@tinycloud/sdk-core 3.8.0-beta.14 → 3.8.0-beta.15

package/dist/index.cjs

@@ -361,6 +361,7 @@ __export(index_exports, {
   ensureNetworkUsableForDecrypt: () => import_sdk_services9.ensureNetworkUsableForDecrypt,
   err: () => import_sdk_services9.err,
   expandActionShortNames: () => expandActionShortNames,
+  expandDelegationPermissionEntries: () => expandDelegationPermissionEntries,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
   extractImmutableSiweFields: () => extractImmutableSiweFields,
@@ -7769,6 +7770,7 @@ function validateEncodedShareData(data) {
 var import_ms = __toESM(require("ms"), 1);
 var import_bootstrap2 = require("@tinycloud/bootstrap");
 var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
@@ -7945,6 +7947,29 @@ function expandEncryptionPermissionEntry(entry) {
 function expandPermissionEntries(entries) {
   return entries.flatMap(expandPermissionEntry);
 }
+function expandDelegationPermissionEntries(entries) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    try {
+      resource = (0, import_resource.parseEncryptionResource)(entry.path);
+    } catch {
+      throw new ManifestValidationError("delegation requires a canonical exact named-key resource");
+    }
+    if (resource.kind !== "key" || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "decrypt" && action !== "tinycloud.encryption/decrypt")) {
+      throw new ManifestValidationError("named-key delegation requires an exact key and decrypt only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/decrypt"],
+      skipPrefix: true
+    }];
+  });
+}
 function applyPrefix(prefix, path, skipPrefix) {
   if (skipPrefix) {
     return path;
@@ -8590,6 +8615,7 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 var PermissionNotInManifestError = class extends Error {
   constructor(missing, granted) {
     super(
@@ -8641,10 +8667,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -8659,7 +8684,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains2(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains2(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {