@predicatesystems/authority 0.3.3 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +59 -15
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -5,8 +5,7 @@
|
|
|
5
5
|
[](LICENSE)
|
|
6
6
|
[](https://www.npmjs.com/package/@predicatesystems/authority)
|
|
7
7
|
|
|
8
|
-
`@predicatesystems/authority` is the TypeScript SDK
|
|
9
|
-
`predicate-authorityd` sidecar from [predicate-authority (Python)](https://github.com/PredicateSystems/predicate-authority). It keeps authority
|
|
8
|
+
`@predicatesystems/authority` is the TypeScript SDK for Predicate Authority. It keeps authority
|
|
10
9
|
decisions in the sidecar and gives Node/TS runtimes a thin, typed client for
|
|
11
10
|
fail-closed pre-execution checks.
|
|
12
11
|
|
|
@@ -33,26 +32,71 @@ This TS repository currently focuses on:
|
|
|
33
32
|
Out of scope for this package:
|
|
34
33
|
|
|
35
34
|
- re-implementing policy engine or mandate logic in TypeScript,
|
|
36
|
-
- replacing
|
|
35
|
+
- replacing sidecar/control-plane authority logic.
|
|
37
36
|
|
|
38
|
-
##
|
|
37
|
+
## Installation
|
|
39
38
|
|
|
40
|
-
|
|
41
|
-
|
|
39
|
+
```bash
|
|
40
|
+
npm install @predicatesystems/authority
|
|
41
|
+
```
|
|
42
42
|
|
|
43
|
-
|
|
44
|
-
- mandate/token baseline: ES256-default signing + standard JWT claim envelope,
|
|
45
|
-
- revocation baseline: explicit cascade semantics and global kill-switch runtime behavior,
|
|
46
|
-
- control-plane baseline: long-poll policy/revocation sync (runtime baseline),
|
|
47
|
-
- control-plane write hardening: replay freshness headers/signature support on Python client paths.
|
|
43
|
+
### Sidecar Prerequisite
|
|
48
44
|
|
|
49
|
-
The
|
|
50
|
-
adding TS-specific extensions.
|
|
45
|
+
This SDK requires the **Predicate Authority Sidecar** daemon to be running. The sidecar is a lightweight Rust binary that handles policy evaluation and mandate signing.
|
|
51
46
|
|
|
52
|
-
|
|
47
|
+
| Resource | Link |
|
|
48
|
+
|----------|------|
|
|
49
|
+
| Sidecar Repository | [predicate-authority-sidecar](https://github.com/PredicateSystems/predicate-authority-sidecar) |
|
|
50
|
+
| Download Binaries | [Latest Releases](https://github.com/PredicateSystems/predicate-authority-sidecar/releases) |
|
|
51
|
+
| License | MIT / Apache 2.0 |
|
|
52
|
+
|
|
53
|
+
### Quick Sidecar Setup
|
|
53
54
|
|
|
54
55
|
```bash
|
|
55
|
-
|
|
56
|
+
# Download the latest release for your platform
|
|
57
|
+
# Linux x64, macOS x64/ARM64, Windows x64 available
|
|
58
|
+
|
|
59
|
+
# Extract and run
|
|
60
|
+
tar -xzf predicate-authorityd-*.tar.gz
|
|
61
|
+
chmod +x predicate-authorityd
|
|
62
|
+
|
|
63
|
+
# Start with a policy file (local mode)
|
|
64
|
+
./predicate-authorityd run --port 8787 --mode local_only --policy-file policy.json
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
### Cloud-connected sidecar (control-plane sync)
|
|
68
|
+
|
|
69
|
+
Connect the sidecar to Predicate Authority control-plane for policy sync, revocation push, and audit forwarding:
|
|
70
|
+
|
|
71
|
+
```bash
|
|
72
|
+
export PREDICATE_API_KEY="your-api-key"
|
|
73
|
+
|
|
74
|
+
./predicate-authorityd run \
|
|
75
|
+
--host 127.0.0.1 \
|
|
76
|
+
--port 8787 \
|
|
77
|
+
--mode cloud_connected \
|
|
78
|
+
--control-plane-url https://api.predicatesystems.dev \
|
|
79
|
+
--tenant-id your-tenant \
|
|
80
|
+
--project-id your-project \
|
|
81
|
+
--predicate-api-key $PREDICATE_API_KEY \
|
|
82
|
+
--sync-enabled
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
### Local IdP mode (development/air-gapped)
|
|
86
|
+
|
|
87
|
+
For development or air-gapped environments without external IdP:
|
|
88
|
+
|
|
89
|
+
```bash
|
|
90
|
+
export LOCAL_IDP_SIGNING_KEY="replace-with-strong-secret"
|
|
91
|
+
|
|
92
|
+
./predicate-authorityd run \
|
|
93
|
+
--host 127.0.0.1 \
|
|
94
|
+
--port 8787 \
|
|
95
|
+
--mode local_only \
|
|
96
|
+
--policy-file policy.json \
|
|
97
|
+
--identity-mode local-idp \
|
|
98
|
+
--local-idp-issuer "http://localhost/predicate-local-idp" \
|
|
99
|
+
--local-idp-audience "api://predicate-authority"
|
|
56
100
|
```
|
|
57
101
|
|
|
58
102
|
## Quick Start
|