@stigmer/server 3.22.1 → 3.23.1-dev.20260923075205
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/artifactstorage/artifact-storage.d.ts +29 -31
- package/dist/artifactstorage/artifact-storage.d.ts.map +1 -1
- package/dist/artifactstorage/artifact-storage.js +5 -7
- package/dist/artifactstorage/artifact-storage.js.map +1 -1
- package/dist/artifactstorage/r2-storage.d.ts +12 -7
- package/dist/artifactstorage/r2-storage.d.ts.map +1 -1
- package/dist/artifactstorage/r2-storage.js +6 -14
- package/dist/artifactstorage/r2-storage.js.map +1 -1
- package/dist/authorization/authorizer.d.ts +4 -8
- package/dist/authorization/authorizer.d.ts.map +1 -1
- package/dist/authorization/authorizer.js +5 -9
- package/dist/authorization/authorizer.js.map +1 -1
- package/dist/authorization/derived-tuples.d.ts.map +1 -1
- package/dist/authorization/derived-tuples.js +10 -25
- package/dist/authorization/derived-tuples.js.map +1 -1
- package/dist/authorization/evaluator.d.ts +7 -8
- package/dist/authorization/evaluator.d.ts.map +1 -1
- package/dist/authorization/evaluator.js +4 -20
- package/dist/authorization/evaluator.js.map +1 -1
- package/dist/authorization/list-read-scope.d.ts.map +1 -1
- package/dist/authorization/list-read-scope.js +5 -9
- package/dist/authorization/list-read-scope.js.map +1 -1
- package/dist/authorization/model/agent.d.ts.map +1 -1
- package/dist/authorization/model/agent.js +4 -5
- package/dist/authorization/model/agent.js.map +1 -1
- package/dist/authorization/model/agent_instance.d.ts.map +1 -1
- package/dist/authorization/model/agent_instance.js +2 -2
- package/dist/authorization/model/agent_instance.js.map +1 -1
- package/dist/authorization/model/mcp_server.d.ts.map +1 -1
- package/dist/authorization/model/mcp_server.js +2 -2
- package/dist/authorization/model/mcp_server.js.map +1 -1
- package/dist/authorization/model/plugin.d.ts.map +1 -1
- package/dist/authorization/model/plugin.js +3 -4
- package/dist/authorization/model/plugin.js.map +1 -1
- package/dist/authorization/model/rewrite.d.ts +8 -10
- package/dist/authorization/model/rewrite.d.ts.map +1 -1
- package/dist/authorization/model/rewrite.js +0 -3
- package/dist/authorization/model/rewrite.js.map +1 -1
- package/dist/authorization/model/skill.d.ts.map +1 -1
- package/dist/authorization/model/skill.js +2 -2
- package/dist/authorization/model/skill.js.map +1 -1
- package/dist/authorization/model/workflow.d.ts.map +1 -1
- package/dist/authorization/model/workflow.js +2 -2
- package/dist/authorization/model/workflow.js.map +1 -1
- package/dist/authorization/model/workflow_instance.d.ts.map +1 -1
- package/dist/authorization/model/workflow_instance.js +2 -2
- package/dist/authorization/model/workflow_instance.js.map +1 -1
- package/dist/authorization/organization-directory.d.ts.map +1 -1
- package/dist/authorization/organization-directory.js +2 -3
- package/dist/authorization/organization-directory.js.map +1 -1
- package/dist/authorization/store-test-kit.d.ts +0 -6
- package/dist/authorization/store-test-kit.d.ts.map +1 -1
- package/dist/authorization/store-test-kit.js +16 -62
- package/dist/authorization/store-test-kit.js.map +1 -1
- package/dist/authorization/tuples.d.ts +13 -32
- package/dist/authorization/tuples.d.ts.map +1 -1
- package/dist/authorization/tuples.js +3 -11
- package/dist/authorization/tuples.js.map +1 -1
- package/dist/boot/compose.d.ts.map +1 -1
- package/dist/boot/compose.js +49 -24
- package/dist/boot/compose.js.map +1 -1
- package/dist/boot/config.d.ts +4 -3
- package/dist/boot/config.d.ts.map +1 -1
- package/dist/boot/config.js.map +1 -1
- package/dist/boot/skill-transfer-origin.d.ts +52 -0
- package/dist/boot/skill-transfer-origin.d.ts.map +1 -0
- package/dist/boot/skill-transfer-origin.js +54 -0
- package/dist/boot/skill-transfer-origin.js.map +1 -0
- package/dist/domain/agent/controller.d.ts.map +1 -1
- package/dist/domain/agent/controller.js +4 -4
- package/dist/domain/agent/controller.js.map +1 -1
- package/dist/domain/agentchannel/controller.d.ts.map +1 -1
- package/dist/domain/agentchannel/controller.js +3 -1
- package/dist/domain/agentchannel/controller.js.map +1 -1
- package/dist/domain/agentexecution/controller.d.ts.map +1 -1
- package/dist/domain/agentexecution/controller.js +3 -1
- package/dist/domain/agentexecution/controller.js.map +1 -1
- package/dist/domain/agentinstance/controller.d.ts.map +1 -1
- package/dist/domain/agentinstance/controller.js +3 -4
- package/dist/domain/agentinstance/controller.js.map +1 -1
- package/dist/domain/agentshare/constants.d.ts +6 -11
- package/dist/domain/agentshare/constants.d.ts.map +1 -1
- package/dist/domain/agentshare/constants.js +8 -16
- package/dist/domain/agentshare/constants.js.map +1 -1
- package/dist/domain/agentshare/controller.d.ts.map +1 -1
- package/dist/domain/agentshare/controller.js +3 -1
- package/dist/domain/agentshare/controller.js.map +1 -1
- package/dist/domain/agentshare/steps.d.ts +18 -25
- package/dist/domain/agentshare/steps.d.ts.map +1 -1
- package/dist/domain/agentshare/steps.js +41 -142
- package/dist/domain/agentshare/steps.js.map +1 -1
- package/dist/domain/environment/controller.d.ts.map +1 -1
- package/dist/domain/environment/controller.js +2 -3
- package/dist/domain/environment/controller.js.map +1 -1
- package/dist/domain/executioncontext/controller.d.ts.map +1 -1
- package/dist/domain/executioncontext/controller.js +2 -1
- package/dist/domain/executioncontext/controller.js.map +1 -1
