@spacefast/common 0.0.12 → 0.0.17

package/dist/utils/access-grant.js

@@ -1,88 +0,0 @@
-// `sf access grant` and the dashboard's Grant access card share one canonical
-// pair: an authenticated admission allow plus an anonymous fallback challenge.
-// Repeated grants widen both rules' OR-list. The split is essential under
-// first-match evaluation: the admission can pass before managed challenges,
-// while the fallback closes otherwise-public traffic after those challenges.
-export const ACCESS_GRANT_GATE_RULE_ID = "access-grant-gate";
-export const ACCESS_GRANT_ADMISSION_RULE_ID = "access-grant-admission";
-export function withAccessGrantGate(rules, grant) {
-    // Raw access writes replace only the unmanaged lane. GET/PUT responses may
-    // include server-owned managed blocks, but sending those blocks back would
-    // be rejected and could let a client accidentally claim their ownership.
-    // Reserved access-grant rules are rebuilt as one canonical pair below.
-    const unmanagedRules = rules.filter((rule) => rule.managedBy === undefined &&
-        rule.id !== ACCESS_GRANT_ADMISSION_RULE_ID &&
-        rule.id !== ACCESS_GRANT_GATE_RULE_ID);
-    const existingRequiredGrants = rules.find((rule) => rule.id === ACCESS_GRANT_ADMISSION_RULE_ID)
-        ?.auth?.requiredGrants;
-    const fallbackRequiredGrants = rules.find((rule) => rule.id === ACCESS_GRANT_GATE_RULE_ID)?.auth
-        ?.requiredGrants;
-    const requiredGrants = [
-        ...new Set([...(existingRequiredGrants ?? fallbackRequiredGrants ?? []), grant]),
-    ];
-    return [
-        ...unmanagedRules,
-        {
-            id: ACCESS_GRANT_ADMISSION_RULE_ID,
-            match: {},
-            effect: "allow",
-            auth: { requiredGrants },
-            reasonCode: "identity_grant_admitted",
-        },
-        {
-            id: ACCESS_GRANT_GATE_RULE_ID,
-            match: {},
-            effect: "challenge",
-            auth: { requiredGrants },
-            reasonCode: "identity_grant_required",
-            message: "Sign in with an approved identity to continue.",
-        },
-    ];
-}
-export function withoutAccessGrantRule(rules, selectedIndex) {
-    const selectedRule = rules[selectedIndex];
-    const removesAccessGrant = selectedRule?.id === ACCESS_GRANT_ADMISSION_RULE_ID ||
-        selectedRule?.id === ACCESS_GRANT_GATE_RULE_ID;
-    return rules.filter((rule, index) => rule.managedBy === undefined &&
-        (removesAccessGrant
-            ? rule.id !== ACCESS_GRANT_ADMISSION_RULE_ID && rule.id !== ACCESS_GRANT_GATE_RULE_ID
-            : index !== selectedIndex));
-}
-export function isAccessGrantAdmissionRule(rule) {
-    return (rule.id === ACCESS_GRANT_ADMISSION_RULE_ID &&
-        rule.effect === "allow" &&
-        Object.keys(rule.match).length === 0 &&
-        rule.auth !== undefined);
-}
-export function isAccessGrantFallbackRule(rule) {
-    return (rule.id === ACCESS_GRANT_GATE_RULE_ID &&
-        rule.effect === "challenge" &&
-        Object.keys(rule.match).length === 0 &&
-        rule.auth !== undefined);
-}
-// The admission allow protects approved identities without preempting the
-// existing password/share/service challenge. The final fallback gate protects
-// public fallthrough. A terminal rule from an earlier effective lane can still
-// stop evaluation before admission; report that explicitly instead of claiming
-// the space is simply gated.
