@stigmer/server 3.27.0 → 3.27.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authorization/authorizer.d.ts +4 -2
- package/dist/authorization/authorizer.d.ts.map +1 -1
- package/dist/authorization/authorizer.js +4 -2
- package/dist/authorization/authorizer.js.map +1 -1
- package/dist/authorization/derived-tuples.d.ts +3 -1
- package/dist/authorization/derived-tuples.d.ts.map +1 -1
- package/dist/authorization/derived-tuples.js +46 -1
- package/dist/authorization/derived-tuples.js.map +1 -1
- package/dist/boot/list-indexes.d.ts.map +1 -1
- package/dist/boot/list-indexes.js +6 -0
- package/dist/boot/list-indexes.js.map +1 -1
- package/dist/domain/iampolicy/list-index.d.ts +2 -0
- package/dist/domain/iampolicy/list-index.d.ts.map +1 -0
- package/dist/domain/iampolicy/list-index.js +32 -0
- package/dist/domain/iampolicy/list-index.js.map +1 -0
- package/dist/domain/iampolicy/resource-store.d.ts.map +1 -1
- package/dist/domain/iampolicy/resource-store.js +24 -11
- package/dist/domain/iampolicy/resource-store.js.map +1 -1
- package/dist/extensions/list-read-scope.d.ts +2 -1
- package/dist/extensions/list-read-scope.d.ts.map +1 -1
- package/dist/extensions/list-read-scope.js +2 -1
- package/dist/extensions/list-read-scope.js.map +1 -1
- package/dist/index.d.ts +5 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +19 -0
- package/dist/index.js.map +1 -1
- package/package.json +6 -6
- package/src/authorization/README.md +7 -5
- package/src/authorization/__tests__/derived-tuples.test.ts +173 -0
- package/src/authorization/__tests__/enterprise-model.ts +59 -0
- package/src/authorization/__tests__/list-read-scope.measure.test.ts +425 -55
- package/src/authorization/authorizer.ts +4 -2
- package/src/authorization/derived-tuples.ts +98 -14
- package/src/boot/__tests__/list-indexes.test.ts +4 -0
- package/src/boot/list-indexes.ts +6 -0
- package/src/domain/iampolicy/__tests__/resource-store.test.ts +65 -5
- package/src/domain/iampolicy/list-index.ts +33 -0
- package/src/domain/iampolicy/resource-store.ts +24 -11
- package/src/extensions/list-read-scope.ts +2 -1
- package/src/index.ts +22 -0
|
@@ -47,8 +47,10 @@
|
|
|
47
47
|
*
|
|
48
48
|
* Cost, per check (measured at slice 4): the target row (1), the caller's
|
|
49
49
|
* account (1 primary-key read; 2 for a caller a composition verifier left
|
|
50
|
-
* idp-shaped), the person's IamPolicy rows (1
|
|
51
|
-
* source
|
|
50
|
+
* idp-shaped), the person's IamPolicy rows (1 read of the port, once per
|
|
51
|
+
* source, indexed by principal on the OSS adapter; one more per team the
|
|
52
|
+
* person holds, which open source never has — derived-tuples.ts), and one
|
|
53
|
+
* row per parent hop the model walks.
|
|
52
54
|
*/
|
|
53
55
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
54
56
|
import type { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAI9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA6E5E"}
|
|
@@ -47,8 +47,10 @@
|
|
|
47
47
|
*
|
|
48
48
|
* Cost, per check (measured at slice 4): the target row (1), the caller's
|
|
49
49
|
* account (1 primary-key read; 2 for a caller a composition verifier left
|
|
50
|
-
* idp-shaped), the person's IamPolicy rows (1
|
|
51
|
-
* source
|
|
50
|
+
* idp-shaped), the person's IamPolicy rows (1 read of the port, once per
|
|
51
|
+
* source, indexed by principal on the OSS adapter; one more per team the
|
|
52
|
+
* person holds, which open source never has — derived-tuples.ts), and one
|
|
53
|
+
* row per parent hop the model walks.