- package/dist/domain/mcpserver/controller.d.ts.map +1 -1
- package/dist/domain/mcpserver/controller.js +3 -4
- package/dist/domain/mcpserver/controller.js.map +1 -1
- package/dist/domain/plugin/controller.d.ts +3 -7
- package/dist/domain/plugin/controller.d.ts.map +1 -1
- package/dist/domain/plugin/controller.js +9 -11
- package/dist/domain/plugin/controller.js.map +1 -1
- package/dist/domain/plugin/push.d.ts +7 -5
- package/dist/domain/plugin/push.d.ts.map +1 -1
- package/dist/domain/plugin/push.js +8 -14
- package/dist/domain/plugin/push.js.map +1 -1
- package/dist/domain/schedule/controller.d.ts.map +1 -1
- package/dist/domain/schedule/controller.js +3 -1
- package/dist/domain/schedule/controller.js.map +1 -1
- package/dist/domain/session/controller.d.ts.map +1 -1
- package/dist/domain/session/controller.js +3 -2
- package/dist/domain/session/controller.js.map +1 -1
- package/dist/domain/skill/constants.d.ts +26 -3
- package/dist/domain/skill/constants.d.ts.map +1 -1
- package/dist/domain/skill/constants.js +26 -3
- package/dist/domain/skill/constants.js.map +1 -1
- package/dist/domain/skill/controller.d.ts +6 -11
- package/dist/domain/skill/controller.d.ts.map +1 -1
- package/dist/domain/skill/controller.js +33 -24
- package/dist/domain/skill/controller.js.map +1 -1
- package/dist/domain/skill/push.d.ts +2 -2
- package/dist/domain/skill/push.d.ts.map +1 -1
- package/dist/domain/skill/push.js +2 -2
- package/dist/domain/skill/push.js.map +1 -1
- package/dist/domain/skill/transfer/handler.d.ts +17 -9
- package/dist/domain/skill/transfer/handler.d.ts.map +1 -1
- package/dist/domain/skill/transfer/handler.js +19 -8
- package/dist/domain/skill/transfer/handler.js.map +1 -1
- package/dist/domain/skill/transfer/slots.d.ts +26 -41
- package/dist/domain/skill/transfer/slots.d.ts.map +1 -1
- package/dist/domain/skill/transfer/slots.js +80 -87
- package/dist/domain/skill/transfer/slots.js.map +1 -1
- package/dist/domain/skill/transfer/staging.d.ts +48 -0
- package/dist/domain/skill/transfer/staging.d.ts.map +1 -0
- package/dist/domain/skill/transfer/staging.js +127 -0
- package/dist/domain/skill/transfer/staging.js.map +1 -0
- package/dist/domain/workflow/agent-call-references.d.ts +54 -0
- package/dist/domain/workflow/agent-call-references.d.ts.map +1 -0
- package/dist/domain/workflow/agent-call-references.js +97 -0
- package/dist/domain/workflow/agent-call-references.js.map +1 -0
- package/dist/domain/workflow/controller.d.ts.map +1 -1
- package/dist/domain/workflow/controller.js +14 -6
- package/dist/domain/workflow/controller.js.map +1 -1
- package/dist/domain/workflow/registry/data/task-kind-registry.json +1 -1
- package/dist/domain/workflow/validation/task-config-constraints.d.ts +10 -1
- package/dist/domain/workflow/validation/task-config-constraints.d.ts.map +1 -1
- package/dist/domain/workflow/validation/task-config-constraints.js +3 -2
- package/dist/domain/workflow/validation/task-config-constraints.js.map +1 -1
- package/dist/domain/workflowexecution/controller.d.ts.map +1 -1
- package/dist/domain/workflowexecution/controller.js +4 -2
- package/dist/domain/workflowexecution/controller.js.map +1 -1
- package/dist/domain/workflowinstance/controller.d.ts.map +1 -1
- package/dist/domain/workflowinstance/controller.js +3 -4
- package/dist/domain/workflowinstance/controller.js.map +1 -1
- package/dist/extensions/authorization-queries.d.ts +6 -5
- package/dist/extensions/authorization-queries.d.ts.map +1 -1
- package/dist/extensions/list-read-scope.d.ts +1 -1
- package/dist/extensions/resource-authorization.d.ts +3 -2
- package/dist/extensions/resource-authorization.d.ts.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/dist/pipeline/apiresource-meta.d.ts +12 -3
- package/dist/pipeline/apiresource-meta.d.ts.map +1 -1
- package/dist/pipeline/apiresource-meta.js +21 -10
- package/dist/pipeline/apiresource-meta.js.map +1 -1
- package/dist/pipeline/steps/authorization-tuples.d.ts +9 -3
- package/dist/pipeline/steps/authorization-tuples.d.ts.map +1 -1
- package/dist/pipeline/steps/authorization-tuples.js +9 -11
- package/dist/pipeline/steps/authorization-tuples.js.map +1 -1
- package/dist/pipeline/steps/references.d.ts +178 -20
- package/dist/pipeline/steps/references.d.ts.map +1 -1
- package/dist/pipeline/steps/references.js +344 -43
- package/dist/pipeline/steps/references.js.map +1 -1
- package/dist/pipeline/steps/resolve-artifact-source.d.ts +11 -8
- package/dist/pipeline/steps/resolve-artifact-source.d.ts.map +1 -1
- package/dist/pipeline/steps/resolve-artifact-source.js +8 -4
- package/dist/pipeline/steps/resolve-artifact-source.js.map +1 -1
- package/dist/query/search/controller.js +0 -1
- package/dist/query/search/controller.js.map +1 -1
- package/dist/query/search/criteria.d.ts +1 -5
- package/dist/query/search/criteria.d.ts.map +1 -1
- package/dist/query/search/criteria.js +3 -13
- package/dist/query/search/criteria.js.map +1 -1
- package/dist/query/search/handler.d.ts +5 -4
- package/dist/query/search/handler.d.ts.map +1 -1
- package/dist/query/search/handler.js +7 -6
- package/dist/query/search/handler.js.map +1 -1
- package/dist/query/search/query-store.d.ts.map +1 -1
- package/dist/query/search/query-store.js +0 -2
- package/dist/query/search/query-store.js.map +1 -1
- package/dist/store/interface.d.ts +3 -6
- package/dist/store/interface.d.ts.map +1 -1
- package/dist/store/interface.js.map +1 -1