-export function accessGrantExposure(rules) {
-    const gateIndex = rules.findIndex(isAccessGrantFallbackRule);
-    const admissionIndex = rules.findIndex(isAccessGrantAdmissionRule);
-    const earlierRules = gateIndex === -1 ? rules : rules.slice(0, gateIndex);
-    const rulesBeforeAdmission = admissionIndex === -1 ? earlierRules : rules.slice(0, admissionIndex);
-    const precedingTerminalRules = rulesBeforeAdmission.filter((rule) => rule.effect === "challenge" || (rule.effect === "deny" && rule.auth === undefined)).length;
-    const earlierAnonymousAllowRules = earlierRules.filter((rule) => rule.effect === "allow" && !rule.auth).length;
-    const earlierManagedAccessRules = earlierRules.filter((rule) => rule.managedBy !== undefined && rule.effect === "allow").length;
-    return {
-        anonymousAccess: precedingTerminalRules > 0
-            ? "shadowed"
-            : earlierAnonymousAllowRules > 0
-                ? "partly_public"
-                : earlierManagedAccessRules > 0
-                    ? "gated_with_exceptions"
-                    : "gated",
-        earlierAnonymousAllowRules,
-        earlierManagedAccessRules,
-        precedingTerminalRules,
-    };
-}

package/dist/utils/access-match.d.ts

@@ -1,46 +0,0 @@
-export declare function filterGrantsByNamespace(grants: string[], namespaces: string[]): string[];
-export declare function grantGlobMatches(pattern: string, grant: string): boolean;
-export declare function grantsIntersect(grants: string[], requiredGrants: string[]): boolean;
-export declare function requiredGrantsForRule(rule: {
-    managedBy?: string | undefined;
-    auth?: {
-        requiredGrants: string[];
-    } | undefined;
-}): string[];
-export declare function grantsSatisfyRule(input: {
-    grants: string[];
-    requiredGrants: string[];
-    grantNamespaces: string[];
-}): boolean;
-export declare function canonicalizeHost(host: string): string;
-export declare function hostGlobMatches(pattern: string, host: string): boolean;
-export declare function hostTemplateMatches(template: string, host: string): boolean;
-export declare function pathGlobMatches(pattern: string, path: string): boolean;
-export declare function agentMatches(needle: string, agent: string): boolean;
-export declare function ipInCidr(ip: string, cidr: string): boolean;
-export declare function ipInAnyCidr(ip: string, cidrs: string[]): boolean;
-export type RuleMatchContext = {
-    host: string;
-    path: string;
-    channel?: string | undefined;
-    ip?: string | undefined;
-    agent?: string | undefined;
-    country?: string | undefined;
-    headers?: Record<string, string> | undefined;
-};
-export type RuleMatchInput = {
-    host?: string | undefined;
-    hostPattern?: string | undefined;
-    hostTemplate?: string | undefined;
-    pathPattern?: string | undefined;
-    channel?: string | undefined;
-    ipCidrs?: string[] | undefined;
-    agent?: string | undefined;
-    country?: string | undefined;
-    countryNotIn?: string[] | undefined;
-    header?: {
-        name: string;
-        value: string;
-    } | undefined;
-};
-export declare function ruleMatchApplies(match: RuleMatchInput, context: RuleMatchContext): boolean;

package/dist/utils/access-match.fixtures.json

@@ -1,513 +0,0 @@
-{
-    "namespaceFilter": [
-        {
-            "name": "platform namespaces keep platform grants",
-            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
-            "namespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "expected": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"]
-        },
-        {
-            "name": "external key drops everything outside its ext binding",
-            "grants": ["ext:acn_1:wc-subscriber", "team:team_1:owner", "user:usr_1", "email:x@y.z"],
-            "namespaces": ["ext:acn_1:"],
-            "expected": ["ext:acn_1:wc-subscriber"]
-        },
-        {
-            "name": "an external token minting team grants is fully dropped",
-            "grants": ["team:team_1:owner", "team:team_1:admin"],
-            "namespaces": ["ext:acn_1:"],
-            "expected": []
-        },
-        {
-            "name": "local pw key signs only pw grants",
-            "grants": ["pw:space-password", "team:team_1:viewer", "email:a@b.c"],
-            "namespaces": ["pw:"],
-            "expected": ["pw:space-password"]
-        },
-        {
-            "name": "prefix match is a plain startsWith, not a segment match",
-            "grants": ["sub-team:sub_1:member", "team:team_1:member"],
-            "namespaces": ["team:"],
-            "expected": ["team:team_1:member"]
-        },
-        {
-            "name": "empty namespace entries never match",
-            "grants": ["user:usr_1"],
-            "namespaces": [""],
-            "expected": []
-        },
-        {
-            "name": "email-domain namespace is dead: nothing carries it, nothing keeps it",
-            "grants": ["email-domain:acme.com"],
-            "namespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "expected": []
-        },
-        {
-            "name": "empty grant strings are dropped",
-            "grants": ["", "user:usr_1"],
-            "namespaces": ["user:"],
-            "expected": ["user:usr_1"]
-        }
-    ],
-    "glob": [
-        {
-            "pattern": "email:carol@acme.com",
-            "grant": "email:carol@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:carol@acme.com",
