@sixb/core 0.1.17 → 0.1.19

package/src/objects/sdk/file-handle.ts

@@ -0,0 +1,77 @@
+/**
+ * File handle factory for ObjectReadByIdHandle.
+ *
+ * Opens a `fileRef` property through the object that holds it, the way the object file content
+ * route does: the object is read again with the caller's permissions, the FileRef is resolved in
+ * that authorized row, then checked against the stored blob before it is opened.
+ */
+import { AuthorizationError } from "../../authorization/errors"
+import { jsonPointerSegment, openFileRef, resolveFileRefAtPath } from "../../blob-storage/internal"
+import type { Property } from "../../ontology"
+import { OntologyValidationError } from "../../ontology/errors"
+import type { PropertyToken } from "../../ontology/tokens"
+import { assertPropertyTokenBelongsToObjectType } from "../../ontology/validation"
+import type { ObjectFileHandle } from "../../runtime/types"
+import type { ObjectSetContext } from "../context"
+
+export function createObjectFileHandle(
+  ctx: ObjectSetContext,
+  primaryId: string,
+  property: PropertyToken<string, string, Property>,
+  index?: number
+): ObjectFileHandle {
+  const { objectType } = ctx
+  assertPropertyTokenBelongsToObjectType(objectType, property)
+  const registered = ctx.ontology
+    .resolveObjectType(objectType.id)
+    .properties.find((candidate) => candidate.id === property.id)
+  if (!registered) {
+    throw new OntologyValidationError(
+      `[Sixb] Unknown property '${property.id}' for object type '${objectType.id}'`
+    )
+  }
+  const path = filePropertyPath(objectType.id, registered, index)
+
+  return {
+    async open() {
+      const row = await ctx.objectReader.getByPrimaryId({ objectTypeId: objectType.id, primaryId })
+      if (!row) return null
+      if (row.redactions?.[property.id]) {
+        // Redacted, so the registered property has a marking the caller is not cleared for.
+        const markings = registered.markings ?? []
+        const marking =
+          markings.find((markingId) => !ctx.authorization?.clearances?.has(markingId)) ??
+          markings[0]
+        throw new AuthorizationError(
+          `clearance:marking:${marking}`,
+          `[Sixb] Cannot open file '${objectType.id}.${property.id}': it requires clearance for marking '${marking}'.`
+        )
+      }
+      const fileRef = resolveFileRefAtPath(row, path)
+      return fileRef ? openFileRef(ctx.blobStorage, fileRef) : null
+    },
+  }
+}
+
+/** JSON Pointer to the file in an object row, validated against the property's schema. */
+function filePropertyPath(objectTypeId: string, property: Property, index: number | undefined) {
+  const { schema } = property
+  const name = `${objectTypeId}.${property.id}`
+  if (schema === "fileRef") {
+    if (index !== undefined) {
+      throw new OntologyValidationError(`[Sixb] Property ${name} holds one file; omit the index.`)
+    }
+    return `/properties/${jsonPointerSegment(property.id)}`
+  }
+  if (typeof schema === "object" && schema.type === "array" && schema.items === "fileRef") {
+    if (index === undefined || !Number.isSafeInteger(index) || index < 0) {
+      throw new OntologyValidationError(
+        `[Sixb] Property ${name} holds a list of files; pass the index of the file to open.`
+      )
+    }
+    return `/properties/${jsonPointerSegment(property.id)}/${index}`
+  }
+  throw new OntologyValidationError(
+    `[Sixb] Property ${name} is not a file: file() takes a "fileRef" property or a list of them.`
+  )
+}

package/src/objects/sdk/object-handle.ts

@@ -5,26 +5,24 @@
  */
 
 import type { ActionDefinition } from "../../actions"
-import type { ObjectLink, ObjectRef } from "../../ontology"
+import type { ObjectLink, ObjectRef, Property } from "../../ontology"
 import { OntologyValidationError } from "../../ontology/errors"
-import type { LinkToken, ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
+import type { LinkToken, ObjectTypeWithPropertyTokens, PropertyToken } from "../../ontology/tokens"
 import { assertLinkTokenBelongsToObjectType } from "../../ontology/validation"
 import type { ObjectByIdHandle, TwinObject } from "../../runtime/types"
-import {
-  requestActionAndWait as requestActionAndWaitLeaf,
-  requestAction as requestActionLeaf,
-} from "../action"
-import type { ExecutionObjectContext, ResolvedLinkContext } from "../context"
+import { requestAction as requestActionLeaf } from "../action"
+import type { ObjectSetContext, ResolvedLinkContext } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
 import { deleteObject, restoreObject } from "../object"
 import { createObjectVectorHandle } from "../vectors/handle"
+import { createObjectFileHandle } from "./file-handle"
 import { createTelemetryChannel } from "./telemetry-channel"
 