- package/dist/store/postgres/migrations.d.ts +3 -1
- package/dist/store/postgres/migrations.d.ts.map +1 -1
- package/dist/store/postgres/migrations.js +35 -1
- package/dist/store/postgres/migrations.js.map +1 -1
- package/dist/store/postgres/store.d.ts.map +1 -1
- package/dist/store/postgres/store.js +4 -9
- package/dist/store/postgres/store.js.map +1 -1
- package/dist/store/public-visibility-retired.d.ts +67 -0
- package/dist/store/public-visibility-retired.d.ts.map +1 -0
- package/dist/store/public-visibility-retired.js +55 -0
- package/dist/store/public-visibility-retired.js.map +1 -0
- package/dist/store/sqlite/migrations.d.ts +3 -1
- package/dist/store/sqlite/migrations.d.ts.map +1 -1
- package/dist/store/sqlite/migrations.js +36 -1
- package/dist/store/sqlite/migrations.js.map +1 -1
- package/dist/store/sqlite/store.d.ts.map +1 -1
- package/dist/store/sqlite/store.js +4 -8
- package/dist/store/sqlite/store.js.map +1 -1
- package/package.json +6 -6
- package/src/artifactstorage/__tests__/artifact-storage.test.ts +36 -33
- package/src/artifactstorage/__tests__/r2-storage.test.ts +11 -13
- package/src/artifactstorage/artifact-storage.ts +37 -33
- package/src/artifactstorage/r2-storage.ts +6 -15
- package/src/authorization/README.md +24 -26
- package/src/authorization/__tests__/authorizer.test.ts +10 -9
- package/src/authorization/__tests__/derived-tuples.test.ts +4 -11
- package/src/authorization/__tests__/evaluator.test.ts +14 -73
- package/src/authorization/__tests__/facts.test.ts +2 -2
- package/src/authorization/__tests__/fixtures/fga/agent-instance-creation.fga.yaml +19 -27
- package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml +6 -98
- package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml +4 -61
- package/src/authorization/__tests__/fixtures/fga/mcp-server-authoring.fga.yaml +1 -15
- package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml +1 -21
- package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml +1 -25
- package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml +1 -3
- package/src/authorization/__tests__/list-read-scope.test.ts +18 -17
- package/src/authorization/__tests__/store-tests.test.ts +2 -6
- package/src/authorization/__tests__/tuples.test.ts +12 -11
- package/src/authorization/authorizer.ts +4 -9
- package/src/authorization/derived-tuples.ts +14 -31
- package/src/authorization/evaluator.ts +8 -44
- package/src/authorization/list-read-scope.ts +5 -11
- package/src/authorization/model/agent.ts +2 -5
- package/src/authorization/model/agent_instance.ts +0 -2
- package/src/authorization/model/mcp_server.ts +0 -2
- package/src/authorization/model/plugin.ts +1 -4
- package/src/authorization/model/rewrite.ts +8 -13
- package/src/authorization/model/skill.ts +0 -2
- package/src/authorization/model/workflow.ts +0 -2
- package/src/authorization/model/workflow_instance.ts +0 -2
- package/src/authorization/organization-directory.ts +1 -3
- package/src/authorization/store-test-kit.ts +16 -75
- package/src/authorization/tuples.ts +16 -39
- package/src/boot/__tests__/skill-transfer-origin.test.ts +72 -0
- package/src/boot/compose.ts +62 -25
- package/src/boot/config.ts +4 -3
- package/src/boot/skill-transfer-origin.ts +76 -0
- package/src/domain/agent/__tests__/agent.test.ts +11 -4
- package/src/domain/agent/controller.ts +7 -7
- package/src/domain/agentchannel/__tests__/agentchannel.test.ts +223 -48
- package/src/domain/agentchannel/controller.ts +6 -1
- package/src/domain/agentexecution/controller.ts +6 -1
- package/src/domain/agentinstance/controller.ts +6 -12
- package/src/domain/agentshare/__tests__/agentshare.test.ts +196 -172
- package/src/domain/agentshare/__tests__/create-authorization.test.ts +16 -31
- package/src/domain/agentshare/constants.ts +14 -26
- package/src/domain/agentshare/controller.ts +6 -1
- package/src/domain/agentshare/steps.ts +41 -194
- package/src/domain/environment/controller.ts +5 -8
- package/src/domain/executioncontext/controller.ts +5 -1
- package/src/domain/mcpserver/__tests__/mcpserver.test.ts +115 -28
- package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts +53 -18
- package/src/domain/mcpserver/controller.ts +6 -12
- package/src/domain/plugin/controller.ts +16 -25
- package/src/domain/plugin/push.ts +8 -16
- package/src/domain/schedule/controller.ts +6 -1
- package/src/domain/session/controller.ts +12 -4
- package/src/domain/skill/__tests__/skill.test.ts +5 -3
- package/src/domain/skill/__tests__/slots.test.ts +113 -60
- package/src/domain/skill/__tests__/staging.test.ts +304 -0
- package/src/domain/skill/constants.ts +28 -3
- package/src/domain/skill/controller.ts +44 -42
- package/src/domain/skill/push.ts +3 -3
- package/src/domain/skill/transfer/handler.ts +33 -15
- package/src/domain/skill/transfer/slots.ts +89 -100
- package/src/domain/skill/transfer/staging.ts +191 -0
- package/src/domain/workflow/__tests__/agent-call-references.test.ts +222 -0
- package/src/domain/workflow/agent-call-references.ts +157 -0
- package/src/domain/workflow/controller.ts +28 -10
- package/src/domain/workflow/registry/data/task-kind-registry.json +1 -1
- package/src/domain/workflow/validation/task-config-constraints.ts +7 -3
- package/src/domain/workflowexecution/controller.ts +7 -2
- package/src/domain/workflowinstance/controller.ts +6 -12
- package/src/extensions/__tests__/built-in-authorization-composed.test.ts +32 -19
