@ultimat3/auth 25.0.0 → 25.1.0

package/CLAUDE.md

@@ -167,7 +167,7 @@ Tier 2. Produces the `Actor`; produces nothing else. Authorization is `@ultimat3
   keys beside their sessions, and logs before its first write.
 - **A key's scopes only ever shrink** (`apiKeyScopes`, `policy-bridge.ts`): `*` and `<res>:*` are
   refused at `issueApiKey` (`X_CONFIG_INVALID`) and dropped from a stored row; an OWNED key keeps
-  only what its owner's grants cover. Roles are policy's to expand, so the default grants are the
+  only what its owner's grants cover (core's `grantCovers`, never a local copy). Roles are policy's to expand, so the default grants are the
   row's `permissions` + `scopes` (`directGrants`) and a role-based app passes
   `apiKeyResolver(store, { grantsOf })`. Never union a key with the owner's roles.
 - **`apiKeyResolver(() => store)` is the ONE token → caller mapping** (`api-key-resolver.ts`):

package/README.md

@@ -796,7 +796,9 @@ default set:
 
 - `*` and `<resource>:*` are refused at `issueApiKey` (`X_CONFIG_INVALID`), and dropped from a row
   that already holds one.
-- A key a user owns keeps only the scopes that owner's grants cover. This package can read the
+- A key a user owns keeps only the scopes that owner's grants cover — `@ultimat3/core`'s
+  `grantCovers`, the reading `can()` uses: an owner with `billing:invoice:*` covers
+  `billing:invoice:read`, never `billing:refund:issue`. This package can read the
   row's `permissions` and `scopes` (`directGrants`) and cannot expand a role — that is
   `@ultimat3/policy`'s — so an app whose users hold roles says what they grant:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/auth",
-  "version": "25.0.0",
+  "version": "25.1.0",
   "description": "Sessions, passwords, OAuth, MFA and api keys — resolved to one Actor",
   "license": "MIT",
   "type": "module",
@@ -32,8 +32,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "25.0.0",
-    "@ultimat3/db": "25.0.0",
-    "@ultimat3/schema": "25.0.0"
+    "@ultimat3/core": "25.1.0",
+    "@ultimat3/db": "25.1.0",
+    "@ultimat3/schema": "25.1.0"
   }
 }

package/src/policy-bridge.ts

@@ -5,7 +5,14 @@
 // import a same-tier package; policy binds to it by structure, in whichever order they land.
 
 import type { Actor } from '@ultimat3/core';
-import { agentActor, anonymousActor, assertNever, serviceActor, userActor } from '@ultimat3/core';
+import {
+  agentActor,
+  anonymousActor,
+  assertNever,
+  grantCovers,
+  serviceActor,
+  userActor,
+} from '@ultimat3/core';
 import type { AuthApiKeyRecord, AuthSession, AuthUser } from './adapter';
 
 /** Structural mirror of `@ultimat3/policy`'s `PolicyActorFields`. Kept in sync by hand. */
@@ -72,15 +79,6 @@ export function actorFromUser(user: AuthUser, session: AuthSession): PolicyActor
 /** `*` and `<resource>:*` — the two spellings a role uses to be granted everything. */
 export const isWildcardScope = (scope: string): boolean => scope === '*' || scope.endsWith(':*');
 
-// `@ultimat3/policy`'s own reading of a grant's resource, mirrored: same tier, so not imported.
-const resourceOf = (grant: string): string => grant.split(':')[0] ?? grant;
-
-/** Whether one of the owner's grants reaches a named permission. A grant MAY be a wildcard. */
-const covers = (grant: string, wanted: string): boolean =>
-  grant === '*' ||
-  grant === wanted ||
-  (grant.endsWith(':*') && resourceOf(grant) === resourceOf(wanted));
-
 /**
  * What a key may carry of what it names. Two cuts, and both only ever remove:
  *
@@ -99,7 +97,7 @@ export function apiKeyScopes(
   return scopes.filter(
     (scope) =>
       !isWildcardScope(scope) &&
-      (ownerGrants === null || ownerGrants.some((grant) => covers(grant, scope))),
+      (ownerGrants === null || ownerGrants.some((grant) => grantCovers(grant, scope))),
   );
 }