@sixb/core 0.1.7 → 0.1.8

package/src/events/execution.ts

@@ -1,4 +1,5 @@
 import { assertPrivileged, canViewEvent } from "../authorization"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   EventsAppendInput,
@@ -21,8 +22,31 @@ export interface EventsRuntime {
 }
 
 export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const visibleEvents = (events: readonly StoredDomainEvent[]): readonly StoredDomainEvent[] => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return []
+      case "principal":
+        return events.filter((event) => canViewEvent(authority.context, event))
+      case "unrestricted":
+        return [...events]
+    }
+  }
+
   return {
-    canRead: (event) => canViewEvent(runtime.authorization, event),
+    canRead: (event) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return false
+        case "principal":
+          return canViewEvent(authority.context, event)
+        case "unrestricted":
+          return true
+      }
+    },
     append: (input) => {
       assertPrivileged(runtime, "events.append")
       return runtime.events.append(input)
@@ -32,14 +56,40 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
       return runtime.events.emit(input, options)
     },
     read: async (input) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return []
+        case "principal":
+        case "unrestricted":
+          break
+      }
       const events = await runtime.events.read(input)
-      return events.filter((event) => canViewEvent(runtime.authorization, event))
+      return visibleEvents(events)
     },
-    latestCursor: () => runtime.events.latestCursor(),
-    subscribe: (input, handler) =>
-      runtime.events.subscribe(input, (events) => {
-        const visible = events.filter((event) => canViewEvent(runtime.authorization, event))
+    latestCursor: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(undefined)
+        case "principal":
+        case "unrestricted":
+          return runtime.events.latestCursor()
+      }
+    },
+    subscribe: (input, handler) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(() => {})
+        case "principal":
+        case "unrestricted":
+          break
+      }
+      return runtime.events.subscribe(input, (events) => {
+        const visible = visibleEvents(events)
         if (visible.length > 0) handler(visible)
-      }),
+      })
+    },
   }
 }

package/src/events/types/datasets.ts

@@ -1,3 +1,4 @@
+import type { DatasetProducer } from "../../lake-storage/types"
 import type { EventEnvelope } from "../envelope"
 
 export interface DatasetVersionCommittedEvent extends EventEnvelope {
@@ -9,12 +10,7 @@ export interface DatasetVersionCommittedEvent extends EventEnvelope {
     versionId: string
     /** Canonical UTC ISO timestamp from the committed immutable dataset version. */
     createdAt: string
-    producer: {
-      kind: "sync" | "pipeline"
-      id?: string
-      runId?: string
-      stepId?: string
-    }
+    producer: DatasetProducer
   }
 }
 

package/src/execution/agent.ts

@@ -131,10 +131,7 @@ export function restoreAgentExecutionScope(input: {
   return Object.freeze({
     execution: context,
     authorization: createAgentRuntimeAuthorization({
-      projectId: input.execution.projectId,
-      executionId: input.execution.id,
-      ...(input.actorId === undefined ? {} : { actorId: input.actorId }),
-      runId: input.runId,
+      execution: context,
       authority:
         input.authorization.type === "principal"
           ? {