- package/src/extensions/__tests__/extension-composition.test.ts +4 -4
- package/src/extensions/__tests__/list-read-scope-composed.test.ts +9 -6
- package/src/extensions/authorization-queries.ts +6 -5
- package/src/extensions/list-read-scope.ts +1 -1
- package/src/extensions/resource-authorization.ts +3 -5
- package/src/index.ts +0 -1
- package/src/pipeline/__tests__/supports-visibility.test.ts +112 -0
- package/src/pipeline/apiresource-meta.ts +21 -10
- package/src/pipeline/steps/__tests__/authorization-tuples.test.ts +18 -31
- package/src/pipeline/steps/__tests__/references.test.ts +703 -0
- package/src/pipeline/steps/authorization-tuples.ts +9 -11
- package/src/pipeline/steps/references.ts +578 -70
- package/src/pipeline/steps/resolve-artifact-source.ts +20 -13
- package/src/query/search/__tests__/criteria.test.ts +0 -4
- package/src/query/search/__tests__/query-store.test.ts +11 -40
- package/src/query/search/controller.ts +0 -1
- package/src/query/search/criteria.ts +0 -14
- package/src/query/search/handler.ts +6 -7
- package/src/query/search/query-store.ts +0 -2
- package/src/store/__tests__/public-visibility-retired.test.ts +127 -0
- package/src/store/__tests__/store-contract.ts +6 -51
- package/src/store/interface.ts +3 -6
- package/src/store/postgres/__tests__/migrations.test.ts +187 -6
- package/src/store/postgres/__tests__/store-contract.test.ts +0 -2
- package/src/store/postgres/migrations.ts +48 -1
- package/src/store/postgres/store.ts +4 -11
- package/src/store/public-visibility-retired.ts +119 -0
- package/src/store/sqlite/__tests__/migrations.test.ts +191 -5
- package/src/store/sqlite/migrations.ts +45 -1
- package/src/store/sqlite/store.ts +4 -10
- package/src/transport/registry/__tests__/lanes.test.ts +1 -1
- package/dist/pipeline/steps/visibility-gates.d.ts +0 -27
- package/dist/pipeline/steps/visibility-gates.d.ts.map +0 -1
- package/dist/pipeline/steps/visibility-gates.js +0 -139
- package/dist/pipeline/steps/visibility-gates.js.map +0 -1
- package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml +0 -98
- package/src/authorization/__tests__/fixtures/fga/public-visibility-setter.fga.yaml +0 -52
- package/src/pipeline/steps/__tests__/visibility-gates.test.ts +0 -187
- package/src/pipeline/steps/visibility-gates.ts +0 -174
|
@@ -12,17 +12,15 @@ export declare class ArtifactStorageNotFoundError extends Error {
|
|
|
12
12
|
constructor(key: string);
|
|
13
13
|
}
|
|
14
14
|
/**
|
|
15
|
-
* A staged upload minted by presignPut: the URL receives the bytes,
|
|
16
|
-
*
|
|
17
|
-
* short-lived by contract — the local lane sweeps them on TTL
|
|
18
|
-
* boot;
|
|
19
|
-
* prefix (the §6b driver-side sweep expectation).
|
|
15
|
+
* A staged upload minted by presignPut: the URL receives the bytes, which
|
|
16
|
+
* the caller reads back through download() under the key IT named. Staged
|
|
17
|
+
* blobs are short-lived by contract — the local lane sweeps them on TTL
|
|
18
|
+
* expiry and boot; a bucket deployment configures a lifecycle rule on the
|
|
19
|
+
* domain's staging prefix (the §6b driver-side sweep expectation).
|
|
20
20
|
*/
|
|
21
21
|
export interface PresignedUpload {
|
|
22
|
-
/** Accepts
|
|
22
|
+
/** Accepts an HTTP PUT of exactly the declared byte count. */
|
|
23
23
|
readonly url: string;
|
|
24
|
-
/** Driver key where the staged bytes land, readable via download(). */
|
|
25
|
-
readonly stagingKey: string;
|
|
26
24
|
/** The TTL actually granted, after per-driver clamping. */
|
|
27
25
|
readonly ttlMs: number;
|
|
28
26
|
}
|
|
@@ -47,18 +45,21 @@ export interface ArtifactStorage {
|
|
|
47
45
|
*/
|
|
48
46
|
getSignedUrl(key: string, expiresInMs: number, downloadFilename: string): Promise<string>;
|
|
49
47
|
/**
|
|
50
|
-
* A time-limited upload URL for a
|
|
51
|
-
*
|
|
52
|
-
*
|
|
53
|
-
*
|
|
54
|
-
*
|
|
55
|
-
*
|
|
56
|
-
*
|
|
57
|
-
*
|
|
58
|
-
*
|
|
59
|
-
*
|
|
48
|
+
* A time-limited upload URL for a blob of exactly declaredSizeBytes at
|
|
49
|
+
* the key the CALLER names (§6b). The key is the domain's: it chooses
|
|
50
|
+
* the staging prefix its sweep targets and the mapping from its wire
|
|
51
|
+
* reference, and reads the bytes back through download(key) — the
|
|
52
|
+
* driver never invents a key of its own. Per-driver semantics differ
|
|
53
|
+
* DELIBERATELY and are contract, not accident: the local backend rides
|
|
54
|
+
* the skill transfer lane's URL-as-credential slot mechanism
|
|
55
|
+
* (single-use, exact-size enforced by the lane, TTL clamped to the
|
|
56
|
+
* lane's slot TTL) and answers only on instances with a staged-upload
|
|
57
|
+
* lane wired — unwired instances throw the explicit not-configured
|
|
58
|
+
* error, never a silent no-op. The R2 backend presigns a PUT
|
|
59
|
+
* (repeatable within its TTL, size enforced by the signed
|
|
60
|
+
* Content-Length header, TTL clamped to the 7-day R2 maximum).
|
|
60
61
|
*/
|
|
61
|
-
presignPut(declaredSizeBytes: number, ttlMs: number): Promise<PresignedUpload>;
|
|
62
|
+
presignPut(key: string, declaredSizeBytes: number, ttlMs: number): Promise<PresignedUpload>;
|
|
62
63
|
/** Removes the artifact; missing is not an error. */
|
|
63
64
|
delete(key: string): Promise<void>;
|
|
64
65
|
/** Whether an artifact with the key exists. */
|
|
@@ -83,19 +84,16 @@ export type ArtifactStorageDriverFactory = () => ArtifactStorage;
|
|
|
83
84
|
* the shape it needs and stays ignorant of who provides it.
