@tinycloud/operations 0.7.7-beta.9 → 0.7.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/coverage.json +14 -0
- package/dist/artifacts.cjs +7 -4
- package/dist/artifacts.cjs.map +1 -1
- package/dist/artifacts.js +7 -4
- package/dist/artifacts.js.map +1 -1
- package/dist/cli-runtime.cjs +19 -15
- package/dist/cli-runtime.cjs.map +1 -1
- package/dist/cli-runtime.js +8 -4
- package/dist/cli-runtime.js.map +1 -1
- package/dist/delegation-binding.cjs +8 -4
- package/dist/delegation-binding.cjs.map +1 -1
- package/dist/delegation-binding.js +8 -4
- package/dist/delegation-binding.js.map +1 -1
- package/dist/index.cjs +19 -15
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +8 -4
- package/dist/index.js.map +1 -1
- package/package.json +4 -4
package/dist/artifacts.js
CHANGED
|
@@ -148,6 +148,7 @@ import { z } from "zod";
|
|
|
148
148
|
// ../sdk-core/src/manifest.ts
|
|
149
149
|
var import_ms = __toESM(require_ms(), 1);
|
|
150
150
|
import { resolveSecretPath, SECRET_NAME_RE, parseNetworkId } from "@tinycloud/sdk-services";
|
|
151
|
+
import { parseEncryptionResource } from "@tinycloud/sdk-services/encryption/resource";
|
|
151
152
|
var DEFAULT_MANIFEST_SPACE = "applications";
|
|
152
153
|
var SERVICE_SHORT_TO_LONG = Object.freeze({
|
|
153
154
|
kv: "tinycloud.kv",
|
|
@@ -177,6 +178,7 @@ var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
|
|
|
177
178
|
var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
|
|
178
179
|
|
|
179
180
|
// ../sdk-core/src/capabilities.ts
|
|
181
|
+
import { encryptionResourceContains } from "@tinycloud/sdk-services/encryption/resource";
|
|
180
182
|
function normalizeSpace(space) {
|
|
181
183
|
if (!space.startsWith("tinycloud:")) {
|
|
182
184
|
return space;
|
|
@@ -200,10 +202,9 @@ function isCapabilitySubset(requested, granted) {
|
|
|
200
202
|
const grantedActions = matchingScope.flatMap(
|
|
201
203
|
(entry) => expandActionShortNames(entry.service, entry.actions)
|
|
202
204
|
);
|
|
205
|
+
const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
|
|
203
206
|
const covered = requestedActions.every(
|
|
204
|
-
(requestedAction) => grantedActions.some(
|
|
205
|
-
(grantedAction) => actionContains(grantedAction, requestedAction)
|
|
206
|
-
)
|
|
207
|
+
(requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
|
|
207
208
|
);
|
|
208
209
|
if (!covered) {
|
|
209
210
|
missing.push(cloneEntry(req));
|
|
@@ -218,7 +219,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
|
|
|
218
219
|
if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
|
|
219
220
|
return false;
|
|
220
221
|
}
|
|
221
|
-
|
|
222
|
+
const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
|
|
223
|
+
const coveredPath = namedKeyRequest ? encryptionResourceContains(granted.path, requested.path) : pathContains(granted.path, requested.path);
|
|
224
|
+
if (!coveredPath) {
|
|
222
225
|
return false;
|
|
223
226
|
}
|
|
224
227
|
if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
|