-            "grant": "email:mallory@acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@evil.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:carol@sub.acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:*acme.com",
-            "grant": "email:carol@sub.acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@acme.com",
-            "grant": "email:@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "team:*",
-            "grant": "team:team_1:member",
-            "expected": true
-        },
-        {
-            "pattern": "team:team_1:*",
-            "grant": "team:team_1:viewer",
-            "expected": true
-        },
-        {
-            "pattern": "team:team_1:*",
-            "grant": "team:team_2:viewer",
-            "expected": false
-        },
-        {
-            "pattern": "user:*",
-            "grant": "user:usr_1",
-            "expected": true
-        },
-        {
-            "pattern": "user:*",
-            "grant": "email:x@y.z",
-            "expected": false
-        },
-        {
-            "pattern": "space:spc_1:*",
-            "grant": "space:spc_1:commenter",
-            "expected": true
-        },
-        {
-            "pattern": "*",
-            "grant": "anything:at:all",
-            "expected": true
-        },
-        {
-            "pattern": "pw:space-password",
-            "grant": "pw:space-password",
-            "expected": true
-        },
-        {
-            "pattern": "pw:space-password",
-            "grant": "pw:other-rule",
-            "expected": false
-        },
-        {
-            "pattern": "email:*@a*.com",
-            "grant": "email:x@acme.com",
-            "expected": true
-        },
-        {
-            "pattern": "email:*@a*.com",
-            "grant": "email:x@bcme.com",
-            "expected": false
-        },
-        {
-            "pattern": "email:a.b@acme.com",
-            "grant": "email:aXb@acme.com",
-            "expected": false
-        },
-        {
-            "pattern": "svc:stk_1",
-            "grant": "svc:stk_1",
-            "expected": true
-        },
-        {
-            "pattern": "link:lnk_*",
-            "grant": "link:lnk_abc",
-            "expected": true
-        },
-        {
-            "pattern": "",
-            "grant": "user:usr_1",
-            "expected": false
-        }
-    ],
-    "intersect": [
-        {
-            "name": "single exact hit",
-            "grants": ["user:usr_1", "email:carol@acme.com"],
-            "requiredGrants": ["email:carol@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "no overlap",
-            "grants": ["user:usr_1", "team:team_1:member"],
-            "requiredGrants": ["email:*@acme.com", "link:lnk_1"],
-            "expected": false
-        },
-        {
-            "name": "glob run crosses separators",
-            "grants": ["team:team_1:member"],
-            "requiredGrants": ["team:*:member"],
-            "expected": true
-        },
-        {
-            "name": "any-of over requiredGrants",
-            "grants": ["invite:sin_1"],
-            "requiredGrants": ["email:x@y.z", "invite:sin_1", "team:team_1:viewer"],
-            "expected": true
-        },
-        {
-            "name": "empty grants never pass",
-            "grants": [],
-            "requiredGrants": ["user:*"],
-            "expected": false
-        },
-        {
-            "name": "empty requiredGrants never pass",
-            "grants": ["user:usr_1"],
-            "requiredGrants": [],
-            "expected": false
-        },
-        {
-            "name": "empty-string entries are ignored on both sides",
-            "grants": [""],
-            "requiredGrants": [""],
-            "expected": false
-        },
-        {
-            "name": "concrete grant does not glob against a concrete requirement",
-            "grants": ["email:carol@acme.com"],
-            "requiredGrants": ["email:carol@acme.co"],
-            "expected": false
-        }
-    ],
-    "satisfy": [
-        {
-            "name": "platform token passes an email-domain wall",
-            "grants": ["user:usr_1", "email:carol@acme.com", "team:team_1:member"],
-            "grantNamespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "requiredGrants": ["email:*@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "external token cannot satisfy a team wall (namespace drop first)",
-            "grants": ["team:team_1:member"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["team:team_1:member"],
-            "expected": false
-        },
-        {
-            "name": "local pw token satisfies exactly its wall",
-            "grants": ["pw:space-password"],
-            "grantNamespaces": ["pw:"],
-            "requiredGrants": ["pw:space-password"],
-            "expected": true
-        },
-        {
-            "name": "pw token cannot satisfy an identity wall",
-            "grants": ["pw:space-password"],
-            "grantNamespaces": ["pw:"],
-            "requiredGrants": ["email:*@acme.com", "team:team_1:viewer"],
-            "expected": false
-        },
-        {
-            "name": "external token satisfies its own owner-defined tag",
-            "grants": ["ext:acn_1:wc-subscriber"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["ext:acn_1:wc-subscriber"],
-            "expected": true
-        },
-        {
-            "name": "external token minting team:* wildcard grants fails the namespace filter",
-            "grants": [