|
|
84
85
|
*/
|
|
85
86
|
export interface StagedUploadLane {
|
|
86
|
-
/** Reserves a single-use upload slot; returns its reference + TTL. */
|
|
87
|
-
mint(declaredSizeBytes: number): {
|
|
88
|
-
ref: string;
|
|
89
|
-
ttlMs: number;
|
|
90
|
-
};
|
|
91
|
-
/** The externally-reachable PUT URL for a minted reference. */
|
|
92
|
-
uploadUrl(ref: string): string;
|
|
93
87
|
/**
|
|
94
|
-
*
|
|
95
|
-
*
|
|
96
|
-
*
|
|
88
|
+
* Reserves a single-use upload slot whose bytes land at `key` under this
|
|
89
|
+
* driver instance's root — the lane stages into the driver's own tree,
|
|
90
|
+
* so download(key) reads exactly what the lane received. Returns the
|
|
91
|
+
* externally-reachable PUT URL and the TTL the lane grants.
|
|
97
92
|
*/
|
|
98
|
-
|
|
93
|
+
reserve(key: string, declaredSizeBytes: number): {
|
|
94
|
+
url: string;
|
|
95
|
+
ttlMs: number;
|
|
96
|
+
};
|
|
99
97
|
}
|
|
100
98
|
export interface ArtifactStorageConfig {
|
|
101
99
|
/** "local" or "r2" ("" defaults to local — Go NewArtifactStorage). */
|
|
@@ -145,7 +143,7 @@ export declare class LocalArtifactStorage implements ArtifactStorage {
|
|
|
145
143
|
upload(key: string, data: Uint8Array, _contentType: string): Promise<void>;
|
|
146
144
|
download(key: string): Promise<Uint8Array>;
|
|
147
145
|
size(key: string): Promise<number>;
|
|
148
|
-
presignPut(declaredSizeBytes: number, _ttlMs: number): Promise<PresignedUpload>;
|
|
146
|
+
presignPut(key: string, declaredSizeBytes: number, _ttlMs: number): Promise<PresignedUpload>;
|
|
149
147
|
getSignedUrl(key: string, _expiresInMs: number, downloadFilename: string): Promise<string>;
|
|
150
148
|
delete(key: string): Promise<void>;
|
|
151
149
|
exists(key: string): Promise<boolean>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"artifact-storage.d.ts","sourceRoot":"","sources":["../../src/artifactstorage/artifact-storage.ts"],"names":[],"mappings":"AAuCA;qEACqE;AACrE,eAAO,MAAM,0BAA0B,aAAa,CAAC;AAErD;;;;;;GAMG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,GAAG,EAAE,MAAM;CAMxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B
|
|
1
|
+
{"version":3,"file":"artifact-storage.d.ts","sourceRoot":"","sources":["../../src/artifactstorage/artifact-storage.ts"],"names":[],"mappings":"AAuCA;qEACqE;AACrE,eAAO,MAAM,0BAA0B,aAAa,CAAC;AAErD;;;;;;GAMG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,GAAG,EAAE,MAAM;CAMxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,YAAY,CACV,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,UAAU,CACR,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,qDAAqD;IACrD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,+CAA+C;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,kEAAkE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,MAAM,eAAe,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,OAAO,CACL,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,GACxB;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA2B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,qBAAqB,EAC7B,iBAAiB,GAAE,WAAW,CAAC,MAAM,EAAE,4BAA4B,CAAa,GAC/E,eAAe,CA2BjB;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAExD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBATjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IACjC;;;;;;OAMG;IACc,gBAAgB,CAAC,EAAE,gBAAgB,YAAA;IAMhD,MAAM,CACV,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAOV,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAY1C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlC,UAAU,CACd,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC;IAerB,YAAY,CAChB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAWZ,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB7B;;;;OAIG;IACH,OAAO,CAAC,IAAI;IAIZ;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;YACW,gBAAgB;CAc/B;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQrE"}
|
|
@@ -132,19 +132,17 @@ export class LocalArtifactStorage {
|
|
|
132
132
|
throw error;
|
|
133
133
|
}
|
|
134
134
|
}
|
|
135
|
-
async presignPut(declaredSizeBytes, _ttlMs) {
|
|
135
|
+
async presignPut(key, declaredSizeBytes, _ttlMs) {
|
|
136
136
|
if (this.stagedUploadLane === undefined) {
|
|
137
137
|
throw new Error("local presigned uploads not configured - no staged-upload lane is wired to this store instance");
|
|
138
138
|
}
|
|
139
|
+
// The key must be one this instance can read back, or the lane would
|
|
140
|
+
// stage bytes download(key) can never reach.
|
|
141
|
+
this.resolveWithinRoot(key);
|
|
139
142
|
// The lane's slot TTL governs, not the caller's ask — the slot
|
|
140
143
|
// registry sweeps on ITS clock, and a URL outliving its slot would be
|
|
141
144
|
// a credential for nothing.
|
|
142
|
-
|
|
143
|
-
return {
|
|
144
|
-
url: this.stagedUploadLane.uploadUrl(ref),
|
|
145
|
-
stagingKey: this.stagedUploadLane.stagedKey(ref),
|
|
146
|
-
ttlMs,
|
|
147
|
-
};
|
|
145
|
+
return this.stagedUploadLane.reserve(key, declaredSizeBytes);
|
|
148
146
|
}
|
|
149
147
|
async getSignedUrl(key, _expiresInMs, downloadFilename) {
|
|
150
148
|
if (this.serveUrl === "") {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD;qEACqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,GAAW;QACrB,uEAAuE;QACvE,qDAAqD;QACrD,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;
|
|
1
|
+
{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD;qEACqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,GAAW;QACrB,uEAAuE;QACvE,qDAAqD;QACrD,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AA+GD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,IAAI,CAAU,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA6B,EAC7B,oBAAuE,IAAI,GAAG,EAAE;IAEhF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/D,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,IAAI,oBAAoB,CAC7B,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,aAAa,CACrB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,WAAW,EAAE,MAAM,CAAC,aAAa;gBACjC,eAAe,EAAE,MAAM,CAAC,iBAAiB;gBACzC,MAAM,EAAE,MAAM,CAAC,QAAQ;aACxB,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,UAAU,EAAE,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;iBACnE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;iBAC1B,IAAI,CAAC,MAAM,CAAC,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,aAAa,KAAK,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAQA;IAVnB,YACmB,QAAgB,EAChB,QAAgB;IACjC;;;;;;OAMG;IACc,gBAAmC;QATnC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAQhB,qBAAgB,GAAhB,gBAAgB,CAAmB;QAEpD,iEAAiE;QACjE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CACV,GAAW,EACX,IAAgB,EAChB,YAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,8CAA8C;QAC9C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAW,EACX,iBAAyB,EACzB,MAAc;QAEd,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,6CAA6C;QAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5B,+DAA+D;QAC/D,sEAAsE;QACtE,4BAA4B;QAC5B,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,YAAoB,EACpB,gBAAwB;QAExB,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpC,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;YAC5B,GAAG,IAAI,IAAI,0BAA0B,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CACpD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,6CAA6C,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,iEAAiE;YACjE,4BAA4B;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;CACF;AAED,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AAErE;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAS;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CACL,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;IAC5E,IAAI,WAAW,GAAG,wBAAwB,MAAM,EAAE,CAAC;IACnD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,WAAW,IAAI,sBAAsB,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,IACE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM;MAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC"}
|
|
@@ -1,14 +1,19 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* R2 artifact storage — ports pkg/domain/artifact/storage/r2_storage.go:
|
|
3
|
+
* the Cloudflare R2 (S3-compatible) backend, filling the factory arm #17
|
|
4
|
+
* deferred to this sub-project (owner-ratified, approved at the #13 plan
|
|
5
|
+
* gate together with the @aws-sdk dependency).
