@sasjs/api 0.8.0 → 0.9.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.8.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.9.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -23,7 +23,9 @@ var SASjsApi = (() => {
   var index_exports = {};
   __export(index_exports, {
     ADMIN_SIGNED_IN: () => ADMIN_SIGNED_IN,
+    ALWAYS_VISIBLE_ROUTES: () => ALWAYS_VISIBLE_ROUTES,
     ApiError: () => ApiError,
+    DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
@@ -38,7 +40,9 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
+    TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
     basename: () => basename,
     checkDeployTree: () => checkDeployTree,
     createDriveService: () => createDriveService,
@@ -53,13 +57,15 @@ var SASjsApi = (() => {
     isApiError: () => isApiError,
     isDeployTree: () => isDeployTree,
     isRoot: () => isRoot,
+    isRouteGranted: () => isRouteGranted,
     measureDeployTree: () => measureDeployTree,
     normaliseDrivePath: () => normaliseDrivePath,
     parseIdentity: () => parseIdentity,
     routeById: () => routeById,
     runCase: () => runCase,
     sanitiseDisplayName: () => sanitiseDisplayName,
-    servicesFor: () => servicesFor
+    servicesFor: () => servicesFor,
+    topLevelRouteFor: () => topLevelRouteFor
   });
 
   // src/types.ts
@@ -2457,7 +2463,6 @@ var SASjsApi = (() => {
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
   var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
-  var PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
   var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
@@ -2604,16 +2609,12 @@ var SASjsApi = (() => {
     // Info - what the host is, and what this caller may use
     "GET /SASjsApi/info": { implemented: false, reason: HOST_CONFIG },
     "GET /SASjsApi/info/authorizedRoutes": {
-      implemented: false,
-      // the route inventory reports what the CALLER may use, so it needs an
-      // identity even though the rest of the Info tag needs nothing
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     "GET /SASjsApi/info/myAuthorizedRoutes": {
-      implemented: false,
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     // Permission - the rules the inventory above is derived from
     "GET /SASjsApi/permission": {
@@ -2970,6 +2971,16 @@ var SASjsApi = (() => {
             { password: body.password }
           )
         };
+      case "GET /SASjsApi/info/authorizedRoutes":
+        return {
+          status: 200,
+          body: await required().listAuthorizedRoutes(await caller())
+        };
+      case "GET /SASjsApi/info/myAuthorizedRoutes":
+        return {
+          status: 200,
+          body: await required().myAuthorizedRoutes(await caller())
+        };
       case "GET /SASjsApi/group":
         return { status: 200, body: await required().listGroups(await caller()) };
       case "GET /SASjsApi/group/{uid}":
@@ -3080,6 +3091,8 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "GET /SASjsApi/info/authorizedRoutes",
+    "GET /SASjsApi/info/myAuthorizedRoutes",
     "GET /SASjsApi/drive/file",
     "POST /SASjsApi/drive/file",
     "PATCH /SASjsApi/drive/file",
@@ -3121,6 +3134,40 @@ var SASjsApi = (() => {
     "PATCH /SASjsApi/auth/updatePassword"
   ];
 
