@sixb/core 0.1.20 → 0.1.22

package/src/actions/execution.ts

@@ -1,4 +1,4 @@
-import { canViewActionRun, isAllowed } from "../authorization"
+import { isAllowed } from "../authorization"
 import type { ExecutionContext } from "../execution"
 import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import {
@@ -15,7 +15,13 @@ import type {
 import { assertObjectReadOutputWithinLimit } from "../storage/objects/execution-limits"
 import { type ActionDescriptor, snapshotActionDescriptor } from "./descriptor"
 import { type RequestActionInput, requestAction } from "./request"
-import { canDelegationAccessActionRun } from "./run-authorization"
+import {
+  canDelegationAccessActionRun,
+  canReadActionRunSubject,
+  readableSubjects,
+  unreadableActionRunTypes,
+  viewableActionRuns,
+} from "./run-authorization"
 import type { ActionDefinition } from "./types"
 
 export interface ActionRunsRuntime {
@@ -71,14 +77,17 @@ export function createActionsRuntime(
       )
     }
     if (authorization.type === "unrestricted") return true
-    return (
-      isAllowed(authorization.context, { kind: "action.apply", actionId: action.id }) &&
-      (action.binding.kind === "global" ||
-        isAllowed(authorization.context, {
-          kind: "object.view",
-          objectTypeId: action.binding.objectType.id,
-        }))
-    )
+    if (!isAllowed(authorization.context, { kind: "action.apply", actionId: action.id })) {
+      return false
+    }
+    if (action.binding.kind === "global") return true
+
+    // A type viewed through a condition is viewable as the reader decides it: its requests then
+    // name objects the reader sees.
+    const objectTypeId = action.binding.objectType.id
+    return objectReader.viewsThroughCondition(objectTypeId)
+      ? getAuthorizedOntologyView(objectReader).getObjectTypeById(objectTypeId) !== null
+      : isAllowed(authorization.context, { kind: "object.view", objectTypeId })
   }
 
   const release = <T>(value: T): T => {
@@ -123,34 +132,57 @@ export function createActionsRuntime(
           })) ?? null
         return run &&
           (authorization.type === "unrestricted" ||
-            (authorization.type === "principal" && canViewActionRun(authorization.context, run)) ||
+            (authorization.type === "principal" &&
+              (await viewableActionRuns(objectReader, authorization.context, [run])).length > 0) ||
             (authorization.type === "delegated" &&
               (await canDelegationAccessActionRun({
                 storage: runtime.storage,
                 projectId,
                 authority: authorization,
                 run,
-              }))))
+              })))) &&
+          (await canReadActionRunSubject(objectReader, run))
           ? release(run)
           : null
       },
-      list: (input = {}) => {
+      list: async (input = {}) => {
         if (authorization.type === "denied" || authorization.type === "delegated") {
-          return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+          return { runs: [], hasMore: false, total: 0 }
         }
         const storage = runtime.storage.actionRuns
-        if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        if (!storage) return { runs: [], hasMore: false, total: 0 }
+        if (authorization.type === "unrestricted") return storage.list({ ...input, projectId })
+
+        // Storage filters, so its pages and totals only count runs the reader can see. A run on a
+        // type viewed through a condition shows only through its subject: a listing that names
+        // one the reader reads now includes it, every other listing leaves the type out. HTTP
+        // names it by objectTypeId and primaryId.
+        const context = authorization.context
+        const unreadable = await unreadableActionRunTypes(objectReader)
+        const objectTypeIds = [...context.grants["view:object"]].filter(
+          (objectTypeId) => !unreadable.has(objectTypeId)
+        )
+
+        const subject =
+          input.subject ??
+          (input.objectTypeId !== undefined && input.primaryId !== undefined
+            ? {
+                kind: "object" as const,
+                objectTypeId: input.objectTypeId,
+                primaryId: input.primaryId,
+              }
+            : undefined)
+        if (subject?.kind === "object" && context.viewConditions?.has(subject.objectTypeId)) {
+          const readable = await readableSubjects(objectReader, [subject])
+          if (readable.size === 0) return { runs: [], hasMore: false, total: 0 }
+          objectTypeIds.push(subject.objectTypeId)
+        }
+
         return storage.list({
           ...input,
           projectId,
-          actionIds:
-            authorization.type === "principal"
-              ? [...authorization.context.grants["apply:action"]]
-              : undefined,
-          objectTypeIds:
-            authorization.type === "principal"
-              ? [...authorization.context.grants["view:object"]]
-              : undefined,
+          actionIds: [...context.grants["apply:action"]],
+          objectTypeIds,
         })
       },
     },

