@vantageos/cloud-identity 0.9.1 → 0.11.0

package/dist/role-policy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Role policy as DATA: a minimum-role check over a caller-supplied order, and a
+ * role-claim mapping with no package-chosen default.
+ *
+ * The package never knows what roles exist. "admin > editor > viewer" is one
+ * consumer's vocabulary, passed in at the call site; another consumer passes
+ * another. Every absence (no role, unknown role, empty order, no mapping, no
+ * fallback) is a refusal, never a default grant.
+ *
+ * Pure functions: no framework SDK, no I/O.
+ */
+import { type IdentityRefusal } from "./identity-refusal.js";
+export type MinRoleInput = {
+    /** The verified role of the caller. null/undefined/"" is "no role". */
+    role: string | null | undefined;
+    /** The least-privileged role that is admitted. Must appear in `order`. */
+    minimum: string;
+    /**
+     * The caller's ordered role list, MOST privileged FIRST
+     * (e.g. `["admin", "editor", "viewer"]`). No empty list, no duplicates.
+     */
+    order: readonly string[];
+    /** The consumer's own name for the entry point. Defaults to the function name. */
+    door?: string;
+};
+export type MinRoleResult = {
+    ok: true;
+    role: string;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Admit `role` when it is at or above `minimum` in `order`.
+ *
+ * Refuses: an invalid order (empty, duplicated, non-string entries), a
+ * `minimum` outside the order, a missing or unknown role, a role below the
+ * minimum. Matching is exact (no case-folding), and a role is only ever found
+ * by array position, so `"constructor"` or `"__proto__"` are unknown roles.
+ */
+export declare function resolveMinRole(input: MinRoleInput): MinRoleResult;
+/** Throwing form of {@link resolveMinRole}; returns the role, throws `IdentityRefusalError`. */
+export declare function assertMinRole(input: MinRoleInput): string;
+export type MapRoleClaimInput = {
+    /** The raw claim from the verified credential. Only a non-empty string counts. */
+    claim: unknown;
+    /** Claim value -> consumer role. Data supplied by the caller. */
+    mapping: Readonly<Record<string, string>>;
+    /**
+     * The role to use when the claim is absent or not in `mapping`. The package
+     * never picks one: omit it and an absent or unmapped claim is REFUSED.
+     * Supply the least-privileged role you have.
+     */
+    fallback?: string;
+    door?: string;
+};
+export type MapRoleClaimResult = {
+    ok: true;
+    role: string;
+    source: "mapped" | "fallback";
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Map a verified role claim to the consumer's role, with a least-privilege
+ * fallback that the CALLER must name. A claim that is not a string (array,
+ * object, number) is absent, never coerced. Lookup uses own keys only, so a
+ * claim of `"constructor"` is unmapped.
+ */
+export declare function mapRoleClaim(input: MapRoleClaimInput): MapRoleClaimResult;
+//# sourceMappingURL=role-policy.d.ts.map

package/dist/role-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../src/role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAS/B,MAAM,MAAM,YAAY,GAAG;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CA2DjE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAIzD;AAMD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAgDzE"}

