@spacefast/common 0.0.12 → 0.0.13

package/dist/utils/access-match.d.ts

@@ -1,46 +0,0 @@
-export declare function filterGrantsByNamespace(grants: string[], namespaces: string[]): string[];
-export declare function grantGlobMatches(pattern: string, grant: string): boolean;
-export declare function grantsIntersect(grants: string[], requiredGrants: string[]): boolean;
-export declare function requiredGrantsForRule(rule: {
-    managedBy?: string | undefined;
-    auth?: {
-        requiredGrants: string[];
-    } | undefined;
-}): string[];
-export declare function grantsSatisfyRule(input: {
-    grants: string[];
-    requiredGrants: string[];
-    grantNamespaces: string[];
-}): boolean;
-export declare function canonicalizeHost(host: string): string;
-export declare function hostGlobMatches(pattern: string, host: string): boolean;
-export declare function hostTemplateMatches(template: string, host: string): boolean;
-export declare function pathGlobMatches(pattern: string, path: string): boolean;
-export declare function agentMatches(needle: string, agent: string): boolean;
-export declare function ipInCidr(ip: string, cidr: string): boolean;
-export declare function ipInAnyCidr(ip: string, cidrs: string[]): boolean;
-export type RuleMatchContext = {
-    host: string;
-    path: string;
-    channel?: string | undefined;
-    ip?: string | undefined;
-    agent?: string | undefined;
-    country?: string | undefined;
-    headers?: Record<string, string> | undefined;
-};
-export type RuleMatchInput = {
-    host?: string | undefined;
-    hostPattern?: string | undefined;
-    hostTemplate?: string | undefined;
-    pathPattern?: string | undefined;
-    channel?: string | undefined;
-    ipCidrs?: string[] | undefined;
-    agent?: string | undefined;
-    country?: string | undefined;
-    countryNotIn?: string[] | undefined;
-    header?: {
-        name: string;
-        value: string;
-    } | undefined;
-};
-export declare function ruleMatchApplies(match: RuleMatchInput, context: RuleMatchContext): boolean;

package/dist/utils/access-match.fixtures.json

@@ -1,513 +0,0 @@
-{
-    "namespaceFilter": [
-        {
-            "name": "platform namespaces keep platform grants",
-            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
-            "namespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "expected": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"]
-        },
-        {
-            "name": "external key drops everything outside its ext binding",
-            "grants": ["ext:acn_1:wc-subscriber", "team:team_1:owner", "user:usr_1", "email:x@y.z"],
-            "namespaces": ["ext:acn_1:"],
-            "expected": ["ext:acn_1:wc-subscriber"]
-        },
-        {
-            "name": "an external token minting team grants is fully dropped",
-            "grants": ["team:team_1:owner", "team:team_1:admin"],
-            "namespaces": ["ext:acn_1:"],
-            "expected": []
-        },
-        {
-            "name": "local pw key signs only pw grants",
-            "grants": ["pw:space-password", "team:team_1:viewer", "email:a@b.c"],
-            "namespaces": ["pw:"],
-            "expected": ["pw:space-password"]
-        },
-        {
-            "name": "prefix match is a plain startsWith, not a segment match",
-            "grants": ["sub-team:sub_1:member", "team:team_1:member"],
-            "namespaces": ["team:"],
-            "expected": ["team:team_1:member"]
-        },
-        {
-            "name": "empty namespace entries never match",
-            "grants": ["user:usr_1"],
-            "namespaces": [""],
-            "expected": []
-        },
-        {
-            "name": "email-domain namespace is dead: nothing carries it, nothing keeps it",
-            "grants": ["email-domain:acme.com"],
-            "namespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "expected": []
-        },
-        {
-            "name": "empty grant strings are dropped",
-            "grants": ["", "user:usr_1"],
-            "namespaces": ["user:"],
-            "expected": ["user:usr_1"]
-        }
-    ],
-    "glob": [
-        {
-            "pattern": "email:carol@acme.com",
-            "grant": "email:carol@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:carol@acme.com",
-            "grant": "email:mallory@acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@evil.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@sub.acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*acme.com",
-            "grant": "email:carol@sub.acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "team:*",
-            "grant": "team:team_1:member",
-            "expected": true
-        },
-        {
-            "pattern": "team:team_1:*",
-            "grant": "team:team_1:viewer",