-                "ext:acn_1:wc-subscriber",
-                "team:*",
-                "team:team_1:owner",
-                "user:usr_1",
-                "email:carol@acme.com"
-            ],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["team:*"],
-            "expected": false
-        },
-        {
-            "name": "external token cannot cross into another connection's ext namespace",
-            "grants": ["ext:acn_2:wc-subscriber"],
-            "grantNamespaces": ["ext:acn_1:"],
-            "requiredGrants": ["ext:acn_2:wc-subscriber"],
-            "expected": false
-        },
-        {
-            "name": "sso token passes the connection audience and its verified email glob",
-            "grants": ["sso:acn_9", "email:carol@acme.com"],
-            "grantNamespaces": [
-                "team:",
-                "sub-team:",
-                "user:",
-                "email:",
-                "space:",
-                "link:",
-                "invite:",
-                "svc:",
-                "sso:"
-            ],
-            "requiredGrants": ["email:*@acme.com"],
-            "expected": true
-        },
-        {
-            "name": "same-space grant cannot satisfy an identity-bound reviewer rule",
-            "grants": ["space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": false
-        },
-        {
-            "name": "the exact reviewer identity satisfies its identity-bound rule",
-            "grants": ["email:reviewer.a@example.com", "space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": true
-        },
-        {
-            "name": "a different reviewer remains denied despite a same-space grant",
-            "grants": ["email:reviewer.b@example.com", "space:spc_review:viewer"],
-            "grantNamespaces": ["email:", "space:"],
-            "requiredGrants": ["email:reviewer.a@example.com"],
-            "expected": false
-        }
-    ],
-    "pathGlob": [
-        {
-            "pattern": "",
-            "path": "/anything",
-            "expected": true
-        },
-        {
-            "pattern": "/x.html",
-            "path": "/x.html",
-            "expected": true
-        },
-        {
-            "pattern": "/x.html",
-            "path": "/x.htm",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs/",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs/a/b/c.html",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/**",
-            "path": "/docs",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/a.html",
-            "expected": true
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/a/b.html",
-            "expected": false
-        },
-        {
-            "pattern": "/docs/*",
-            "path": "/docs/",
-            "expected": true
-        },
-        {
-            "pattern": "/report/**",
-            "path": "/report/q2/deck.pdf",
-            "expected": true
-        },
-        {
-            "pattern": "/report/**",
-            "path": "/reports/q2.pdf",
-            "expected": false
-        },
-        {
-            "pattern": "/*.html",
-            "path": "/index.html",
-            "expected": true
-        },
-        {
-            "pattern": "/*.html",
-            "path": "/a/index.html",
-            "expected": false
-        },
-        {
-            "pattern": "/**",
-            "path": "/",
-            "expected": true
-        },
-        {
-            "pattern": "/**",
-            "path": "/deep/path/file.txt",
-            "expected": true
-        },
-        {
-            "pattern": "/a+b/**",
-            "path": "/a+b/x",
-            "expected": true
-        },
-        {
-            "pattern": "/a.b/**",
-            "path": "/axb/x",
-            "expected": false
-        }
-    ],
-    "cidr": [
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.0/24",
-            "expected": true
-        },
-        {
-            "ip": "1.2.4.4",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.4",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.5",
-            "expected": false
-        },
-        {
-            "ip": "10.0.0.1",
-            "cidr": "10.0.0.0/8",
-            "expected": true
-        },
-        {
-            "ip": "10.128.0.1",
-            "cidr": "10.0.0.0/9",
-            "expected": false
-        },
-        {
-            "ip": "10.127.255.255",
-            "cidr": "10.0.0.0/9",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "0.0.0.0/0",
-            "expected": true
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "1.2.3.0/33",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "",
-            "expected": false
-        },
-        {
-            "ip": "not-an-ip",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "2001:db8::1",
-            "cidr": "2001:db8::/32",
-            "expected": true
-        },
-        {
-            "ip": "2001:db9::1",
-            "cidr": "2001:db8::/32",
-            "expected": false
-        },
-        {
-            "ip": "2001:db8::1",
-            "cidr": "1.2.3.0/24",
-            "expected": false
-        },
-        {
-            "ip": "1.2.3.4",
-            "cidr": "2001:db8::/32",
-            "expected": false
-        },
-        {
-            "ip": "::ffff:1.2.3.4",
-            "cidr": "::ffff:1.2.3.0/120",
-            "expected": true
-        },
-        {
-            "ip": "fe80::aaaa:bbbb",
-            "cidr": "fe80::/10",
-            "expected": true
-        }
-    ]
-}