@tinycloud/operations 0.4.0-beta.12 → 0.4.0-beta.14

package/dist/delegation-binding.cjs

@@ -278,8 +278,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -581,7 +590,8 @@ async function acquireProfileLock(profile, options) {
   const lockPath = profileLockPath(profile);
   const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
-  await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
+  if (!options.requireProfile) await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
   await (0, import_promises.mkdir)((0, import_node_path.dirname)(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await (0, import_promises.chmod)(path, PRIVATE_DIR_MODE).catch((error) => {
@@ -590,11 +600,15 @@ async function acquireProfileLock(profile, options) {
   }
   const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
   try {
+    if (options.requireProfile && !await exists(profileConfigPath(profile))) {
+      await (0, import_promises.rmdir)(directory).catch(() => void 0);
+      throw new ProfileDeletedError(profile);
+    }
     const deletion = await readJson((0, import_node_path.join)(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = (0, import_node_crypto.randomUUID)();
-      if (await publishProfileLock(profile, lockPath, token)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -845,12 +859,13 @@ async function collectTurns(profile, turn) {
     }
   }
 }
-async function publishProfileLock(profile, lockPath, token) {
+async function publishProfileLock(profile, lockPath, token, requireProfile) {
   try {
     await (0, import_promises.mkdir)(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
     if (isErrno(error, "EEXIST")) return false;
     if (!isErrno(error, "ENOENT")) throw error;
+    if (requireProfile) throw new ProfileDeletedError(profile);
     await (0, import_promises.mkdir)(profilePath(profile), { recursive: true, mode: PRIVATE_DIR_MODE });
     return false;
   }