+  // src/identity/routeAccess.ts
+  var TOP_LEVEL_ROUTES = ["/AppStream", "/SASjsApi"];
+  var ALWAYS_VISIBLE_ROUTES = ["/AppStream"];
+  var STATIC_AUTHORIZED_ROUTES = [
+    "/SASjsApi/code/execute",
+    "/SASjsApi/stp/execute",
+    "/SASjsApi/drive/deploy",
+    "/SASjsApi/drive/deploy/upload",
+    "/SASjsApi/drive/file",
+    "/SASjsApi/drive/folder",
+    "/SASjsApi/drive/fileTree",
+    "/SASjsApi/drive/rename"
+  ];
+  var DEFAULT_GRANTABLE_ROUTES = [
+    ...TOP_LEVEL_ROUTES,
+    ...STATIC_AUTHORIZED_ROUTES
+  ];
+  var topLevelRouteFor = (routePath) => TOP_LEVEL_ROUTES.find(
+    (route) => routePath.toLowerCase().startsWith(route.toLowerCase())
+  ) ?? routePath;
+  var settingOn = (rules, path) => rules.find((rule) => rule.path === path)?.setting;
+  var GRANT = "Grant";
+  var DENY = "Deny";
+  var isRouteGranted = (rules, path, topLevelRoute = topLevelRouteFor(path)) => {
+    const userSetting = settingOn(rules.user, path) ?? settingOn(rules.user, topLevelRoute);
+    if (userSetting) return userSetting === GRANT;
+    const onPath = rules.group.filter((rule) => rule.path === path);
+    if (onPath.some((rule) => rule.setting === GRANT)) return true;
+    if (onPath.some((rule) => rule.setting === DENY)) return false;
+    return rules.group.some(
+      (rule) => rule.path === topLevelRoute && rule.setting === GRANT
+    );
+  };
+
   // src/identity/service.ts
   var unauthorized = () => new ApiError(401, "Unauthorized");
   var liveSubject = async (store, subject) => {
@@ -3241,7 +3288,8 @@ var SASjsApi = (() => {
     name: group.name,
     description: group.description
   });
-  var createRecordService = (store) => {
+  var createRecordService = (store, options = {}) => {
+    const grantableRoutes = options.grantableRoutes || DEFAULT_GRANTABLE_ROUTES;
     const groupDetails = async (group) => {
       const members = [];
       for (const uid of group.users) {
@@ -3428,6 +3476,32 @@ var SASjsApi = (() => {
         if (!updated) throw new ApiError(400, "Unable to update group.");
         return groupDetails(updated);
       },
+      async listAuthorizedRoutes(caller) {
+        await requireCaller(store, caller);
+        return { paths: [...grantableRoutes] };
+      },
+      async myAuthorizedRoutes(caller) {
+        const reader = await requireCaller(store, caller);
+        if (reader.isAdmin) return { paths: [...grantableRoutes] };
+        const rules = await store.permissions();
+        const mine = {
+          user: rules.filter((rule) => rule.user === reader.uid).map((rule) => ({ path: rule.path, setting: rule.setting })),
+          group: rules.filter(
+            (rule) => rule.group !== void 0 && reader.groups.includes(rule.group)
+          ).map((rule) => ({ path: rule.path, setting: rule.setting }))
+        };
+        const publicGroup = (await store.groups()).find(
+          (group) => group.name === "public"
+        );
+        const publicGrants = publicGroup ? rules.filter(
+          (rule) => rule.group === publicGroup.uid && rule.setting === "Grant"
+        ).map((rule) => rule.path) : [];
+        return {
+          paths: grantableRoutes.filter(
+            (path) => ALWAYS_VISIBLE_ROUTES.includes(path) || publicGrants.includes(path) || isRouteGranted(mine, path, topLevelRouteFor(path))
+          )
+        };
+      },
       async listPermissions(caller) {
         const reader = await requireCaller(store, caller);
         const rules = await store.permissions();
@@ -5343,6 +5417,70 @@ var SASjsApi = (() => {
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
+    {
+      id: "authorized-routes",
+      route: "GET /SASjsApi/info/authorizedRoutes",
+      description: "answers the routes that accept a rule, to any caller",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-admin",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers every route to an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-user",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers a caller only the routes its rules grant",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        // /AppStream is visible whatever the rules say; the two grants come from
+        // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+        // and nothing grants the rest
+        body: {
+          paths: ["/AppStream", "/SASjsApi/stp/execute", "/SASjsApi/drive/file"]
+        }
+      }
+    },
     {
       id: "list-permissions-as-admin",
       route: "GET /SASjsApi/permission",

package/build/cjs/corpus/records.js

@@ -702,6 +702,70 @@ exports.RECORD_CORPUS = [
         expect: { status: 404, error: 'Group not found.' }
     },
     // ------------------------------------------------------------ permissions
+    {
+        id: 'authorized-routes',
+        route: 'GET /SASjsApi/info/authorizedRoutes',
+        description: 'answers the routes that accept a rule, to any caller',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-admin',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers every route to an administrator',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: ADMIN },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-user',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers a caller only the routes its rules grant',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            // /AppStream is visible whatever the rules say; the two grants come from
+            // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+            // and nothing grants the rest
+            body: {
+                paths: ['/AppStream', '/SASjsApi/stp/execute', '/SASjsApi/drive/file']
+            }
+        }
+    },
     {
         id: 'list-permissions-as-admin',
         route: 'GET /SASjsApi/permission',

package/build/cjs/host/dispatch.js

@@ -219,6 +219,16 @@ const dispatch = async (services, routeId, request = {}) => {
                 status: 200,
                 body: await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password })
             };
+        case 'GET /SASjsApi/info/authorizedRoutes':
+            return {
+                status: 200,
+                body: await required().listAuthorizedRoutes(await caller())
+            };
+        case 'GET /SASjsApi/info/myAuthorizedRoutes':
+            return {
+                status: 200,
+                body: await required().myAuthorizedRoutes(await caller())
+            };
         case 'GET /SASjsApi/group':
             return { status: 200, body: await required().listGroups(await caller()) };
         case 'GET /SASjsApi/group/{uid}':
@@ -322,6 +332,8 @@ const dispatch = async (services, routeId, request = {}) => {
 exports.dispatch = dispatch;
 /** Whether a route is one `dispatch` can answer today. */
 exports.HANDLED_ROUTES = [
+    'GET /SASjsApi/info/authorizedRoutes',
+    'GET /SASjsApi/info/myAuthorizedRoutes',
     'GET /SASjsApi/drive/file',
     'POST /SASjsApi/drive/file',
     'PATCH /SASjsApi/drive/file',

