@sixb/core 0.1.21 → 0.1.22

package/src/execution/authorization.ts

@@ -9,6 +9,7 @@ import {
 } from "../authorization/grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "../authorization/types"
 import { createSixbError } from "../errors/internal"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
 import type { ObjectRef } from "../ontology"
 import {
   type ObjectReadExecutionLimits,
@@ -602,6 +603,9 @@ function snapshotAuthorizationContext(
     groupIds: Object.freeze([...context.groupIds]),
     roleIds: Object.freeze([...context.roleIds]),
     grants: frozenGrants,
+    ...(context.viewConditions === undefined
+      ? {}
+      : { viewConditions: new ImmutableViewConditions(context.viewConditions) }),
     clearances: new ImmutableGrantSet(context.clearances ?? []),
   })
 }
@@ -668,6 +672,72 @@ function immutableGrantSetMutation(): Error {
   return new Error("[Sixb] Runtime authorization grants are immutable.")
 }
 
+/** Conditions detached from the caller's map and predicates, readable and never writable. */
+class ImmutableViewConditions implements ReadonlyMap<string, readonly ObjectQueryPredicate[]> {
+  readonly #entries: Map<string, readonly ObjectQueryPredicate[]>
+  readonly [Symbol.toStringTag] = "Map"
+
+  constructor(entries: ReadonlyMap<string, readonly ObjectQueryPredicate[]>) {
+    this.#entries = new Map(
+      [...entries].map(([objectTypeId, predicates]) => [
+        objectTypeId,
+        deepFreeze(structuredClone([...predicates])),
+      ])
+    )
+    Object.freeze(this)
+  }
+
+  get size(): number {
+    return this.#entries.size
+  }
+
+  get(objectTypeId: string): readonly ObjectQueryPredicate[] | undefined {
+    return this.#entries.get(objectTypeId)
+  }
+
+  has(objectTypeId: string): boolean {
+    return this.#entries.has(objectTypeId)
+  }
+
+  entries(): ReturnType<Map<string, readonly ObjectQueryPredicate[]>["entries"]> {
+    return this.#entries.entries()
+  }
+
+  keys(): ReturnType<Map<string, readonly ObjectQueryPredicate[]>["keys"]> {
+    return this.#entries.keys()
+  }
+
+  values(): ReturnType<Map<string, readonly ObjectQueryPredicate[]>["values"]> {
+    return this.#entries.values()
+  }
+
+  [Symbol.iterator](): ReturnType<Map<string, readonly ObjectQueryPredicate[]>["entries"]> {
+    return this.#entries.entries()
+  }
+
+  forEach(
+    callback: (
+      predicates: readonly ObjectQueryPredicate[],
+      objectTypeId: string,
+      map: ReadonlyMap<string, readonly ObjectQueryPredicate[]>
+    ) => void,
+    thisArg?: unknown
+  ): void {
+    for (const [objectTypeId, predicates] of this.#entries) {
+      callback.call(thisArg, predicates, objectTypeId, this)
+    }
+  }
+}
+
+Object.freeze(ImmutableViewConditions.prototype)
+
+function deepFreeze<T>(value: T): T {
+  if (typeof value !== "object" || value === null) return value
+
+  for (const child of Object.values(value)) deepFreeze(child)
+  return Object.freeze(value)
+}
+
 function snapshotAuthorizablePrincipal(principal: Principal): AuthorizablePrincipal {
   if (principal.type !== "user" && principal.type !== "serviceAccount") {
     throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`)

