@steve31415/baselib 3.35.0 → 3.36.0

package/dist/s2s.d.ts

@@ -7,8 +7,12 @@ import { type Logger } from './log-core.js';
  * disables the always-allow rule (fail closed). */
 export declare function codingAgentSa(): string | undefined;
 /** caller service-account email → allowed "METHOD /path" patterns.
- *  Patterns: exact ("GET /api/whoami"), trailing wildcard ("POST /api/admin/*"),
- *  or "*" for everything. */
+ *  Patterns: exact ("GET /api/whoami"), trailing wildcard ("POST /api/admin/*",
+ *  a prefix: the bare path and everything under it), a single-segment
+ *  wildcard anywhere else ("GET /api/tasks/*\/card": exactly one non-empty
+ *  segment in that position, so one task-scoped method can be granted without
+ *  the whole prefix — 2026-10-12, Radar's grant on Coder's card and decide
+ *  routes), or "*" for everything. */
 export type Grants = Record<string, string[]>;
 export interface ServiceCaller {
     type: 's2s';

package/dist/s2s.js

@@ -40,9 +40,20 @@ export function grantAllows(grants, email, method, path) {
             const prefix = p.slice(0, -1); // keep the trailing slash
             return want.startsWith(prefix) || want === p.slice(0, -2);
         }
+        if (p.includes('/*/'))
+            return segmentsMatch(p, want);
         return want === p;
     });
 }
+/** "METHOD /a/*\/b" against "METHOD /a/x/b": the same number of segments,
+ *  each equal or a `*` standing for exactly one non-empty segment. */
+function segmentsMatch(pattern, want) {
+    const ps = pattern.split('/');
+    const ws = want.split('/');
+    if (ps.length !== ws.length)
+        return false;
+    return ps.every((seg, i) => (seg === '*' ? ws[i].length > 0 : seg === ws[i]));
+}
 // Fixed-window per-identity rate limiter — a sanity check against runaway
 // loops and mischief, not a precision tool (per-instance state only).
 export class RateLimiter {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.35.0",
+  "version": "3.36.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",