@vantageos/cloud-identity 0.20.0 → 0.20.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/README.md +38 -1
- package/dist/caller-from-claims.d.ts +7 -0
- package/dist/caller-from-claims.d.ts.map +1 -1
- package/dist/caller-from-claims.js +2 -2
- package/dist/caller-from-claims.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -1
- package/dist/index.js.map +1 -1
- package/dist/scope-standing.d.ts +57 -3
- package/dist/scope-standing.d.ts.map +1 -1
- package/dist/scope-standing.js +64 -3
- package/dist/scope-standing.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,17 @@
|
|
|
3
3
|
All notable changes to `@vantageos/cloud-identity` are documented here.
|
|
4
4
|
This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
5
5
|
|
|
6
|
+
## [0.20.1]
|
|
7
|
+
|
|
8
|
+
### Added
|
|
9
|
+
- `isServiceAccountScope(scope)` and `requireServiceAccountStanding(scope, door)` (`./scope-standing`): the fleet service account apart from the internal opt-in, which `"fleet"` also covers. The require form throws `RBAC_DENIED` `scope-not-resolved` or `standing-not-allowed`.
|
|
10
|
+
- `bearerStanding(context)` (`./scope-standing`): `"service-bearer"`, `"local-trust"`, `"caller"` or `"refused"` for a verified bearer context (`isMaster`, `viaMasterBearer`). Fails closed. Types `BearerStanding`, `StandingBearer`.
|
|
11
|
+
- The `@standingGate` JSDoc tag on every standing gate, kept in `dist/*.d.ts`, so an analyser derives the gates from the package.
|
|
12
|
+
- `resolveCallerFromClaims` refusals carry `subject` when the claims had a verified one.
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
15
|
+
- README: `requireFleetStanding`'s example no longer says "the fleet's own service only"; it admits the internal opt-in too.
|
|
16
|
+
|
|
6
17
|
## [0.20.0]
|
|
7
18
|
|
|
8
19
|
### Added
|
package/README.md
CHANGED
|
@@ -973,7 +973,7 @@ on its `isMaster` boolean. That boolean mixes "may read the whole fleet" with
|
|
|
973
973
|
```ts
|
|
974
974
|
import { requireStanding, requireFleetStanding, hasFleetRead } from "@vantageos/cloud-identity/scope-standing";
|
|
975
975
|
|
|
976
|
-
requireFleetStanding(scope, "
|
|
976
|
+
requireFleetStanding(scope, "fleet.stats"); // the fleet: service account or internal opt-in
|
|
977
977
|
requireStanding(scope, "tasks.list", ["fleet", "operator-admin", "member"]);
|
|
978
978
|
if (hasFleetRead(scope)) { /* unfiltered read: fleet or operator-admin */ }
|
|
979
979
|
```
|
|
@@ -990,6 +990,42 @@ if (hasFleetRead(scope)) { /* unfiltered read: fleet or operator-admin */ }
|
|
|
990
990
|
meaning of `isMaster`.
|
|
991
991
|
- Types: `ScopeStanding`, `StandingScope`.
|
|
992
992
|
|
|
993
|
+
**The service account apart from the internal opt-in (0.20.1).** `"fleet"`
|
|
994
|
+
covers two grants: the fleet's service account and an internal opt-in that
|
|
995
|
+
carries no credential. A door that must be the service account itself (a
|
|
996
|
+
verified actor, an agent credential) uses:
|
|
997
|
+
|
|
998
|
+
```ts
|
|
999
|
+
import { isServiceAccountScope, requireServiceAccountStanding } from "@vantageos/cloud-identity/scope-standing";
|
|
1000
|
+
|
|
1001
|
+
requireServiceAccountStanding(scope, "secrets.read"); // the service account only; the internal opt-in is refused
|
|
1002
|
+
if (isServiceAccountScope(scope)) { /* ... */ }
|
|
1003
|
+
```
|
|
1004
|
+
|
|
1005
|
+
`requireServiceAccountStanding` throws `RBAC_DENIED` with `scope-not-resolved`
|
|
1006
|
+
for a `"refused"` scope and `standing-not-allowed` for any other standing, the
|
|
1007
|
+
internal opt-in included.