package/src/actions/read-facade.ts

@@ -25,6 +25,7 @@ import type {
   ObjectRow,
   TimeseriesHistoryBatchInput,
   TimeseriesHistoryBatchResult,
+  UniqueValueRef,
 } from "../storage"
 import type { ActionReadDependencies } from "./commit-edits"
 import type {
@@ -55,6 +56,7 @@ export class ActionReadRecorder {
   private readonly objects = new Map<string, ExpectedObjectRevision>()
   private readonly links = new Map<string, ExpectedLinkRevision>()
   private readonly linkScopes = new Map<string, ExpectedLinkScopeRevision>()
+  private readonly unclaimedValues = new Map<string, UniqueValueRef>()
 
   /** Records a concrete object read, including exact absence. */
   observeObject(ref: OntologyObjectRef, row: ObjectRow | null): void {
@@ -143,11 +145,27 @@ export class ActionReadRecorder {
     )
   }
 
+  /**
+   * Records a unique value no object held. A holder that appears before the commit, such as one a
+   * concurrent run created, replays the Action instead of failing its own create on the duplicate.
+   */
+  observeUnclaimedValue(value: UniqueValueRef): void {
+    this.unclaimedValues.set(
+      JSON.stringify([value.objectTypeId, value.propertyId, value.valueKey]),
+      {
+        objectTypeId: value.objectTypeId,
+        propertyId: value.propertyId,
+        valueKey: value.valueKey,
+      }
+    )
+  }
+
   dependencies(): ActionReadDependencies {
     return {
       objects: [...this.objects.values()],
       links: [...this.links.values()],
       linkScopes: [...this.linkScopes.values()],
+      unclaimedValues: [...this.unclaimedValues.values()],
     }
   }
 }
@@ -163,6 +181,8 @@ export interface ActionReadFacadeOptions {
    * recorded scopes.
    */
   readonly resolveLinkIds: (objectTypeId: string) => readonly string[]
+  /** The key a unique value is stored under, as `getBy` computes it. */
+  readonly uniqueValueKey: (objectTypeId: string, propertyId: string, value: unknown) => string
   /** Canonical authorized telemetry history leaf. Omitted only by isolated facade consumers. */
   readonly telemetry?: ActionTelemetryReadSource
 }
@@ -292,6 +312,19 @@ function recordObjectReads<TObjectType extends ObjectTypeWithPropertyTokens>(
       recorder.observeObject(ref(id), row && storageRow(row))
       return row
     },
+    async getBy(property, value) {
+      const row = await objectSet.getBy(property, value)
+      if (row) {
+        recorder.observeObject(ref(row.primaryId), storageRow(row))
+      } else {
+        recorder.observeUnclaimedValue({
+          objectTypeId: objectType.id,
+          propertyId: property.id,
+          valueKey: options.uniqueValueKey(objectType.id, property.id, value),
+        })
+      }
+      return row
+    },
     query() {
       // Recording at the executor covers every terminal of every refinement, present and future.
       return decorateObjectQueryExecutor(objectSet.query(), (executor) =>

