@sixb/core 0.1.21 → 0.1.22

package/src/security/view-conditions.ts

@@ -0,0 +1,215 @@
+import { bindCurrentUserPredicate } from "../objects/query/current-user"
+import { ObjectQueryValidationError } from "../objects/query/errors"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
+import {
+  type ObjectQuerySemanticAdmission,
+  validateObjectQueryWithAdmission,
+} from "../objects/query/validate"
+import type { OntologyRegistry } from "../ontology"
+import { compileConditionalObjectReadScope } from "../storage/objects/read-scope"
+import type { ObjectReadScopeFactory } from "../storage/objects/types"
+import { SecurityValidationError } from "./errors"
+import type { GrantDefinition, Selection } from "./types"
+
+/** A role's `can.view(Type).where(...)`, validated against the ontology at startup. */
+export interface ViewCondition {
+  readonly roleId: string
+  /** The type the grant names. The condition also applies to its subtypes. */
+  readonly objectTypeId: string
+  /**
+   * The condition as the validator returns it, `scalarKind` resolved, and deeply frozen. It may
+   * still hold `currentUser()`, which each reader binds to its own user.
+   */
+  readonly predicate: ObjectQueryPredicate
+}
+
+/**
+ * Validate a role grant's condition at startup: `can.view(Type).where(...)`.
+ *
+ * The condition is validated as a filter over the type and every subtype the grant covers, which
+ * is the query its reads run. Without an ontology there is nothing to validate it against, so it
+ * is refused.
+ */
+export function resolveViewCondition(
+  roleId: string,
+  grant: GrantDefinition,
+  ontology: OntologyRegistry | undefined
+): ViewCondition | undefined {
+  if (!("condition" in grant) || grant.condition === undefined) return undefined
+
+  const objectTypeId =
+    grant.capability === "view" && grant.target === "object" ? onlyId(grant.selection) : undefined
+
+  if (objectTypeId === undefined) {
+    throw new SecurityValidationError(
+      `[Sixb] Role '${roleId}' declares a condition on a grant that is not a view grant on one object type. Write can.view(Type).where(...).`
+    )
+  }
+
+  const subject = viewConditionSubject({ roleId, objectTypeId })
+
+  if (!ontology) {
+    throw new SecurityValidationError(`[Sixb] ${subject} needs the ontology to be validated.`)
+  }
+
+  const objectTypeIds = [objectTypeId, ...ontology.listSubTypes(objectTypeId)]
+
+  try {
+    const validated = validateObjectQueryWithAdmission(
+      {
+        kind: "filter",
+        input: { kind: "start", objectTypeId, includeSubtypes: true },
+        predicate: grant.condition,
+      },
+      { ontology },
+      unmarkedPropertiesOnly(subject, objectTypeIds, ontology)
+    )
+
+    if (validated.query.kind !== "filter") {
+      throw new Error(`[Sixb] ${subject} did not validate as a filter.`)
+    }
+
+    const ordered = orderedTextComparison(validated.query.predicate)
+    if (ordered) {
+      throw new SecurityValidationError(
+        `[Sixb] ${subject} compares '${objectTypeId}.${ordered.propertyId}' with ${ordered.op}(). Storage providers order text differently, so a condition cannot order text: compare with eq, neq, in or contains instead.`
+      )
+    }
+
+    return {
+      roleId,
+      objectTypeId,
+      predicate: deepFreeze(structuredClone(validated.query.predicate)),
+    }
+  } catch (error) {
+    if (!(error instanceof ObjectQueryValidationError)) throw error
+
+    const reasons = error.issues.map((issue) => issue.message).join("; ")
+    throw new SecurityValidationError(`[Sixb] ${subject}: ${reasons}`)
+  }
+}
+
+/**
+ * Compile each condition once against the object storage, at startup. A condition the storage
+ * cannot read would otherwise fail every read of its type, for every reader it applies to.
+ *
+ * Each reader binds `currentUser()` to its own user; the check binds it to a placeholder, so the
+ * storage compiles the comparison a user's reads run.