|
|
6
|
+
*
|
|
7
|
+
* Not conformance-assertable on the local targets (same as Go — the Go
|
|
8
|
+
* tree carries no R2 tests at all); the port adds unit pins for the pieces
|
|
9
|
+
* that have logic: config validation copy, the 7-day presign clamp, the
|
|
10
|
+
* signed Content-Disposition, and the not-found mapping.
|
|
11
|
+
*/
|
|
1
12
|
import { S3Client } from "@aws-sdk/client-s3";
|
|
2
13
|
import { getSignedUrl as presignGetObject } from "@aws-sdk/s3-request-presigner";
|
|
3
14
|
import type { ArtifactStorage, PresignedUpload } from "./artifact-storage.js";
|
|
4
15
|
/** Go: "R2 has a maximum expiration of 7 days" — presigns clamp here. */
|
|
5
16
|
export declare const R2_MAX_EXPIRATION_MS: number;
|
|
6
|
-
/**
|
|
7
|
-
* Key prefix for presignPut staging blobs (§6b). Pinned as the surface a
|
|
8
|
-
* deployment's bucket lifecycle rule targets: the driver mints under it,
|
|
9
|
-
* operations sweeps it — changing it orphans staged blobs from the sweep.
|
|
10
|
-
*/
|
|
11
|
-
export declare const R2_STAGING_PREFIX = "staging/";
|
|
12
17
|
export interface R2StorageConfig {
|
|
13
18
|
readonly bucket: string;
|
|
14
19
|
readonly endpoint: string;
|
|
@@ -40,7 +45,7 @@ export declare class R2ArtifactStorage implements ArtifactStorage {
|
|
|
40
45
|
upload(key: string, data: Uint8Array, contentType: string): Promise<void>;
|
|
41
46
|
download(key: string): Promise<Uint8Array>;
|
|
42
47
|
size(key: string): Promise<number>;
|
|
43
|
-
presignPut(declaredSizeBytes: number, ttlMs: number): Promise<PresignedUpload>;
|
|
48
|
+
presignPut(key: string, declaredSizeBytes: number, ttlMs: number): Promise<PresignedUpload>;
|
|
44
49
|
getSignedUrl(key: string, expiresInMs: number, downloadFilename: string): Promise<string>;
|
|
45
50
|
delete(key: string): Promise<void>;
|
|
46
51
|
exists(key: string): Promise<boolean>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"r2-storage.d.ts","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"r2-storage.d.ts","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAML,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjF,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM9E,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAA0B,CAAC;AAU5D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,gBAAgB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAE7E;AAED,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,SAAS;IAkClD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyB1C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAclC,UAAU,CACd,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC;IAuBrB,YAAY,CAChB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAoBZ,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcrC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAS9B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAevD"}
|
|
@@ -9,18 +9,11 @@
|
|
|
9
9
|
* that have logic: config validation copy, the 7-day presign clamp, the
|
|
10
10
|
* signed Content-Disposition, and the not-found mapping.
|
|
11
11
|
*/
|
|
12
|
-
import { randomBytes } from "node:crypto";
|
|
13
12
|
import { DeleteObjectCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
|
|
14
13
|
import { getSignedUrl as presignGetObject } from "@aws-sdk/s3-request-presigner";
|
|
15
14
|
import { ArtifactStorageNotFoundError, contentDispositionAttachment, } from "./artifact-storage.js";
|
|
16
15
|
/** Go: "R2 has a maximum expiration of 7 days" — presigns clamp here. */
|
|
17
16
|
export const R2_MAX_EXPIRATION_MS = 7 * 24 * 60 * 60 * 1000;
|
|
18
|
-
/**
|
|
19
|
-
* Key prefix for presignPut staging blobs (§6b). Pinned as the surface a
|
|
20
|
-
* deployment's bucket lifecycle rule targets: the driver mints under it,
|
|
21
|
-
* operations sweeps it — changing it orphans staged blobs from the sweep.
|
|
22
|
-
*/
|
|
23
|
-
export const R2_STAGING_PREFIX = "staging/";
|
|
24
17
|
/**
|
|
25
18
|
* Go get_content/get_download_url wrap their storage calls in a 30s
|
|
26
19
|
* context timeout. The TS ArtifactStorage interface carries no signal, so
|
|
@@ -123,15 +116,14 @@ export class R2ArtifactStorage {
|
|
|
123
116
|
throw new Error(`r2 head failed: ${errorText(error)}`, { cause: error });
|
|
124
117
|
}
|
|
125
118
|
}
|
|
126
|
-
async presignPut(declaredSizeBytes, ttlMs) {
|
|
119
|
+
async presignPut(key, declaredSizeBytes, ttlMs) {
|
|
127
120
|
const clampedMs = Math.min(ttlMs, R2_MAX_EXPIRATION_MS);
|
|
128
|
-
//
|
|
129
|
-
//
|
|
130
|
-
//
|
|
131
|
-
const stagingKey = `${R2_STAGING_PREFIX}${randomBytes(16).toString("hex")}`;
|
|
121
|
+
// The key is the caller's: the domain names its staging prefix (the
|
|
122
|
+
// surface a bucket lifecycle rule sweeps) and keeps the unguessable
|
|
123
|
+
// part of the URL-as-credential in the reference it hands the client.