package/src/execution/authorized-object-reader.ts

@@ -1,4 +1,6 @@
 import { assertNever } from "../assert-never"
+import { isRuntimeAllowed } from "../authorization"
+import { AuthorizationError } from "../authorization/errors"
 import type { EmbeddingModelCatalog, RerankingModelCatalog } from "../models/catalog"
 import type { AuthorizedOntologyView } from "../objects/authorized-ontology-view"
 import {
@@ -26,10 +28,12 @@ import {
 } from "../objects/query"
 import { createClearanceQueryAdmission } from "../objects/query/clearance-admission"
 import { ObjectQueryValidationError } from "../objects/query/errors"
-import { validateObjectFacetRequests } from "../objects/query/executor"
-import type { ObjectQuery } from "../objects/query/ir"
+import { type QueryExecutorOptions, validateObjectFacetRequests } from "../objects/query/executor"
+import type { ObjectQuery, ObjectQueryPredicate } from "../objects/query/ir"
 import { assertLinkQueryReadable } from "../objects/query/link-query-clearance"
 import { preflightObjectQueryLinks } from "../objects/query/links"
+import { normalizeObjectQuery } from "../objects/query/normalize"
+import { userExpansionPlan } from "../objects/query/user-expansions"
 import {
   type AdmittedObjectQuery,
   composeObjectQueryAdmissions,
@@ -45,6 +49,7 @@ import {
 import type { OntologyRegistry } from "../ontology"
 import type { AppliedMarkings } from "../security/applied-markings"
 import type {
+  AuthUserStore,
   LinkBatchKey,
   ObjectFacetRequest,
   ObjectLinkRow,
@@ -56,11 +61,19 @@ import { assertObjectReadOutputWithinLimit, MAX_OBJECT_READ_FACETS } from "../st
 import { captureExecutionScope, resolveExecutionScopeAuthorization } from "./authorization"
 import type { Clearance, EventSources } from "./object-reader-clearance"
 import { ObjectReaderOntology } from "./object-reader-ontology"
-import { ObjectReaderSecurity, type ResolvedExecutionAuthority } from "./object-reader-security"
+import { ObjectReaderSecurity } from "./object-reader-security"
+import { attachUserProfiles } from "./object-reader-users"
 import type { ExecutionScope } from "./types"
+import { uniqueLookupKey } from "./unique-lookup"
 
 type GetObjectInput = Omit<Parameters<ObjectReadStorage["getByPrimaryId"]>[0], "projectId">
 type GetObjectsInput = Omit<Parameters<ObjectReadStorage["getByPrimaryIdBatch"]>[0], "projectId">
+/** A caller's value, validated and keyed against the property's schema. */
+interface GetByUniqueValueInput {
+  readonly objectTypeId: string
+  readonly propertyId: string
+  readonly value: unknown
+}
 type SelectObjectPropertiesInput = Parameters<ObjectReadStorage["selectsObjectProperties"]>[0]
 type CanReadObjectPropertyInput = SelectObjectPropertiesInput["items"][number]
 type CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, "projectId">
@@ -85,13 +98,15 @@ const readerConstructionKey = Object.freeze({})
  *
  * Its state is grouped as a project is: the ontology it resolves against, the security of the
  * authority (its delegation and clearance included), the model catalogs search uses, and the
- * storage it reads. Each group decides what belongs to it; the reader composes them.
+ * storage it reads, with the member directory that expanded user properties resolve against.
+ * Each group decides what belongs to it; the reader composes them.
  */
 class AuthorizedObjectReaderImpl {
   readonly #ontology: ObjectReaderOntology
   readonly #security: ObjectReaderSecurity
   readonly #models: ObjectReaderModels
   readonly #storage: ObjectReadStorage
+  readonly #users: AuthUserStore | undefined
 
   constructor(
     key: typeof readerConstructionKey,
@@ -100,6 +115,7 @@ class AuthorizedObjectReaderImpl {
       readonly security: ObjectReaderSecurity
       readonly models: ObjectReaderModels
       readonly storage: ObjectReadStorage
+      readonly users?: AuthUserStore
     }
   ) {
     if (key !== readerConstructionKey) {
@@ -109,6 +125,7 @@ class AuthorizedObjectReaderImpl {
     this.#security = input.security
     this.#models = input.models
     this.#storage = input.storage
+    this.#users = input.users
   }
 
   static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void {
@@ -134,6 +151,25 @@ class AuthorizedObjectReaderImpl {
     return reader.#security.clearance.forEvent(sources)
   }
 