package/build/cjs/identity/records.js

@@ -17,6 +17,7 @@ exports.createRecordService = exports.sanitiseDisplayName = void 0;
  * the server sends.
  */
 const types_js_1 = require("../types.js");
+const routeAccess_js_1 = require("./routeAccess.js");
 /** The name the server gives the group every account is added to on creation. */
 const ALL_USERS_GROUP = 'all-users';
 /** The group whose membership the API refuses to change. */
@@ -83,7 +84,8 @@ const asGroup = (group) => ({
     name: group.name,
     description: group.description
 });
-const createRecordService = (store) => {
+const createRecordService = (store, options = {}) => {
+    const grantableRoutes = options.grantableRoutes || routeAccess_js_1.DEFAULT_GRANTABLE_ROUTES;
     const groupDetails = async (group) => {
         const members = [];
         for (const uid of group.users) {
@@ -285,6 +287,41 @@ const createRecordService = (store) => {
                 throw new types_js_1.ApiError(400, 'Unable to update group.');
             return groupDetails(updated);
         },
+        async listAuthorizedRoutes(caller) {
+            // an identity is required because the route is about a caller's access,
+            // even though what it returns is the whole inventory
+            await requireCaller(store, caller);
+            return { paths: [...grantableRoutes] };
+        },
+        async myAuthorizedRoutes(caller) {
+            const reader = await requireCaller(store, caller);
+            // an administrator holds every route, and the always-visible ones are
+            // visible whatever the rules say
+            if (reader.isAdmin)
+                return { paths: [...grantableRoutes] };
+            const rules = await store.permissions();
+            const mine = {
+                user: rules
+                    .filter((rule) => rule.user === reader.uid)
+                    .map((rule) => ({ path: rule.path, setting: rule.setting })),
+                group: rules
+                    .filter((rule) => rule.group !== undefined && reader.groups.includes(rule.group))
+                    .map((rule) => ({ path: rule.path, setting: rule.setting }))
+            };
+            // a grant on the reserved public group admits any caller, and it is
+            // checked before the rules so no user or group rule can take it away
+            const publicGroup = (await store.groups()).find((group) => group.name === 'public');
+            const publicGrants = publicGroup
+                ? rules
+                    .filter((rule) => rule.group === publicGroup.uid && rule.setting === 'Grant')
+                    .map((rule) => rule.path)
+                : [];
+            return {
+                paths: grantableRoutes.filter((path) => routeAccess_js_1.ALWAYS_VISIBLE_ROUTES.includes(path) ||
+                    publicGrants.includes(path) ||
+                    (0, routeAccess_js_1.isRouteGranted)(mine, path, (0, routeAccess_js_1.topLevelRouteFor)(path)))
+            };
+        },
         async listPermissions(caller) {
             const reader = await requireCaller(store, caller);
             const rules = await store.permissions();