package/src/actions/request.ts

@@ -1,4 +1,4 @@
-import { AuthorizationError, assertAuthorized, canViewActionRun } from "../authorization"
+import { AuthorizationError, assertAuthorized } from "../authorization"
 import {
   getAuthorizationRef,
   type ResolvedRuntimeAuthorization,
@@ -10,18 +10,25 @@ import {
   executionRecordInputFromRuntime,
 } from "../execution/durable"
 import type { ExecutionContext } from "../execution/types"
+import type { ObjectRef } from "../ontology"
 import { OntologyValidationError } from "../ontology/errors"
+import { isObjectRefSchema } from "../ontology/refs"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
 import type { SixbRuntimeContext } from "../runtime/types"
 import { assertParamUsersActive } from "../shared/params/user-refs"
-import type { ActionRunRecord } from "../storage"
+import { type ActionRunRecord, ObjectNotFoundError, objectBatchKey } from "../storage"
+import type { ActionRunParams } from "../storage/action-runs/types"
 import {
   assertObjectReadOutputWithinLimit,
   ObjectReadLimitExceededError,
 } from "../storage/objects/execution-limits"
 import { admitDelegatedObjectAction, assertDelegatedActionTarget } from "./delegated-admission"
 import { getActionRunExecutor } from "./run/executor"
-import { actionRunBelongsToShareGrant } from "./run-authorization"
+import {
+  actionRunBelongsToShareGrant,
+  canReadActionRunSubject,
+  viewableActionRuns,
+} from "./run-authorization"
 import { createActionRunId } from "./run-id"
 import { type ExistingActionRun, persistActionRun } from "./run-persistence"
 import type { ActionDefinition, ActionSubject } from "./types"
@@ -68,68 +75,10 @@ export async function requestAction(
   execution: ExecutionContext,
   input: RequestActionInput
 ): Promise<ActionRunRecord> {
-  // Capture the three process-local capabilities before caller-owned request getters can run.
-  const projectId = runtime.projectId
-  const runtimeAuthorization = runtime.runtimeAuthorization
-  const objectReader = runtime.objectReader
-  const request = snapshotActionRequest(input)
-  const authorization = resolveExecutionScopeAuthorization(projectId, {
-    execution,
-    authorization: runtimeAuthorization,
-  })
-  const subject = request.subject
-  const delegatedSubject =
-    authorization.type === "delegated"
-      ? assertDelegatedActionTarget({
-          authorization,
-          actionId: request.actionId,
-          subject,
-        })
-      : undefined
-  const action = getActionDefinition(runtime, request.actionId)
+  const admitted = await admitActionRequest(runtime, execution, input)
+  const { projectId, runtimeAuthorization, objectReader, authorization, request } = admitted
+  const { action, subject, pathPrefix, actionParams } = admitted
   const actionId = action.id
-  const rawParams = request.params
-
-  if (authorization.type === "delegated") {
-    await admitDelegatedObjectAction({
-      objectReader,
-      runtimeAuthorization,
-      execution,
-      authorization,
-      action,
-      subject: delegatedSubject!,
-    })
-  } else {
-    assertAuthorized({ projectId, runtimeAuthorization }, { kind: "action.apply", actionId })
-  }
-  if (authorization.type !== "delegated" && action.binding.kind === "object") {
-    // Object actions require visibility of the type they are bound to, as listing them does.
-    assertAuthorized(
-      { projectId, runtimeAuthorization },
-      { kind: "object.view", objectTypeId: action.binding.objectType.id }
-    )
-  }
-
-  validateActionSubject(action, subject)
-
-  let pathPrefix = action.id
-  let objectType: ObjectTypeWithPropertyTokens | null = null
-
-  if (isObjectActionDefinition(action)) {
-    objectType = resolveObjectActionSubject({ runtime, action, subject })
-    pathPrefix = `${objectType.id}.${action.id}`
-    if (authorization.type !== "delegated") {
-      // A run is visible to whoever may view its subject's type (`canViewActionRun`). A subtype
-      // excluded from a broad grant is not visible through its parent, so admitting the request on
-      // the bound type alone would run what its caller can never read back.
-      assertAuthorized(
-        { projectId, runtimeAuthorization },
-        { kind: "object.view", objectTypeId: objectType.id }
-      )
-    }
-  }
-
-  const actionParams = normalizeActionParams(runtime, action.params, rawParams, pathPrefix)
   const runId = createActionRunId(request.runId)
 