+  /** The conditions the reader views object types through, by concrete type. */
+  static viewConditions(
+    reader: AuthorizedObjectReaderImpl
+  ): ReadonlyMap<string, ReaderViewCondition> {
+    const security = reader.#security
+    const conditions = security.conditionalScope?.conditions ?? []
+
+    return new Map(
+      conditions.map(({ objectTypeId, predicate }) => [
+        objectTypeId,
+        {
+          predicate,
+          hiddenBy: (clearance: Clearance) =>
+            !security.isObjectTypeViewable(objectTypeId, clearance),
+        },
+      ])
+    )
+  }
+
   static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView {
     return reader.#ontology.view()
   }
@@ -161,6 +197,41 @@ class AuthorizedObjectReaderImpl {
     )
   }
 
+  /**
+   * The object of exactly `objectTypeId` holding a unique property's value, or null. A lookup by a
+   * marked property would reveal its value, so it needs the clearance a query predicate needs.
+   */
+  async getByUniqueValue(input: GetByUniqueValueInput): Promise<ObjectRow | null> {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      propertyId: input.propertyId,
+      value: input.value,
+    })
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
+
+    const valueKey = uniqueLookupKey(this.#ontology.registry, request)
+    const marking = clearance?.missingMarking(request.objectTypeId, request.propertyId)
+    if (marking !== undefined) {
+      throw new AuthorizationError(
+        `clearance:marking:${marking}`,
+        `[Sixb] Cannot look up '${request.objectTypeId}.${request.propertyId}' by value: it requires clearance for marking '${marking}'.`
+      )
+    }
+
+    const row = await this.#storage.getByUniqueValue({
+      objectTypeId: request.objectTypeId,
+      propertyId: request.propertyId,
+      valueKey,
+      projectId: this.#security.runtime.projectId,
+    })
+    return this.#detachRows(
+      row && this.#omitHidden(row, clearance),
+      (detached) => [detached],
+      clearance
+    )
+  }
+
   async getByPrimaryIdBatch(
     input: GetObjectsInput
   ): ReturnType<ObjectReadStorage["getByPrimaryIdBatch"]> {
@@ -196,12 +267,8 @@ class AuthorizedObjectReaderImpl {
     this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
 
     if (hidesProperty(request, clearance)) return false
-    if (this.#security.authority.type !== "delegated") return true
-    const [readable] = await this.#storage.selectsObjectProperties({
-      projectId: this.#security.runtime.projectId,
-      items: [request],
-    })
-    return readable ?? false
+    const [selected] = await this.#selectsObjectProperties([request])
+    return selected ?? false
   }
 
   async canReadObjectPropertiesBatch(
@@ -219,13 +286,7 @@ class AuthorizedObjectReaderImpl {
       request.items.map((item) => item.objectTypeId),
       clearance
     )
-    const selected =
-      this.#security.authority.type === "delegated"
-        ? await this.#storage.selectsObjectProperties({
-            ...request,
-            projectId: this.#security.runtime.projectId,
-          })
-        : request.items.map(() => true)
+    const selected = await this.#selectsObjectProperties(request.items)
     return request.items.map(
       (item, index) => !hidesProperty(item, clearance) && selected[index] === true
     )
@@ -337,11 +398,14 @@ class AuthorizedObjectReaderImpl {
       },
       this.#queryExecutorOptions(clearance)
     )
-    return this.#detachRows(
+    const detached = this.#detachRows(
       { ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) },
       (detached) => detached.objects,
       clearance
     )
+
+    await this.#attachUsers(detached.objects, query)
+    return detached
   }
 
   async queryLinks(
@@ -498,6 +562,34 @@ class AuthorizedObjectReaderImpl {
     return (row) => (clearance ? redactObjectRow(row, clearance) : row)
   }
 
