@sixb/core 0.1.7 → 0.1.8

package/src/storage/share-sessions/record.ts

@@ -0,0 +1,176 @@
+import { ShareSessionStorageError } from "./errors"
+import type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+} from "./types"
+
+const SHA256_HEX = /^[0-9a-f]{64}$/
+
+export function normalizeShareSessionCreate(input: CreateShareSessionInput): ShareSessionRecord {
+  if (!isRecord(input)) throw invalidInput("Share session create input must be an object.")
+  const createdAt = inputDate(input.createdAt, "Share session creation time")
+  const expiresAt = inputDate(input.expiresAt, "Share session inactivity expiry")
+  const absoluteExpiresAt = inputDate(input.absoluteExpiresAt, "Share session absolute expiry")
+  if (expiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must be later than creation time.")
+  }
+  if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session absolute expiry must be later than creation time.")
+  }
+  if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must not exceed its absolute expiry.")
+  }
+
+  return {
+    id: identifier(input.id, "Share session id"),
+    projectId: identifier(input.projectId, "Project id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    createdAt,
+    expiresAt,
+    absoluteExpiresAt,
+  }
+}
+
+export function parseShareSessionRecord(input: unknown): ShareSessionRecord {
+  if (!isRecord(input)) throw invalidRecord("Share session row must be an object.")
+  try {
+    const createdAt = storedDate(input.createdAt, "Share session creation time")
+    const expiresAt = storedDate(input.expiresAt, "Share session inactivity expiry")
+    const absoluteExpiresAt = storedDate(input.absoluteExpiresAt, "Share session absolute expiry")
+    if (expiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry must be later than creation time.")
+    }
+    if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session absolute expiry must be later than creation time.")
+    }
+    if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry exceeds its absolute expiry.")
+    }
+
+    const revokedAtValue = input.revokedAt
+    if (revokedAtValue === null) {
+      throw invalidRecord("Share session revocation time must be omitted rather than null.")
+    }
+    const revokedAt =
+      revokedAtValue === undefined
+        ? undefined
+        : storedDate(revokedAtValue, "Share session revocation time")
+    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {
+      throw invalidRecord("Share session revocation time must not precede creation time.")
+    }
+
+    return {
+      id: identifier(input.id, "Share session id"),
+      projectId: identifier(input.projectId, "Project id"),
+      grantId: identifier(input.grantId, "Share grant id"),
+      tokenHash: sha256(input.tokenHash, "Share session token hash"),
+      createdAt,
+      expiresAt,
+      absoluteExpiresAt,
+      ...(revokedAt === undefined ? {} : { revokedAt }),
+    }
+  } catch (error) {
+    if (error instanceof ShareSessionStorageError) {
+      if (error.code === "invalid_record") throw error
+      throw invalidRecord(error.message.replace(/^\[Sixb\] /, ""), error)
+    }
+    throw error
+  }
+}
+
+export function normalizeGetShareSessionByIdInput(
+  input: GetShareSessionByIdInput
+): GetShareSessionByIdInput {
+  if (!isRecord(input)) throw invalidInput("Share session lookup input must be an object.")
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+  }
+}
+
+export function normalizeRenewShareSessionIfValidInput(
+  input: RenewShareSessionIfValidInput
+): RenewShareSessionIfValidInput {
+  if (!isRecord(input)) throw invalidInput("Share session renewal input must be an object.")
+  const now = inputDate(input.now, "Share session renewal time")
+  const expiresAt = inputDate(input.expiresAt, "Requested Share session expiry")
+  if (expiresAt.getTime() <= now.getTime()) {
+    throw invalidInput("Requested Share session expiry must be later than renewal time.")
+  }
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    now,
+    expiresAt,
+  }
+}
+
+export function normalizeRevokeShareSessionInput(
+  input: RevokeShareSessionInput,
+  createdAt?: Date
+): RevokeShareSessionInput {
+  if (!isRecord(input)) throw invalidInput("Share session revocation input must be an object.")
+  const normalized = {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    revokedAt: inputDate(input.revokedAt, "Share session revocation time"),
+  }
+  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {
+    throw invalidInput("Share session revocation time must not precede creation time.")
+  }
+  return normalized
+}
+
+export function cloneShareSessionRecord(input: ShareSessionRecord): ShareSessionRecord {
+  return structuredClone(input)
+}
+
+function identifier(value: unknown, label: string): string {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`)
+  }
+  return value
+}
+
+function sha256(value: unknown, label: string): string {
+  if (typeof value !== "string" || !SHA256_HEX.test(value)) {
+    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`)
+  }
+  return value
+}
+
+function inputDate(value: unknown, label: string): Date {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+    throw invalidInput(`${label} must be a valid Date.`)
+  }
+  return new Date(value)
+}
+
+function storedDate(value: unknown, label: string): Date {
+  const parsed =
+    value instanceof Date
+      ? new Date(value)
+      : typeof value === "string"
+        ? new Date(value)
+        : new Date(Number.NaN)
+  if (!Number.isFinite(parsed.getTime())) throw invalidRecord(`${label} is invalid.`)
+  return parsed
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function invalidInput(message: string, cause?: unknown): ShareSessionStorageError {
+  return new ShareSessionStorageError("invalid_input", `[Sixb] ${message}`, { cause })
+}
+
+function invalidRecord(message: string, cause?: unknown): ShareSessionStorageError {
+  return new ShareSessionStorageError("invalid_record", `[Sixb] ${message}`, { cause })
+}

