@svadmin/cerbos 0.0.0-stage → 0.2.0

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@svadmin/cerbos",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Cerbos Cloud-Native Policy PDP AccessControl adapter for svadmin",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "src/**/*.ts",
+    "!src/**/*.test.*",
+    "!src/**/*.spec.*"
+  ],
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  },
+  "peerDependencies": {
+    "@svadmin/core": "^0.79.0"
+  },
+  "keywords": [
+    "svadmin",
+    "cerbos",
+    "access-control",
+    "authorization",
+    "pdp",
+    "policies"
+  ],
+  "license": "MIT",
+  "author": "zuohuadong",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vibeunion/svadmin.git",
+    "directory": "packages/cerbos"
+  },
+  "homepage": "https://github.com/vibeunion/svadmin#readme",
+  "bugs": {
+    "url": "https://github.com/vibeunion/svadmin/issues"
+  },
+  "svadmin": {
+    "capabilities": [
+      "access-control"
+    ],
+    "core": "^0.55.0",
+    "stability": "stable",
+    "migration": null
+  }
+}

package/src/cerbos-access-control.ts

@@ -0,0 +1,148 @@
+import type { AccessControlProvider, CanParams, CanResult } from '@svadmin/core';
+
+export interface CerbosPrincipal {
+  id: string;
+  roles: string[];
+  attr?: Record<string, unknown>;
+}
+
+export interface CerbosResource {
+  kind: string;
+  id: string;
+  attr?: Record<string, unknown>;
+}
+
+export interface CerbosCheckResponseLike {
+  isAllowed(action: string): boolean;
+}
+
+export interface CerbosClientLike {
+  checkResource(params: {
+    principal: CerbosPrincipal;
+    resource: CerbosResource;
+    actions: string[];
+  }): Promise<CerbosCheckResponseLike>;
+}
+
+export interface CerbosAccessControlOptions {
+  /** Initialized Cerbos Client instance */
+  client?: CerbosClientLike;
+  /** Cerbos PDP HTTP API base URL (e.g. 'http://localhost:3592') */
+  apiUrl?: string;
+  /** Optional bearer or access token for PDP communication */
+  token?: string;
+  /** Resolver returning current principal credentials and attributes */
+  principal: () => CerbosPrincipal | Promise<CerbosPrincipal>;
+  /** Optional custom fetch implementation */
+  fetch?: typeof fetch;
+}
+
+interface CerbosHttpCheckResponse {
+  results?: Array<{
+    actions?: Record<string, 'EFFECT_ALLOW' | 'EFFECT_DENY'>;
+  }>;
+}
+
+/**
+ * Creates a Cerbos PDP AccessControl adapter for svadmin.
+ * Evaluates fine-grained authorization against Cerbos policies.
+ */
+export function createCerbosAccessControl(
+  options: CerbosAccessControlOptions,
+): AccessControlProvider {
+  const request = options.fetch ?? fetch;
+
+  async function checkViaHttp(
+    principal: CerbosPrincipal,
+    resource: CerbosResource,
+    action: string,
+  ): Promise<boolean> {
+    if (!options.apiUrl) {
+      throw new Error('Cerbos adapter requires either options.client or options.apiUrl');
+    }
+
+    const endpoint = `${options.apiUrl.replace(/\/+$/, '')}/api/check/resources`;
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    };
+    if (options.token) {
+      headers['Authorization'] = `Bearer ${options.token}`;
+    }
+
+    const bodyPayload = {
+      principal: {
+        id: principal.id,
+        roles: principal.roles,
+        attr: principal.attr ?? {},
+      },
+      resources: [
+        {
+          resource: {
+            kind: resource.kind,
+            id: resource.id,
+            attr: resource.attr ?? {},
+          },
+          actions: [action],
+        },
+      ],
+    };
+
+    const res = await request(endpoint, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(bodyPayload),
+    });
+
+    if (!res.ok) {
+      throw new Error(`Cerbos PDP responded with status ${res.status}`);
+    }
+
+    const data = (await res.json()) as CerbosHttpCheckResponse;
+    const actionResult = data.results?.[0]?.actions?.[action];
+    return actionResult === 'EFFECT_ALLOW';
+  }
+
+  return {
+    async can(params: CanParams): Promise<CanResult> {
+      try {
+        const principal = await options.principal();
+        const resourceId = params.params?.id !== undefined ? String(params.params.id) : '*';
+        const resource: CerbosResource = {
+          kind: params.resource,
+          id: resourceId,
+        };
+        if (params.params && typeof params.params === 'object') {
+          resource.attr = params.params;
+        }
+
+        let allowed = false;
+
+        if (options.client) {
+          const checkRes = await options.client.checkResource({
+            principal,
+            resource,
+            actions: [params.action],
+          });
+          allowed = checkRes.isAllowed(params.action);
+        } else {
+          allowed = await checkViaHttp(principal, resource, params.action);
+        }
+
+        if (allowed) {
+          return { can: true };
+        }
+
+        return {
+          can: false,
+          reason: `Cerbos policy denied action "${params.action}" on resource "${params.resource}"`,
+        };
+      } catch {
+        return {
+          can: false,
+          reason: 'Cerbos authorization error',
+        };
+      }
+    },
+  };
+}

package/src/index.ts

@@ -0,0 +1,8 @@
+export {
+  createCerbosAccessControl,
+  type CerbosPrincipal,
+  type CerbosResource,
+  type CerbosClientLike,
+  type CerbosCheckResponseLike,
+  type CerbosAccessControlOptions,
+} from './cerbos-access-control.js';

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.