|
|
132
124
|
const command = new PutObjectCommand({
|
|
133
125
|
Bucket: this.bucket,
|
|
134
|
-
Key:
|
|
126
|
+
Key: key,
|
|
135
127
|
// Signed into the URL: a PUT whose body disagrees with the declared
|
|
136
128
|
// size fails the signature check — R2's arm of the exact-size
|
|
137
129
|
// contract the local lane enforces by counting bytes.
|
|
@@ -141,7 +133,7 @@ export class R2ArtifactStorage {
|
|
|
141
133
|
const url = await this.presign(this.client, command, {
|
|
142
134
|
expiresIn: Math.floor(clampedMs / 1000),
|
|
143
135
|
});
|
|
144
|
-
return { url,
|
|
136
|
+
return { url, ttlMs: clampedMs };
|
|
145
137
|
}
|
|
146
138
|
catch (error) {
|
|
147
139
|
throw new Error(`r2 presign failed: ${errorText(error)}`, { cause: error });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"r2-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,
|
|
1
|
+
{"version":3,"file":"r2-storage.js","sourceRoot":"","sources":["../../src/artifactstorage/r2-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,GACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjF,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAiBlC;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAW;IACjB,OAAO,CAA0B;IACjC,MAAM,CAAS;IAEhC,YAAY,MAAuB,EAAE,OAAmB;QACtD,2DAA2D;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;YACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,4DAA4D;YAC5D,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE;gBACX,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAgB,EAAE,WAAmB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EACvD,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CACzD,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAW,EACX,iBAAyB,EACzB,KAAa;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACxD,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG;YACR,oEAAoE;YACpE,8DAA8D;YAC9D,sDAAsD;YACtD,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;gBACnD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,WAAmB,EACnB,gBAAwB;QAExB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG;YACR,oEAAoE;YACpE,qEAAqE;YACrE,GAAG,CAAC,gBAAgB,KAAK,EAAE;gBACzB,CAAC,CAAC,EAAE,0BAA0B,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;gBAC9C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC7D,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAI,KAAqD;SACtE,SAAS,EAAE,cAAc,CAAC;IAC7B,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
|
|
@@ -17,9 +17,7 @@
|
|
|
17
17
|
* 2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
|
|
18
18
|
* the predicate 2b's `checkMyPermission` arm 1 uses, so the console
|
|
19
19
|
* and the server agree by construction). `platform` is the one that
|
|
20
|
-
*
|
|
21
|
-
* posture nobody sets public visibility, the model's own reason for
|
|
22
|
-
* making it a platform operator's act.
|
|
20
|
+
* can arrive, through an operator capability no self-host holds.
|
|
23
21
|
* 3. The caller as a person (person.ts) and one derived tuple source for
|
|
24
22
|
* them; the target loaded ONCE through the source's memoised loader,
|
|
25
23
|
* so the read that decides not-found is the read the derivation
|
|
@@ -31,11 +29,9 @@
|
|
|
31
29
|
* member cannot learn which account ids exist. Present or exempt, the
|
|
32
30
|
* row is then evaluated: the cloud asks OpenFGA whether or not the row
|
|
33
31
|
* exists, and so does this driver.
|
|
34
|
-
* 5. `checkRelation
|
|
35
|
-
*
|
|
36
|
-
*
|
|
37
|
-
* the method annotation's byte-pinned `error_msg` wins on the wire,
|
|
38
|
-
* exactly the cloud's genuine-denial path.
|
|
32
|
+
* 5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
|
|
33
|
+
* reason, so the method annotation's byte-pinned `error_msg` wins on
|
|
34
|
+
* the wire, exactly the cloud's genuine-denial path.
|
|
39
35
|
*
|
|
40
36
|
* Faults. Everything past the pre-checks runs under one guard: a store
|
|
41
37
|
* fault, a person that names nobody (`personFor`), an evaluation fault
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAG9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA6E5E"}
|
|
@@ -17,9 +17,7 @@
|
|
|
17
17
|
* 2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
|
|
18
18
|
* the predicate 2b's `checkMyPermission` arm 1 uses, so the console
|
|
19
19
|
* and the server agree by construction). `platform` is the one that
|
|
20
|
-
*
|
|
21
|
-
* posture nobody sets public visibility, the model's own reason for
|
|
22
|
-
* making it a platform operator's act.
|
|
20
|
+
* can arrive, through an operator capability no self-host holds.
|
|
23
21
|
* 3. The caller as a person (person.ts) and one derived tuple source for
|
|
24
22
|
* them; the target loaded ONCE through the source's memoised loader,
|
|
25
23
|
* so the read that decides not-found is the read the derivation
|
|
@@ -31,11 +29,9 @@
|
|
|
31
29
|
* member cannot learn which account ids exist. Present or exempt, the
|
|
32
30
|
* row is then evaluated: the cloud asks OpenFGA whether or not the row
|
|
33
31
|
* exists, and so does this driver.
|
|
34
|
-
* 5. `checkRelation
|
|
35
|
-
*
|
|
36
|
-
*
|
|
37
|
-
* the method annotation's byte-pinned `error_msg` wins on the wire,
|
|
38
|
-
* exactly the cloud's genuine-denial path.
|
|
32
|
+
* 5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
|
|
33
|
+
* reason, so the method annotation's byte-pinned `error_msg` wins on
|
|
34
|
+
* the wire, exactly the cloud's genuine-denial path.