package/src/storage/share-sessions/types.ts

@@ -0,0 +1,57 @@
+/** Durable server-side session created after a Share link secret is exchanged. */
+export interface ShareSessionRecord {
+  readonly id: string
+  readonly projectId: string
+  readonly grantId: string
+  /** SHA-256 of the bearer session secret. The plaintext secret is never durable. */
+  readonly tokenHash: string
+  readonly createdAt: Date
+  /** Sliding inactivity deadline. */
+  readonly expiresAt: Date
+  /** Immutable upper bound, normally inherited from the Share grant expiry. */
+  readonly absoluteExpiresAt: Date
+  readonly revokedAt?: Date
+}
+
+export type CreateShareSessionInput = Omit<ShareSessionRecord, "revokedAt">
+
+export interface GetShareSessionByIdInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface RenewShareSessionIfValidInput {
+  readonly projectId: string
+  readonly id: string
+  readonly grantId: string
+  readonly tokenHash: string
+  /** Explicit clock keeps expiry semantics deterministic across providers. */
+  readonly now: Date
+  /** Requested sliding inactivity deadline. Storage clamps it to the absolute deadline. */
+  readonly expiresAt: Date
+}
+
+export interface RevokeShareSessionInput {
+  readonly projectId: string
+  readonly id: string
+  readonly revokedAt: Date
+}
+
+/** Persistence contract for short-lived Share access sessions. */
+export interface ShareSessionStorage {
+  /** `(projectId, id)` and `(projectId, tokenHash)` must both be unique. */
+  create(input: CreateShareSessionInput): Promise<ShareSessionRecord>
+
+  /** Load one project-scoped session, including expired or revoked sessions, or return null. */
+  getById(input: GetShareSessionByIdInput): Promise<ShareSessionRecord | null>
+
+  /**
+   * Atomically authenticate and renew an active session. Mismatched, expired, or revoked sessions
+   * return null. A renewal never shortens the current deadline and never exceeds
+   * `absoluteExpiresAt`.
+   */
+  renewIfValid(input: RenewShareSessionIfValidInput): Promise<ShareSessionRecord | null>
+
+  /** Preserve and return the first revocation; a missing session returns null. */
+  revoke(input: RevokeShareSessionInput): Promise<ShareSessionRecord | null>
+}

package/src/storage/transaction.ts

@@ -1,12 +1,21 @@
 import { StorageTransactionError } from "./errors"
+import { createObjectOperationScope } from "./operation-scope"
+import type { Storage } from "./types"
 
 type ObjectLike = Record<PropertyKey, unknown>
 
-export function createTransactionStorageProxy<T extends object>(
+export function createTransactionStorageProxy<T extends Storage>(
   target: T,
   isActive: () => boolean
 ): T {
   const proxies = new WeakMap<object, object>()
+  const objectStorage = createObjectOperationScope(target.objects, {
+    assertAvailable: () => assertTransactionActive(isActive),
+    run: async <TResult>(operation: () => Promise<TResult> | TResult): Promise<TResult> => {
+      assertTransactionActive(isActive)
+      return operation()
+    },
+  })
 
   const wrap = <TValue extends object>(value: TValue): TValue => {
     const existing = proxies.get(value)
@@ -19,7 +28,10 @@ export function createTransactionStorageProxy<T extends object>(
       // from `tx` are wrapped (a handful), not the row/link data graph, and never per-record.
       get(current, property, receiver) {
         assertTransactionActive(isActive)
-        const result = Reflect.get(current, property, receiver)
+        const result =
+          current === target && property === "objects"
+            ? objectStorage
+            : Reflect.get(current, property, receiver)
         if (typeof result === "function") {
           return (...args: unknown[]) => {
             assertTransactionActive(isActive)