package/build/cjs/identity/routeAccess.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Which routes a caller may use, from the permission rules alone.
+ *
+ * This is the answer `GET /SASjsApi/info/myAuthorizedRoutes` gives, and it is the
+ * same decision the gate makes when the route is actually requested - a
+ * web interface that offers a route the gate then refuses is the bug this exists
+ * to prevent, so the two must not be two implementations. A host that gates its
+ * own middleware should call `isRouteGranted` rather than re-derive it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRouteGranted = exports.topLevelRouteFor = exports.DEFAULT_GRANTABLE_ROUTES = exports.STATIC_AUTHORIZED_ROUTES = exports.ALWAYS_VISIBLE_ROUTES = exports.TOP_LEVEL_ROUTES = void 0;
+/** The two top-level routes, which a rule can address to cover everything below. */
+exports.TOP_LEVEL_ROUTES = ['/AppStream', '/SASjsApi'];
+/**
+ * Routes any authenticated caller may use whatever the rules say. `/AppStream` is
+ * the navigation page whose job is to list the apps the caller may open, so
+ * gating it on a grant that lists them would hide the page that leads to them.
+ */
+exports.ALWAYS_VISIBLE_ROUTES = ['/AppStream'];
+/**
+ * The routes that accept a rule, before a host adds its own. A host with
+ * streamed applications extends this with `/AppStream/<app>` for each one, which
+ * is why the inventory is passed in rather than derived from a fixed list here.
+ */
+exports.STATIC_AUTHORIZED_ROUTES = [
+    '/SASjsApi/code/execute',
+    '/SASjsApi/stp/execute',
+    '/SASjsApi/drive/deploy',
+    '/SASjsApi/drive/deploy/upload',
+    '/SASjsApi/drive/file',
+    '/SASjsApi/drive/folder',
+    '/SASjsApi/drive/fileTree',
+    '/SASjsApi/drive/rename'
+];
+/** The route inventory when the host states no additions of its own. */
+exports.DEFAULT_GRANTABLE_ROUTES = [
+    ...exports.TOP_LEVEL_ROUTES,
+    ...exports.STATIC_AUTHORIZED_ROUTES
+];
+/**
+ * The top-level route that governs a request: `/SASjsApi/code/execute` is
+ * governed by `/SASjsApi`, and a rule on the top-level route applies to
+ * everything beneath it.
+ */
+const topLevelRouteFor = (routePath) => exports.TOP_LEVEL_ROUTES.find((route) => routePath.toLowerCase().startsWith(route.toLowerCase())) ?? routePath;
+exports.topLevelRouteFor = topLevelRouteFor;
+const settingOn = (rules, path) => rules.find((rule) => rule.path === path)?.setting;
+const GRANT = 'Grant';
+const DENY = 'Deny';
+/**
+ * Whether these rules grant access to `path`.
+ *
+ * The order is the documented one and the only implementation of it:
+ *
+ *   1. a rule addressed to the user on the path itself decides either way;
+ *   2. otherwise a rule addressed to the user on the top-level route decides;
+ *   3. otherwise a group grant on the path allows, and a group deny on the path
+ *      blocks the top-level check - but a grant from another group still allows;
+ *   4. otherwise a group grant on the top-level route allows;
+ *   5. otherwise denied.
+ *
+ * A grant beats a deny at the same level, which is why step 3 looks at every
+ * group rule rather than stopping at the first deny.
+ */
+const isRouteGranted = (rules, path, topLevelRoute = (0, exports.topLevelRouteFor)(path)) => {
+    const userSetting = settingOn(rules.user, path) ?? settingOn(rules.user, topLevelRoute);
+    if (userSetting)
+        return userSetting === GRANT;
+    const onPath = rules.group.filter((rule) => rule.path === path);
+    if (onPath.some((rule) => rule.setting === GRANT))
+        return true;
+    if (onPath.some((rule) => rule.setting === DENY))
+        return false;
+    return rules.group.some((rule) => rule.path === topLevelRoute && rule.setting === GRANT);
+};
+exports.isRouteGranted = isRouteGranted;

package/build/cjs/index.js

@@ -60,6 +60,8 @@ Object.defineProperty(exports, "TAG_CAPABILITIES", { enumerable: true, get: func
 var dispatch_js_1 = require("./host/dispatch.js");
 Object.defineProperty(exports, "dispatch", { enumerable: true, get: function () { return dispatch_js_1.dispatch; } });
 Object.defineProperty(exports, "HANDLED_ROUTES", { enumerable: true, get: function () { return dispatch_js_1.HANDLED_ROUTES; } });
+// a host gating its own middleware reads the same decision the inventory reports
+__exportStar(require("./identity/routeAccess.js"), exports);
 var service_js_2 = require("./identity/service.js");
 Object.defineProperty(exports, "createIdentityService", { enumerable: true, get: function () { return service_js_2.createIdentityService; } });
 var records_js_1 = require("./identity/records.js");

package/build/cjs/routes/overlay.js

@@ -30,7 +30,6 @@ const EDITOR = 'Linting and formatting come from @sasjs/lint, which this package
 const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
 const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
 const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
-const PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
 const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
@@ -177,16 +176,12 @@ exports.OVERLAY = {
     // Info - what the host is, and what this caller may use
     'GET /SASjsApi/info': { implemented: false, reason: HOST_CONFIG },
     'GET /SASjsApi/info/authorizedRoutes': {
-        implemented: false,
-        // the route inventory reports what the CALLER may use, so it needs an
-        // identity even though the rest of the Info tag needs nothing
-        capabilities: ['identity'],
-        reason: PERMISSIONS
+        implemented: true,
+        capabilities: ['identity']
     },
     'GET /SASjsApi/info/myAuthorizedRoutes': {
-        implemented: false,
-        capabilities: ['identity'],
-        reason: PERMISSIONS
+        implemented: true,
+        capabilities: ['identity']
     },
     // Permission - the rules the inventory above is derived from
     'GET /SASjsApi/permission': {

