@spacefast/common 0.0.11 → 0.0.12

package/dist/utils/access-match.fixtures.json

@@ -0,0 +1,513 @@
+{
+    "namespaceFilter": [
+        {
+            "name": "platform namespaces keep platform grants",
+            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
+            "namespaces": [
+                "team:",
+                "sub-team:",
+                "user:",
+                "email:",
+                "space:",
+                "link:",
+                "invite:",
+                "svc:",
+                "sso:"
+            ],
+            "expected": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"]
+        },
+        {
+            "name": "external key drops everything outside its ext binding",
+            "grants": ["ext:acn_1:wc-subscriber", "team:team_1:owner", "user:usr_1", "email:x@y.z"],
+            "namespaces": ["ext:acn_1:"],
+            "expected": ["ext:acn_1:wc-subscriber"]
+        },
+        {
+            "name": "an external token minting team grants is fully dropped",
+            "grants": ["team:team_1:owner", "team:team_1:admin"],
+            "namespaces": ["ext:acn_1:"],
+            "expected": []
+        },
+        {
+            "name": "local pw key signs only pw grants",
+            "grants": ["pw:space-password", "team:team_1:viewer", "email:a@b.c"],
+            "namespaces": ["pw:"],
+            "expected": ["pw:space-password"]
+        },
+        {
+            "name": "prefix match is a plain startsWith, not a segment match",
+            "grants": ["sub-team:sub_1:member", "team:team_1:member"],
+            "namespaces": ["team:"],
+            "expected": ["team:team_1:member"]
+        },
+        {
+            "name": "empty namespace entries never match",
+            "grants": ["user:usr_1"],
+            "namespaces": [""],
+            "expected": []
+        },
+        {
+            "name": "email-domain namespace is dead: nothing carries it, nothing keeps it",
+            "grants": ["email-domain:acme.com"],
+            "namespaces": [
+                "team:",
+                "sub-team:",
+                "user:",
+                "email:",
+                "space:",
+                "link:",
+                "invite:",
+                "svc:",
+                "sso:"
+            ],
+            "expected": []
+        },
+        {
+            "name": "empty grant strings are dropped",
+            "grants": ["", "user:usr_1"],
+            "namespaces": ["user:"],
+            "expected": ["user:usr_1"]
+        }
+    ],
+    "glob": [
+        {
+            "pattern": "email:carol@acme.com",
+            "grant": "email:carol@acme.com",
+            "expected": true
+        },
+        {
+            "pattern": "email:carol@acme.com",
+            "grant": "email:mallory@acme.com",
+            "expected": false
+        },
+        {
+            "pattern": "email:*@acme.com",
+            "grant": "email:carol@acme.com",
+            "expected": true
+        },
+        {
+            "pattern": "email:*@acme.com",
+            "grant": "email:carol@evil.com",
+            "expected": false
+        },
+        {
+            "pattern": "email:*@acme.com",
+            "grant": "email:carol@sub.acme.com",
+            "expected": false
+        },
+        {
+            "pattern": "email:*acme.com",
+            "grant": "email:carol@sub.acme.com",
+            "expected": true
+        },
+        {
+            "pattern": "email:*@acme.com",
+            "grant": "email:@acme.com",
+            "expected": true
+        },
+        {
+            "pattern": "team:*",
+            "grant": "team:team_1:member",
+            "expected": true
+        },
+        {
+            "pattern": "team:team_1:*",
+            "grant": "team:team_1:viewer",
+            "expected": true
+        },
+        {
+            "pattern": "team:team_1:*",
+            "grant": "team:team_2:viewer",
+            "expected": false
+        },
+        {
+            "pattern": "user:*",
+            "grant": "user:usr_1",
+            "expected": true
+        },
+        {
+            "pattern": "user:*",
+            "grant": "email:x@y.z",
+            "expected": false
+        },
+        {
+            "pattern": "space:spc_1:*",
+            "grant": "space:spc_1:commenter",
+            "expected": true
+        },
+        {
+            "pattern": "*",
+            "grant": "anything:at:all",
+            "expected": true
+        },
+        {
+            "pattern": "pw:space-password",
+            "grant": "pw:space-password",
+            "expected": true
+        },
+        {
+            "pattern": "pw:space-password",