+ */
+export function assertViewConditionsReadable(input: {
+  readonly projectId: string
+  readonly conditions: readonly ViewCondition[]
+  readonly objectStorage: Pick<ObjectReadScopeFactory, "createConditionalReadScope">
+  readonly getSubTypes: (objectTypeId: string) => readonly string[]
+}): void {
+  for (const condition of input.conditions) {
+    const predicate = bindCurrentUserPredicate(condition.predicate, STARTUP_CHECK_USER)
+    const objectTypeIds = [condition.objectTypeId, ...input.getSubTypes(condition.objectTypeId)]
+
+    try {
+      input.objectStorage.createConditionalReadScope({
+        projectId: input.projectId,
+        scope: compileConditionalObjectReadScope({
+          kind: "conditional",
+          conditions: objectTypeIds.map((objectTypeId) => ({ objectTypeId, predicate })),
+        }),
+      })
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error)
+      throw new SecurityValidationError(
+        `[Sixb] ${viewConditionSubject(condition)} cannot be read by the configured object storage: ${reason}`,
+        { cause: error }
+      )
+    }
+  }
+}
+
+const STARTUP_CHECK_USER = Object.freeze({ type: "user", id: "usr_sixb_startup_check" } as const)
+
+function viewConditionSubject(condition: Pick<ViewCondition, "roleId" | "objectTypeId">): string {
+  return `Role '${condition.roleId}': can.view(${condition.objectTypeId}).where(...)`
+}
+
+/**
+ * PostgreSQL orders text by the database collation, SQLite and the in-memory store by code unit, so
+ * `code.gte("M")` would show different objects depending on the store.
+ */
+function orderedTextComparison(
+  predicate: ObjectQueryPredicate
+): { readonly propertyId: string; readonly op: string } | null {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      for (const item of predicate.items) {
+        const ordered = orderedTextComparison(item)
+        if (ordered) return ordered
+      }
+      return null
+
+    case "not":
+      return orderedTextComparison(predicate.item)
+
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte":
+      return predicate.scalarKind === "string" || predicate.scalarKind === "uuid"
+        ? { propertyId: predicate.propertyId, op: predicate.op }
+        : null
+
+    default:
+      return null
+  }
+}
+
+function onlyId(selection: Selection): string | undefined {
+  if (selection.all || selection.ids.length !== 1) return undefined
+  return selection.ids[0]
+}
+
+/**
+ * Refuse a condition that reads a marked property, on the type or on any subtype the grant covers.
+ * Which objects match would reveal values their reader cannot read.
+ *
+ * The validator walks the condition and reports each property it reads; its own issues are raised
+ * before this denial.
+ */
+function unmarkedPropertiesOnly(
+  subject: string,
+  objectTypeIds: readonly string[],
+  ontology: OntologyRegistry
+): ObjectQuerySemanticAdmission {
+  const state = Object.freeze({})
+
+  const admission: ObjectQuerySemanticAdmission = {
+    empty: () => state,
+    source: () => ({ state }),
+    edge: () => ({ state }),
+    set: () => state,
+    property: ({ propertyId }) => {
+      for (const objectTypeId of objectTypeIds) {
+        const property = ontology
+          .getObjectTypeById(objectTypeId)
+          ?.properties.find((candidate) => candidate.id === propertyId)
+
+        const markings = property?.markings ?? []
+        if (markings.length === 0) continue
+
+        return new SecurityValidationError(
+          `[Sixb] ${subject} reads '${objectTypeId}.${propertyId}', which carries [${markings.join(", ")}]. A condition can only read unmarked properties.`
+        )
+      }
+
+      return undefined
+    },
+  }
+
+  return Object.freeze(admission)
+}
+
+function deepFreeze<T>(value: T): T {
+  if (typeof value !== "object" || value === null) return value
+
+  for (const child of Object.values(value)) deepFreeze(child)
+  return Object.freeze(value)
+}

