@ultimat3/policy 22.9.0 → 22.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/src/errors.ts +5 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ultimat3/policy",
|
|
3
|
-
"version": "22.
|
|
3
|
+
"version": "22.10.0",
|
|
4
4
|
"description": "The one authz rule, evaluated identically in every surface",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -31,6 +31,6 @@
|
|
|
31
31
|
"test": "bun test"
|
|
32
32
|
},
|
|
33
33
|
"dependencies": {
|
|
34
|
-
"@ultimat3/core": "22.
|
|
34
|
+
"@ultimat3/core": "22.10.0"
|
|
35
35
|
}
|
|
36
36
|
}
|
package/src/errors.ts
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
// declaration site that cannot express the requirement in a type — a config-driven route table,
|
|
5
5
|
// a policy resolved by name — and `policyMissing()` is how such a site says it.
|
|
6
6
|
import {
|
|
7
|
+
deniedCallerFix,
|
|
7
8
|
type ErrorRetry,
|
|
8
9
|
nearestName,
|
|
9
10
|
registerErrorCodes,
|
|
@@ -75,11 +76,12 @@ registerErrorRetry(POLICY_ERROR_RETRY);
|
|
|
75
76
|
export class PolicyError extends UltimateError {
|
|
76
77
|
override readonly name = 'PolicyError';
|
|
77
78
|
|
|
78
|
-
constructor(init: { code: PolicyErrorCode; cause: string; fix: string }) {
|
|
79
|
+
constructor(init: { code: PolicyErrorCode; cause: string; fix: string; callerFix?: string }) {
|
|
79
80
|
super({
|
|
80
81
|
code: init.code,
|
|
81
82
|
cause: init.cause,
|
|
82
83
|
fix: init.fix,
|
|
84
|
+
...(init.callerFix === undefined ? {} : { callerFix: init.callerFix }),
|
|
83
85
|
});
|
|
84
86
|
}
|
|
85
87
|
}
|
|
@@ -105,6 +107,8 @@ export const forbidden = (label: string, reason: string): PolicyError =>
|
|
|
105
107
|
fix: BARE_PERMISSION.test(label)
|
|
106
108
|
? `x policy explain ${label} --json # shows which clause decided and why`
|
|
107
109
|
: `x policy list --json # then: x policy explain <permission> --json for the clause that decided`,
|
|
110
|
+
// The remote caller's half: it holds a credential, not the policy file.
|
|
111
|
+
callerFix: deniedCallerFix(BARE_PERMISSION.test(label) ? label : undefined),
|
|
108
112
|
});
|
|
109
113
|
|
|
110
114
|
export const policyMissing = (subject: string): PolicyError =>
|