   // `persistActionRun` checks an existing run id before creating its durable execution. Keep
@@ -141,7 +90,13 @@ export async function requestAction(
 
   const payload = { actionId, subject, params: actionParams }
   const assertCanReuse = (run: ExistingActionRun) =>
-    assertCallerMayHaveRun({ storage: runtime.storage, projectId, authorization, run })
+    assertCallerMayHaveRun({
+      storage: runtime.storage,
+      projectId,
+      authorization,
+      objectReader,
+      run,
+    })
   const persist = () =>
     persistActionRun({
       projectId,
@@ -177,6 +132,12 @@ export async function requestAction(
       },
     })
 
+  // The request saw its subject; the run reads it again, and must find a state its requester sees.
+  const conditioned =
+    authorization.type === "principal" &&
+    subject.kind === "object" &&
+    objectReader.viewsThroughCondition(subject.objectTypeId)
+
   const run = await executor.request({
     runId,
     payload,
@@ -184,10 +145,214 @@ export async function requestAction(
     assertCanReuse,
     signal: request.signal,
     onRequested: request.onRequested,
+    ...(conditioned
+      ? {
+          readSubjectAsRequester: ({ objectTypeId, primaryId }) =>
+            objectReader.getByPrimaryId({ objectTypeId, primaryId }),
+        }
+      : {}),
   })
   return enforceDelegatedOutputBudget(authorization, run)
 }
 