+  /**
+   * The check a direct write runs on each object's properties before its commit claims them. It
+   * refuses a value for a unique property this authority cannot read: whether the write is refused
+   * as taken would reveal which values objects hold, as a `getBy` would.
+   */
+  async uniqueValueWriteCheck(
+    objectTypeId: string
+  ): Promise<(properties: Readonly<Record<string, unknown>>) => void> {
+    const clearance = await this.#security.clearance.current()
+    const marked = this.#ontology.registry
+      .listUniqueProperties(objectTypeId)
+      .flatMap((property) => {
+        const marking = clearance?.missingMarking(objectTypeId, property.propertyId)
+        return marking === undefined ? [] : [{ propertyId: property.propertyId, marking }]
+      })
+
+    return (properties) => {
+      for (const { propertyId, marking } of marked) {
+        if (properties[propertyId] === undefined || properties[propertyId] === null) continue
+
+        throw new AuthorizationError(
+          `clearance:marking:${marking}`,
+          `[Sixb] Cannot write a value to '${objectTypeId}.${propertyId}': it is unique and requires clearance for marking '${marking}'.`
+        )
+      }
+    }
+  }
+
   /**
    * Refuse a write or a request that names an object type or link this authority cannot read,
    * before any lookup: it would answer whether what it names exists, and land where the reader
@@ -507,6 +599,21 @@ class AuthorizedObjectReaderImpl {
     assertTargetsReadable(await this.#security.clearance.current(), targets)
   }
 
+  /**
+   * Whether this reader sees only the objects of a type that a condition matches. A write or a
+   * request that names such an object finds it through this reader first: one it cannot find is
+   * hidden or missing, and both answer alike.
+   */
+  viewsThroughCondition(objectTypeId: string): boolean {
+    return this.#security.viewsThroughCondition(objectTypeId)
+  }
+
+  /** Refuse a type this reader views neither whole nor through a condition. */
+  async assertViewable(objectTypeIds: readonly string[]): Promise<void> {
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable(objectTypeIds, clearance)
+  }
+
   /** Enforce the delegated response budget without exposing or recombining its limits. */
   assertVisibleOutputWithinLimit(value: unknown): void {
     if (this.#security.authority.type !== "delegated") return
@@ -533,6 +640,7 @@ class AuthorizedObjectReaderImpl {
         embeddingModels: this.#models.embedding,
         rerankingModels: this.#models.reranking,
         ...(admission === undefined ? {} : { admission }),
+        requestingUser: this.#security.requestingUser,
       }
     }
     return {
@@ -540,11 +648,30 @@ class AuthorizedObjectReaderImpl {
       embeddingModels: this.#models.embedding,
       rerankingModels: this.#models.reranking,
       storage: this.#storage,
-      runtimeAuthorization: this.#security.runtime.runtimeAuthorization,
-      ...(this.#security.runtime.authorization === undefined
-        ? {}
-        : { authorization: this.#security.runtime.authorization }),
+      ...this.#queryAuthorization(clearance),
       ...(admission === undefined ? {} : { admission }),
+      requestingUser: this.#security.requestingUser,
+    }
+  }
+
+  /**
+   * A principal's queries read the types this reader's security grants, including those its
+   * storage reads through a condition, which no view grant holds.
+   */
+  #queryAuthorization(
+    clearance: Clearance
+  ): Pick<QueryExecutorOptions, "readableObjectTypes" | "runtimeAuthorization"> {
+    const runtimeAuthorization = this.#security.runtime.runtimeAuthorization
+    if (this.#security.authority.type !== "principal") return { runtimeAuthorization }
+
+    const security = this.#security
+    return {
+      runtimeAuthorization,
+      readableObjectTypes: Object.freeze({
+        assert: (objectTypeIds: readonly string[]) =>
+          security.assertObjectTypesGranted(objectTypeIds, clearance),
+        has: (objectTypeId: string) => security.isObjectTypeGranted(objectTypeId, clearance),
+      }),
     }
   }
 
@@ -560,6 +687,49 @@ class AuthorizedObjectReaderImpl {
     return selected ?? admission
   }
 