package/src/shares/execution.ts

@@ -1,11 +1,13 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto"
-import { assertAuthorized, isRuntimeAllowed } from "../authorization"
+import { AuthorizationError, assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { AuthorizablePrincipal, ExecutionContext } from "../execution"
 import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import type { ObjectRef } from "../ontology"
 import type { DefinitionCatalog } from "../runtime/definitions"
 import type { SixbRuntimeContext } from "../runtime/types"
 import { ObjectNotFoundError, type ShareGrantRecord, ShareGrantStorageError } from "../storage"
+import { compileSelectedObjectReadScope } from "../storage/objects/read-scope"
+import { objectReadScopeForAccessPlan, type ShareAccessPlan } from "./access-plan"
 import { compileShareAccessPlan } from "./compiler"
 import type { ShareDefinition } from "./types"
 
@@ -142,8 +144,22 @@ export function createSharesRuntime(
     const createdAt = new Date()
     const expiresAt = validFutureDate(input.expiresAt, createdAt)
     const target = exactTarget(definition, input.target)
+    const access = compileShareAccessPlan({
+      share: definition,
+      target,
+      ontology: runtime.ontology,
+      actions: runtime.actionRegistry,
+    })
+
+    // A link keeps showing whatever its target links to, now and later: on a type its issuer sees
+    // only through a condition, it would expose the objects that condition hides. Each type its
+    // links reach must be viewed whole.
+    assertViewsWhole(runtime, definition, issuer, linkedObjectTypeIds(access))
 
     // This canonical read checks both the caller's current object authority and target existence.
+    // A target its issuer sees through a condition must be visible now; a hidden one is not found,
+    // like a missing one. The link then holds its own grants: it keeps showing the target even
+    // once the target stops matching the issuer's condition.
     const object = await runtime.objectReader.getByPrimaryId({
       objectTypeId: target.objectTypeId,
       primaryId: target.primaryId,
@@ -152,15 +168,7 @@ export function createSharesRuntime(
       throw new ObjectNotFoundError(target.objectTypeId, target.primaryId, "Share target not found")
     }
 
-    const authoritySnapshot = {
-      version: 1 as const,
-      access: compileShareAccessPlan({
-        share: definition,
-        target,
-        ontology: runtime.ontology,
-        actions: runtime.actionRegistry,
-      }),
-    }
+    const authoritySnapshot = { version: 1 as const, access }
 
     for (let attempt = 0; attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
       const secret = randomBytes(32).toString("base64url")
@@ -333,6 +341,31 @@ function assertCanManage(runtime: SixbRuntimeContext, shareId: string): void {
   assertAuthorized(runtime, { kind: "share.manage", shareId })
 }
 
+/** Every object type a Share's links reach from its target, nested links included. */
+function linkedObjectTypeIds(access: ShareAccessPlan): readonly string[] {
+  const { steps } = compileSelectedObjectReadScope(objectReadScopeForAccessPlan(access))
+  return [...new Set(steps.map((step) => step.targetObjectTypeId))]
+}
+
+/** Refuse links reaching a type the issuer views only through a condition, or not at all. */
+function assertViewsWhole(
+  runtime: SixbRuntimeContext,
+  definition: ShareDefinition,
+  issuer: AuthorizablePrincipal,
+  objectTypeIds: readonly string[]
+): void {
+  const partial = objectTypeIds.filter(
+    (objectTypeId) => !isRuntimeAllowed(runtime, { kind: "object.view", objectTypeId })
+  )
+  if (partial.length === 0) return
+
+  const types = partial.map((objectTypeId) => `'${objectTypeId}'`).join(", ")
+  throw new AuthorizationError(
+    `view:object:${partial[0]}`,
+    `[Sixb] Principal '${issuer.id}' cannot issue Share '${definition.id}', whose links show every object of ${types} they reach: the principal views these types only through a condition, or not at all. Grant can.view() on them without a condition, or leave their links out of the Share.`
+  )
+}
+
 function requireShareStorage(runtime: SixbRuntimeContext) {
   const storage = runtime.storage.shareGrants
   if (!storage) {

package/src/storage/action-runs/types.ts

@@ -21,7 +21,9 @@ export const ACTION_RUN_FAILURE_CODES = [
   "runtime.cancelled",
   "action.phase_failed",
   "action.read_conflict",
+  "action.rejected",
   "action.timeout",
+  "object.unique_violation",
 ] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]
 
 export type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]

package/src/storage/agents/errors.ts

@@ -1,5 +1,7 @@
 export type AgentStorageErrorCode =
   | "thread_not_found"
+  /** A conversation's operation on a sub-agent's thread: a turn, a fork, a participant. */
+  | "thread_not_conversation"
   | "active_run_exists"
   | "active_child_limit"
   | "run_not_found"
@@ -7,6 +9,7 @@ export type AgentStorageErrorCode =
   | "invalid_state"
   | "execution_lost"
   | "duplicate_id"
+  | "participant_limit"
 
 /**
  * Error for agent-storage invariants and invalid state transitions (single-flight, execution