|
|
52
54
|
*/
|
|
53
55
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
54
56
|
import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,eAAe;CAChC,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
|
|
@@ -30,7 +30,9 @@ export interface DerivedTupleSource extends TupleSource {
|
|
|
30
30
|
* The person's own IamPolicy rows as tuples — the ONE read of them this
|
|
31
31
|
* source makes, shared with `tuplesOf`. A list-shaped consumer (the
|
|
32
32
|
* organization directory; the list scope) reads its candidate objects
|
|
33
|
-
* from here instead of scanning the port a second time.
|
|
33
|
+
* from here instead of scanning the port a second time. The rows granted
|
|
34
|
+
* to the person's teams are not among them: they name the team, and
|
|
35
|
+
* `tuplesOf` serves them where a check meets them.
|
|
34
36
|
*/
|
|
35
37
|
personTuples(): Promise<ReadonlyArray<Tuple>>;
|
|
36
38
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAqFA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAUH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AA8BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;;;OAOG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAwHpB"}
|
|
@@ -16,6 +16,9 @@ import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
|
|
|
16
16
|
export const ROW_RECORDED_OWNER_KINDS = new Set([
|
|
17
17
|
ApiResourceKind.organization,
|
|
18
18
|
]);
|
|
19
|
+
/** The FGA type a team grant names, and the relation that makes a person one of its members (the model's `team#member`). */
|
|
20
|
+
const TEAM_TYPE = kindEnumName(ApiResourceKind.team);
|
|
21
|
+
const TEAM_MEMBER_RELATION = "member";
|
|
19
22
|
function account(id) {
|
|
20
23
|
return { form: "object", object: { type: ACCOUNT_TYPE, id } };
|
|
21
24
|
}
|
|
@@ -105,6 +108,7 @@ export function newDerivedTupleSource(deps, person, seed) {
|
|
|
105
108
|
seeded.set(formatObjectRef({ type: kindEnumName(facts.kind), id: facts.id }), facts);
|
|
106
109
|
}
|
|
107
110
|
let personRows;
|
|
111
|
+
let reachableRows;
|
|
108
112
|
const loader = {
|
|
109
113
|
load(object) {
|
|
110
114
|
const key = formatObjectRef(object);
|
|
@@ -150,6 +154,29 @@ export function newDerivedTupleSource(deps, person, seed) {
|
|
|
150
154
|
}
|
|
151
155
|
return personRows;
|
|
152
156
|
}
|
|
157
|
+
/**
|
|
158
|
+
* Every row a check can meet, keyed by (object, relation): the person's
|
|
159
|
+
* own, then the rows granted to each team the person holds `member` on
|
|
160
|
+
* (the module header says why that set is complete). A person in no
|
|
161
|
+
* team costs nothing beyond their own rows.
|
|
162
|
+
*/
|
|
163
|
+
function reachableTuples() {
|
|
164
|
+
if (reachableRows === undefined) {
|
|
165
|
+
reachableRows = rowTuples().then(async (own) => {
|
|
166
|
+
const teams = new Set();
|
|
167
|
+
for (const tuple of own) {
|
|
168
|
+
if (tuple.object.type === TEAM_TYPE &&
|
|
169
|
+
tuple.relation === TEAM_MEMBER_RELATION &&
|
|
170
|
+
tuple.object.id !== "") {
|
|
171
|
+
teams.add(tuple.object.id);
|
|
172
|
+
}
|
|
173
|
+
}
|
|
174
|
+
const granted = await Promise.all([...teams].map((team) => deps.policies.findByPrincipal(TEAM_TYPE, team)));
|
|
175
|
+
return indexByPair([...own, ...granted.flat().map(tupleOfRow)]);
|
|
176
|
+
});
|
|
177
|
+
}
|
|
178
|
+
return reachableRows;
|
|
179
|
+
}
|
|
153
180
|
return {
|
|
154
181
|
loader,
|
|
155
182
|
personTuples: rowTuples,
|
|
@@ -157,7 +184,7 @@ export function newDerivedTupleSource(deps, person, seed) {
|
|
|
157
184
|
const onPair = (tuple) => tuple.relation === relation &&
|
|
158
185
|
tuple.object.type === object.type &&
|
|
159
186
|
tuple.object.id === object.id;
|
|
160
|
-
const fromRows = (await
|
|
187
|
+
const fromRows = (await reachableTuples()).get(pairKey(object, relation)) ?? [];
|
|
161
188
|
const declaration = model.byType(object.type);
|
|
162
189
|
if (declaration === undefined) {
|
|
163
190
|
return fromRows;
|
|
@@ -195,6 +222,24 @@ async function loadRow(deps, model, object) {
|
|
|
195
222
|
throw error;
|
|
196
223
|
}
|
|
197
224
|
}
|
|
225
|
+