+            "grant": "pw:other-rule",
+            "expected": false
+        },
+        {
+            "pattern": "email:*@a*.com",
+            "grant": "email:x@acme.com",
+            "expected": true
+        },
+        {
+            "pattern": "email:*@a*.com",
+            "grant": "email:x@bcme.com",
+            "expected": false
+        },
+        {
+            "pattern": "email:a.b@acme.com",
+            "grant": "email:aXb@acme.com",
+            "expected": false
+        },
+        {
+            "pattern": "svc:stk_1",
+            "grant": "svc:stk_1",
+            "expected": true
+        },
+        {
+            "pattern": "link:lnk_*",
+            "grant": "link:lnk_abc",
+            "expected": true
+        },
+        {
+            "pattern": "",
+            "grant": "user:usr_1",
+            "expected": false
+        }
+    ],
+    "intersect": [
+        {
+            "name": "single exact hit",
+            "grants": ["user:usr_1", "email:carol@acme.com"],
+            "requiredGrants": ["email:carol@acme.com"],
+            "expected": true
+        },
+        {
+            "name": "no overlap",
+            "grants": ["user:usr_1", "team:team_1:member"],
+            "requiredGrants": ["email:*@acme.com", "link:lnk_1"],
+            "expected": false
+        },
+        {
+            "name": "glob run crosses separators",
+            "grants": ["team:team_1:member"],
+            "requiredGrants": ["team:*:member"],
+            "expected": true
+        },
+        {
+            "name": "any-of over requiredGrants",
+            "grants": ["invite:sin_1"],
+            "requiredGrants": ["email:x@y.z", "invite:sin_1", "team:team_1:viewer"],
+            "expected": true
+        },
+        {
+            "name": "empty grants never pass",
+            "grants": [],
+            "requiredGrants": ["user:*"],
+            "expected": false
+        },
+        {
+            "name": "empty requiredGrants never pass",
+            "grants": ["user:usr_1"],
+            "requiredGrants": [],
+            "expected": false
+        },
+        {
+            "name": "empty-string entries are ignored on both sides",
+            "grants": [""],
+            "requiredGrants": [""],
+            "expected": false
+        },
+        {
+            "name": "concrete grant does not glob against a concrete requirement",
+            "grants": ["email:carol@acme.com"],
+            "requiredGrants": ["email:carol@acme.co"],
+            "expected": false
+        }
+    ],
+    "satisfy": [
+        {
+            "name": "platform token passes an email-domain wall",
+            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
+            "grantNamespaces": [
+                "team:",
+                "sub-team:",
+                "user:",
+                "email:",
+                "space:",
+                "link:",
+                "invite:",
+                "svc:",
+                "sso:"
+            ],
+            "requiredGrants": ["email:*@acme.com"],
+            "expected": true
+        },
+        {
+            "name": "external token cannot satisfy a team wall (namespace drop first)",
+            "grants": ["team:team_1:member"],
+            "grantNamespaces": ["ext:acn_1:"],
+            "requiredGrants": ["team:team_1:member"],
+            "expected": false
+        },
+        {
+            "name": "local pw token satisfies exactly its wall",
+            "grants": ["pw:space-password"],
+            "grantNamespaces": ["pw:"],
+            "requiredGrants": ["pw:space-password"],
+            "expected": true
+        },
+        {
+            "name": "pw token cannot satisfy an identity wall",
+            "grants": ["pw:space-password"],
+            "grantNamespaces": ["pw:"],
+            "requiredGrants": ["email:*@acme.com", "team:team_1:viewer"],
+            "expected": false
+        },
+        {
+            "name": "external token satisfies its own owner-defined tag",
+            "grants": ["ext:acn_1:wc-subscriber"],
+            "grantNamespaces": ["ext:acn_1:"],
+            "requiredGrants": ["ext:acn_1:wc-subscriber"],
+            "expected": true
+        },
+        {
+            "name": "external token minting team:* wildcard grants fails the namespace filter",
+            "grants": [
+                "ext:acn_1:wc-subscriber",
+                "team:*",
+                "team:team_1:owner",
+                "user:usr_1",
+                "email:carol@acme.com"
+            ],
+            "grantNamespaces": ["ext:acn_1:"],
+            "requiredGrants": ["team:*"],
+            "expected": false
+        },
+        {