|
|
1008
|
+
|
|
1009
|
+
**A verified bearer context (0.20.1).** An MCP transport attaches a context to
|
|
1010
|
+
each request after verifying its bearer: `isMaster` for the master population,
|
|
1011
|
+
`viaMasterBearer` only when that master presented the network master bearer.
|
|
1012
|
+
`bearerStanding(context)` reads it:
|
|
1013
|
+
|
|
1014
|
+
| standing | the context |
|
|
1015
|
+
|---|---|
|
|
1016
|
+
| `"service-bearer"` | master, through the network master bearer |
|
|
1017
|
+
| `"local-trust"` | master with no network bearer (a process-local server) |
|
|
1018
|
+
| `"caller"` | a non-master token |
|
|
1019
|
+
| `"refused"` | absent, malformed, or `viaMasterBearer` on a non-master context |
|
|
1020
|
+
|
|
1021
|
+
Types: `BearerStanding`, `StandingBearer`.
|
|
1022
|
+
|
|
1023
|
+
**`@standingGate` (0.20.1).** `scopeStanding`, `hasFleetRead`, `requireStanding`,
|
|
1024
|
+
`requireFleetStanding`, `isServiceAccountScope`, `requireServiceAccountStanding`
|
|
1025
|
+
and `bearerStanding` carry the JSDoc tag `@standingGate` in the published
|
|
1026
|
+
declarations, so an analyser credits a call to any of them as a delegated gate
|
|
1027
|
+
instead of keeping its own list.
|
|
1028
|
+
|
|
993
1029
|
### From verified claims to the caller (`/caller-from-claims`, 0.20.0)
|
|
994
1030
|
|
|
995
1031
|
`resolveCallerFromClaims(claims, { orgLookups, principalLookups }, { adminRoles, door })`
|
|
@@ -1006,6 +1042,7 @@ const c = await resolveCallerFromClaims(identity, { orgLookups, principalLookups
|
|
|
1006
1042
|
if (!c.ok) {
|
|
1007
1043
|
// c.refusal: typed RBAC_DENIED (no-verified-organisation, org-mapping-not-found, other-organisation, credential-invalid, ...)
|
|
1008
1044
|
// c.claimsOrg: the claims NAME an organisation they could not prove (refuse loudly), vs none at all
|
|
1045
|
+
// c.subject (0.20.1): the verified subject when the claims had one, e.g. to decide a service account by subject
|
|
1009
1046
|
} else {
|
|
1010
1047
|
// c.subject, c.actorName ("user:<sub>"), c.org { id, label, orgKind, ... }, c.principal, c.role, c.isOrgAdmin
|
|
1011
1048
|
}
|
|
@@ -54,6 +54,13 @@ export type CallerFromClaimsResult = {
|
|
|
54
54
|
* never an organisation itself.
|
|
55
55
|
*/
|
|
56
56
|
claimsOrg: boolean;
|
|
57
|
+
/**
|
|
58
|
+
* The verified subject, when the claims carried one (0.20.1). A consumer
|
|
59
|
+
* that decides some callers by subject before any organisation (a fleet
|
|
60
|
+
* service account) reads it here, never from the credential. Absent when
|
|
61
|
+
* the refusal is the missing subject itself.
