@vantageos/cloud-identity 0.20.1 → 0.20.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/README.md +1 -1
- package/dist/scope-standing.d.ts +3 -3
- package/dist/scope-standing.d.ts.map +1 -1
- package/dist/scope-standing.js +3 -2
- package/dist/scope-standing.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,11 @@
|
|
|
3
3
|
All notable changes to `@vantageos/cloud-identity` are documented here.
|
|
4
4
|
This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
5
5
|
|
|
6
|
+
## [0.20.2]
|
|
7
|
+
|
|
8
|
+
### Changed
|
|
9
|
+
- `requireServiceAccountStanding(scope, door)` returns the literal `"fleet"` instead of `void`, like `requireFleetStanding`. An analyser that classifies a standing gate by its return can now credit a door that calls it. Callers that ignore the return are unaffected.
|
|
10
|
+
|
|
6
11
|
## [0.20.1]
|
|
7
12
|
|
|
8
13
|
### Added
|
package/README.md
CHANGED
|
@@ -1002,7 +1002,7 @@ requireServiceAccountStanding(scope, "secrets.read"); // the service account on
|
|
|
1002
1002
|
if (isServiceAccountScope(scope)) { /* ... */ }
|
|
1003
1003
|
```
|
|
1004
1004
|
|
|
1005
|
-
`requireServiceAccountStanding` throws `RBAC_DENIED` with `scope-not-resolved`
|
|
1005
|
+
`requireServiceAccountStanding` returns `"fleet"` (0.20.2) or throws `RBAC_DENIED` with `scope-not-resolved`
|
|
1006
1006
|
for a `"refused"` scope and `standing-not-allowed` for any other standing, the
|
|
1007
1007
|
internal opt-in included.
|
|
1008
1008
|
|
package/dist/scope-standing.d.ts
CHANGED
|
@@ -68,14 +68,14 @@ export declare function requireFleetStanding(scope: unknown, door: string): "fle
|
|
|
68
68
|
*/
|
|
69
69
|
export declare function isServiceAccountScope(scope: unknown): boolean;
|
|
70
70
|
/**
|
|
71
|
-
* Returns when the scope is the service account (`isServiceAccountScope`)
|
|
72
|
-
* otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
71
|
+
* Returns `"fleet"` when the scope is the service account (`isServiceAccountScope`),
|
|
72
|
+
* the same literal as `requireFleetStanding`; otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
73
73
|
* - "scope-not-resolved" the scope is "refused";
|
|
74
74
|
* - "standing-not-allowed" any other standing, the internal opt-in included.
|
|
75
75
|
*
|
|
76
76
|
* @standingGate — judges a resolved scope or a verified bearer context; consumers may credit a call to it as a delegated gate.
|
|
77
77
|
*/
|
|
78
|
-
export declare function requireServiceAccountStanding(scope: unknown, door: string):
|
|
78
|
+
export declare function requireServiceAccountStanding(scope: unknown, door: string): "fleet";
|
|
79
79
|
/**
|
|
80
80
|
* The standing of a VERIFIED bearer context, as an MCP transport attaches it to
|
|
81
81
|
* a request: `isMaster` for the master population, `viaMasterBearer` set only
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-standing.d.ts","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAiB3D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,GACpD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAqBnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,
|
|
1
|
+
{"version":3,"file":"scope-standing.d.ts","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAiB3D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,GACpD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAqBnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAkBnF;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErF,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAO/D"}
|
package/dist/scope-standing.js
CHANGED
|
@@ -108,8 +108,8 @@ export function isServiceAccountScope(scope) {
|
|
|
108
108
|
return scope.masterSource === "service-account";
|
|
109
109
|
}
|
|
110
110
|
/**
|
|
111
|
-
* Returns when the scope is the service account (`isServiceAccountScope`)
|
|
112
|
-
* otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
111
|
+
* Returns `"fleet"` when the scope is the service account (`isServiceAccountScope`),
|
|
112
|
+
* the same literal as `requireFleetStanding`; otherwise throws `IdentityRefusalError` RBAC_DENIED naming `door`:
|
|
113
113
|
* - "scope-not-resolved" the scope is "refused";
|
|
114
114
|
* - "standing-not-allowed" any other standing, the internal opt-in included.
|
|
115
115
|
*
|
|
@@ -123,6 +123,7 @@ export function requireServiceAccountStanding(scope, door) {
|
|
|
123
123
|
if (!isServiceAccountScope(scope)) {
|
|
124
124
|
throw new IdentityRefusalError(refusal("RBAC_DENIED", "standing-not-allowed", door, `Only the fleet service account is allowed here (standing "${standing}").`));
|
|
125
125
|
}
|
|
126
|
+
return "fleet";
|
|
126
127
|
}
|
|
127
128
|
/**
|
|
128
129
|
* The standing of `context`; "refused" for anything that is not a well-formed bearer context.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-standing.js","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1F,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC;QACtD,IAAI,CAAC,CAAC,YAAY,KAAK,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,gBAAgB,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,IAAY,EACZ,OAAqD;IAErD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,aAAa,QAAQ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAY,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnD,OAAQ,KAAoC,CAAC,YAAY,KAAK,iBAAiB,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,6DAA6D,QAAQ,KAAK,CAC3E,CACF,CAAC;IACJ,CAAC;
|
|
1
|
+
{"version":3,"file":"scope-standing.js","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1F,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC;QACtD,IAAI,CAAC,CAAC,YAAY,KAAK,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,gBAAgB,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,IAAY,EACZ,OAAqD;IAErD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,aAAa,QAAQ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAY,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnD,OAAQ,KAAoC,CAAC,YAAY,KAAK,iBAAiB,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,IAAY;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,6DAA6D,QAAQ,KAAK,CAC3E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC;AACvE,CAAC"}
|
package/package.json
CHANGED