/** The key a tuple is served under: its object and relation. */
|
|
226
|
+
function pairKey(object, relation) {
|
|
227
|
+
return `${formatObjectRef(object)}#${relation}`;
|
|
228
|
+
}
|
|
229
|
+
function indexByPair(tuples) {
|
|
230
|
+
const index = new Map();
|
|
231
|
+
for (const tuple of tuples) {
|
|
232
|
+
const key = pairKey(tuple.object, tuple.relation);
|
|
233
|
+
const held = index.get(key);
|
|
234
|
+
if (held === undefined) {
|
|
235
|
+
index.set(key, [tuple]);
|
|
236
|
+
}
|
|
237
|
+
else {
|
|
238
|
+
held.push(tuple);
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
return index;
|
|
242
|
+
}
|
|
198
243
|
/** An IamPolicy row as the tuple it records: `resource#relation@principal`. */
|
|
199
244
|
function tupleOfRow(row) {
|
|
200
245
|
const spec = row.spec;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAqFA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,4HAA4H;AAC5H,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AACrD,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAmCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAC1D,IAAI,aAES,CAAC;IAEd,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,SAAS,eAAe;QAGtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBACxB,IACE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;wBAC/B,KAAK,CAAC,QAAQ,KAAK,oBAAoB;wBACvC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EACtB,CAAC;wBACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAC/C,CACF,CAAC;gBACF,OAAO,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,OAAO,CAAC,MAAiB,EAAE,QAAgB;IAClD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,MAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;QAClD,CAAC,CAAC;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"list-indexes.d.ts","sourceRoot":"","sources":["../../src/boot/list-indexes.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"list-indexes.d.ts","sourceRoot":"","sources":["../../src/boot/list-indexes.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAM5D,CAAC"}
|
|
@@ -10,14 +10,20 @@
|
|
|
10
10
|
* parent's rows without decoding the whole kind; the kinds here were
|
|
11
11
|
* chosen on the hosted edition's row counts and sizes (2026-09-23: every
|
|
12
12
|
* other org-scoped kind held under a hundred rows and a hundred kilobytes).
|
|
13
|
+
* A kind also joins when a port read on every authorization check would
|
|
14
|
+
* otherwise decode the whole kind: `iam_policy`, whose adapter reads a
|
|
15
|
+
* person's rows by principal (measured 2026-09-24: about 4.6 microseconds
|
|
16
|
+
* per row per read, 47 ms a check at ten thousand rows on sqlite).
|
|
13
17
|
*/
|
|
14
18
|
import { agentExecutionListIndex } from "../domain/agentexecution/list-index.js";
|
|
15
19
|
import { artifactListIndex } from "../domain/artifact/list-index.js";
|
|
20
|
+
import { iamPolicyListIndex } from "../domain/iampolicy/list-index.js";
|
|
16
21
|
import { sessionListIndex } from "../domain/session/list-index.js";
|
|
17
22
|
import { workflowExecutionListIndex } from "../domain/workflowexecution/list-index.js";
|
|
18
23
|
export const LIST_INDEXES = [
|
|
19
24
|
agentExecutionListIndex,
|
|
20
25
|
artifactListIndex,
|
|
26
|
+
iamPolicyListIndex,
|
|
21
27
|
sessionListIndex,
|
|
22
28
|
workflowExecutionListIndex,
|
|
23
29
|
];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"list-indexes.js","sourceRoot":"","sources":["../../src/boot/list-indexes.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"list-indexes.js","sourceRoot":"","sources":["../../src/boot/list-indexes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGvF,MAAM,CAAC,MAAM,YAAY,GAAwC;IAC/D,uBAAuB;IACvB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,0BAA0B;CAC3B,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"list-index.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/list-index.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,kBAAkB,uEAO7B,CAAC"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The IamPolicy list index (store/list-index.ts): `principal` is the key
|
|
3
|
+
* the open-source adapter's `findByPrincipal` reads (resource-store.ts).