package/src/storage/types.ts

@@ -12,6 +12,8 @@ import type { OntologyStorage } from "./ontology"
 import type { PipelineRunStorage } from "./pipeline-runs"
 import type { ProjectionRunStorage } from "./projection-runs"
 import type { RulesStorage } from "./rules"
+import type { ShareGrantStorage } from "./share-grants"
+import type { ShareSessionStorage } from "./share-sessions"
 import type { SyncRunStorage } from "./sync-runs"
 import type { TimeseriesStorage } from "./timeseries/types"
 import type { WebhookRunStorage } from "./webhook-runs"
@@ -231,6 +233,29 @@ export type {
   RuleStateRecord,
   RulesStorage,
 } from "./rules"
+export type {
+  CreateShareGrantInput,
+  GetShareGrantByIdInput,
+  ListShareGrantsInput,
+  ListShareGrantsResult,
+  RevokeShareGrantInput,
+  ShareAuthoritySnapshot,
+  ShareAuthoritySnapshotV1,
+  ShareGrantRecord,
+  ShareGrantStorage,
+  ShareGrantStorageErrorCode,
+} from "./share-grants"
+export { ShareGrantStorageError } from "./share-grants"
+export type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+  ShareSessionStorage,
+  ShareSessionStorageErrorCode,
+} from "./share-sessions"
+export { ShareSessionStorageError } from "./share-sessions"
 export type {
   FinishSyncRunInput,
   ListSyncRunsInput,
@@ -340,6 +365,8 @@ export interface Storage {
   workflowInterventions?: WorkflowInterventionStorage
   webhookRuns?: WebhookRunStorage
   rules?: RulesStorage
+  shareGrants?: ShareGrantStorage
+  shareSessions?: ShareSessionStorage
   fileUploadSessions?: FileUploadSessionStore
   connectorConnections?: ConnectorConnectionStorage
 

package/src/syncs/execution.ts

@@ -1,5 +1,6 @@
-import { isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   ListLatestSyncRunsResult,
@@ -29,26 +30,39 @@ export function createSyncsRuntime(
   execution: ExecutionContext,
   source: Pick<SyncsRuntime, "list" | "getById">
 ): SyncsRuntime {
-  const allowed = (syncId: string) => isAllowed(runtime.authorization, { kind: "sync.run", syncId })
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const allowed = (syncId: string) => isRuntimeAllowed(runtime, { kind: "sync.run", syncId })
   const visibleIds = () =>
     source
       .list()
       .filter((sync) => allowed(sync.id))
       .map((sync) => sync.id)
+  const historyFilterIds = () =>
+    authority.type === "unrestricted"
+      ? undefined
+      : authority.type === "principal"
+        ? visibleIds()
+        : []
 
   return {
-    list: () => source.list().filter((sync) => allowed(sync.id)),
+    list: () =>
+      authority.type === "denied" || authority.type === "delegated"
+        ? []
+        : source.list().filter((sync) => allowed(sync.id)),
     getById: (syncId) => {
+      if (authority.type === "denied" || authority.type === "delegated") return null
       const sync = source.getById(syncId)
       return sync && allowed(syncId) ? sync : null
     },
     request: async (input) => {
+      assertAuthorized(runtime, { kind: "sync.run", syncId: input.syncId })
       const sync = source.getById(input.syncId)
       if (!sync) throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`)
       return requestSyncRun(runtime, execution, sync, input)
     },
     runs: {
       getById: async (runId) => {
+        if (authority.type === "denied" || authority.type === "delegated") return null
         const run =
           (await runtime.storage.syncRuns?.getById({
             projectId: runtime.projectId,
@@ -57,15 +71,21 @@ export function createSyncsRuntime(
         return run && allowed(run.syncId) ? run : null
       },
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        }
         const storage = runtime.storage.syncRuns
         if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          syncIds: runtime.authorization ? visibleIds() : undefined,
+          syncIds: historyFilterIds(),
+          projectId: runtime.projectId,
         })
       },
       listLatest: (syncIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] })
+        }
         const storage = runtime.storage.syncRuns
         if (!storage || syncIds.length === 0) return Promise.resolve({ runs: [] })
         const allowedIds = syncIds.filter(allowed)

package/src/syncs/request.ts

@@ -1,4 +1,5 @@
 import { assertAuthorized } from "../authorization"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import {
   createPrimitiveExecutionRecord,
   ensureExecutionRecord,
@@ -45,6 +46,10 @@ export async function requestSyncRun(
   sync: SyncDefinition,
   options: SyncRunRequestOptions = {}
 ): Promise<SyncRunRequestResult> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertAuthorized(runtime, { kind: "sync.run", syncId: sync.id })
   if (!runtime.storage.syncRuns) {
     throw new SyncValidationError("[Sixb] Sync run storage is not configured.")