-            "expected": true
-        },
-        {
-            "pattern": "team:team_1:*",
-            "grant": "team:team_2:viewer",
-            "expected": false
-        },
-        {
-            "pattern": "user:*",
-            "grant": "user:usr_1",
-            "expected": true
-        },
-        {
-            "pattern": "user:*",
-            "grant": "email:x@y.z",
-            "expected": false
-        },
-        {
-            "pattern": "space:spc_1:*",
-            "grant": "space:spc_1:commenter",
-            "expected": true
-        },
-        {
-            "pattern": "*",
-            "grant": "anything:at:all",
-            "expected": true
-        },
-        {
-            "pattern": "pw:space-password",
-            "grant": "pw:space-password",
-            "expected": true
-        },
-        {
-            "pattern": "pw:space-password",
-            "grant": "pw:other-rule",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@a*.com",
-            "grant": "email:x@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@a*.com",
-            "grant": "email:x@bcme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:a.b@acme.com",
-            "grant": "email:aXb@acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "svc:stk_1",
-            "grant": "svc:stk_1",
-            "expected": true
-        },
-        {
-            "pattern": "link:lnk_*",
-            "grant": "link:lnk_abc",
-            "expected": true
-        },
-        {
-            "pattern": "",
-            "grant": "user:usr_1",
-            "expected": false
-        }
-    ],
-    "intersect": [
-        {
-            "name": "single exact hit",
-            "grants": ["user:usr_1", "email:carol@acme.com"],
-            "requiredGrants": ["email:carol@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "no overlap",
-            "grants": ["user:usr_1", "team:team_1:member"],
-            "requiredGrants": ["email:*@acme.com", "link:lnk_1"],
-            "expected": false
-        },
-        {
-            "name": "glob run crosses separators",
-            "grants": ["team:team_1:member"],
-            "requiredGrants": ["team:*:member"],
-            "expected": true
-        },
-        {
-            "name": "any-of over requiredGrants",
-            "grants": ["invite:sin_1"],
-            "requiredGrants": ["email:x@y.z", "invite:sin_1", "team:team_1:viewer"],
-            "expected": true
-        },
-        {
-            "name": "empty grants never pass",
-            "grants": [],
-            "requiredGrants": ["user:*"],
-            "expected": false
-        },
-        {
-            "name": "empty requiredGrants never pass",
-            "grants": ["user:usr_1"],
-            "requiredGrants": [],
-            "expected": false
-        },
-        {
-            "name": "empty-string entries are ignored on both sides",
-            "grants": [""],
-            "requiredGrants": [""],
-            "expected": false
-        },
-        {
-            "name": "concrete grant does not glob against a concrete requirement",
-            "grants": ["email:carol@acme.com"],
-            "requiredGrants": ["email:carol@acme.co"],
-            "expected": false
-        }
-    ],
-    "satisfy": [
-        {
-            "name": "platform token passes an email-domain wall",
-            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
-            "grantNamespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "requiredGrants": ["email:*@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "external token cannot satisfy a team wall (namespace drop first)",
-            "grants": ["team:team_1:member"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["team:team_1:member"],
-            "expected": false
-        },
-        {
-            "name": "local pw token satisfies exactly its wall",
-            "grants": ["pw:space-password"],
-            "grantNamespaces": ["pw:"],
-            "requiredGrants": ["pw:space-password"],
-            "expected": true
-        },
-        {
-            "name": "pw token cannot satisfy an identity wall",
-            "grants": ["pw:space-password"],
-            "grantNamespaces": ["pw:"],
-            "requiredGrants": ["email:*@acme.com", "team:team_1:viewer"],
-            "expected": false
-        },
-        {
-            "name": "external token satisfies its own owner-defined tag",
-            "grants": ["ext:acn_1:wc-subscriber"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["ext:acn_1:wc-subscriber"],
-            "expected": true
-        },
-        {
-            "name": "external token minting team:* wildcard grants fails the namespace filter",
-            "grants": [
-                "ext:acn_1:wc-subscriber",
