@tinycloud/node-sdk 3.5.0-beta.0 → 3.5.0

package/dist/core.cjs

@@ -2983,6 +2983,16 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   return entries;
 }
 var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core8.EXPIRY.SESSION_MS;
+var SHARE_NETWORK_NAME_RE = /^share-[a-z0-9][a-z0-9-]{15,35}$/;
+function grantsCappedDecrypt(path, actions) {
+  if (!actions.some((action) => (0, import_sdk_core8.actionContains)(action, import_sdk_core8.ENCRYPTION.DECRYPT))) {
+    return false;
+  }
+  return !((0, import_sdk_core8.isNetworkId)(path) && SHARE_NETWORK_NAME_RE.test((0, import_sdk_core8.parseNetworkId)(path).name));
+}
+function includesDecrypt(entries) {
+  return entries.some((entry) => grantsCappedDecrypt(entry.path, entry.actions));
+}
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -3150,6 +3160,15 @@ var NodeSecretsService = class {
     if (this.hasPermission(permissionEntries)) {
       return ok();
     }
+    let escalation;
+    try {
+      escalation = this.config.uncoveredEntries?.(permissionEntries) ?? permissionEntries;
+    } catch (error) {
+      return this.escalationError(action, target, error);
+    }
+    if (this.config.uncoveredEntries !== void 0 && escalation.length === 0) {
+      return ok();
+    }
     if (!this.config.canEscalate()) {
       return secretsError(
         import_sdk_core9.ErrorCodes.PERMISSION_DENIED,
@@ -3157,16 +3176,20 @@ var NodeSecretsService = class {
       );
     }
     try {
-      await this.config.grantPermissions(permissionEntries);
+      const grant = action === "get" && this.config.grantGetPermissions !== void 0 ? this.config.grantGetPermissions : this.config.grantPermissions;
+      await grant(escalation);
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
-      return secretsError(
-        import_sdk_core9.ErrorCodes.PERMISSION_DENIED,
-        error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
-        error instanceof Error ? error : void 0
-      );
+      return this.escalationError(action, target, error);
     }
   }
+  escalationError(action, target, error) {
+    return secretsError(
+      import_sdk_core9.ErrorCodes.PERMISSION_DENIED,
+      error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
+      error instanceof Error ? error : void 0
+    );
+  }
   async restoreUnlockAfterEscalation() {
     if (!this.shouldRestoreUnlock) {
       return ok();
@@ -3572,6 +3595,8 @@ function ownerPermissionsToAbilities(permissions) {
   return { abilities, rawAbilities };
 }
 var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation to a did:key (not did:pkh); use the session-key DID or drop the flag";
+var DECRYPT_GRANT_MAX_EXPIRY_MS = 60 * 60 * 1e3;
+var SECRET_GET_GRANT_EXPIRY_MS = 59 * 60 * 1e3;
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -7694,6 +7719,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
+        grantGetPermissions: (additional) => this.grantRuntimePermissions(additional, { expiry: SECRET_GET_GRANT_EXPIRY_MS }),
+        uncoveredEntries: (permissions) => permissions.filter((entry) => !this.hasRuntimePermissions([entry])),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
         getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
         resolveSpace: (space) => space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space),
@@ -8041,6 +8068,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
+    const requestsDecrypt = includesDecrypt(expanded);
+    const requestedExpiryMs = requestsDecrypt && options?.expiry === void 0 ? DECRYPT_GRANT_MAX_EXPIRY_MS : resolveExpiryMs(options?.expiry);
+    if (requestsDecrypt && requestedExpiryMs > DECRYPT_GRANT_MAX_EXPIRY_MS) {
+      throw Object.assign(new Error("decrypt grants last at most one hour"), {
+        code: "DECRYPT_EXPIRY_TOO_LONG"
+      });
+    }
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return [];
     }
@@ -8071,7 +8105,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       bySpace.set(session.spaceId, []);
     }
     const now = /* @__PURE__ */ new Date();
-    const requestedExpiryMs = resolveExpiryMs(options?.expiry);
     let expiresAt = new Date(now.getTime() + requestedExpiryMs);
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;