 type ObjectRefInput = ObjectRef
 type AnyLinkToken = LinkToken<string, string, string | readonly string[], ObjectLink>
 
 export function createObjectByIdHandle<TObjectType extends ObjectTypeWithPropertyTokens>(
-  ctx: ExecutionObjectContext,
+  ctx: ObjectSetContext,
   primaryId: string
 ): ObjectByIdHandle<TObjectType> {
   const objectHandle = {
@@ -90,6 +88,7 @@ export function createObjectByIdHandle<TObjectType extends ObjectTypeWithPropert
       actionId?: string
       params?: Record<string, unknown>
       runId?: string
+      signal?: AbortSignal
     }) => {
       const actionId = input.action?.id ?? input.actionId
       if (!actionId) {
@@ -101,35 +100,14 @@ export function createObjectByIdHandle<TObjectType extends ObjectTypeWithPropert
         primaryId,
         actionId,
         params: input.params,
-        options: { runId: input.runId },
-      })
-    },
-
-    requestActionAndWait: async (input: {
-      action?: ActionDefinition
-      actionId?: string
-      params?: Record<string, unknown>
-      timeoutMs?: number
-      signal?: AbortSignal
-    }) => {
-      const actionId = input.action?.id ?? input.actionId
-      if (!actionId) {
-        throw new OntologyValidationError(
-          "[Sixb] requestActionAndWait requires either 'action' or 'actionId'"
-        )
-      }
-      return requestActionAndWaitLeaf(ctx, {
-        primaryId,
-        actionId,
-        params: input.params,
-        options: {
-          timeoutMs: input.timeoutMs,
-          signal: input.signal,
-        },
+        options: { runId: input.runId, signal: input.signal },
       })
     },
 
     telemetry: createTelemetryChannel<TObjectType>(ctx, primaryId),
+
+    file: (property: PropertyToken<string, string, Property>, index?: number) =>
+      createObjectFileHandle(ctx, primaryId, property, index),
   }
 
   return objectHandle as unknown as ObjectByIdHandle<TObjectType>

package/src/objects/sdk/object-set.ts

@@ -5,7 +5,9 @@
  */
 
 import type { ActionDefinition } from "../../actions"
+import { shareActionRunExecutor } from "../../actions/run/executor"
 import type { AuthorizationContext } from "../../authorization"
+import type { BlobStorage } from "../../blob-storage"
 import { shareSixbErrorReporter } from "../../error-reporting/capability"
 import type { ExecutionContext } from "../../execution"
 import { assertAuthorizedObjectReaderBinding } from "../../execution/authorized-object-reader"
@@ -18,11 +20,8 @@ import type {
   SixbRuntimeContext,
   TwinObject,
 } from "../../runtime/types"
-import {
-  requestActionAndWait as requestActionAndWaitLeaf,
-  requestAction as requestActionLeaf,
-} from "../action"
-import type { ExecutionObjectContext, ResolvedLinkContext } from "../context"
+import { requestAction as requestActionLeaf } from "../action"
+import type { ObjectSetContext, ResolvedLinkContext } from "../context"
 import { requireLinkDefinition } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
 import { upsertObject as upsertObjectLeaf } from "../object"
@@ -36,6 +35,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
     readonly execution: ExecutionContext
     readonly objectType: TObjectType
     readonly authorization?: AuthorizationContext
+    readonly blobStorage: Pick<BlobStorage, "stat" | "open">
   }
 ): ObjectSet<TObjectType> {
   assertAuthorizedObjectReaderBinding({
@@ -67,7 +67,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
     objectReader,
   })
 