package/dist/role-policy.js

@@ -0,0 +1,101 @@
+/**
+ * Role policy as DATA: a minimum-role check over a caller-supplied order, and a
+ * role-claim mapping with no package-chosen default.
+ *
+ * The package never knows what roles exist. "admin > editor > viewer" is one
+ * consumer's vocabulary, passed in at the call site; another consumer passes
+ * another. Every absence (no role, unknown role, empty order, no mapping, no
+ * fallback) is a refusal, never a default grant.
+ *
+ * Pure functions: no framework SDK, no I/O.
+ */
+import { IdentityRefusalError, refusal, } from "./identity-refusal.js";
+const DOOR_MIN = "resolveMinRole";
+const DOOR_MAP = "mapRoleClaim";
+/**
+ * Admit `role` when it is at or above `minimum` in `order`.
+ *
+ * Refuses: an invalid order (empty, duplicated, non-string entries), a
+ * `minimum` outside the order, a missing or unknown role, a role below the
+ * minimum. Matching is exact (no case-folding), and a role is only ever found
+ * by array position, so `"constructor"` or `"__proto__"` are unknown roles.
+ */
+export function resolveMinRole(input) {
+    const door = input.door ?? DOOR_MIN;
+    const { order, role, minimum } = input;
+    const orderValid = Array.isArray(order) &&
+        order.length > 0 &&
+        order.every((r) => typeof r === "string" && r.length > 0) &&
+        new Set(order).size === order.length;
+    if (!orderValid) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-order", door, "The role order must be a non-empty list of distinct role names."),
+        };
+    }
+    const minIndex = order.indexOf(minimum);
+    if (minIndex === -1) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "unknown-minimum-role", door, "The required minimum role is not part of the role order."),
+        };
+    }
+    const roleIndex = typeof role === "string" && role.length > 0 ? order.indexOf(role) : -1;
+    if (roleIndex === -1) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "unknown-role", door, "The caller's role is absent or not part of the role order."),
+        };
+    }
+    if (roleIndex > minIndex) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "role-below-minimum", door, "The caller's role is below the required minimum."),
+        };
+    }
+    return { ok: true, role: order[roleIndex] };
+}
+/** Throwing form of {@link resolveMinRole}; returns the role, throws `IdentityRefusalError`. */
+export function assertMinRole(input) {
+    const result = resolveMinRole(input);
+    if (!result.ok)
+        throw new IdentityRefusalError(result.refusal);
+    return result.role;
+}
+/**
+ * Map a verified role claim to the consumer's role, with a least-privilege
+ * fallback that the CALLER must name. A claim that is not a string (array,
+ * object, number) is absent, never coerced. Lookup uses own keys only, so a
+ * claim of `"constructor"` is unmapped.
+ */
+export function mapRoleClaim(input) {
+    const door = input.door ?? DOOR_MAP;
+    const { claim, mapping, fallback } = input;
+    if (mapping === null || typeof mapping !== "object" || Array.isArray(mapping)) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-mapping", door, "The role mapping must be a plain object of claim to role."),
+        };
+    }
+    const present = typeof claim === "string" && claim.length > 0;
+    if (present && Object.hasOwn(mapping, claim)) {
+        const mapped = mapping[claim];
+        if (typeof mapped === "string" && mapped.length > 0) {
+            return { ok: true, role: mapped, source: "mapped" };
+        }
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-mapping", door, "The role mapping holds a non-string or empty role."),
+        };
+    }
+    if (typeof fallback === "string" && fallback.length > 0) {
+        return { ok: true, role: fallback, source: "fallback" };
+    }
+    return {
+        ok: false,
+        refusal: refusal("RBAC_DENIED", present ? "role-claim-unmapped" : "role-claim-absent", door, present
+            ? "The role claim is not in the mapping and no fallback was supplied."
+            : "No role claim was presented and no fallback was supplied."),
+    };
+}
+//# sourceMappingURL=role-policy.js.map

package/dist/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../src/role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,oBAAoB,EACpB,OAAO,GAER,MAAM,uBAAuB,CAAC;AAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,QAAQ,GAAG,cAAc,CAAC;AAwBhC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEvC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,iEAAiE,CAClE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,0DAA0D,CAC3D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,cAAc,EACd,IAAI,EACJ,4DAA4D,CAC7D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,kDAAkD,CACnD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAW,EAAE,CAAC;AACxD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAwBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,2DAA2D,CAC5D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,oDAAoD,CACrD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,EACrD,IAAI,EACJ,OAAO;YACL,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,2DAA2D,CAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/scope-filter.d.ts

@@ -61,6 +61,13 @@ import type { OAuthCtx } from "./types.js";
  * and pass it BY NAME. It is never inferred from an omitted argument.
  */
 export declare const LEGACY_WILDCARD_CTX: OAuthCtx;
+/**
+ * THE path-boundary rule for namespaces: `namespace` is inside `prefix` when it
+ * equals it, or continues it after a '/'. `team/finance-archive` is NOT inside
+ * `team/finance`. One implementation, used by the read filter and by
+ * `assertNamespaceWrite`, so the two can never drift apart.
+ */
+export declare function namespaceMatchesPrefix(namespace: string, prefix: string): boolean;
 /**
  * Row shape accepted by the scope filter. All fields optional because real
  * Convex documents from list_peers / list_messages / etc. don't all carry both.
@@ -112,6 +119,13 @@ export type GrantFieldDeclaration = readonly string[];
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
+ *
+ * @deprecated Since 0.11.0. A `createdBy` name matched against
+ * `fromAllowList` selects the row, which backend standard R-53 clause 1
+ * forbids: a name never selects or authorises a row. Use
+ * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
+ * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
+ * and is removed in a major release.
  */
 export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
@@ -119,6 +133,12 @@ export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: O
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
@@ -128,6 +148,12 @@ export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAu
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAgBT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -71,6 +71,15 @@ function assertOauthCtx(oauthCtx) {
             "if you deliberately want the pre-0.3.0 legacy-bearer wildcard behaviour.");
     }
 }
+/**
+ * THE path-boundary rule for namespaces: `namespace` is inside `prefix` when it
+ * equals it, or continues it after a '/'. `team/finance-archive` is NOT inside
+ * `team/finance`. One implementation, used by the read filter and by
+ * `assertNamespaceWrite`, so the two can never drift apart.
+ */
+export function namespaceMatchesPrefix(namespace, prefix) {
+    return namespace === prefix || namespace.startsWith(`${prefix}/`);
+}
 /**
  * Returns true when the scope profile grants full, wildcard access.
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
@@ -116,6 +125,13 @@ function grantFieldMatches(value, fromAllowList) {
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
+ *
+ * @deprecated Since 0.11.0. A `createdBy` name matched against
+ * `fromAllowList` selects the row, which backend standard R-53 clause 1
+ * forbids: a name never selects or authorises a row. Use
+ * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
+ * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
+ * and is removed in a major release.
  */
 export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -126,9 +142,7 @@ export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS)
         return true;
     if (namespace) {
         for (const p of oauthCtx.namespaceReadPrefixes) {
-            if (namespace === p)
-                return true;
-            if (namespace.startsWith(`${p}/`))
+            if (namespaceMatchesPrefix(namespace, p))
                 return true;
         }
     }
@@ -144,6 +158,12 @@ export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS)
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -156,6 +176,12 @@ export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export function scopeFilterGet(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/secret-compare-sync.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Synchronous constant-time secret comparison.
+ *
+ * `timingSafeEqual` in `./crypto` is async (it uses Web Crypto for its dummy
+ * work) and takes bytes. A synchronous call site — a plain admin-secret gate,
+ * a framework hook that cannot await — needs a synchronous equivalent. This is
+ * pure JavaScript with no runtime dependency, so it also runs on any edge
+ * runtime. The async comparator is unchanged.
+ *
+ * Constant time here means: the number of loop iterations depends only on the
+ * LONGER input's length, never on where the first difference is. JavaScript
+ * gives no hard timing guarantee; this removes the content-dependent early
+ * exit, which is the leak a naive `===` has.
+ */
+/**
+ * Compare two strings (UTF-8) or byte arrays in constant time with respect to
+ * their content. Always walks the longer length; a length difference is folded
+ * into the result rather than returned early. Any other input type is `false`.
+ */
+export declare function timingSafeEqualSync(a: string | Uint8Array, b: string | Uint8Array): boolean;
+/**
+ * Assert a presented secret equals the configured one. Throws
+ * `IdentityRefusalError` (`CREDENTIAL_REFUSED`) on mismatch. An unset expected
+ * secret (undefined, null, empty) matches NOTHING, not even an empty
+ * presentation: a missing configuration must never open a door. The refusal
+ * carries neither value.
+ */
+export declare function assertSecretSync(presented: string | Uint8Array | null | undefined, expected: string | Uint8Array | null | undefined, door?: string): void;
+//# sourceMappingURL=secret-compare-sync.d.ts.map

package/dist/secret-compare-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-compare-sync.d.ts","sourceRoot":"","sources":["../src/secret-compare-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,GAAG,UAAU,EACtB,CAAC,EAAE,MAAM,GAAG,UAAU,GACrB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,EACjD,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,EAChD,IAAI,SAAqB,GACxB,IAAI,CAyBN"}