package/build/esm/corpus/records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/corpus/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAA;AAkB/B,qFAAqF;AACrF,eAAO,MAAM,eAAe,EAAE,eAG7B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,eA0C9B,CAAA;AAOD,eAAO,MAAM,aAAa,EAAE,UAAU,EA4kCrC,CAAA"}
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/corpus/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAA;AAkB/B,qFAAqF;AACrF,eAAO,MAAM,eAAe,EAAE,eAG7B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,eA0C9B,CAAA;AAOD,eAAO,MAAM,aAAa,EAAE,UAAU,EA4oCrC,CAAA"}

package/build/esm/corpus/records.js

@@ -699,6 +699,70 @@ export const RECORD_CORPUS = [
         expect: { status: 404, error: 'Group not found.' }
     },
     // ------------------------------------------------------------ permissions
+    {
+        id: 'authorized-routes',
+        route: 'GET /SASjsApi/info/authorizedRoutes',
+        description: 'answers the routes that accept a rule, to any caller',
+        identity: ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-admin',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers every route to an administrator',
+        identity: ADMIN_SIGNED_IN,
+        request: { token: ADMIN },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-user',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers a caller only the routes its rules grant',
+        identity: ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            // /AppStream is visible whatever the rules say; the two grants come from
+            // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+            // and nothing grants the rest
+            body: {
+                paths: ['/AppStream', '/SASjsApi/stp/execute', '/SASjsApi/drive/file']
+            }
+        }
+    },
     {
         id: 'list-permissions-as-admin',
         route: 'GET /SASjsApi/permission',

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAqWrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAwClC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAgXrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EA0ClC,CAAA"}

package/build/esm/host/dispatch.js

@@ -216,6 +216,16 @@ export const dispatch = async (services, routeId, request = {}) => {
                 status: 200,
                 body: await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password })
             };
+        case 'GET /SASjsApi/info/authorizedRoutes':
+            return {
+                status: 200,
+                body: await required().listAuthorizedRoutes(await caller())
+            };
+        case 'GET /SASjsApi/info/myAuthorizedRoutes':
+            return {
+                status: 200,
+                body: await required().myAuthorizedRoutes(await caller())
+            };
         case 'GET /SASjsApi/group':
             return { status: 200, body: await required().listGroups(await caller()) };
         case 'GET /SASjsApi/group/{uid}':
@@ -318,6 +328,8 @@ export const dispatch = async (services, routeId, request = {}) => {
 };
 /** Whether a route is one `dispatch` can answer today. */
 export const HANDLED_ROUTES = [
+    'GET /SASjsApi/info/authorizedRoutes',
+    'GET /SASjsApi/info/myAuthorizedRoutes',
     'GET /SASjsApi/drive/file',
     'POST /SASjsApi/drive/file',
     'PATCH /SASjsApi/drive/file',

package/build/esm/identity/records.d.ts

@@ -44,6 +44,10 @@ export interface PermissionResponse {
     /** The uid of the group the rule is assigned to, when it is a group's. */
     group?: string;
 }
+/** What `authorizedRoutes` and `myAuthorizedRoutes` answer. */
+export interface AuthorizedRoutesResponse {
+    paths: string[];
+}
 export interface RecordService {
     listUsers(caller: Subject | undefined): Promise<UserResponse[]>;
     getUser(caller: Subject | undefined, by: {
@@ -88,6 +92,13 @@ export interface RecordService {
     deleteGroup(caller: Subject | undefined, uid: string): Promise<void>;
     addUserToGroup(caller: Subject | undefined, groupUid: string, userUid: string): Promise<GroupDetailsResponse>;
     removeUserFromGroup(caller: Subject | undefined, groupUid: string, userUid: string): Promise<GroupDetailsResponse>;
+    /**
+     * The routes that accept a rule. Any authenticated caller may read it: it is
+     * the inventory, not a statement about what this caller holds.
+     */
+    listAuthorizedRoutes(caller: Subject | undefined): Promise<AuthorizedRoutesResponse>;
+    /** The routes this caller may use, from the rules that bear on them. */
+    myAuthorizedRoutes(caller: Subject | undefined): Promise<AuthorizedRoutesResponse>;
     listPermissions(caller: Subject | undefined): Promise<PermissionResponse[]>;
     createPermission(caller: Subject | undefined, body: {
         path: string;
@@ -109,5 +120,13 @@ export interface RecordService {
     }): Promise<void>;
 }
 export declare const sanitiseDisplayName: (value: unknown) => string;
-export declare const createRecordService: (store: IdentityStore) => RecordService;
+export interface RecordServiceOptions {
+    /**
+     * The routes that accept a permission rule. Defaults to the ones this package
+     * knows; a host that streams applications adds `/AppStream/<app>` for each,
+     * because that set is the host's configuration and not a fact about the API.
+     */
+    grantableRoutes?: string[];
+}
+export declare const createRecordService: (store: IdentityStore, options?: RecordServiceOptions) => RecordService;
 //# sourceMappingURL=records.d.ts.map