|
|
39
35
|
*
|
|
40
36
|
* Faults. Everything past the pre-checks runs under one guard: a store
|
|
41
37
|
* fault, a person that names nobody (`personFor`), an evaluation fault
|
|
@@ -127,7 +123,7 @@ export function newBuiltInAuthorizer(deps) {
|
|
|
127
123
|
});
|
|
128
124
|
return { kind: "not-found" };
|
|
129
125
|
}
|
|
130
|
-
const allowed = await checkRelation({ model, source }, object, relation, person
|
|
126
|
+
const allowed = await checkRelation({ model, source }, object, relation, person);
|
|
131
127
|
if (allowed) {
|
|
132
128
|
return { kind: "allow" };
|
|
133
129
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAgEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAMH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AA8BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAoFpB"}
|
|
@@ -6,7 +6,7 @@ import { visibilityShapesFor } from "../pipeline/steps/authorization-tuples.js";
|
|
|
6
6
|
import { ResourceNotFoundError } from "../store/interface.js";
|
|
7
7
|
import { rowFactsOf } from "./facts.js";
|
|
8
8
|
import { builtInModel } from "./model/index.js";
|
|
9
|
-
import { ACCOUNT_TYPE,
|
|
9
|
+
import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
|
|
10
10
|
/**
|
|
11
11
|
* Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
|
|
12
12
|
* by this edition (the module header): the derivation writes no owner
|
|
@@ -88,12 +88,6 @@ function visibilitySubject(shape, org) {
|
|
|
88
88
|
object: { type: "organization", id: org },
|
|
89
89
|
relation: "viewer",
|
|
90
90
|
};
|
|
91
|
-
case "public-viewer":
|
|
92
|
-
return {
|
|
93
|
-
form: "wildcard",
|
|
94
|
-
type: ACCOUNT_TYPE,
|
|
95
|
-
condition: ALLOW_PUBLIC_CONDITION,
|
|
96
|
-
};
|
|
97
91
|
case "platform-viewer":
|
|
98
92
|
return undefined;
|
|
99
93
|
default: {
|
|
@@ -214,27 +208,18 @@ function tupleOfRow(row) {
|
|
|
214
208
|
type: principal?.kind ?? "",
|
|
215
209
|
id: principal?.id ?? "",
|
|
216
210
|
};
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
211
|
+
// A principal id of `*` (a wildcard row a cloud database may still hold
|
|
212
|
+
// from the retired public level) is read as an ordinary object id here:
|
|
213
|
+
// no person carries `*` among their aliases, so the row matches nobody
|
|
214
|
+
// and reads as the inert grant it is, never as a fault that would turn
|
|
215
|
+
// the resource unreadable.
|
|
216
|
+
const subject = principal !== undefined && principal.relation !== ""
|
|
217
|
+
? {
|
|
220
218
|
form: "userset",
|
|
221
219
|
object: principalObject,
|
|
222
220
|
relation: principal.relation,
|
|
223
|
-
}
|
|
224
|
-
|
|
225
|
-
else if (principalObject.id === "*") {
|
|
226
|
-
// A wildcard row carries no condition of its own; the evaluator
|
|
227
|
-
// honours it only where a line admits an unconditioned wildcard,
|
|
228
|
-
// which no line in the model does.
|
|
229
|
-
subject = {
|
|
230
|
-
form: "wildcard",
|
|
231
|
-
type: principalObject.type,
|
|
232
|
-
condition: undefined,
|
|
233
|
-
};
|
|
234
|
-
}
|
|
235
|
-
else {
|
|
236
|
-
subject = { form: "object", object: principalObject };
|
|
237
|
-
}
|
|
221
|
+
}
|
|
222
|
+
: { form: "object", object: principalObject };
|
|
238
223
|
return { object, relation: spec?.relation ?? "", subject };
|
|
239
224
|
}
|
|
240
225
|
//# sourceMappingURL=derived-tuples.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAgEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAiCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAE1D,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;QAClD,CAAC,CAAC;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* The evaluator — OpenFGA's check, over the built-in model and a tuple
|
|
3
3
|
* source, small because the model uses four rewrite forms and nothing
|
|
4
|
-
* else (model/rewrite.ts). `checkRelation(object, relation, person
|
|
4
|
+
* else (model/rewrite.ts). `checkRelation(object, relation, person)`
|
|
5
5
|
* answers "does this person hold this relation on this object" the way
|
|
6
6
|
* the cloud's engine answers it over stored tuples, so the two editions
|
|
7
|
-
* share one meaning of authorization.
|
|
7
|
+
* share one meaning of authorization. There is no context parameter: the
|
|
8
|
+
* model declares no condition, so a check has no posture to state.
|
|
8
9
|
*
|
|
9
10
|
* The walk, in the order a `.fga` line reads:
|
|
10
11
|
* - `this`: the tuples on (object, relation). A tuple counts only if
|
|
@@ -12,9 +13,7 @@
|
|
|
12
13
|
* OpenFGA makes at write time, made here at read time, so a derived
|
|
13
14
|
* tuple the model no longer admits denies instead of allowing. An
|
|
14
15
|
* object subject matches when it names one of the person's aliases;
|
|
15
|
-
* a userset subject is resolved on its own object
|
|
16
|
-
* honoured only under its condition (`allow_public` reads the
|
|
17
|
-
* context's `allow`; an unknown condition is a fault).
|
|
16
|
+
* a userset subject is resolved on its own object.
|
|
18
17
|
* - `computed`: the same object, another relation.
|
|
19
18
|
* - `from`: every object the tupleset relation links to (again within
|
|
20
19
|
* the tupleset line's type restriction), resolved for the relation.
|
|
@@ -43,7 +42,7 @@
|
|
|
43
42
|
* denial.
|
|
44
43
|
*/
|
|
45
44
|
import type { Model } from "./model/index.js";
|
|
46
|
-
import type {
|
|
45
|
+
import type { ObjectRef, Person, TupleSource } from "./tuples.js";
|
|
47
46
|
/**
|
|
48
47
|
* OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
|
|
49
48
|
* the bound here is the oracle's own and not a number chosen locally. The
|
|
@@ -58,7 +57,7 @@ export declare const MAX_RESOLUTION_DEPTH = 25;
|
|
|
58
57
|
* offered to the list scope's restrict verb, which the shared helper
|
|
59
58
|
* answers before any driver); the rest are the model's own.
|
|
60
59
|
*/
|
|
61
|
-
export type EvaluationFault = "undeclared-target-kind" | "internal-caller-offered" | "resolution-depth-exceeded" | "resolution-cycle"
|
|
60
|
+
export type EvaluationFault = "undeclared-target-kind" | "internal-caller-offered" | "resolution-depth-exceeded" | "resolution-cycle";
|
|
62
61
|
/** A fault in the model or its evaluation — never a denial; the driver maps it to `unavailable`. */
|
|
63
62
|
export declare class AuthorizationEvaluationError extends Error {
|
|
64
63
|
readonly reason: EvaluationFault;
|
|
@@ -68,5 +67,5 @@ export interface EvaluationDeps {
|
|
|
68
67
|
readonly model: Model;
|
|
69
68
|
readonly source: TupleSource;
|
|
70
69
|
}
|
|
71
|
-
export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person
|
|
70
|
+
export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person): Promise<boolean>;
|
|
72
71
|
//# sourceMappingURL=evaluator.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB"}
|