package/dist/secret-compare-sync.js

@@ -0,0 +1,64 @@
+/**
+ * Synchronous constant-time secret comparison.
+ *
+ * `timingSafeEqual` in `./crypto` is async (it uses Web Crypto for its dummy
+ * work) and takes bytes. A synchronous call site — a plain admin-secret gate,
+ * a framework hook that cannot await — needs a synchronous equivalent. This is
+ * pure JavaScript with no runtime dependency, so it also runs on any edge
+ * runtime. The async comparator is unchanged.
+ *
+ * Constant time here means: the number of loop iterations depends only on the
+ * LONGER input's length, never on where the first difference is. JavaScript
+ * gives no hard timing guarantee; this removes the content-dependent early
+ * exit, which is the leak a naive `===` has.
+ */
+import { IdentityRefusalError, refusal } from "./identity-refusal.js";
+const encoder = new TextEncoder();
+function toBytes(value) {
+    if (typeof value === "string")
+        return encoder.encode(value);
+    if (value instanceof Uint8Array)
+        return value;
+    return null;
+}
+/**
+ * Compare two strings (UTF-8) or byte arrays in constant time with respect to
+ * their content. Always walks the longer length; a length difference is folded
+ * into the result rather than returned early. Any other input type is `false`.
+ */
+export function timingSafeEqualSync(a, b) {
+    const x = toBytes(a);
+    const y = toBytes(b);
+    if (x === null || y === null)
+        return false;
+    const xl = x.length;
+    const yl = y.length;
+    const max = xl > yl ? xl : yl;
+    let diff = xl ^ yl;
+    for (let i = 0; i < max; i++) {
+        const xi = i < xl ? x[i] : 0;
+        const yi = i < yl ? y[i] : 0;
+        diff |= xi ^ yi;
+    }
+    return diff === 0;
+}
+/**
+ * Assert a presented secret equals the configured one. Throws
+ * `IdentityRefusalError` (`CREDENTIAL_REFUSED`) on mismatch. An unset expected
+ * secret (undefined, null, empty) matches NOTHING, not even an empty
+ * presentation: a missing configuration must never open a door. The refusal
+ * carries neither value.
+ */
+export function assertSecretSync(presented, expected, door = "assertSecretSync") {
+    const expectedBytes = toBytes(expected);
+    if (expectedBytes === null || expectedBytes.length === 0) {
+        throw new IdentityRefusalError(refusal("CREDENTIAL_REFUSED", "secret-not-configured", door, "No secret is configured for this entry point, so nothing can match."));
+    }
+    const presentedBytes = toBytes(presented) ?? new Uint8Array(0);
+    // Compare even when presented is empty so the work does not depend on it.
+    const equal = timingSafeEqualSync(presentedBytes, expectedBytes);
+    if (!equal || presentedBytes.length === 0) {
+        throw new IdentityRefusalError(refusal("CREDENTIAL_REFUSED", "secret-mismatch", door, "The presented secret does not match."));
+    }
+}
+//# sourceMappingURL=secret-compare-sync.js.map