-  const resolvedCtx: ExecutionObjectContext = {
+  const resolvedCtx: ObjectSetContext = {
     embeddingModels: params.embeddingModels,
     projectId,
     broker,
@@ -80,11 +80,13 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
     runtimeAuthorization,
     authorization,
     execution,
+    blobStorage: params.blobStorage,
     objectType,
     primaryPropertyId,
   }
   shareOntologyMutationRuntime(params, resolvedCtx)
   shareSixbErrorReporter(params, resolvedCtx)
+  shareActionRunExecutor(params, resolvedCtx)
 
   const objectSet = {
     get: async (id: string) => {
@@ -146,6 +148,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
       actionId?: string
       params?: Record<string, unknown>
       runId?: string
+      signal?: AbortSignal
     }) => {
       const actionId = input.action?.id ?? input.actionId
       if (!actionId) {
@@ -157,32 +160,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
         primaryId: input.id,
         actionId,
         params: input.params,
-        options: { runId: input.runId },
-      })
-    },
-
-    requestActionAndWait: async (input: {
-      id: string
-      action?: ActionDefinition
-      actionId?: string
-      params?: Record<string, unknown>
-      timeoutMs?: number
-      signal?: AbortSignal
-    }) => {
-      const actionId = input.action?.id ?? input.actionId
-      if (!actionId) {
-        throw new OntologyValidationError(
-          "[Sixb] requestActionAndWait requires either 'action' or 'actionId'"
-        )
-      }
-      return requestActionAndWaitLeaf(resolvedCtx, {
-        primaryId: input.id,
-        actionId,
-        params: input.params,
-        options: {
-          timeoutMs: input.timeoutMs,
-          signal: input.signal,
-        },
+        options: { runId: input.runId, signal: input.signal },
       })
     },
 

package/src/objects/service/index.ts

@@ -1,4 +1,3 @@
-export { requestAction, requestActionAndWait } from "./action-service"
 export { removeLink, upsertLink, upsertLinkBatch } from "./link-service"
 export type { ListObjectsParams } from "./list-service"
 export { listObjects } from "./list-service"

package/src/ontology/builders.ts

@@ -26,6 +26,8 @@
  * ```
  */
 
+import { markingIdsFrom } from "../security/builders"
+import type { MarkingDefinition } from "../security/types"
 import type { ObjectTypeWithPropertyTokens, ObjectTypeWithTokens } from "./tokens"
 import { createLinkTokenMap, createPropertyTokenMap } from "./tokens"
 import type {
@@ -353,8 +355,17 @@ type PropertyOptions = {
   mode?: PropertyMode
   semanticType?: QuantitativeTypeId
   query?: PropertyQueryMetadata
+  /** Readers need a clearance for every marking to receive this property's value. */
+  markings?: readonly MarkingDefinition[]
 }
 
+/** The property records marking ids; only a declared, non-empty list marks it. */
+type MarkingsFromOptions<TOptions> = TOptions extends {
+  markings: readonly [MarkingDefinition, ...MarkingDefinition[]]
+}
+  ? { markings: readonly string[] }
+  : { markings?: readonly string[] }
+
 type PropertyResult<
   TId extends string,
   TSchema extends Schema,
@@ -369,7 +380,8 @@ type PropertyResult<
   FieldFromOptions<TOptions, "primary", true> &
   FieldFromOptions<TOptions, "mode", PropertyMode> &
   FieldFromOptions<TOptions, "semanticType", QuantitativeTypeId> &
-  FieldFromOptions<TOptions, "query", PropertyQueryMetadata>
+  FieldFromOptions<TOptions, "query", PropertyQueryMetadata> &
+  MarkingsFromOptions<TOptions>
 
 /**
  * Shorthand for creating a {@link Property}.
@@ -396,11 +408,15 @@ export function prop<
   const TOptions extends PropertyOptions,
 >(id: TId, schema: TSchema, options: TOptions): PropertyResult<TId, TSchema, TOptions>
 export function prop(id: string, schema: Schema, options?: PropertyOptions): Property {
+  const { markings, ...rest } = options ?? {}
   return {
     id,
     name: options?.name ?? id,
     schema,
-    ...options,
+    ...rest,
+    ...(markings && markings.length > 0
+      ? { markings: markingIdsFrom(markings, `Property '${id}' markings`) }
+      : {}),
   }
 }