+            "name": "external token cannot cross into another connection's ext namespace",
+            "grants": ["ext:acn_2:wc-subscriber"],
+            "grantNamespaces": ["ext:acn_1:"],
+            "requiredGrants": ["ext:acn_2:wc-subscriber"],
+            "expected": false
+        },
+        {
+            "name": "sso token passes the connection audience and its verified email glob",
+            "grants": ["sso:acn_9", "email:carol@acme.com"],
+            "grantNamespaces": [
+                "team:",
+                "sub-team:",
+                "user:",
+                "email:",
+                "space:",
+                "link:",
+                "invite:",
+                "svc:",
+                "sso:"
+            ],
+            "requiredGrants": ["email:*@acme.com"],
+            "expected": true
+        },
+        {
+            "name": "same-space grant cannot satisfy an identity-bound reviewer rule",
+            "grants": ["space:spc_review:viewer"],
+            "grantNamespaces": ["email:", "space:"],
+            "requiredGrants": ["email:reviewer.a@example.com"],
+            "expected": false
+        },
+        {
+            "name": "the exact reviewer identity satisfies its identity-bound rule",
+            "grants": ["email:reviewer.a@example.com", "space:spc_review:viewer"],
+            "grantNamespaces": ["email:", "space:"],
+            "requiredGrants": ["email:reviewer.a@example.com"],
+            "expected": true
+        },
+        {
+            "name": "a different reviewer remains denied despite a same-space grant",
+            "grants": ["email:reviewer.b@example.com", "space:spc_review:viewer"],
+            "grantNamespaces": ["email:", "space:"],
+            "requiredGrants": ["email:reviewer.a@example.com"],
+            "expected": false
+        }
+    ],
+    "pathGlob": [
+        {
+            "pattern": "",
+            "path": "/anything",
+            "expected": true
+        },
+        {
+            "pattern": "/x.html",
+            "path": "/x.html",
+            "expected": true
+        },
+        {
+            "pattern": "/x.html",
+            "path": "/x.htm",
+            "expected": false
+        },
+        {
+            "pattern": "/docs/**",
+            "path": "/docs/",
+            "expected": true
+        },
+        {
+            "pattern": "/docs/**",
+            "path": "/docs/a/b/c.html",
+            "expected": true
+        },
+        {
+            "pattern": "/docs/**",
+            "path": "/docs",
+            "expected": false
+        },
+        {
+            "pattern": "/docs/*",
+            "path": "/docs/a.html",
+            "expected": true
+        },
+        {
+            "pattern": "/docs/*",
+            "path": "/docs/a/b.html",
+            "expected": false
+        },
+        {
+            "pattern": "/docs/*",
+            "path": "/docs/",
+            "expected": true
+        },
+        {
+            "pattern": "/report/**",
+            "path": "/report/q2/deck.pdf",
+            "expected": true
+        },
+        {
+            "pattern": "/report/**",
+            "path": "/reports/q2.pdf",
+            "expected": false
+        },
+        {
+            "pattern": "/*.html",
+            "path": "/index.html",
+            "expected": true
+        },
+        {
+            "pattern": "/*.html",
+            "path": "/a/index.html",
+            "expected": false
+        },
+        {
+            "pattern": "/**",
+            "path": "/",
+            "expected": true
+        },
+        {
+            "pattern": "/**",
+            "path": "/deep/path/file.txt",
+            "expected": true
+        },
+        {
+            "pattern": "/a+b/**",
+            "path": "/a+b/x",
+            "expected": true
+        },
+        {
+            "pattern": "/a.b/**",
+            "path": "/axb/x",
+            "expected": false
+        }
+    ],
+    "cidr": [
+        {
+            "ip": "1.2.3.4",
+            "cidr": "1.2.3.0/24",
+            "expected": true
+        },
+        {
+            "ip": "1.2.4.4",
+            "cidr": "1.2.3.0/24",
+            "expected": false
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "1.2.3.4",
+            "expected": true
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "1.2.3.5",
+            "expected": false
+        },
+        {
+            "ip": "10.0.0.1",
+            "cidr": "10.0.0.0/8",
+            "expected": true
+        },
+        {
+            "ip": "10.128.0.1",
+            "cidr": "10.0.0.0/9",
+            "expected": false
+        },
+        {
+            "ip": "10.127.255.255",
+            "cidr": "10.0.0.0/9",