|
|
4
|
+
* It is not a lane's index: the built-in authorizer reads a person's rows,
|
|
5
|
+
* and the rows granted to each team they belong to, on every check and
|
|
6
|
+
* every list batch (authorization/derived-tuples.ts), and without the key
|
|
7
|
+
* each of those reads decodes the whole kind — a table that grows with
|
|
8
|
+
* every member, organization and grant.
|
|
9
|
+
*
|
|
10
|
+
* The key is the principal's id alone: a key reads one string field, and
|
|
11
|
+
* an id carries its kind's prefix (`ida_` for an account, `tm_` for a
|
|
12
|
+
* team), so the index narrows to one principal and the adapter's
|
|
13
|
+
* predicate on (kind, id) keeps the answer exact whatever the index
|
|
14
|
+
* returns. A policy is not organization-scoped the way a lane's rows are,
|
|
15
|
+
* so the read names no organization; the key table's lookup index leads
|
|
16
|
+
* with the key, not the organization (the v6 migration of each driver).
|
|
17
|
+
*
|
|
18
|
+
* A change to `keys` bumps `revision` (boot/__tests__/list-indexes.test.ts
|
|
19
|
+
* pins the pair).
|
|
20
|
+
*/
|
|
21
|
+
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
22
|
+
import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
|
|
23
|
+
import { declareListIndex, field } from "../../store/list-index.js";
|
|
24
|
+
export const iamPolicyListIndex = declareListIndex({
|
|
25
|
+
kind: ApiResourceKind.iam_policy,
|
|
26
|
+
schema: IamPolicySchema,
|
|
27
|
+
revision: 1,
|
|
28
|
+
keys: {
|
|
29
|
+
principal: field("spec.principal.id"),
|
|
30
|
+
},
|
|
31
|
+
});
|
|
32
|
+
//# sourceMappingURL=list-index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"list-index.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/list-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE;QACJ,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC;KACtC;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"resource-store.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgBjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CA6GtE"}
|
|
@@ -4,14 +4,21 @@
|
|
|
4
4
|
* §3a, §4). The composition root installs it when no extension registers
|
|
5
5
|
* `drivers.iamPolicyStore`.
|
|
6
6
|
*
|
|
7
|
-
* Reads. `findById` is a PRIMARY-KEY read.
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
7
|
+
* Reads. `findById` is a PRIMARY-KEY read. `findByPrincipal` is an
|
|
8
|
+
* INDEXED read through the kind's list index (list-index.ts), because the
|
|
9
|
+
* built-in authorizer calls it on every check and every list batch — for
|
|
10
|
+
* the person, and once more per team they belong to — and a scan there
|
|
11
|
+
* costs a decode of every row the server holds, per call (measured
|
|
12
|
+
* 2026-09-24: about 4.6 microseconds per row, 47 ms a check at ten
|
|
13
|
+
* thousand rows on sqlite). The index narrows by the principal's id; the
|
|
14
|
+
* (kind, id) predicate decides, so the answer is exact whatever the index
|
|
15
|
+
* returns, and the store keeps it exact while an older binary still
|
|
16
|
+
* writes (store/interface.ts, `queryResources`). Every other find decodes
|
|
17
|
+
* `listResources(iam_policy)` and filters in memory: they serve the grant
|
|
18
|
+
* path and the access lists, not the check, and the row count behind them
|
|
19
|
+
* is members × organizations on a self-host. The filters are the cloud
|
|
20
|
+
* store's WHERE clauses restated over the proto (store.ts names each), so
|
|
21
|
+
* a driver's test over either edition reads the same contract.