package/build/esm/identity/records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/identity/records.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,oBAAoB,EAGpB,aAAa,EAEb,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/D,OAAO,CACL,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1B,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACjE,QAAQ,CACN,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CACT,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,mBAAmB,CACjB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3E,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;KACpB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3E,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACzE,YAAY,CACV,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC,wEAAwE;IACxE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB;AAiED,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAKf,CAAA;AAetC,eAAO,MAAM,mBAAmB,GAAI,OAAO,aAAa,KAAG,aAwZ1D,CAAA"}
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/identity/records.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,oBAAoB,EAGpB,aAAa,EAEb,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/D,OAAO,CACL,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1B,OAAO,CAAC,MAAM,CAAC,CAAA;IAElB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACjE,QAAQ,CACN,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CACT,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,mBAAmB,CACjB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC;;;OAGG;IACH,oBAAoB,CAClB,MAAM,EAAE,OAAO,GAAG,SAAS,GAC1B,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAEpC,wEAAwE;IACxE,kBAAkB,CAChB,MAAM,EAAE,OAAO,GAAG,SAAS,GAC1B,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAEpC,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3E,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;KACpB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE3E,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACzE,YAAY,CACV,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC,wEAAwE;IACxE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB;AAiED,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAKf,CAAA;AAetC,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,eAAO,MAAM,mBAAmB,GAC9B,OAAO,aAAa,EACpB,UAAS,oBAAyB,KACjC,aA6cF,CAAA"}

package/build/esm/identity/records.js

@@ -14,6 +14,7 @@
  * the server sends.
  */
 import { ApiError } from '../types.js';
+import { ALWAYS_VISIBLE_ROUTES, DEFAULT_GRANTABLE_ROUTES, isRouteGranted, topLevelRouteFor } from './routeAccess.js';
 /** The name the server gives the group every account is added to on creation. */
 const ALL_USERS_GROUP = 'all-users';
 /** The group whose membership the API refuses to change. */
@@ -79,7 +80,8 @@ const asGroup = (group) => ({
     name: group.name,
     description: group.description
 });
-export const createRecordService = (store) => {
+export const createRecordService = (store, options = {}) => {
+    const grantableRoutes = options.grantableRoutes || DEFAULT_GRANTABLE_ROUTES;
     const groupDetails = async (group) => {
         const members = [];
         for (const uid of group.users) {
@@ -281,6 +283,41 @@ export const createRecordService = (store) => {
                 throw new ApiError(400, 'Unable to update group.');
             return groupDetails(updated);
         },
+        async listAuthorizedRoutes(caller) {
+            // an identity is required because the route is about a caller's access,
+            // even though what it returns is the whole inventory
+            await requireCaller(store, caller);
+            return { paths: [...grantableRoutes] };
+        },
+        async myAuthorizedRoutes(caller) {
+            const reader = await requireCaller(store, caller);
+            // an administrator holds every route, and the always-visible ones are
+            // visible whatever the rules say
+            if (reader.isAdmin)
+                return { paths: [...grantableRoutes] };
+            const rules = await store.permissions();
+            const mine = {
+                user: rules
+                    .filter((rule) => rule.user === reader.uid)
+                    .map((rule) => ({ path: rule.path, setting: rule.setting })),
+                group: rules
+                    .filter((rule) => rule.group !== undefined && reader.groups.includes(rule.group))
+                    .map((rule) => ({ path: rule.path, setting: rule.setting }))
+            };
+            // a grant on the reserved public group admits any caller, and it is
+            // checked before the rules so no user or group rule can take it away
+            const publicGroup = (await store.groups()).find((group) => group.name === 'public');
+            const publicGrants = publicGroup
+                ? rules
+                    .filter((rule) => rule.group === publicGroup.uid && rule.setting === 'Grant')
+                    .map((rule) => rule.path)
+                : [];
+            return {
+                paths: grantableRoutes.filter((path) => ALWAYS_VISIBLE_ROUTES.includes(path) ||
+                    publicGrants.includes(path) ||
+                    isRouteGranted(mine, path, topLevelRouteFor(path)))
+            };
+        },
         async listPermissions(caller) {
             const reader = await requireCaller(store, caller);
             const rules = await store.permissions();