|
|
62
|
+
*/
|
|
63
|
+
subject?: string;
|
|
57
64
|
};
|
|
58
65
|
/** The verified org role claim, under any of its spellings, or null. */
|
|
59
66
|
export declare function readOrgRoleClaim(claims: Record<string, unknown>): string | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"caller-from-claims.d.ts","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAGtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG;IACjC,iFAAiF;IACjF,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0EAA0E;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,0FAA0F;IAC1F,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,WAAW,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,eAAe,CAAC;IAC3B,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;CACrB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"caller-from-claims.d.ts","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAGtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG;IACjC,iFAAiF;IACjF,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0EAA0E;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,0FAA0F;IAC1F,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,WAAW,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,eAAe,CAAC;IAC3B,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;CACrB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AASN,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAK/E;AAED,oHAAoH;AACpH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CA8CjC"}
|
|
@@ -61,7 +61,7 @@ export async function resolveCallerFromClaims(claims, deps, options) {
|
|
|
61
61
|
}
|
|
62
62
|
const resolved = await resolveOrgFromClaim(record, deps?.orgLookups, { door });
|
|
63
63
|
if (!resolved.ok)
|
|
64
|
-
return { ok: false, claimsOrg, refusal: resolved.refusal };
|
|
64
|
+
return { ok: false, claimsOrg, subject, refusal: resolved.refusal };
|
|
65
65
|
const org = resolved.org;
|
|
66
66
|
const role = readOrgRoleClaim(record);
|
|
67
67
|
const person = await resolveActingPrincipal({
|
|
@@ -71,7 +71,7 @@ export async function resolveCallerFromClaims(claims, deps, options) {
|
|
|
71
71
|
...(role !== null ? { verifiedOrgRole: role } : {}),
|
|
72
72
|
}, deps?.principalLookups, door);
|
|
73
73
|
if (!person.ok)
|
|
74
|
-
return { ok: false, claimsOrg, refusal: person.refusal };
|
|
74
|
+
return { ok: false, claimsOrg, subject, refusal: person.refusal };
|
|
75
75
|
const isOrgAdmin = assertOrgAdmin(person.principal, org.id, { adminRoles, door }).ok;
|
|
76
76
|
return {
|
|
77
77
|
ok: true,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"caller-from-claims.js","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAA4C,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAGL,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"caller-from-claims.js","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAA4C,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAGL,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAmD9B,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAU,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEtG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAW,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAClE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAkD,EAClD,IAA0B,EAC1B,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACvD,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,uCAAuC,CAAC;SACrG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAEzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO;QACjB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,EACD,IAAI,EAAE,gBAAgB,EACtB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAElF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACrF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;QACnC,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI;QACJ,UAAU;KACX,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -21,8 +21,8 @@ export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
|
|
|
21
21
|
export type { AuthorizeClient, ClerkOrgMembership, AuthorizationCodeRecord, AuthorizationCodeStore, ConsumeCodeResult, AuthorizeConfig, AuthorizeDeps, AuthorizeOutcome, OrgPickerModel, ResumeInput, } from "./authorize-flow.js";
|
|
22
22
|
export { resolveClerkSessionFromRequest, resumeAuthorizeFromRequest, } from "./clerk-handshake.js";
|
|
23
23
|
export type { ClerkSessionFromRequest, ClerkSessionFromRequestOptions, ResumeFromRequestOutcome, } from "./clerk-handshake.js";
|
|
24
|
-
export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding, } from "./scope-standing.js";
|
|
25
|
-
export type { ScopeStanding, StandingScope } from "./scope-standing.js";
|
|
24
|
+
export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding, isServiceAccountScope, requireServiceAccountStanding, bearerStanding, } from "./scope-standing.js";
|
|
25
|
+
export type { ScopeStanding, StandingScope, BearerStanding, StandingBearer, } from "./scope-standing.js";
|
|
26
26
|
export { resolveCallerFromClaims, readOrgRoleClaim, claimsAnOrganisation, } from "./caller-from-claims.js";
|
|
27
27
|
export type { CallerFromClaimsDeps, CallerFromClaimsOptions, CallerFromClaimsResult, } from "./caller-from-claims.js";
|
|
28
28
|
export { exchangeAuthorizationCode } from "./token-exchange.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EAEpB,qBAAqB,EACrB,6BAA6B,EAC7B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,cAAc,EACd,kCAAkC,GACnC,MAAM,wBAAwB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -23,7 +23,9 @@ export { validatePresentedBearer, requireAgentScopedIdentity, storedBearerRowSch
|
|
|
23
23
|
export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
|
|
24
24
|
export { resolveClerkSessionFromRequest, resumeAuthorizeFromRequest, } from "./clerk-handshake.js";
|
|
25
25
|
// 0.20.0 — the standing of a resolved org scope: one reading of "isMaster".