|
|
15
22
|
*
|
|
16
23
|
* Writes. `save` refuses a policy whose id is not its triple's derived id
|
|
17
24
|
* (constants.ts policyIdFor): open source has no legacy random ids, and a
|
|
@@ -39,6 +46,7 @@ import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api
|
|
|
39
46
|
import { kindEnumName } from "../../pipeline/apiresource-meta.js";
|
|
40
47
|
import { ResourceNotFoundError } from "../../store/interface.js";
|
|
41
48
|
import { USER_GRANT_PRINCIPAL_KINDS, policyIdFor } from "./constants.js";
|
|
49
|
+
import { iamPolicyListIndex } from "./list-index.js";
|
|
42
50
|
import { DuplicatePolicyError } from "./store.js";
|
|
43
51
|
const KIND = ApiResourceKind.iam_policy;
|
|
44
52
|
/**
|
|
@@ -63,7 +71,7 @@ export function newResourceIamPolicyStore(store) {
|
|
|
63
71
|
throw error;
|
|
64
72
|
}
|
|
65
73
|
}
|
|
66
|
-
/** Every row of the kind, decoded — the scan behind every
|
|
74
|
+
/** Every row of the kind, decoded — the scan behind every read but by id and by principal. */
|
|
67
75
|
async function all() {
|
|
68
76
|
const rows = await store.listResources(KIND);
|
|
69
77
|
return rows.map((bytes) => fromBinary(IamPolicySchema, bytes));
|
|
@@ -86,8 +94,13 @@ export function newResourceIamPolicyStore(store) {
|
|
|
86
94
|
await store.deleteResource(KIND, id);
|
|
87
95
|
},
|
|
88
96
|
findById: readById,
|
|
89
|
-
findByPrincipal(principalKind, principalId) {
|
|
90
|
-
|
|
97
|
+
async findByPrincipal(principalKind, principalId) {
|
|
98
|
+
const rows = await store.queryResources(iamPolicyListIndex, {
|
|
99
|
+
anyKey: [{ name: "principal", value: principalId }],
|
|
100
|
+
});
|
|
101
|
+
return rows
|
|
102
|
+
.map((row) => fromBinary(IamPolicySchema, row.data))
|
|
103
|
+
.filter((policy) => onPrincipal(policy, principalKind, principalId));
|
|
91
104
|
},
|
|
92
105
|
findByResource(resourceKind, resourceId) {
|
|
93
106
|
return where((policy) => onResource(policy, resourceKind, resourceId));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"resource-store.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/resource-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAClC,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,wBAAwB,GAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,KAAY;IACpD,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,KAAK,UAAU,GAAG;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,SAAyC;QAEzC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,EAAE,QAAQ;QAElB,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,WAAW;YAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,kBAAkB,EAAE;gBAC1D,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,IAAI;iBACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;iBACnD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,cAAc,CAAC,YAAY,EAAE,UAAU;YACrC,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B,CACxB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU;YAEV,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS;YAC7D,OAAO,KAAK,CACV,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,iCAAiC,CACrC,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS;YAET,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,IACE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC5C,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACtC,CAAC,aAAa,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,CAAC,EACjD,CAAC;oBACD,UAAU,CAAC,GAAG,CACZ,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU;YAC3C,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;gBAC5C,CAAC,8BAA8B,CAAC,QAAQ,CACtC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CACnC;gBACD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC9D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAY,EAAE,EAAU;IAC7D,OAAO,CACL,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC"}
|
|
@@ -202,7 +202,8 @@ export interface ScopedListResource {
|
|
|
202
202
|
/**
|
|
203
203
|
* The ONE consumption idiom for post-scan lanes (the shared-step
|
|
204
204
|
* discipline of pipeline/steps/authorization-tuples.ts, rendered as a
|
|
205
|
-
* helper because half the lanes are direct handlers
|
|
205
|
+
* helper because half the lanes are direct handlers; on the barrel, so a
|
|
206
|
+
* composition's lane over its own table narrows the same way):
|
|
206
207
|
*
|
|
207
208
|
* - no scope composed → the input array unchanged (byte-identity;
|
|
208
209
|
* `requestOrg` deliberately not consulted — the OSS single-tenant
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2HG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAUjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,qBAAqB,CAAC;KACpC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvC;AAED
|
|
1
|
+
{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2HG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAUjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,qBAAqB,CAAC;KACpC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CA2Bd"}
|
|
@@ -8,7 +8,8 @@ import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.j
|
|
|
8
8
|
/**
|
|
9
9
|
* The ONE consumption idiom for post-scan lanes (the shared-step
|
|
10
10
|
* discipline of pipeline/steps/authorization-tuples.ts, rendered as a
|
|
11
|
-
* helper because half the lanes are direct handlers
|
|
11
|
+
* helper because half the lanes are direct handlers; on the barrel, so a
|
|
12
|
+
* composition's lane over its own table narrows the same way):
|
|
12
13
|
*
|
|
13
14
|
* - no scope composed → the input array unchanged (byte-identity;
|
|
14
15
|
* `requestOrg` deliberately not consulted — the OSS single-tenant
