@vantageos/backend-doctor 0.1.14 → 0.3.0

package/dist/detectors/source/identity-by-id.d.ts

@@ -0,0 +1,80 @@
+import * as ts from "typescript";
+import type { Detector } from "../../engine-types.js";
+import { type FnDef, type Parsed, type SrcFile } from "./_ast.js";
+import { type Scan, type SourceDetectorEntry } from "./_scan.js";
+export declare const IDENTITY_PACKAGE = "@vantageos/cloud-identity";
+export declare const R53_ID = "R-53 an actor and a target are identified by ID through @vantageos/cloud-identity; a name never selects or authorises a row";
+/** Name fields: a display label that must never be an admission operand. */
+export declare const NAME_TOKENS: ReadonlySet<string>;
+/** The package's principal resolvers: the ONLY sinks a host credential read
+ * may feed (first argument). The package verifies nothing about the credential
+ * (cloud-identity 0.11.0 `principal-by-id.d.ts:37`, `person-principal.d.ts:28`),
+ * so the host MUST read `ctx.auth` and hand the claims over; the read is a local
+ * identity decision only when its value goes anywhere else. */
+export declare const PACKAGE_RESOLVERS: ReadonlySet<string>;
+/** Name comparisons in a node's OWN body: `a === b` with a name on one side
+ * and no literal on either, or `names.includes(x)` over a name list. */
+export declare function nameComparisons(n: ts.Node): ts.Node[];
+/** The package's own target check (cloud-identity `principal-by-id`):
+ * `assertTargetBelongsTo(principal, { orgId, ownerId? }, opts?)` at a6e5780,
+ * `await assertTargetBelongsTo(principal, target, lookups, opts?)` at PR #21. */
+export declare const TARGET_CHECK = "assertTargetBelongsTo";
+/** A file's bindings of the package: local name -> exported name for a named
+ * import (aliases resolved), and the locals bound to a namespace import. */
+interface PkgImports {
+    named: Map<string, string>;
+    namespaces: Set<string>;
+}
+export declare function importsOf(p: Parsed): {
+    pkg: Set<string>;
+    imports: PkgImports;
+    unresolved: boolean;
+};
+/** The package export a callee names, through the file's own import of it
+ * (`assertTargetBelongsTo`, `x as y`, `identity.assertTargetBelongsTo`). */
+export declare function pkgExportOf(callee: ts.Expression, imp: PkgImports): string | undefined;
+/** `!v.ok`, `v.ok === false`, `v.ok !== true` (either operand order). */
+export declare function refusesOnNotOk(c0: ts.Expression, v: string): boolean;
+export declare class HostReadFlow {
+    private readonly parsed;
+    private readonly fns;
+    private readonly pkgImports;
+    private readonly defOf;
+    private readonly memo;
+    constructor(parsed: Parsed[], fns: Map<string, FnDef[]>, pkgImports: Map<string, PkgImports>);
+    /** Every `getUserIdentity()` call in `n` whose value does NOT end only in a
+     * package resolver. */
+    unsanctioned(n: ts.Node): ts.CallExpression[];
+    sanctioned(read: ts.CallExpression): boolean;
+    /** Does the value of expression `e` reach ONLY package resolvers? */
+    private flows;
+    private bindingFlows;
+    /** One read of a bound value: an absence test forwarded to the package, or
+     * a value that flows on. */
+    private refFlows;
+    /** A function's return reaches only package resolvers, at EVERY call site. */
+    private returnFlows;
+}
+export declare const ORG_KIND_ADAPTER = "orgKindOf";
+export declare const ORG_BY_ID_ADAPTER = "organisationById";
+/** The host adapters that may hold the ID-keyed mapping read. */
+export declare const ORG_ID_ADAPTERS: ReadonlySet<string>;
+export declare const ORG_ID_INDEX = "by_clerk_org_id";
+export declare const ORG_ID_FIELD = "clerkOrgId";
+/**
+ * The `client_org_mapping` reads the org-kind ruling admits (see OrgKindReads),
+ * computed over `parsed` so a caller holding the same AST nodes can test
+ * membership. Exported for CR-2 (local-identity.ts), which must not re-derive
+ * R-53's ruling.
+ */
+export declare function conformantMappingReads(parsed: Parsed[]): Set<ts.CallExpression>;
+export interface R53Detail {
+    scan: Scan;
+    doors: number;
+    gates: number;
+}
+export declare function scanR53(files: SrcFile[]): Scan;
+export declare function scanR53Detailed(files: SrcFile[]): R53Detail;
+export declare const R53: Detector;
+export declare const SOURCE_IDENTITY_BY_ID_DETECTORS: SourceDetectorEntry[];
+export {};