@segmentstream-cloud/app 0.11.0 → 0.12.0

package/dist/permissions.d.ts

@@ -1,7 +1,8 @@
 /**
  * Permissions are `<entity>:<verb>` strings, such as `lead:changeStatus`. A role may use `*` for the
  * entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
- * holds a wildcard.
+ * holds a wildcard. A wildcard entity does not cover the built-in `agent_chat`: only a permission
+ * that names it does.
  *
  * The matching rule is the ontology service's, copied from `@segmentstream-cloud/ontology`
  * (`src/permissions.ts`) so that the app SDK and its browser components do not depend on the

package/dist/permissions.js

@@ -1,7 +1,8 @@
 /**
  * Permissions are `<entity>:<verb>` strings, such as `lead:changeStatus`. A role may use `*` for the
  * entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
- * holds a wildcard.
+ * holds a wildcard. A wildcard entity does not cover the built-in `agent_chat`: only a permission
+ * that names it does.
  *
  * The matching rule is the ontology service's, copied from `@segmentstream-cloud/ontology`
  * (`src/permissions.ts`) so that the app SDK and its browser components do not depend on the
@@ -9,6 +10,8 @@
  */
 import { toSnakeCase } from "./ontology-names.js";
 const WILDCARD = "*";
+/** Entities only a permission that names them covers; `*:read` and `*:*` grant nothing on them. */
+const EXPLICIT_GRANT_ENTITIES = new Set(["agent_chat"]);
 /** `<entity>:<verb>` with lowercase snake_case entities and lowercase snake_case verbs, or `*` for either. */
 const PERMISSION = /^(\*|[a-z][a-zA-Z0-9]*(?:_[a-z0-9]+)*):(\*|[a-z][a-zA-Z0-9]*(?:_[a-z0-9]+)*)$/;
 function parsePermission(value) {
@@ -27,7 +30,9 @@ export function grants(granted, required) {
     if (held === undefined || wanted === undefined) {
         return false;
     }
-    return ((held.entity === WILDCARD || held.entity === wanted.entity) &&
+    return ((held.entity === WILDCARD
+        ? !EXPLICIT_GRANT_ENTITIES.has(wanted.entity)
+        : held.entity === wanted.entity) &&
         (held.verb === WILDCARD || held.verb === wanted.verb));
 }
 /** Whether one of the holder's permissions equals `required` or covers it through a wildcard. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",