+  /**
+   * Resolve the user properties the query expands on rows already detached and redacted. Only an
+   * authority that may view the directory reads profiles; a delegated one never does.
+   */
+  async #attachUsers(rows: readonly ObjectRow[], query: ObjectQuery): Promise<void> {
+    const plan = userExpansionPlan(normalizeObjectQuery(query))
+    if (!plan) return
+
+    await attachUserProfiles({
+      rows,
+      plan,
+      ontology: this.#ontology.registry,
+      projectId: this.#security.runtime.projectId,
+      canViewUsers: isRuntimeAllowed(this.#security.runtime, { kind: "users.view" }),
+      users: this.#users,
+    })
+  }
+
+  /**
+   * Whether the reader's storage selects each property of its object. A delegated reader selects
+   * what its share does. A principal reads a type it views through a condition object by object,
+   * so a hidden object and a missing one both select nothing; it selects every other property.
+   */
+  async #selectsObjectProperties(
+    items: readonly CanReadObjectPropertyInput[]
+  ): Promise<readonly boolean[]> {
+    const readsByObject = (item: CanReadObjectPropertyInput) =>
+      this.#security.authority.type === "delegated" ||
+      this.#security.viewsThroughCondition(item.objectTypeId)
+
+    const checked = items.filter(readsByObject)
+    const selected =
+      checked.length === 0
+        ? []
+        : await this.#storage.selectsObjectProperties({
+            projectId: this.#security.runtime.projectId,
+            items: checked,
+          })
+
+    let next = 0
+    return items.map((item) => !readsByObject(item) || selected[next++] === true)
+  }
+
   #omitHidden<TRow extends ObjectRow>(row: TRow, clearance: Clearance): TRow {
     return clearance ? omitHiddenProperties(row, clearance) : row
   }
@@ -622,25 +792,30 @@ export function createAuthorizedObjectReader(input: {
   readonly objectStorage: ObjectStorage
   /** Markings of the dataset versions projections applied; the code's markings alone without. */
   readonly appliedMarkings?: AppliedMarkings
+  /** The member directory expanded user properties resolve against. */
+  readonly users?: AuthUserStore
 }): AuthorizedObjectReader {
   const scope = captureExecutionScope(input.scope)
   const projectId = scope.execution.projectId
   const authority = resolveExecutionScopeAuthorization(projectId, scope)
-  const storage = objectStorageForAuthority(authority, input.objectStorage)
+  const security = new ObjectReaderSecurity({
+    authorization: scope.authorization,
+    authority,
+    projectId,
+    ontology: input.ontology,
+    ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),
+    requestedBy: scope.execution.requestedBy,
+  })
+  const storage = objectStorageForAuthority(security, input.objectStorage)
   const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
-    ontology: new ObjectReaderOntology(input.ontology, authority),
-    security: new ObjectReaderSecurity({
-      authorization: scope.authorization,
-      authority,
-      projectId,
-      ontology: input.ontology,
-      ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),
-    }),
+    ontology: new ObjectReaderOntology(input.ontology, security),
+    security,
     models: Object.freeze({
       ...(input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels }),
       ...(input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }),
     }),
     storage,
+    ...(input.users === undefined ? {} : { users: input.users }),
   })
   Object.freeze(reader)
   return reader
@@ -679,6 +854,29 @@ export function readerEventClearance(
   return AuthorizedObjectReaderImpl.eventClearance(reader, sources)
 }
 
+/** A condition a reader views an object type through, for a surface that decides per object. */
+export interface ReaderViewCondition {
+  /** The condition, `currentUser()` bound, as the reader's storage reads it. */
+  readonly predicate: ObjectQueryPredicate
+  /**
+   * Whether a clearance hides the type, or a property the condition reads: which objects match
+   * would reveal it, so the reader reads no object of the type.
+   */
+  hiddenBy(clearance: Clearance): boolean
+}
+
+/**
+ * The conditions a reader views object types through, by concrete type: empty for a reader that
+ * views each type it reads whole. A type absent here is decided by its grants alone, which deny a
+ * type viewed only under a condition. Events match the state they carry against these, and read
+ * through the reader what they cannot decide from it.
+ */
+export function readerViewConditions(
+  reader: AuthorizedObjectReader
+): ReadonlyMap<string, ReaderViewCondition> {
+  return AuthorizedObjectReaderImpl.viewConditions(reader)
+}
+
 /** What a write or a request names: object types, and links by their source type. */
 interface ReadTargets {
   readonly objectTypeIds: readonly string[]
@@ -707,11 +905,19 @@ function hidesProperty(
 }
 