package/dist/secret-compare-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-compare-sync.js","sourceRoot":"","sources":["../src/secret-compare-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,CAAsB,EACtB,CAAsB;IAEtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiD,EACjD,QAAgD,EAChD,IAAI,GAAG,kBAAkB;IAEzB,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,oBAAoB,EACpB,uBAAuB,EACvB,IAAI,EACJ,qEAAqE,CACtE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,MAAM,KAAK,GAAG,mBAAmB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,oBAAoB,EACpB,iBAAiB,EACjB,IAAI,EACJ,sCAAsC,CACvC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tenant-membership.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Membership resolution, row-in-tenant visibility and the org-admin proof.
+ *
+ * The package cannot query a datastore, so the membership read is an INJECTED
+ * async lookup. Everything that can be got wrong stays here: a throwing lookup,
+ * a miss, an inactive row, a row of the wrong shape and a row that names a
+ * different organisation are all refusals. Nothing in this module returns a
+ * grant on an error path.
+ *
+ * Identifiers are OPAQUE and compared byte-for-byte: no trimming, no case
+ * folding, and never a slug compared against an id (supply the same kind of
+ * identifier on both sides).
+ */
+import { z } from "zod";
+import { type IdentityRefusal } from "./identity-refusal.js";
+/**
+ * True only when the row is stamped with an organisation, the caller has one,
+ * and the two are strictly equal. An unstamped row is NEVER visible, including
+ * to a caller that also has no organisation (absence equals absence is not a
+ * match).
+ */
+export declare function isRowInTenant(input: {
+    rowOrgId: string | null | undefined;
+    callerOrgId: string | null | undefined;
+}): boolean;
+/**
+ * What the consumer's lookup returns for (subject, organisation).
+ * `orgId`, when the row carries it, is re-checked here so a loose lookup (a
+ * prefix match, a wrong index) cannot become a membership in another org.
+ */
+export declare const membershipRecordSchema: z.ZodObject<{
+    active: z.ZodBoolean;
+    role: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type MembershipRecord = z.infer<typeof membershipRecordSchema>;
+export type ResolvedMembership = {
+    subject: string;
+    orgId: string;
+    /** The role the record carries, or null when it carries none. */
+    role: string | null;
+};
+export type ResolveMembershipInput = {
+    /** The verified subject. Never a client-supplied argument. */
+    subject: string;
+    /** The verified organisation id. */
+    orgId: string;
+    /** Indexed read of one membership. Return null/undefined on a miss. */
+    lookup: (subject: string, orgId: string) => Promise<MembershipRecord | null | undefined> | MembershipRecord | null | undefined;
+    door?: string;
+};
+export type ResolveMembershipResult = {
+    ok: true;
+    membership: ResolvedMembership;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Resolve the membership of a verified subject in a verified organisation via
+ * the injected `lookup`. Only `active === true` on a well-shaped record that
+ * names no other organisation is served. The lookup's own error text is never
+ * surfaced.
+ */
+export declare function resolveMembership(input: ResolveMembershipInput): Promise<ResolveMembershipResult>;
+export type RequireOrgAdminInput = {
+    /** The organisation the credential was VERIFIED for (a verified claim). */
+    verifiedOrgId: string | null | undefined;
+    /** The organisation the action is aimed at. Must equal `verifiedOrgId`. */
+    targetOrgId: string | null | undefined;
+    /** The caller's verified role. */
+    role: string | null | undefined;
+    /** Roles that count as organisation admin: data, supplied by the consumer. */
+    adminRoles: readonly string[];
+    door?: string;
+};
+/**
+ * An org-admin proof is bound to the caller's own verified organisation: the
+ * target must equal it, and the role must be one of `adminRoles`. Being an
+ * admin somewhere is not being an admin of the target. Throws
+ * `IdentityRefusalError`; returns nothing when served. An empty `adminRoles`
+ * admits nobody.
+ */
+export declare function requireOrgAdmin(input: RequireOrgAdminInput): void;
+//# sourceMappingURL=tenant-membership.d.ts.map

package/dist/tenant-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-membership.d.ts","sourceRoot":"","sources":["../src/tenant-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAU/B;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACxC,GAAG,OAAO,CAGV;AAMD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA4ClC;AAMD,MAAM,MAAM,oBAAoB,GAAG;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,kCAAkC;IAClC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAmBjE"}

