb) return false;
-	const scope = capability.scope;
-	if (scope !== void 0 && scope !== "*" && scope !== request.scope) return false;
+	if (!scopeCovers(capability.scope, request.scope)) return false;
 	if (capability.can === "execute") {
 		if (capability.operation === void 0) return true;
 		return request.operation !== void 0 && capability.operation.includes(request.operation);
@@ -4409,7 +4434,7 @@ function evaluateGrantStack(grants, subject, request, groups, conditions) {
 			if (conditions === void 0) continue;
 			if (!evaluateCondition(grant.where, subject, request, conditions)) continue;
 		}
-		if (capabilityCovers(grant.capability, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
+		if (grantAnswers(grant, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
 	}
 	if (applicable === void 0) return {
 		decision: "deny",
@@ -5545,7 +5570,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	};
 	let result = document;
 	if (operationsToReplay.length) result = operationsToReplay.reduce((document, operation) => {
-		if (isDenied(operation)) return appendWithoutApplying(document, operation);
+		if (isDenied(operation)) return updateHeaderRevision(appendWithoutApplying(document, operation), operation.action.scope, operation.timestampUtcMs);
 		return reducer(document, operation.action, dispatch, {
 			ignoreSkipOperations: true,
 			checkHashes,
@@ -7037,7 +7062,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			const segEnd = k < validatedUpgrades.length ? boundaries[k]?.[s] ?? ops.length : ops.length;
 			const segOps = ops.slice(segStart, segEnd);
 			for (const op of segOps) {
-				if (isDenied(op)) document = appendWithoutApplying(document, op, s);
+				if (isDenied(op)) document = updateHeaderRevision(appendWithoutApplying(document, op, s), s, op.timestampUtcMs);
 				else document = reducer(document, op.action, dispatch, {
 					ignoreSkipOperations: true,
 					checkHashes,
@@ -8309,4 +8334,4 @@ const driveDocumentModelModule = {
 //#endregion
 export { setOperationSchema as $, createZip as A, replayDocumentVersioned as B, baseSaveToFileHandle as C, createPresignedHeader as D, createBaseState as E, documentModelDocumentType as F, setModelExtension as G, setAuthorWebsite as H, hashDocumentStateForScope as I, setModuleName as J, setModelId as K, isDocumentAction as L, deleteModule as M, deleteOperation as N, createReducer as O, deleteOperationError as P, setOperationName as Q, redo as R, baseLoadFromInputVersioned as S, createAction as T, setInitialState as U, setAuthorName as V, setModelDescription as W, setOperationDescription as X, setName as Y, setOperationErrorName as Z, addOperationError as _, handleTargetNameCollisions as a, generateId as at, baseCreateDocument as b, isValidName as c, documentModelDocumentModelModule as d, setStateSchema as et, logger as f, addOperation as g, addModule as h, generateNodesCopy as i, validateStateSchemaName as it, defaultBaseState as j, createState as k, moveNode as l, BaseDocumentStateSchema as m, copyNode as n, validateInitialState as nt, isFileNode as o, BaseDocumentHeaderSchema as p, setModelName as q, driveDocumentModelModule as r, validateModules as rt, isFolderNode as s, addFolder as t, undo as tt, updateNode as u, assertAuthPreservedOnDuplicate as v, buildSignedAction as w, baseLoadFromInput as x, baseActions as y, releaseNewVersion as z };
 
-//# sourceMappingURL=document-drive-DrBAR9as.mjs.map
+//# sourceMappingURL=document-drive-BgHPyTwW.mjs.map