@tinycloud/node-sdk 3.1.0-beta.3 → 3.1.0-beta.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{core-Bm76PnOz.d.cts → core-BWvBTn9l.d.cts} +5 -0
- package/dist/{core-Bm76PnOz.d.ts → core-BWvBTn9l.d.ts} +5 -0
- package/dist/core.cjs +3 -0
- package/dist/core.cjs.map +1 -1
- package/dist/core.d.cts +1 -1
- package/dist/core.d.ts +1 -1
- package/dist/core.js +3 -0
- package/dist/core.js.map +1 -1
- package/dist/index.cjs +3 -0
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js +3 -0
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
|
@@ -849,9 +849,14 @@ interface CompactRuntimeDelegationInput {
|
|
|
849
849
|
* compact UCAN's signed payload, verifies the transport fields agree, then
|
|
850
850
|
* invokes {@link TinyCloudNode.useRuntimeDelegation}. The node activation call
|
|
851
851
|
* remains the authority and delegation-chain validation boundary.
|
|
852
|
+
*
|
|
853
|
+
* `options.authorize`, when given, sees the signed capabilities before
|
|
854
|
+
* anything is activated or installed; returning `false` refuses the
|
|
855
|
+
* delegation.
|
|
852
856
|
*/
|
|
853
857
|
declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
|
|
854
858
|
host: string;
|
|
859
|
+
authorize?: (effectivePermissions: readonly PermissionEntry[]) => boolean;
|
|
855
860
|
}): Promise<ValidatedRuntimeDelegation>;
|
|
856
861
|
/**
|
|
857
862
|
* Import compact UCAN bytes returned by an authority ceremony through the
|
|
@@ -849,9 +849,14 @@ interface CompactRuntimeDelegationInput {
|
|
|
849
849
|
* compact UCAN's signed payload, verifies the transport fields agree, then
|
|
850
850
|
* invokes {@link TinyCloudNode.useRuntimeDelegation}. The node activation call
|
|
851
851
|
* remains the authority and delegation-chain validation boundary.
|
|
852
|
+
*
|
|
853
|
+
* `options.authorize`, when given, sees the signed capabilities before
|
|
854
|
+
* anything is activated or installed; returning `false` refuses the
|
|
855
|
+
* delegation.
|
|
852
856
|
*/
|
|
853
857
|
declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
|
|
854
858
|
host: string;
|
|
859
|
+
authorize?: (effectivePermissions: readonly PermissionEntry[]) => boolean;
|
|
855
860
|
}): Promise<ValidatedRuntimeDelegation>;
|
|
856
861
|
/**
|
|
857
862
|
* Import compact UCAN bytes returned by an authority ceremony through the
|
package/dist/core.cjs
CHANGED
|
@@ -7687,6 +7687,9 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
|
|
|
7687
7687
|
if (!resourcesMatch(declaredResources, signed.resources)) {
|
|
7688
7688
|
throw new Error("Runtime delegation resources do not match signed authority.");
|
|
7689
7689
|
}
|
|
7690
|
+
if (options.authorize !== void 0 && !options.authorize(signed.permissions)) {
|
|
7691
|
+
throw new Error("Runtime delegation is not authorized for this runtime.");
|
|
7692
|
+
}
|
|
7690
7693
|
const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
|
|
7691
7694
|
if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
|
|
7692
7695
|
throw new Error(
|