package/dist/tenant-membership.js

@@ -0,0 +1,113 @@
+/**
+ * Membership resolution, row-in-tenant visibility and the org-admin proof.
+ *
+ * The package cannot query a datastore, so the membership read is an INJECTED
+ * async lookup. Everything that can be got wrong stays here: a throwing lookup,
+ * a miss, an inactive row, a row of the wrong shape and a row that names a
+ * different organisation are all refusals. Nothing in this module returns a
+ * grant on an error path.
+ *
+ * Identifiers are OPAQUE and compared byte-for-byte: no trimming, no case
+ * folding, and never a slug compared against an id (supply the same kind of
+ * identifier on both sides).
+ */
+import { z } from "zod";
+import { IdentityRefusalError, refusal, } from "./identity-refusal.js";
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+// ---------------------------------------------------------------------------
+// Row in tenant
+// ---------------------------------------------------------------------------
+/**
+ * True only when the row is stamped with an organisation, the caller has one,
+ * and the two are strictly equal. An unstamped row is NEVER visible, including
+ * to a caller that also has no organisation (absence equals absence is not a
+ * match).
+ */
+export function isRowInTenant(input) {
+    const { rowOrgId, callerOrgId } = input;
+    return nonEmpty(rowOrgId) && nonEmpty(callerOrgId) && rowOrgId === callerOrgId;
+}
+// ---------------------------------------------------------------------------
+// Membership
+// ---------------------------------------------------------------------------
+/**
+ * What the consumer's lookup returns for (subject, organisation).
+ * `orgId`, when the row carries it, is re-checked here so a loose lookup (a
+ * prefix match, a wrong index) cannot become a membership in another org.
+ */
+export const membershipRecordSchema = z.object({
+    active: z.boolean(),
+    role: z.string().nullish(),
+    orgId: z.string().nullish(),
+});
+function deny(reason, door, detail) {
+    return { ok: false, refusal: refusal("RBAC_DENIED", reason, door, detail) };
+}
+/**
+ * Resolve the membership of a verified subject in a verified organisation via
+ * the injected `lookup`. Only `active === true` on a well-shaped record that
+ * names no other organisation is served. The lookup's own error text is never
+ * surfaced.
+ */
+export async function resolveMembership(input) {
+    const door = input.door ?? "resolveMembership";
+    if (typeof input?.lookup !== "function") {
+        // A programming error in the consumer, not a claim about any caller.
+        throw new TypeError("resolveMembership: lookup must be a function.");
+    }
+    const { subject, orgId, lookup } = input;
+    if (!nonEmpty(subject) || !nonEmpty(orgId)) {
+        return deny("membership-invalid-input", door, "A verified subject and a verified organisation are both required.");
+    }
+    let record;
+    try {
+        record = await lookup(subject, orgId);
+    }
+    catch {
+        return deny("membership-lookup-failed", door, "The membership could not be read, so none is granted.");
+    }
+    if (record === null || record === undefined) {
+        return deny("membership-not-found", door, "No membership for this subject in this organisation.");
+    }
+    const parsed = membershipRecordSchema.safeParse(record);
+    if (!parsed.success) {
+        return deny("membership-record-invalid", door, "The membership record is not well formed.");
+    }
+    const row = parsed.data;
+    if (nonEmpty(row.orgId) && row.orgId !== orgId) {
+        return deny("other-organisation", door, "The membership belongs to another organisation.");
+    }
+    if (row.active !== true) {
+        return deny("membership-inactive", door, "The membership is not active.");
+    }
+    return {
+        ok: true,
+        membership: { subject, orgId, role: nonEmpty(row.role) ? row.role : null },
+    };
+}
+/**
+ * An org-admin proof is bound to the caller's own verified organisation: the
+ * target must equal it, and the role must be one of `adminRoles`. Being an
+ * admin somewhere is not being an admin of the target. Throws
+ * `IdentityRefusalError`; returns nothing when served. An empty `adminRoles`
+ * admits nobody.
+ */
+export function requireOrgAdmin(input) {
+    const door = input.door ?? "requireOrgAdmin";
+    const { verifiedOrgId, targetOrgId, role, adminRoles } = input;
+    const fail = (reason, detail) => {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", reason, door, detail));
+    };
+    if (!nonEmpty(verifiedOrgId)) {
+        fail("no-verified-organisation", "The caller has no verified organisation.");
+    }
+    if (!nonEmpty(targetOrgId) || targetOrgId !== verifiedOrgId) {
+        fail("other-organisation", "The target organisation is not the caller's verified organisation.");
+    }
+    if (!nonEmpty(role) || !Array.isArray(adminRoles) || !adminRoles.includes(role)) {
+        fail("role-not-admin", "The caller's role is not an organisation-admin role.");
+    }
+}
+//# sourceMappingURL=tenant-membership.js.map

package/dist/tenant-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-membership.js","sourceRoot":"","sources":["../src/tenant-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,OAAO,GAER,MAAM,uBAAuB,CAAC;AAE/B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAG7B;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,WAAW,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AA4BH,SAAS,IAAI,CACX,MAAqC,EACrC,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,mBAAmB,CAAC;IAC/C,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,qEAAqE;QACrE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CACT,0BAA0B,EAC1B,IAAI,EACJ,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,0BAA0B,EAC1B,IAAI,EACJ,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,sBAAsB,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,2BAA2B,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,IAAI,EAAE,iDAAiD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KAC3E,CAAC;AACJ,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC7C,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACP,EAAE;QACT,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,oEAAoE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}