+/** An Action request as it would run: admitted, and its params normalized. */
+export interface PreparedActionRequest {
+  readonly actionId: string
+  readonly subject: ActionSubject
+  readonly params: ActionRunParams
+  /** `external` when the Action has a writeback or effects: it reaches beyond Sixb. */
+  readonly effect: "ontology" | "external"
+}
+
+/**
+ * Admit an Action request without running it: the checks and the params `requestAction` applies
+ * before anything is persisted. The agent API gateway prepares the calls it holds for approval.
+ */
+export async function prepareActionRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  input: Pick<RequestActionInput, "actionId" | "subject" | "params">
+): Promise<PreparedActionRequest> {
+  const { action, subject, actionParams } = await admitActionRequest(runtime, execution, input)
+
+  return {
+    actionId: action.id,
+    subject,
+    params: actionParams,
+    effect:
+      action.phases.writeback !== undefined || action.phases.effects !== undefined
+        ? "external"
+        : "ontology",
+  }
+}
+
+/**
+ * Who may request the Action on this subject, and its normalized params, with the capabilities the
+ * request runs with. Persists nothing.
+ */
+async function admitActionRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  input: RequestActionInput
+) {
+  // Capture the three process-local capabilities before caller-owned request getters can run.
+  const projectId = runtime.projectId
+  const runtimeAuthorization = runtime.runtimeAuthorization
+  const objectReader = runtime.objectReader
+  const request = snapshotActionRequest(input)
+  const authorization = resolveExecutionScopeAuthorization(projectId, {
+    execution,
+    authorization: runtimeAuthorization,
+  })
+  const subject = request.subject
+  const delegatedSubject =
+    authorization.type === "delegated"
+      ? assertDelegatedActionTarget({
+          authorization,
+          actionId: request.actionId,
+          subject,
+        })
+      : undefined
+  const action = getActionDefinition(runtime, request.actionId)
+  const rawParams = request.params
+
+  if (authorization.type === "delegated") {
+    await admitDelegatedObjectAction({
+      objectReader,
+      runtimeAuthorization,
+      execution,
+      authorization,
+      action,
+      subject: delegatedSubject!,
+    })
+  } else {
+    assertAuthorized(
+      { projectId, runtimeAuthorization },
+      { kind: "action.apply", actionId: action.id }
+    )
+  }
+  if (authorization.type !== "delegated" && action.binding.kind === "object") {
+    // Object actions require visibility of the type they are bound to, as listing them does.
+    await assertTypeViewable({
+      projectId,
+      runtimeAuthorization,
+      objectReader,
+      objectTypeId: action.binding.objectType.id,
+    })
+  }
+
+  validateActionSubject(action, subject)
+
+  let pathPrefix = action.id
+  if (isObjectActionDefinition(action)) {
+    const objectType: ObjectTypeWithPropertyTokens = resolveObjectActionSubject({
+      runtime,
+      action,
+      subject,
+    })
+    pathPrefix = `${objectType.id}.${action.id}`
+  }
+
+  const actionParams = normalizeActionParams(runtime, action.params, rawParams, pathPrefix)
+
+  if (authorization.type !== "delegated") {
+    await assertNamedObjectsVisible({
+      objectReader,
+      subject,
+      paramsConfig: action.params,
+      params: actionParams,
+      pathPrefix,
+    })
+  }
+
+  return {
+    projectId,
+    runtimeAuthorization,
+    objectReader,
+    authorization,
+    request,
+    action,
+    subject,
+    pathPrefix,
+    actionParams,
+  }
+}
+
+/**
+ * A principal views a type whole, through a view grant, or through a condition its reader applies.
+ * Only the reader knows the latter, and each object the request names is then read through it.
+ */
+async function assertTypeViewable(input: {
+  readonly projectId: string
+  readonly runtimeAuthorization: SixbRuntimeContext["runtimeAuthorization"]
+  readonly objectReader: SixbRuntimeContext["objectReader"]
+  readonly objectTypeId: string
+}): Promise<void> {
+  const { objectReader, objectTypeId } = input
+
+  if (objectReader.viewsThroughCondition(objectTypeId)) {
+    await objectReader.assertViewable([objectTypeId])
+    return
+  }
+
+  assertAuthorized(input, { kind: "object.view", objectTypeId })
+}
+
+/**
+ * A principal acts only on the objects it can see: the action runs as trusted code, so it cannot
+ * name, as its subject or a `ref()` param, an object it could not read itself. Each one's type must
+ * be viewable as a read requires it, its markings included. A subtype excluded from a broad grant
+ * is not viewable through its parent, and a run on it is one its caller could never read back.
+ *
+ * Where it views a type through a condition, each object of that type must also be visible through
+ * its reader now: one that is not is hidden or missing, and both are not found, before anything is
+ * recorded. An object of a type it views whole is not read here. Its missing subject fails the run,
+ * and its `ref()` params are not looked up, as before conditions existed.
+ */
+async function assertNamedObjectsVisible(input: {
+  readonly objectReader: SixbRuntimeContext["objectReader"]
+  readonly subject: ActionSubject
+  readonly paramsConfig: ActionDefinition["params"]
+  readonly params: Record<string, unknown>
+  readonly pathPrefix: string
+}): Promise<void> {
+  const { objectReader, subject, params } = input
+
+  const named: { readonly ref: ObjectRef; readonly context: string }[] = []
+  if (subject.kind === "object") {
+    named.push({ ref: subject, context: "Object not found for action run" })
+  }
+  for (const [paramId, param] of Object.entries(input.paramsConfig)) {
+    const value = params[paramId]
+    if (!isObjectRefSchema(param.schema) || value === undefined || value === null) continue
+
+    named.push({
+      ref: value as ObjectRef,
+      context: `Object not found for action param '${input.pathPrefix}.${paramId}'`,
+    })
+  }
+
+  if (named.length === 0) return
+  await objectReader.assertViewable(named.map(({ ref }) => ref.objectTypeId))
+
+  const conditioned = named.filter(({ ref }) =>
+    objectReader.viewsThroughCondition(ref.objectTypeId)
+  )
+  if (conditioned.length === 0) return
+
+  const visible = await objectReader.getByPrimaryIdBatch({
+    items: conditioned.map(({ ref }) => ({
+      objectTypeId: ref.objectTypeId,
+      primaryId: ref.primaryId,
+    })),
+  })
+
+  for (const { ref, context } of conditioned) {
+    if (visible.has(objectBatchKey(ref.objectTypeId, ref.primaryId))) continue
+    throw new ObjectNotFoundError(ref.objectTypeId, ref.primaryId, context)
+  }
+}
+
 /**
  * A run that already exists under the requested run id, recorded or executing, answers this request
  * only under the rules that would let its caller read it.
@@ -201,6 +366,7 @@ async function assertCallerMayHaveRun(input: {
   readonly storage: SixbRuntimeContext["storage"]
   readonly projectId: string
   readonly authorization: ResolvedRuntimeAuthorization
+  readonly objectReader: SixbRuntimeContext["objectReader"]
   readonly run: ExistingActionRun
 }): Promise<void> {
   const { authorization, run } = input
@@ -213,7 +379,9 @@ async function assertCallerMayHaveRun(input: {
           run,
           grantId: authorization.delegation.grantId,
         }))
-      : authorization.type !== "principal" || canViewActionRun(authorization.context, run)
+      : authorization.type !== "principal" ||
+        ((await viewableActionRuns(input.objectReader, authorization.context, [run])).length > 0 &&
+          (await canReadActionRunSubject(input.objectReader, run)))
   if (!visible) {
     throw new AuthorizationError(
       `apply:action:${run.actionId}`,