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAgIA,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,sBAAsB;AACtB,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAyFnF
|
|
1
|
+
{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAgIA,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,sBAAsB;AACtB,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAyFnF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxD,MAAM,KAAK,GAAkB;YAC3B,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC1C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,IAAqB;IAIrB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,WAAW,EAAE,EAAE,CACrB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -95,6 +95,7 @@ export type { StoreTestCase, StoreTestDocument, StoreTestKit, StoreTestSkip, Sto
|
|
|
95
95
|
export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
|
|
96
96
|
export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
|
|
97
97
|
export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
|
|
98
|
+
export { restrictListByReadScope } from "./extensions/list-read-scope.js";
|
|
98
99
|
export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
|
|
99
100
|
export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
|
|
100
101
|
export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
|
|
@@ -114,6 +115,10 @@ export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
|
|
|
114
115
|
export { newValidateProtoStep } from "./pipeline/steps/validation.js";
|
|
115
116
|
export { newBuildNewStateStep } from "./pipeline/steps/defaults.js";
|
|
116
117
|
export { newResolveSlugStep } from "./pipeline/steps/slug.js";
|
|
118
|
+
export { newBuildUpdateStateStep } from "./pipeline/steps/build-update-state.js";
|
|
119
|
+
export { EXISTING_RESOURCE_KEY } from "./pipeline/steps/load-existing.js";
|
|
120
|
+
export { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "./pipeline/steps/authorize-resolved-target.js";
|
|
121
|
+
export { TARGET_RESOURCE_KEY } from "./pipeline/steps/load-target.js";
|
|
117
122
|
export type { Store, StoreOpenOptions } from "./store/interface.js";
|
|
118
123
|
export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
|
|
119
124
|
export type { ListIndexCursor, ListIndexDeclaration, ListIndexQuery, ListIndexRow, } from "./store/list-index.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAK3E,YAAY,EACV,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAOzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAS3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,YAAY,EACV,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAOrC,YAAY,EACV,eAAe,EACf,eAAe,EACf,OAAO,EACP,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,KAAK,EACL,WAAW,GACZ,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAK3E,YAAY,EACV,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAOzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAS3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,YAAY,EACV,+BAA+B,EAC/B,kCAAkC,GACnC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAOrC,YAAY,EACV,eAAe,EACf,eAAe,EACf,OAAO,EACP,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,KAAK,EACL,WAAW,GACZ,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAM1E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAM3F,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAYtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAW9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAI9B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAK/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -63,6 +63,11 @@ export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-t
|
|
|
63
63
|
// answering not-found — the cloud's probe exemption over the open-source
|
|
64
64
|
// tier; exported so the cloud's drift test pins the two sets equal.
|
|
65
65
|
export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
|
|
66
|
+
// The one consumption idiom of the list read scope for post-scan list lanes:
|
|
67
|
+
// exported so a list lane a composition serves from its own table narrows
|
|
68
|
+
// its rows exactly as the library's lanes do, instead of building each
|
|
69
|
+
// candidate's authorization facts by hand.
|
|
70
|
+
export { restrictListByReadScope } from "./extensions/list-read-scope.js";
|
|
66
71
|
export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
|
|
67
72
|
export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
|
|
68
73
|
// The tuple lifecycle's resolution, for a kind a composition serves outside
|
|
@@ -134,6 +139,20 @@ export { newValidateProtoStep } from "./pipeline/steps/validation.js";
|
|
|
134
139
|
// same name over its own repo.
|
|
135
140
|
export { newBuildNewStateStep } from "./pipeline/steps/defaults.js";
|
|
136
141
|
export { newResolveSlugStep } from "./pipeline/steps/slug.js";
|
|
142
|
+
// The update and reference-read steps for the same kinds, on the same
|
|
143
|
+
// terms. An update runs BuildUpdateState after the composition's own
|
|
144
|
+
// loader has stashed the stored row under EXISTING_RESOURCE_KEY, so which
|
|
145
|
+
// fields a client may change, how status carries over and how the audit
|
|
146
|
+
// slots are stamped stay the OSS step's. A read by reference runs
|
|
147
|
+
// AuthorizeResolvedTarget with `loadedTargetAsMethod(get)` after the
|
|
148
|
+
// loader has stashed the row under TARGET_RESOURCE_KEY, so the kind's
|
|
149
|
+
// `get` annotation owns the permission and the refusal copy for both
|
|
150
|
+
// reads. The loaders stay the composition's for CheckDuplicate's reason:
|
|
151
|
+
// they read its own table.
