@selvajs/server 1.5.0-beta.7 → 1.5.0-beta.8

package/dist/tokens/api-token-holder.d.ts

@@ -1,14 +1,30 @@
-import { type RequestContext } from '@selvajs/platform';
+import { type ApiScope, type RequestContext } from '@selvajs/platform';
+import { type VisibilityDeps } from '../definitions/visibility.js';
 /**
- * Who may hold API tokens in the context's acting org, decided by the host.
- * Without one, holding a key needs the platform permission `manage_api_tokens`.
+ * Who may hold an API token with `scopes` in the context's acting org, decided
+ * by the host. It replaces the default rule ({@link canHoldApiTokens}) whole.
  *
  * Asked at mint, and again by the resolver on every request against the
  * owner's live context in the token's org, so a key stops working (403
  * `API_TOKEN_HOLDER_REFUSED`) the moment its owner no longer qualifies,
  * without being revoked.
  */
-export type ApiTokenHolderPolicy = (ctx: RequestContext) => boolean;
-/** The one place the "no policy means `manage_api_tokens`" default lives. */
-export declare function canHoldApiTokens(ctx: RequestContext, policy?: ApiTokenHolderPolicy): boolean;
+export type ApiTokenHolderPolicy = (ctx: RequestContext, scopes: readonly ApiScope[]) => boolean | Promise<boolean>;
+export interface ApiTokenHolderOptions {
+    policy?: ApiTokenHolderPolicy;
+    /** What the default rule reads to find a project the owner may create a definition in. */
+    deps: VisibilityDeps;
+}
+/**
+ * May `ctx` hold a key with `scopes` in its acting org? Without a host policy:
+ *
+ * - `manage_api_tokens` holds any key.
+ * - A key that only reads and uploads needs only the right to create a
+ *   definition in one project of the org. It can do nothing the owner's
+ *   browser session can't.
+ *
+ * A scope this version can't parse counts as broad, so it needs
+ * `manage_api_tokens`.
+ */
+export declare function canHoldApiTokens(ctx: RequestContext, scopes: readonly string[], { policy, deps }: ApiTokenHolderOptions): Promise<boolean>;
 //# sourceMappingURL=api-token-holder.d.ts.map

package/dist/tokens/api-token-holder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-holder.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;AAEpE,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAE5F"}
+{"version":3,"file":"api-token-holder.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE7F;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAClC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,QAAQ,EAAE,KACvB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,qBAAqB;IACrC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,0FAA0F;IAC1F,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,qBAAqB,GACrC,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/tokens/api-token-holder.js

@@ -1,6 +1,27 @@
-import { hasPermission } from '@selvajs/platform';
-/** The one place the "no policy means `manage_api_tokens`" default lives. */
-export function canHoldApiTokens(ctx, policy) {
-    return policy ? policy(ctx) : hasPermission(ctx, 'manage_api_tokens');
+import { hasPermission, parseApiScope } from '@selvajs/platform';
+import { canCreateDefinitionInOrg } from '../definitions/visibility.js';
+/**
+ * May `ctx` hold a key with `scopes` in its acting org? Without a host policy:
+ *
+ * - `manage_api_tokens` holds any key.
+ * - A key that only reads and uploads needs only the right to create a
+ *   definition in one project of the org. It can do nothing the owner's
+ *   browser session can't.
+ *
+ * A scope this version can't parse counts as broad, so it needs
+ * `manage_api_tokens`.
+ */
+export async function canHoldApiTokens(ctx, scopes, { policy, deps }) {
+    const parsed = scopes.map(parseApiScope).filter((s) => s !== null);
+    if (policy)
+        return policy(ctx, parsed);
+    if (hasPermission(ctx, 'manage_api_tokens'))
+        return true;
+    const readAndUploadOnly = parsed.length > 0 &&
+        parsed.length === scopes.length &&
+        parsed.every((s) => s.action === 'read' || s.action === 'upload');
+    if (!readAndUploadOnly || !ctx.actingOrgId)
+        return false;
+    return canCreateDefinitionInOrg(ctx, ctx.actingOrgId, deps);
 }
 //# sourceMappingURL=api-token-holder.js.map

package/dist/tokens/api-token-holder.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-holder.js","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAuB,MAAM,mBAAmB,CAAC;AAavE,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,MAA6B;IAClF,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"api-token-holder.js","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,aAAa,EAGb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAuB,MAAM,8BAA8B,CAAC;AAsB7F;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAmB,EACnB,MAAyB,EACzB,EAAE,MAAM,EAAE,IAAI,EAAyB;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,iBAAiB,GACtB,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/tokens/index.d.ts

@@ -1,4 +1,4 @@
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken, type ApiTokenCodec } from './api-token-codec.js';
-export { canHoldApiTokens, type ApiTokenHolderPolicy } from './api-token-holder.js';
+export { canHoldApiTokens, type ApiTokenHolderOptions, type ApiTokenHolderPolicy } from './api-token-holder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC"}

package/dist/tokens/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAGhB,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.5.0-beta.7",
+  "version": "1.5.0-beta.8",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -115,10 +115,10 @@
   ],
   "dependencies": {
     "zod": "^4.6.5",
-    "@selvajs/compute": "^4.2.2-beta.0",
-    "@selvajs/notifications": "^0.3.0-beta.2",
-    "@selvajs/platform": "^0.21.0-beta.2",
-    "@selvajs/schemas": "^5.2.0"
+    "@selvajs/platform": "^0.21.0-beta.3",
+    "@selvajs/schemas": "^5.3.0-beta.0",
+    "@selvajs/notifications": "^0.3.0-beta.3",
+    "@selvajs/compute": "^4.3.0-beta.1"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
@@ -143,7 +143,7 @@
     "typescript": "~6.0.3",
     "vitest": "^5.0.2",
     "@selvajs/config": "0.0.4",
-    "@selvajs/local-provider": "0.16.0-beta.1"
+    "@selvajs/local-provider": "0.16.0-beta.2"
   },
   "scripts": {
     "build": "tsc",