|
|
26
|
-
export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding,
|
|
26
|
+
export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding,
|
|
27
|
+
// 0.20.1 — the service account apart from the internal opt-in; a verified bearer context.
|
|
28
|
+
isServiceAccountScope, requireServiceAccountStanding, bearerStanding, } from "./scope-standing.js";
|
|
27
29
|
// 0.20.0 — one entry from verified claims to org + person + role + admin.
|
|
28
30
|
export { resolveCallerFromClaims, readOrgRoleClaim, claimsAnOrganisation, } from "./caller-from-claims.js";
|
|
29
31
|
export { exchangeAuthorizationCode } from "./token-exchange.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,4EAA4E;AAC5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,4EAA4E;AAC5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB;AACpB,0FAA0F;AAC1F,qBAAqB,EACrB,6BAA6B,EAC7B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAQ7B,0EAA0E;AAC1E,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,qEAAqE;AACrE,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAiBxB,mFAAmF;AACnF,iFAAiF;AACjF,qBAAqB;AACrB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}
|
package/dist/scope-standing.d.ts
CHANGED
|
@@ -30,9 +30,17 @@ export interface StandingScope {
|
|
|
30
30
|
orgClerkId?: string;
|
|
31
31
|
refused?: boolean;
|
|
32
32
|
}
|
|
33
|
-
/**
|
|
33
|
+
/**
|
|
34
|
+
* The standing of `scope`; "refused" for anything that is not a well-formed scope.
|
|
35
|
+
*
|
|
36
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
37
|
+
*/
|
|
34
38
|
export declare function scopeStanding(scope: unknown): ScopeStanding;
|
|
35
|
-
/**
|
|
39
|
+
/**
|
|
40
|
+
* True when the scope may read the whole fleet: "fleet" or "operator-admin".
|
|
41
|
+
*
|
|
42
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
43
|
+
*/
|
|
36
44
|
export declare function hasFleetRead(scope: unknown): boolean;
|
|
37
45
|
/**
|
|
38
46
|
* Returns the scope's standing when it is in `allowed`; otherwise throws
|
|
@@ -40,8 +48,54 @@ export declare function hasFleetRead(scope: unknown): boolean;
|
|
|
40
48
|
* - "scope-not-resolved" the scope is "refused";
|
|
41
49
|
* - "standing-not-allowed" the standing exists but is not in `allowed`.
|
|
42
50
|
* An empty `allowed` is a programming error (TypeError), never a pass.
|
|
51
|
+
*
|
|
52
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
43
53
|
*/
|
|
44
54
|
export declare function requireStanding(scope: unknown, door: string, allowed: readonly Exclude<ScopeStanding, "refused">[]): Exclude<ScopeStanding, "refused">;
|
|
45
|
-
/**
|
|
55
|
+
/**
|
|
56
|
+
* `requireStanding(scope, door, ["fleet"])`: the fleet itself (the service account or the internal opt-in).
|
|
57
|
+
*
|
|
58
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
59
|
+
*/
|
|
46
60
|
export declare function requireFleetStanding(scope: unknown, door: string): "fleet";
|
|
61
|
+
/**
|
|
62
|
+
* True when the scope is the fleet's own SERVICE ACCOUNT: standing "fleet" with
|
|
63
|
+
* `masterSource` "service-account". The internal opt-in is fleet too, but it
|
|
64
|
+
* carries no credential, so a door that must be the service account itself (a
|
|
65
|
+
* verified actor, an agent credential) does not admit it.
|
|
66
|
+
*
|
|
67
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
68
|
+
*/
|
|
69
|
+
export declare function isServiceAccountScope(scope: unknown): boolean;
|
|
70
|
+
/**
|
|
71
|
+
* Returns when the scope is the service account (`isServiceAccountScope`);
|
|
72
|
+
* otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
73
|
+
* - "scope-not-resolved" the scope is "refused";
|
|
74
|
+
* - "standing-not-allowed" any other standing, the internal opt-in included.