package/build/esm/identity/routeAccess.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Which routes a caller may use, from the permission rules alone.
+ *
+ * This is the answer `GET /SASjsApi/info/myAuthorizedRoutes` gives, and it is the
+ * same decision the gate makes when the route is actually requested - a
+ * web interface that offers a route the gate then refuses is the bug this exists
+ * to prevent, so the two must not be two implementations. A host that gates its
+ * own middleware should call `isRouteGranted` rather than re-derive it.
+ */
+/** The two top-level routes, which a rule can address to cover everything below. */
+export declare const TOP_LEVEL_ROUTES: string[];
+/**
+ * Routes any authenticated caller may use whatever the rules say. `/AppStream` is
+ * the navigation page whose job is to list the apps the caller may open, so
+ * gating it on a grant that lists them would hide the page that leads to them.
+ */
+export declare const ALWAYS_VISIBLE_ROUTES: string[];
+/**
+ * The routes that accept a rule, before a host adds its own. A host with
+ * streamed applications extends this with `/AppStream/<app>` for each one, which
+ * is why the inventory is passed in rather than derived from a fixed list here.
+ */
+export declare const STATIC_AUTHORIZED_ROUTES: string[];
+/** The route inventory when the host states no additions of its own. */
+export declare const DEFAULT_GRANTABLE_ROUTES: string[];
+export interface RouteRule {
+    path: string;
+    setting: string;
+}
+/** The rules that can bear on one caller. */
+export interface RouteRules {
+    user: RouteRule[];
+    group: RouteRule[];
+}
+/**
+ * The top-level route that governs a request: `/SASjsApi/code/execute` is
+ * governed by `/SASjsApi`, and a rule on the top-level route applies to
+ * everything beneath it.
+ */
+export declare const topLevelRouteFor: (routePath: string) => string;
+/**
+ * Whether these rules grant access to `path`.
+ *
+ * The order is the documented one and the only implementation of it:
+ *
+ *   1. a rule addressed to the user on the path itself decides either way;
+ *   2. otherwise a rule addressed to the user on the top-level route decides;
+ *   3. otherwise a group grant on the path allows, and a group deny on the path
+ *      blocks the top-level check - but a grant from another group still allows;
+ *   4. otherwise a group grant on the top-level route allows;
+ *   5. otherwise denied.
+ *
+ * A grant beats a deny at the same level, which is why step 3 looks at every
+ * group rule rather than stopping at the first deny.
+ */
+export declare const isRouteGranted: (rules: RouteRules, path: string, topLevelRoute?: string) => boolean;
+//# sourceMappingURL=routeAccess.d.ts.map

package/build/esm/identity/routeAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routeAccess.d.ts","sourceRoot":"","sources":["../../../src/identity/routeAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,UAA8B,CAAA;AAE3D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAAiB,CAAA;AAEnD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,UASpC,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,UAGpC,CAAA;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,EAAE,CAAA;IACjB,KAAK,EAAE,SAAS,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,MAGrC,CAAA;AAQhB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,UAAU,EACjB,MAAM,MAAM,EACZ,gBAAe,MAA+B,KAC7C,OAcF,CAAA"}

package/build/esm/identity/routeAccess.js

@@ -0,0 +1,72 @@
+/**
+ * Which routes a caller may use, from the permission rules alone.
+ *
+ * This is the answer `GET /SASjsApi/info/myAuthorizedRoutes` gives, and it is the
+ * same decision the gate makes when the route is actually requested - a
+ * web interface that offers a route the gate then refuses is the bug this exists
+ * to prevent, so the two must not be two implementations. A host that gates its
+ * own middleware should call `isRouteGranted` rather than re-derive it.
+ */
+/** The two top-level routes, which a rule can address to cover everything below. */
+export const TOP_LEVEL_ROUTES = ['/AppStream', '/SASjsApi'];
+/**
+ * Routes any authenticated caller may use whatever the rules say. `/AppStream` is
+ * the navigation page whose job is to list the apps the caller may open, so
+ * gating it on a grant that lists them would hide the page that leads to them.
+ */
+export const ALWAYS_VISIBLE_ROUTES = ['/AppStream'];
+/**
+ * The routes that accept a rule, before a host adds its own. A host with
+ * streamed applications extends this with `/AppStream/<app>` for each one, which
+ * is why the inventory is passed in rather than derived from a fixed list here.
+ */
+export const STATIC_AUTHORIZED_ROUTES = [
+    '/SASjsApi/code/execute',
+    '/SASjsApi/stp/execute',
+    '/SASjsApi/drive/deploy',
+    '/SASjsApi/drive/deploy/upload',
+    '/SASjsApi/drive/file',
+    '/SASjsApi/drive/folder',
+    '/SASjsApi/drive/fileTree',
+    '/SASjsApi/drive/rename'
+];
+/** The route inventory when the host states no additions of its own. */
+export const DEFAULT_GRANTABLE_ROUTES = [
+    ...TOP_LEVEL_ROUTES,
+    ...STATIC_AUTHORIZED_ROUTES
+];
+/**
+ * The top-level route that governs a request: `/SASjsApi/code/execute` is
+ * governed by `/SASjsApi`, and a rule on the top-level route applies to
+ * everything beneath it.
+ */
+export const topLevelRouteFor = (routePath) => TOP_LEVEL_ROUTES.find((route) => routePath.toLowerCase().startsWith(route.toLowerCase())) ?? routePath;
+const settingOn = (rules, path) => rules.find((rule) => rule.path === path)?.setting;
+const GRANT = 'Grant';
+const DENY = 'Deny';
+/**
+ * Whether these rules grant access to `path`.
+ *
+ * The order is the documented one and the only implementation of it:
+ *
+ *   1. a rule addressed to the user on the path itself decides either way;
+ *   2. otherwise a rule addressed to the user on the top-level route decides;
+ *   3. otherwise a group grant on the path allows, and a group deny on the path
+ *      blocks the top-level check - but a grant from another group still allows;
+ *   4. otherwise a group grant on the top-level route allows;
+ *   5. otherwise denied.
+ *
+ * A grant beats a deny at the same level, which is why step 3 looks at every
+ * group rule rather than stopping at the first deny.
+ */
+export const isRouteGranted = (rules, path, topLevelRoute = topLevelRouteFor(path)) => {
+    const userSetting = settingOn(rules.user, path) ?? settingOn(rules.user, topLevelRoute);
+    if (userSetting)
+        return userSetting === GRANT;
+    const onPath = rules.group.filter((rule) => rule.path === path);
+    if (onPath.some((rule) => rule.setting === GRANT))
+        return true;
+    if (onPath.some((rule) => rule.setting === DENY))
+        return false;
+    return rules.group.some((rule) => rule.path === topLevelRoute && rule.setting === GRANT);
+};