package/src/actions/run/context.ts

@@ -1,7 +1,8 @@
 import { createSixbError } from "../../errors/internal"
+import { uniqueLookupKeyOf } from "../../execution/unique-lookup"
 import type { Logger } from "../../logging"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
-import { ObjectNotFoundError } from "../../storage"
+import { ObjectNotFoundError, type ObjectRow } from "../../storage"
 import type { ActionReadRecorder } from "../read-facade"
 import { createActionReadFacade } from "../read-facade"
 import type {
@@ -38,6 +39,7 @@ export function toActionRuntimeFacade(runtime: ActionRunContext): ActionRuntimeF
     },
     connector: runtime.sixb.connector,
     models: runtime.sixb.models,
+    users: runtime.sixb.users,
     objects(objectType) {
       return {
         appendTelemetryBatch(items) {
@@ -56,6 +58,13 @@ export function toActionReadFacade(
     recorder,
     resolveLinkIds: (objectTypeId) =>
       runtime.sixb.objects.resolveType(objectTypeId).links.map((definition) => definition.id),
+    uniqueValueKey: (objectTypeId, propertyId, value) =>
+      uniqueLookupKeyOf(
+        runtime.sixb.objects.resolveType(objectTypeId),
+        propertyId,
+        value,
+        runtime.sixb.objects.getValueTypesById()
+      ),
     telemetry: {
       resolveObjectType: (objectTypeId) => runtime.sixb.objects.resolveType(objectTypeId),
       getHistoryBatch: (input) => runtime.sixb.objects.getTelemetryHistoryBatch(input),
@@ -105,6 +114,7 @@ export function createBasePhaseContext(input: {
       input.runtime.sixb.objects.getValueTypesById()
     ),
     subject: run.subject,
+    requestedBy: input.runtime.requestedBy,
   }
 }
 
@@ -155,6 +165,11 @@ export async function loadObjectTarget(input: {
     )
   }
 
+  await assertRequesterSees(input.runtime, targetRow, {
+    actionId: input.action.id,
+    runId: input.run.id,
+  })
+
   return {
     subjectObjectType,
     snapshot: toActionTargetObject(targetRow, input.action.binding.objectType.id),
@@ -162,6 +177,37 @@ export async function loadObjectTarget(input: {
   }
 }
 
+/**
+ * Handlers run on, and the commit fences on, the state just read. A requester that views the type
+ * through a condition must see that very state: hidden, it is not found, as a missing subject is,
+ * and on a replay too. A state that changed between the two reads conflicts, and the run replays
+ * on what it finds then.
+ */
+async function assertRequesterSees(
+  runtime: ActionRunContext,
+  row: ObjectRow,
+  ids: { readonly actionId: string; readonly runId: string }
+): Promise<void> {
+  if (!runtime.readSubjectAsRequester) return
+
+  const seen = await runtime.readSubjectAsRequester(row)
+  if (!seen) {
+    throw new ObjectNotFoundError(
+      row.objectTypeId,
+      row.primaryId,
+      "Object not found for action run"
+    )
+  }
+
+  if (seen.version !== row.version) {
+    throw createSixbError(
+      "action.read_conflict",
+      `[Sixb] Action run '${ids.runId}' read its subject while it changed.`,
+      { details: ids }
+    )
+  }
+}
+
 export function requireObjectSubject<
   TObjectType extends ObjectTypeWithPropertyTokens = ObjectTypeWithPropertyTokens,
 >(