|
|
75
|
+
*
|
|
76
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
77
|
+
*/
|
|
78
|
+
export declare function requireServiceAccountStanding(scope: unknown, door: string): void;
|
|
79
|
+
/**
|
|
80
|
+
* The standing of a VERIFIED bearer context, as an MCP transport attaches it to
|
|
81
|
+
* a request: `isMaster` for the master population, `viaMasterBearer` set only
|
|
82
|
+
* when that master presented the network master bearer.
|
|
83
|
+
*
|
|
84
|
+
* - "service-bearer" master, through the network master bearer (the fleet service account);
|
|
85
|
+
* - "local-trust" master with no network bearer (a process-local server, e.g. stdio);
|
|
86
|
+
* - "caller" any non-master token (a person or a seat of one organisation);
|
|
87
|
+
* - "refused" absent, malformed, or a master-bearer flag on a non-master context.
|
|
88
|
+
*/
|
|
89
|
+
export type BearerStanding = "service-bearer" | "local-trust" | "caller" | "refused";
|
|
90
|
+
/** The fields of a bearer context this module reads. Other fields are ignored. */
|
|
91
|
+
export interface StandingBearer {
|
|
92
|
+
isMaster: boolean;
|
|
93
|
+
viaMasterBearer?: boolean;
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* The standing of `context`; "refused" for anything that is not a well-formed bearer context.
|
|
97
|
+
*
|
|
98
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
99
|
+
*/
|
|
100
|
+
export declare function bearerStanding(context: unknown): BearerStanding;
|
|
47
101
|
//# sourceMappingURL=scope-standing.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-standing.d.ts","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD
|
|
1
|
+
{"version":3,"file":"scope-standing.d.ts","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAiB3D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,GACpD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAqBnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBhF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErF,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAO/D"}
|
package/dist/scope-standing.js
CHANGED
|
@@ -25,7 +25,11 @@ const FLEET_SOURCES = new Set(["service-account", "internal"]);
|
|
|
25
25
|
function nonEmptyString(value) {
|
|
26
26
|
return typeof value === "string" && value.length > 0;
|
|
27
27
|
}
|
|
28
|
-
/**
|
|
28
|
+
/**
|
|
29
|
+
* The standing of `scope`; "refused" for anything that is not a well-formed scope.
|
|
30
|
+
*
|
|
31
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
32
|
+
*/
|
|
29
33
|
export function scopeStanding(scope) {
|
|
30
34
|
if (scope === null || typeof scope !== "object" || Array.isArray(scope))
|
|
31
35
|
return "refused";
|
|
@@ -51,7 +55,11 @@ export function scopeStanding(scope) {
|
|
|
51
55
|
return "member";
|
|
52
56
|
return "refused";
|
|
53
57
|
}
|
|
54
|
-
/**
|
|
58
|
+
/**
|
|
59
|
+
* True when the scope may read the whole fleet: "fleet" or "operator-admin".
|
|
60
|
+
*
|
|
61
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
62
|
+
*/
|
|
55
63
|
export function hasFleetRead(scope) {
|
|
56
64
|
const standing = scopeStanding(scope);
|
|
57
65
|
return standing === "fleet" || standing === "operator-admin";
|
|
@@ -62,6 +70,8 @@ export function hasFleetRead(scope) {
|
|
|
62
70
|
* - "scope-not-resolved" the scope is "refused";
|
|
63
71
|
* - "standing-not-allowed" the standing exists but is not in `allowed`.
|
|
64
72
|
* An empty `allowed` is a programming error (TypeError), never a pass.
