@teikyo/access 0.1.1 → 0.2.0

package/README.md

@@ -75,5 +75,5 @@ await cache.allows('did:key:z6Mk...', 'app/read')
 `accessRevocationPlugin()` (plugin name `access:revocation`) provides a Hozon-backed revocation store and a `verifyToken` hook for Enkaku servers.
 
 - Records are scoped by issuer: the store's `get(jti, issuer)` only returns records signed by `issuer`, and the hook looks up the capability's own issuer, so another identity cannot revoke or shadow a jti it does not own.
-- `requireJTI` defaults to `true`, so capabilities created without an explicit `jti` are rejected with `Capability without jti rejected`; set it to `false` to accept them (they can never be revoked).
+- `requireJTI` defaults to `true`, so tokens created without an explicit `jti` are rejected with `Token without jti rejected`; set it to `false` to accept them (they can never be revoked).
 - Register the store through the plugin, which carries the DID resolution options (`resolver`, `cache`, `methods`) that `add` needs.

package/lib/grants/plugin.d.ts

@@ -6,6 +6,8 @@ export type AccessGrants = {
     store: GrantStore;
     /** Build an Enkaku access predicate admitting issuers, or verified delegates, holding a matching grant. */
     allow(): AllowPredicate;
+    /** Whether the subject holds a grant matching the resource, using the same cache as `allow()`. */
+    allows(subject: string, resource: string): Promise<boolean>;
 };
 export declare const ACCESS_GRANTS: import("@sozai/http-server").PluginName<"access:grants", AccessGrants>;
 export type AccessGrantsPluginParams = {

package/lib/grants/plugin.js

@@ -23,6 +23,19 @@ export const ACCESS_GRANTS = pluginName()('access:grants');
             ctx.onClose(()=>cache.dispose());
             return {
                 store,
+                async allows (subject, resource) {
+                    try {
+                        return await cache.allows(subject, resource);
+                    } catch (cause) {
+                        ctx.logger.error('access check failed for {resource}', {
+                            resource,
+                            error: cause
+                        });
+                        throw new Error('Access denied', {
+                            cause
+                        });
+                    }
+                },
                 allow: ()=>async ({ payload, procedure, verifyDelegation })=>{
                         try {
                             if (await cache.allows(payload.iss, procedure)) {

package/lib/revocation/backend.d.ts

@@ -1,5 +1,6 @@
 import type { StoreDefinition } from '@hozon/db';
-import { type RevocationBackend, type RevocationOptions, type VerifyTokenHook } from '@kokuin/capability';
+import { type RevocationBackend, type RevocationOptions } from '@kokuin/capability';
+import { type SignedToken } from '@kokuin/token';
 import type { RevocationTables } from './tables.js';
 /**
  * Revocation backend of the store. `get` is scoped by issuer because the jti namespace belongs to
@@ -24,4 +25,4 @@ export type RevocationHookParams = {
  * a revocation are logged through `onError` and surface as `Access denied`, because Enkaku copies
  * error messages to the client.
  */
-export declare function createRevocationHook(params: RevocationHookParams): VerifyTokenHook;
+export declare function createRevocationHook(params: RevocationHookParams): (token: SignedToken, raw: string) => Promise<void>;

package/lib/revocation/backend.js

@@ -66,9 +66,10 @@ function toRecord(row) {
  * a revocation are logged through `onError` and surface as `Access denied`, because Enkaku copies
  * error messages to the client.
  */ export function createRevocationHook(params) {
+    // Parameter widened to any signed token so plain invocation tokens can be checked too.
     return async (token, raw)=>{
         if (params.requireJTI && token.payload.jti == null) {
-            throw new Error('Capability without jti rejected');
+            throw new Error('Token without jti rejected');
         }
         try {
             await createRevocationChecker(params.backend, params.options)(token, raw);

package/lib/revocation/plugin.d.ts

@@ -1,15 +1,16 @@
-import type { RevocationOptions, VerifyTokenHook } from '@kokuin/capability';
+import type { RevocationOptions } from '@kokuin/capability';
+import type { SignedToken } from '@kokuin/token';
 import { type HTTPPlugin } from '@sozai/http-server';
 import { HOZON_DB } from '@teikyo/hozon';
 import { type RevocationStoreAPI } from './backend.js';
 export type AccessRevocation = {
     backend: RevocationStoreAPI;
-    /** Enkaku `verifyToken` hook rejecting revoked capabilities. */
-    verifyToken: VerifyTokenHook;
+    /** Enkaku `verifyToken` hook rejecting revoked signed tokens. */
+    verifyToken: (token: SignedToken, raw: string) => Promise<void>;
 };
 export declare const ACCESS_REVOCATION: import("@sozai/http-server").PluginName<"access:revocation", AccessRevocation>;
 export type AccessRevocationPluginParams = RevocationOptions & {
-    /** Reject capabilities without a jti, which cannot be revoked. Defaults to `true`. */
+    /** Reject signed tokens without a jti, which cannot be revoked. Defaults to `true`. */
     requireJTI?: boolean;
 };
 /** Provide a persistent revocation backend and the `verifyToken` hook that consults it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teikyo/access",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Access grants and revocation for Enkaku servers",
   "repository": {
     "type": "git",
@@ -19,20 +19,20 @@
     "lib/*"
   ],
   "dependencies": {
-    "@enkaku/server": "^0.21.4",
-    "@hozon/db": "^0.2.1",
-    "@kokuin/capability": "^0.4.0",
-    "@kokuin/token": "^0.5.0",
-    "@sozai/codec": "^0.4.2",
-    "@sozai/http-server": "^0.1.0",
+    "@enkaku/server": "^0.22.1",
+    "@hozon/db": "^0.3.0",
+    "@kokuin/capability": "^0.5.1",
+    "@kokuin/token": "^0.6.1",
+    "@sozai/codec": "^0.4.3",
+    "@sozai/http-server": "^0.2.0",
     "@sozai/log": "^0.4.0",
-    "@teikyo/hozon": "^0.1.1"
+    "@teikyo/hozon": "^0.2.0"
   },
   "devDependencies": {
-    "@hozon/provider": "^0.1.1",
-    "@types/node": "^26.6.4",
-    "del-cli": "^7.0.0",
-    "vitest": "5.0.3"
+    "@hozon/provider": "^0.1.2",
+    "@types/node": "^26.6.5",
+    "del-cli": "^8.0.1",
+    "vitest": "5.0.5"
   },
   "engines": {
     "node": ">=24"