 function objectStorageForAuthority(
-  authority: ResolvedExecutionAuthority,
+  security: ObjectReaderSecurity,
   objectStorage: ObjectStorage
 ): ObjectReadStorage {
+  const authority = security.authority
+
   switch (authority.type) {
     case "principal":
+      return security.conditionalScope
+        ? objectStorage.createConditionalReadScope({
+            projectId: authority.projectId,
+            scope: security.conditionalScope,
+          })
+        : objectStorage
     case "unrestricted":
       return objectStorage
     case "delegated":

package/src/execution/lineage.ts

@@ -0,0 +1,14 @@
+/**
+ * The nearest of an execution and its ancestors that `isOwner` accepts, walking up through
+ * `parentOf`: where a roll-up counts what the execution spent. Undefined when the walk runs out of
+ * known parents first.
+ */
+export function nearestOwner(
+  executionId: string,
+  parentOf: (executionId: string) => string | undefined,
+  isOwner: (executionId: string) => boolean
+): string | undefined {
+  let current: string | undefined = executionId
+  while (current !== undefined && !isOwner(current)) current = parentOf(current)
+  return current
+}

package/src/execution/object-reader-ontology.ts

@@ -1,4 +1,3 @@
-import { isAllowed } from "../authorization"
 import {
   type AuthorizedOntologySelection,
   type AuthorizedOntologyView,
@@ -6,26 +5,26 @@ import {
 } from "../objects/authorized-ontology-view"
 import type { OntologyRegistry } from "../ontology"
 import { assertObjectReadOutputWithinLimit } from "../storage"
-import type { ResolvedExecutionAuthority } from "./object-reader-security"
+import type { ObjectReaderSecurity } from "./object-reader-security"
 
 /** The ontology a reader resolves against, and the part of it its authority may describe. */
 export class ObjectReaderOntology {
   readonly registry: OntologyRegistry
-  readonly #authority: ResolvedExecutionAuthority
+  readonly #security: ObjectReaderSecurity
   #view?: AuthorizedOntologyView
 
-  constructor(registry: OntologyRegistry, authority: ResolvedExecutionAuthority) {
+  constructor(registry: OntologyRegistry, security: ObjectReaderSecurity) {
     this.registry = registry
-    this.#authority = authority
+    this.#security = security
     Object.freeze(this)
   }
 
   /** Inert metadata for the types the authority may view, built on first use. */
   view(): AuthorizedOntologyView {
-    const authority = this.#authority
+    const authority = this.#security.authority
     this.#view ??= createAuthorizedOntologyView({
       ontology: this.registry,
-      selection: selectionForAuthority(authority, this.registry),
+      selection: selectionForAuthority(this.#security, this.registry),
       ...(authority.type === "delegated"
         ? {
             assertOutputWithinLimit: (value: unknown) =>
@@ -38,9 +37,11 @@ export class ObjectReaderOntology {
 }
 
 function selectionForAuthority(
-  authority: ResolvedExecutionAuthority,
+  security: ObjectReaderSecurity,
   ontology: OntologyRegistry
 ): AuthorizedOntologySelection {
+  const authority = security.authority
+
   switch (authority.type) {
     case "unrestricted":
       return { kind: "all" }
@@ -49,12 +50,8 @@ function selectionForAuthority(
         kind: "types",
         objectTypeIds: ontology
           .listObjectTypes()
-          .filter((objectType) =>
-            isAllowed(authority.context, {
-              kind: "object.view",
-              objectTypeId: objectType.id,
-            })
-          )
+          // A type viewed through a condition is listed: the reader reads the objects it matches.
+          .filter((objectType) => security.isObjectTypeGranted(objectType.id, undefined))
           .map((objectType) => objectType.id),
       }
     case "delegated":