|
|
73
|
+
*
|
|
74
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
65
75
|
*/
|
|
66
76
|
export function requireStanding(scope, door, allowed) {
|
|
67
77
|
if (!Array.isArray(allowed) || allowed.length === 0) {
|
|
@@ -76,8 +86,59 @@ export function requireStanding(scope, door, allowed) {
|
|
|
76
86
|
}
|
|
77
87
|
return standing;
|
|
78
88
|
}
|
|
79
|
-
/**
|
|
89
|
+
/**
|
|
90
|
+
* `requireStanding(scope, door, ["fleet"])`: the fleet itself (the service account or the internal opt-in).
|
|
91
|
+
*
|
|
92
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
93
|
+
*/
|
|
80
94
|
export function requireFleetStanding(scope, door) {
|
|
81
95
|
return requireStanding(scope, door, ["fleet"]);
|
|
82
96
|
}
|
|
97
|
+
/**
|
|
98
|
+
* True when the scope is the fleet's own SERVICE ACCOUNT: standing "fleet" with
|
|
99
|
+
* `masterSource` "service-account". The internal opt-in is fleet too, but it
|
|
100
|
+
* carries no credential, so a door that must be the service account itself (a
|
|
101
|
+
* verified actor, an agent credential) does not admit it.
|
|
102
|
+
*
|
|
103
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
104
|
+
*/
|
|
105
|
+
export function isServiceAccountScope(scope) {
|
|
106
|
+
if (scopeStanding(scope) !== "fleet")
|
|
107
|
+
return false;
|
|
108
|
+
return scope.masterSource === "service-account";
|
|
109
|
+
}
|
|
110
|
+
/**
|
|
111
|
+
* Returns when the scope is the service account (`isServiceAccountScope`);
|
|
112
|
+
* otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
113
|
+
* - "scope-not-resolved" the scope is "refused";
|
|
114
|
+
* - "standing-not-allowed" any other standing, the internal opt-in included.
|
|
115
|
+
*
|
|
116
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
117
|
+
*/
|
|
118
|
+
export function requireServiceAccountStanding(scope, door) {
|
|
119
|
+
const standing = scopeStanding(scope);
|
|
120
|
+
if (standing === "refused") {
|
|
121
|
+
throw new IdentityRefusalError(refusal("RBAC_DENIED", "scope-not-resolved", door, "The caller's scope did not resolve to a standing."));
|
|
122
|
+
}
|
|
123
|
+
if (!isServiceAccountScope(scope)) {
|
|
124
|
+
throw new IdentityRefusalError(refusal("RBAC_DENIED", "standing-not-allowed", door, `Only the fleet service account is allowed here (standing "${standing}").`));
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
/**
|
|
128
|
+
* The standing of `context`; "refused" for anything that is not a well-formed bearer context.
|
|
129
|
+
*
|
|
130
|
+
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
131
|
+
*/
|
|
132
|
+
export function bearerStanding(context) {
|
|
133
|
+
if (context === null || typeof context !== "object" || Array.isArray(context))
|
|
134
|
+
return "refused";
|
|
135
|
+
const c = context;
|
|
136
|
+
if (typeof c.isMaster !== "boolean")
|
|
137
|
+
return "refused";
|
|
138
|
+
if (c.viaMasterBearer !== undefined && typeof c.viaMasterBearer !== "boolean")
|
|
139
|
+
return "refused";
|
|
140
|
+
if (!c.isMaster)
|
|
141
|
+
return c.viaMasterBearer === true ? "refused" : "caller";
|
|
142
|
+
return c.viaMasterBearer === true ? "service-bearer" : "local-trust";
|
|
143
|
+
}
|
|
83
144
|
//# sourceMappingURL=scope-standing.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-standing.js","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"scope-standing.js","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1F,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC;QACtD,IAAI,CAAC,CAAC,YAAY,KAAK,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,gBAAgB,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,IAAY,EACZ,OAAqD;IAErD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,aAAa,QAAQ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAY,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnD,OAAQ,KAAoC,CAAC,YAAY,KAAK,iBAAiB,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,6DAA6D,QAAQ,KAAK,CAC3E,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC;AACvE,CAAC"}
|
package/package.json
CHANGED