package/build/esm/index.d.ts

@@ -25,10 +25,11 @@ export type { RouteMatch } from './routes/index.js';
 export { OVERLAY, TAG_CAPABILITIES } from './routes/overlay.js';
 export type { RouteOverlay } from './routes/overlay.js';
 export { dispatch, HANDLED_ROUTES } from './host/dispatch.js';
+export * from './identity/routeAccess.js';
 export type { ApiRequest, ApiResponse, Services } from './host/dispatch.js';
 export { createIdentityService } from './identity/service.js';
 export { createRecordService, sanitiseDisplayName } from './identity/records.js';
-export type { GroupDetailsResponse, GroupResponse, PermissionResponse, RecordService, UserDetailsResponse, UserResponse } from './identity/records.js';
+export type { AuthorizedRoutesResponse, GroupDetailsResponse, GroupResponse, PermissionResponse, RecordServiceOptions, RecordService, UserDetailsResponse, UserResponse } from './identity/records.js';
 export type { IdentityService, LoginResult, SessionResult } from './identity/service.js';
 export { MemoryIdentityStore } from './identity/memory-store.js';
 export { DEFAULT_IDENTITY, IDENTITY_FORMAT, parseIdentity } from './identity/fixture.js';

package/build/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7D,cAAc,2BAA2B,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}

package/build/esm/index.js

@@ -21,6 +21,8 @@ export { MemoryDriveStore } from './drive/memory-store.js';
 export { ROUTES, routeById, findRoute } from './routes/index.js';
 export { OVERLAY, TAG_CAPABILITIES } from './routes/overlay.js';
 export { dispatch, HANDLED_ROUTES } from './host/dispatch.js';
+// a host gating its own middleware reads the same decision the inventory reports
+export * from './identity/routeAccess.js';
 export { createIdentityService } from './identity/service.js';
 export { createRecordService, sanitiseDisplayName } from './identity/records.js';
 export { MemoryIdentityStore } from './identity/memory-store.js';

package/build/esm/routes/overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAiDD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAuNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}
+{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AA8CD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAmNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}

package/build/esm/routes/overlay.js

@@ -27,7 +27,6 @@ const EDITOR = 'Linting and formatting come from @sasjs/lint, which this package
 const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
 const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
 const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
-const PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
 const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
@@ -174,16 +173,12 @@ export const OVERLAY = {
     // Info - what the host is, and what this caller may use
     'GET /SASjsApi/info': { implemented: false, reason: HOST_CONFIG },
     'GET /SASjsApi/info/authorizedRoutes': {
-        implemented: false,
-        // the route inventory reports what the CALLER may use, so it needs an
-        // identity even though the rest of the Info tag needs nothing
-        capabilities: ['identity'],
-        reason: PERMISSIONS
+        implemented: true,
+        capabilities: ['identity']
     },
     'GET /SASjsApi/info/myAuthorizedRoutes': {
-        implemented: false,
-        capabilities: ['identity'],
-        reason: PERMISSIONS
+        implemented: true,
+        capabilities: ['identity']
     },
     // Permission - the rules the inventory above is derived from
     'GET /SASjsApi/permission': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",