-                "team:*",
-                "team:team_1:owner",
-                "user:usr_1",
-                "email:carol@acme.com"
-            ],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["team:*"],
-            "expected": false
-        },
-        {
-            "name": "external token cannot cross into another connection's ext namespace",
-            "grants": ["ext:acn_2:wc-subscriber"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["ext:acn_2:wc-subscriber"],
-            "expected": false
-        },
-        {
-            "name": "sso token passes the connection audience and its verified email glob",
-            "grants": ["sso:acn_9", "email:carol@acme.com"],
-            "grantNamespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "requiredGrants": ["email:*@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "same-space grant cannot satisfy an identity-bound reviewer rule",
-            "grants": ["space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": false
-        },
-        {
-            "name": "the exact reviewer identity satisfies its identity-bound rule",
-            "grants": ["email:reviewer.a@example.com", "space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": true
-        },
-        {
-            "name": "a different reviewer remains denied despite a same-space grant",
-            "grants": ["email:reviewer.b@example.com", "space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": false
-        }
-    ],
-    "pathGlob": [
-        {
-            "pattern": "",
-            "path": "/anything",
-            "expected": true
-        },
-        {
-            "pattern": "/x.html",
-            "path": "/x.html",
-            "expected": true
-        },
-        {
-            "pattern": "/x.html",
-            "path": "/x.htm",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs/",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs/a/b/c.html",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/a.html",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/a/b.html",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/",
-            "expected": true
-        },
-        {
-            "pattern": "/report/**",
-            "path": "/report/q2/deck.pdf",
-            "expected": true
-        },
-        {
-            "pattern": "/report/**",
-            "path": "/reports/q2.pdf",
-            "expected": false
-        },
-        {
-            "pattern": "/*.html",
-            "path": "/index.html",
-            "expected": true
-        },
-        {
-            "pattern": "/*.html",
-            "path": "/a/index.html",
-            "expected": false
-        },
-        {
-            "pattern": "/**",
-            "path": "/",
-            "expected": true
-        },
-        {
-            "pattern": "/**",
-            "path": "/deep/path/file.txt",
-            "expected": true
-        },
-        {
-            "pattern": "/a+b/**",
-            "path": "/a+b/x",
-            "expected": true
-        },
-        {
-            "pattern": "/a.b/**",
-            "path": "/axb/x",
-            "expected": false
-        }
-    ],
-    "cidr": [
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.0/24",
-            "expected": true
-        },
-        {
-            "ip": "1.2.4.4",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.4",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.5",
-            "expected": false
-        },
-        {
-            "ip": "10.0.0.1",
-            "cidr": "10.0.0.0/8",
-            "expected": true
-        },
-        {
-            "ip": "10.128.0.1",
-            "cidr": "10.0.0.0/9",
-            "expected": false
-        },
-        {
-            "ip": "10.127.255.255",
-            "cidr": "10.0.0.0/9",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "0.0.0.0/0",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.0/33",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "",
-            "expected": false
-        },
-        {
-            "ip": "not-an-ip",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "2001:db8::1",
-            "cidr": "2001:db8::/32",
-            "expected": true
-        },
-        {
-            "ip": "2001:db9::1",
-            "cidr": "2001:db8::/32",
-            "expected": false
-        },
-        {
-            "ip": "2001:db8::1",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "2001:db8::/32",
-            "expected": false
-        },
-        {
-            "ip": "::ffff:1.2.3.4",
-            "cidr": "::ffff:1.2.3.0/120",
-            "expected": true
-        },
-        {
-            "ip": "fe80::aaaa:bbbb",
-            "cidr": "fe80::/10",
-            "expected": true
-        }
-    ]
-}