+            "expected": true
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "0.0.0.0/0",
+            "expected": true
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "1.2.3.0/33",
+            "expected": false
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "",
+            "expected": false
+        },
+        {
+            "ip": "not-an-ip",
+            "cidr": "1.2.3.0/24",
+            "expected": false
+        },
+        {
+            "ip": "2001:db8::1",
+            "cidr": "2001:db8::/32",
+            "expected": true
+        },
+        {
+            "ip": "2001:db9::1",
+            "cidr": "2001:db8::/32",
+            "expected": false
+        },
+        {
+            "ip": "2001:db8::1",
+            "cidr": "1.2.3.0/24",
+            "expected": false
+        },
+        {
+            "ip": "1.2.3.4",
+            "cidr": "2001:db8::/32",
+            "expected": false
+        },
+        {
+            "ip": "::ffff:1.2.3.4",
+            "cidr": "::ffff:1.2.3.0/120",
+            "expected": true
+        },
+        {
+            "ip": "fe80::aaaa:bbbb",
+            "cidr": "fe80::/10",
+            "expected": true
+        }
+    ]
+}

package/dist/utils/access-match.js

@@ -60,6 +60,18 @@ export function grantsIntersect(grants, requiredGrants) {
     }
     return false;
 }
+// Managed reviewer rules are identity bindings. Policies compiled before the
+// identity-only cutover may still contain a generic `space:` grant beside the
+// reviewer's email. Treating that legacy entry as another ANY-OF alternative
+// recreates the cross-reviewer bypass, so every evaluator derives the effective
+// requirement from the trusted managed-block owner before intersecting.
+export function requiredGrantsForRule(rule) {
+    const requiredGrants = rule.auth?.requiredGrants ?? [];
+    if (rule.managedBy !== "cast_reviewer") {
+        return requiredGrants;
+    }
+    return requiredGrants.filter((grant) => grant.startsWith("email:"));
+}
 // The composed satisfaction test the authorize pre-flight runs: namespace-drop
 // the visitor's grants by the signing key, then intersect with the rule's
 // requiredGrants — exactly what the runtime does after verifying a signature.
@@ -146,6 +158,19 @@ export function agentMatches(needle, agent) {
     }
     return agent.toLowerCase().includes(needle.toLowerCase());
 }
+function parseIpv6Groups(raw) {
+    if (raw === "") {
+        return [];
+    }
+    const groups = [];
+    for (const part of raw.split(":")) {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part)) {
+            return null;
+        }
+        groups.push(Number.parseInt(part, 16));
+    }
+    return groups;
+}
 // inet_pton equivalent: dotted-quad IPv4 or RFC 4291 IPv6 (including "::"
 // compression and an embedded IPv4 tail) → bytes, or null when unparseable.
 function ipToBytes(ip) {
@@ -175,30 +200,17 @@ function ipToBytes(ip) {
     if (doubleColonSplits.length > 2) {
         return null;
     }
-    const parseGroups = (raw) => {
-        if (raw === "") {
-            return [];
-        }
-        const groups = [];
-        for (const part of raw.split(":")) {
-            if (!/^[0-9a-fA-F]{1,4}$/.test(part)) {
-                return null;
-            }
-            groups.push(Number.parseInt(part, 16));
-        }
-        return groups;
-    };
     let groups;
     if (doubleColonSplits.length === 2) {
-        const left = parseGroups(doubleColonSplits[0] ?? "");
-        const right = parseGroups(doubleColonSplits[1] ?? "");
+        const left = parseIpv6Groups(doubleColonSplits[0] ?? "");
+        const right = parseIpv6Groups(doubleColonSplits[1] ?? "");
         if (left === null || right === null || left.length + right.length > 8) {
             return null;
         }
         groups = [...left, ...Array(8 - left.length - right.length).fill(0), ...right];
     }
     else {
-        groups = parseGroups(head);
+        groups = parseIpv6Groups(head);
         if (groups === null || groups.length !== 8) {
             return null;
         }
@@ -285,6 +297,10 @@ export function ruleMatchApplies(match, context) {
     if (match.country !== undefined && match.country.toUpperCase() !== (context.country ?? "")) {
         return false;
     }
+    if (match.countryNotIn !== undefined &&
+        match.countryNotIn.some((country) => country.toUpperCase() === (context.country ?? "").toUpperCase())) {
+        return false;
+    }
     if (match.header !== undefined) {
         const name = match.header.name.toLowerCase();
         const actual = Object.entries(context.headers ?? {}).find(([key]) => key.toLowerCase() === name)?.[1];