@rebasepro/server 0.23.0 → 0.24.0

package/dist/functions/index.js

@@ -233,31 +233,33 @@ function defineFunction(definition) {
 //#endregion
 //#region src/auth/admin-roles.ts
 /**
-* Which role names carry administrative privilege.
-*
-* One definition, because there used to be several and they disagreed.
-* `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses
-* a dangerous `defaultRole` compared against `admin` alone. So
-* `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public
-* registrant an administrator — and, since a `schema-admin` may edit users, one
-* of them could then grant themselves real `admin` and keep it.
-*
-* The guard and the check have to read the same list or the gap comes back, so
-* neither of them owns it.
-*
-* `schema-admin` is here deliberately: it can reach the schema editor and the
-* SQL surfaces, which is administrative by any definition that matters. If a
-* genuinely lesser role is added later, it does not belong in this list — it
-* belongs in a capability check of its own.
+* The admin role and scope matching, for code that may not import
+* `@rebasepro/types`.
+*
+* The custom-functions surface (`@rebasepro/server/functions`) must bundle for
+* a runtime with no Node built-ins and imports nothing but `hono`, so its
+* guards cannot reach the canonical definitions in `@rebasepro/types`
+* (`ADMIN_ROLE`, `hasAdminRole`, `scopeGrants`). These are the same rules,
+* restated, and `test/admin-roles.test.ts` holds them equal.
+*
+* Everything else imports the `@rebasepro/types` versions.
 */
-var ADMINISTRATIVE_ROLES = ["admin", "schema-admin"];
-/** Does this single role name carry administrative privilege? */
-function isAdministrativeRole(role) {
-	return ADMINISTRATIVE_ROLES.includes(role);
+/** The one built-in role. It holds every scope. */
+var ADMIN_ROLE_NAME = "admin";
+/** Does this list of roles include the admin role? */
+function holdsAdminRole(roles) {
+	return !!roles?.includes(ADMIN_ROLE_NAME);
 }
-/** Does any role in this list carry administrative privilege? */
-function hasAdministrativeRole(roles) {
-	return !!roles?.some(isAdministrativeRole);
+/**
+* Does a set of held scopes grant `scope`, optionally on one `target`? The
+* unqualified grant covers every target; `scope:target` covers its own.
+*/
+function heldScopesGrant(held, scope, target) {
+	for (const entry of held) {
+		if (entry === scope) return true;
+		if (target !== void 0 && entry === `${scope}:${target}`) return true;
+	}
+	return false;
 }
 //#endregion
 //#region src/functions/context.ts
@@ -310,16 +312,31 @@ function hasRole(c, ...roles) {
 	const held = new Set(getRoles(c));
 	return roles.some((role) => held.has(role));
 }
+/** Whether the caller holds the `admin` role, which holds every scope. */
+function isAdmin(c) {
+	return holdsAdminRole(getRoles(c));
+}
 /**
-* Whether the caller holds an administrative role.
+* Everything the caller may do, as `resource:action[:target]` scope strings —
+* the data plane, the app's own `auth.scopes`, and whatever their roles (or
+* their API key) hold. Empty for an anonymous request.
 *
-* Delegates to the single definition in `auth/admin-roles.ts` — which is
-* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
-* Those two lists disagreed once, and the gap made every public registrant an
-* administrator; see that file.
+* Resolved by the framework before the handler runs; `undefined` only when no
+* Rebase auth middleware ran (see {@link identityResolved}).
 */
-function isAdmin(c) {
-	return hasAdministrativeRole(getRoles(c));
+function getScopes(c) {
+	return read(c, "scopes");
+}
+/**
+* Whether the caller holds `scope`, on `target` when one is given.
+*
+* For an app scope declared under `auth.scopes` — `project:deploy` — a
+* signed-in person always holds it, so this narrows only API keys and tokens.
+* Whether the *person* may deploy *this* project is still the handler's to
+* decide.
+*/
+function hasScope(c, scope, target) {
+	return heldScopesGrant(getScopes(c) ?? [], scope, target);
 }
 /** Whether the request carries an identity at all. */
 function isAuthenticated(c) {
@@ -428,15 +445,14 @@ var requireAuth = async (c, next) => {
 	} }, 401);
 };
 /**
-* Reject callers without an administrative role with 403.
+* Reject callers without the `admin` role with 403.
 *
 * Must come **after** {@link requireAuth}: on its own it answers 401 for an
 * anonymous caller, which is right, but pairing them keeps the two failures
 * distinguishable — 401 "who are you", 403 "not you".
 *
-* Administrative means `admin` or `schema-admin`, from the single list in
-* `auth/admin-roles.ts`. Do not compare against `"admin"` by hand; that is the
-* divergence that list exists to prevent.
+* Prefer {@link requireScope} for anything an app declares a scope for: a
+* scope can be granted to a narrower role and to a key, and `admin` cannot.
 */
 var requireAdmin = async (c, next) => {
 	if (!getUser(c)) {
@@ -483,6 +499,44 @@ function requireRole(...roles) {
 		return next();
 	};
 }
+/**
+* Reject callers who do not hold `scope` with 403.
+*
+* `scope` is a built-in scope or one the app declares under `auth.scopes` on
+* the users collection. `target` narrows it to one resource — a key holding
+* `project:deploy:p1` passes `requireScope("project:deploy", c => c.req.param("project"))`
+* for `p1` only — and may be read from the request.
+*
+* A signed-in person holds every app scope, so for a person this is no
+* authorization at all: it narrows API keys and tokens. Decide whether the
+* person may act in the handler, as you would without it.
+*
+* @example
+* ```ts
+* app.post("/deploy/:project", requireAuth, requireScope("project:deploy", c => c.req.param("project")), handler);
+* ```
+*/
+function requireScope(scope, target) {
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		const resolvedTarget = typeof target === "function" ? target(c) : target;
+		if (!hasScope(c, scope, resolvedTarget)) {
+			const wanted = resolvedTarget !== void 0 ? `${scope}:${resolvedTarget}` : scope;
+			return c.json({ error: {
+				message: `This credential does not hold the "${wanted}" scope.`,
+				code: "SCOPE_MISSING",
+				details: { requiredScope: wanted }
+			} }, 403);
+		}
+		return next();
+	};
+}
 //#endregion
 //#region src/functions/runtime-env.ts
 /**
@@ -634,7 +688,7 @@ function isProduction() {
 var configuredLevel;
 function getMinLevel() {
 	if (configuredLevel) return configuredLevel;
-	const env = (hostEnv().LOG_LEVEL || "info").toLowerCase();
+	const env = (hostEnv().LOG_LEVEL || "info").trim().toLowerCase();
 	if (env in LOG_PRIORITY) return env;
 	return "info";
 }
@@ -1024,6 +1078,6 @@ var ApiError = class ApiError extends Error {
 	}
 };
 //#endregion
-export { ApiError, defineFunction, env, getApiKey, getDriver, getEnv, getRequestId, getRoles, getUser, getUserId, hasRole, identityResolved, isAdmin, isAuthenticated, isNodeRuntime, lazyResource, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, runtimeKey, waitUntil };
+export { ApiError, defineFunction, env, getApiKey, getDriver, getEnv, getRequestId, getRoles, getScopes, getUser, getUserId, hasRole, hasScope, identityResolved, isAdmin, isAuthenticated, isNodeRuntime, lazyResource, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, requireScope, runtimeKey, waitUntil };
 
 //# sourceMappingURL=index.js.map