@sixb/core 0.1.1 → 0.1.3

package/dist/{chunk-xt6qx9sh.js → chunk-d2adj15j.js}

@@ -15,8 +15,9 @@ import {
   GRANT_KINDS,
   canAccessApplication,
   grantKindOf,
-  resolveAuthorizationContext
-} from "./chunk-exrfbt2d.js";
+  resolveAuthorizationContext,
+  resolveRoleGrants
+} from "./chunk-4z3n1dzt.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -210,7 +211,8 @@ var GRANT_CAPABILITIES = Object.keys({
   append: true,
   apply: true,
   run: true,
-  observe: true
+  observe: true,
+  manage: true
 });
 function formatAlternatives(values) {
   const quoted = values.map((value) => `'${value}'`);
@@ -327,6 +329,9 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (value.capability === "observe" && value.target !== "logs") {
     throw createError(`[Sixb] ${field} observe grant target must be 'logs'.`);
   }
+  if (value.capability === "manage" && value.target !== undefined) {
+    throw createError(`[Sixb] ${field} manage grant must not declare a target.`);
+  }
   assertSelection(value.selection, field, createError);
 }
 function assertSelection(value, field, createError) {
@@ -526,7 +531,8 @@ var BREADTH_TARGETS = [
   "sync",
   "pipeline",
   "agent",
-  "application"
+  "application",
+  "connector"
 ];
 function isBreadthSelector(value) {
   if (typeof value !== "object" || value === null)
@@ -560,7 +566,8 @@ var every = {
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
   agent: () => all("agent"),
-  application: () => all("application")
+  application: () => all("application"),
+  connector: () => all("connector")
 };
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
@@ -571,7 +578,8 @@ var TARGET_BY_DEFINITION_KIND = {
   pipeline: "pipeline",
   agent: "agent",
   workflow: "workflow",
-  application: "application"
+  application: "application",
+  connector: "connector"
 };
 var UNDISCRIMINATED_TARGETS = ["object", "action"];
 function targetOfDefinition(item, label, allowedTargets) {
@@ -658,6 +666,13 @@ function observe(target) {
     selection: { all: false, ids: [target] }
   };
 }
+function manage(input) {
+  return {
+    kind: "grant",
+    capability: "manage",
+    selection: resolveGrant(input, "can.manage", ["connector"]).selection
+  };
+}
 var can = {
   access,
   view,
@@ -665,8 +680,75 @@ var can = {
   append,
   apply,
   run,
-  observe
+  observe,
+  manage
 };
+// src/security/registry.ts
+class SecurityRegistry {
+  groupsById;
+  rolesById;
+  membershipPoliciesById;
+  resolvedRoles;
+  constructor(input) {
+    const definitions = validateSecurityDefinitionsAtStartup({
+      groups: input.groups ?? [],
+      roles: input.roles ?? [],
+      membershipPolicies: input.membershipPolicies ?? [],
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds,
+      datasetIds: input.datasetIds,
+      actionIds: input.actionIds,
+      workflowIds: input.workflowIds,
+      syncIds: input.syncIds,
+      pipelineIds: input.pipelineIds,
+      agentIds: input.agentIds,
+      connectorIds: input.connectorIds,
+      observableIds: new Set(["logs"])
+    });
+    const universe = {
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds ?? new Set,
+      datasetIds: input.datasetIds ?? new Set,
+      actionIds: input.actionIds ?? new Set,
+      workflowIds: input.workflowIds ?? new Set,
+      syncIds: input.syncIds ?? new Set,
+      pipelineIds: input.pipelineIds ?? new Set,
+      agentIds: input.agentIds ?? new Set,
+      connectorIds: input.connectorIds ?? new Set,
+      observableIds: new Set(["logs"]),
+      getSubTypes: input.getSubTypes ?? (() => [])
+    };
+    this.groupsById = definitions.groupsById;
+    this.rolesById = definitions.rolesById;
+    this.membershipPoliciesById = definitions.membershipPoliciesById;
+    this.resolvedRoles = definitions.roles.map((role) => ({
+      id: role.id,
+      grantedToGroupIds: role.grantedToGroupIds,
+      grants: resolveRoleGrants(role, universe)
+    }));
+  }
+  listGroups() {
+    return [...this.groupsById.values()];
+  }
+  getGroupById(groupId) {
+    return this.groupsById.get(groupId) ?? null;
+  }
+  listRoles() {
+    return [...this.rolesById.values()];
+  }
+  getRoleById(roleId) {
+    return this.rolesById.get(roleId) ?? null;
+  }
+  listResolvedRoles() {
+    return this.resolvedRoles;
+  }
+  listMembershipPolicies() {
+    return [...this.membershipPoliciesById.values()];
+  }
+  getMembershipPolicyById(policyId) {
+    return this.membershipPoliciesById.get(policyId) ?? null;
+  }
+}
 // src/storage/auth/errors.ts
 class AuthStorageError extends Error {
   code;
@@ -2949,6 +3031,6 @@ var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
 function principalsEqual(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, APPLICATION_IDS, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup, defineRole, defineMembershipPolicy, every, can, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
 
-//# debugId=76194AFCF3E3EC0564756E2164756E21
+//# debugId=698DF2CA1C4F721C64756E2164756E21