|
|
152
|
+
export { newBuildUpdateStateStep } from "./pipeline/steps/build-update-state.js";
|
|
153
|
+
export { EXISTING_RESOURCE_KEY } from "./pipeline/steps/load-existing.js";
|
|
154
|
+
export { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "./pipeline/steps/authorize-resolved-target.js";
|
|
155
|
+
export { TARGET_RESOURCE_KEY } from "./pipeline/steps/load-target.js";
|
|
137
156
|
export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
|
|
138
157
|
// The Postgres driver constructor (stigmer-cloud 20260910.04 ruling 4;
|
|
139
158
|
// the newR2ArtifactStorage precedent for blessing a driver constructor).
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAkEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAe3E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAQ9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAU3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAGxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAkEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAe3E,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAQ9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAU3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAGxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAehF,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,kCAAkC,EAClC,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,kCAAkC,EAClC,OAAO,EACP,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAKvE,6EAA6E;AAC7E,0EAA0E;AAC1E,uEAAuE;AACvE,2CAA2C;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAO1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,mCAAmC;AACnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,+DAA+D;AAC/D,iEAAiE;AACjE,yEAAyE;AACzE,uEAAuE;AACvE,+BAA+B;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,2BAA2B;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAe9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stigmer/server",
|
|
3
|
-
"version": "3.27.
|
|
3
|
+
"version": "3.27.2",
|
|
4
4
|
"description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -62,11 +62,11 @@
|
|
|
62
62
|
"@connectrpc/connect-node": "^2.0.0",
|
|
63
63
|
"@kubernetes/client-node": "2.0.0",
|
|
64
64
|
"@opentelemetry/api": "^1.9.0",
|
|
65
|
-
"@stigmer/outbound": "3.27.
|
|
66
|
-
"@stigmer/plugin-package": "3.27.
|
|
67
|
-
"@stigmer/protos": "3.27.
|
|
68
|
-
"@stigmer/temporal-codecs": "3.27.
|
|
69
|
-
"@stigmer/zip-structure": "3.27.
|
|
65
|
+
"@stigmer/outbound": "3.27.2",
|
|
66
|
+
"@stigmer/plugin-package": "3.27.2",
|
|
67
|
+
"@stigmer/protos": "3.27.2",
|
|
68
|
+
"@stigmer/temporal-codecs": "3.27.2",
|
|
69
|
+
"@stigmer/zip-structure": "3.27.2",
|
|
70
70
|
"@temporalio/activity": "1.16.2",
|
|
71
71
|
"@temporalio/client": "1.16.2",
|
|
72
72
|
"@temporalio/common": "1.16.2",
|
|
@@ -54,11 +54,13 @@ editions; the cloud stores what open source computes.
|
|
|
54
54
|
the tuple lifecycle's create-time resolution, pinned equal to it.
|
|
55
55
|
- `derived-tuples.ts` — the derivation (the cloud driver's shapes, from the
|
|
56
56
|
facts) and the source that joins it with the person's IamPolicy rows, read
|
|
57
|
-
once per source
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
57
|
+
once per source, and with the rows granted to each team the person holds
|
|
58
|
+
`member` on (one read more per team; open source serves no team, so its
|
|
59
|
+
callers never pay it). The two edition-specific facts live here: the
|
|
60
|
+
organization's owner is a row, and a stamp that names no person is no tuple. A
|
|
61
|
+
source may be seeded with candidates' facts (the list scope), so a seeded
|
|
62
|
+
object's tuples derive without a read of its row; a `derived` rule still reads
|
|
63
|
+
the row it needs.
|
|
62
64
|
- `store-test-kit.ts` — runs an OpenFGA store test (`.fga.yaml`) against the
|
|
63
65
|
evaluator, vitest-free, exported from the barrel. Open source runs it over
|
|
64
66
|
pinned copies of the cloud's own model tests (`__tests__/fixtures/fga/`, a
|