@tinycloud/operations 0.7.7-beta.12 → 0.7.7-beta.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/artifacts.cjs +7 -4
- package/dist/artifacts.cjs.map +1 -1
- package/dist/artifacts.js +7 -4
- package/dist/artifacts.js.map +1 -1
- package/dist/cli-runtime.cjs +9 -6
- package/dist/cli-runtime.cjs.map +1 -1
- package/dist/cli-runtime.js +7 -4
- package/dist/cli-runtime.js.map +1 -1
- package/dist/delegation-binding.cjs +7 -4
- package/dist/delegation-binding.cjs.map +1 -1
- package/dist/delegation-binding.js +7 -4
- package/dist/delegation-binding.js.map +1 -1
- package/dist/index.cjs +9 -6
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +7 -4
- package/dist/index.js.map +1 -1
- package/package.json +3 -3
package/dist/index.js
CHANGED
|
@@ -1039,6 +1039,7 @@ var init_sha2 = __esm({
|
|
|
1039
1039
|
|
|
1040
1040
|
// ../sdk-core/src/manifest.ts
|
|
1041
1041
|
import { resolveSecretPath, SECRET_NAME_RE, parseNetworkId } from "@tinycloud/sdk-services";
|
|
1042
|
+
import { parseEncryptionResource } from "@tinycloud/sdk-services/encryption/resource";
|
|
1042
1043
|
function expandActionShortNames(service, actions) {
|
|
1043
1044
|
return actions.map((a) => {
|
|
1044
1045
|
if (a.includes("/")) {
|
|
@@ -1075,6 +1076,7 @@ var init_manifest = __esm({
|
|
|
1075
1076
|
});
|
|
1076
1077
|
|
|
1077
1078
|
// ../sdk-core/src/capabilities.ts
|
|
1079
|
+
import { encryptionResourceContains } from "@tinycloud/sdk-services/encryption/resource";
|
|
1078
1080
|
function normalizeSpace(space) {
|
|
1079
1081
|
if (!space.startsWith("tinycloud:")) {
|
|
1080
1082
|
return space;
|
|
@@ -1098,10 +1100,9 @@ function isCapabilitySubset(requested, granted) {
|
|
|
1098
1100
|
const grantedActions = matchingScope.flatMap(
|
|
1099
1101
|
(entry) => expandActionShortNames(entry.service, entry.actions)
|
|
1100
1102
|
);
|
|
1103
|
+
const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
|
|
1101
1104
|
const covered = requestedActions.every(
|
|
1102
|
-
(requestedAction) => grantedActions.some(
|
|
1103
|
-
(grantedAction) => actionContains(grantedAction, requestedAction)
|
|
1104
|
-
)
|
|
1105
|
+
(requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
|
|
1105
1106
|
);
|
|
1106
1107
|
if (!covered) {
|
|
1107
1108
|
missing.push(cloneEntry(req));
|
|
@@ -1116,7 +1117,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
|
|
|
1116
1117
|
if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
|
|
1117
1118
|
return false;
|
|
1118
1119
|
}
|
|
1119
|
-
|
|
1120
|
+
const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
|
|
1121
|
+
const coveredPath = namedKeyRequest ? encryptionResourceContains(granted.path, requested.path) : pathContains(granted.path, requested.path);
|
|
1122
|
+
if (!coveredPath) {
|
|
1120
1123
|
return false;
|
|
1121
1124
|
}
|
|
1122
1125
|
if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
|