@vercel/board 0.29.0 → 0.31.0

package/dist/access-CY5xVMIK.mjs

@@ -0,0 +1,242 @@
+import { c as ChannelPath, v as SCOPE_MAX } from "./schemas-DBmUO6pr.mjs";
+import { a as forbidden } from "./errors-CJXhhzvT.mjs";
+//#region src/server/access.ts
+/**
+* What a principal may do in a channel. `read` covers messages, threads,
+* `/events`, and schedules; `post` starts threads and edits your own messages;
+* `manage` is the board's own bookkeeping (inbox, sources).
+*/
+const PERMISSIONS = [
+	"read",
+	"post",
+	"react",
+	"label",
+	"sync",
+	"manage"
+];
+/**
+* One hop of implication, kept as data like Vercel's git broker
+* (`ACTION_IMPLICATIONS`). Each verb that addresses a message by ID implies
+* `read`, so none of them is a blind existence oracle. `post` implies nothing:
+* write-only is `['post']`.
+*/
+const IMPLIES = {
+	read: [],
+	post: [],
+	react: ["read"],
+	label: ["read"],
+	sync: ["read"],
+	manage: [
+		"read",
+		"post",
+		"react",
+		"label",
+		"sync"
+	]
+};
+const ORDER = new Map(PERMISSIONS.map((permission, index) => [permission, index]));
+const SHAPE = "write *, a channel, or a channel and its subtree (feedback/)";
+/** A pattern's parts; any other `*` throws, and says what to type instead. */
+function parsePattern(pattern) {
+	if (pattern === "*") return { kind: "all" };
+	if (pattern.includes("*")) {
+		const before = pattern.slice(0, pattern.indexOf("*")).replace(/\/+$/, "");
+		const hint = before === "" ? "write * for every channel" : ChannelPath.safeParse(before).success ? `write ${before}/ for ${before} and its subtree` : SHAPE;
+		throw new Error(`invalid channel pattern ${pattern}: ${hint}`);
+	}
+	const subtree = pattern.endsWith("/");
+	const path = subtree ? pattern.slice(0, -1) : pattern;
+	if (!ChannelPath.safeParse(path).success) throw new Error(`invalid channel pattern ${pattern || "(empty)"}: ${SHAPE}`);
+	return subtree ? {
+		kind: "subtree",
+		path
+	} : {
+		kind: "exact",
+		path
+	};
+}
+const key = (pattern) => pattern.kind === "all" ? "*" : pattern.kind === "subtree" ? `${pattern.path}/` : pattern.path;
+/** A grant with its implications, closed: `['label']` is `read` and `label`. */
+function expand(grant) {
+	const out = /* @__PURE__ */ new Set();
+	const add = (permission) => {
+		if (!ORDER.has(permission)) throw new Error(`unknown permission ${String(permission)}: use ${PERMISSIONS.join(", ")}`);
+		if (out.has(permission)) return;
+		out.add(permission);
+		for (const implied of IMPLIES[permission]) add(implied);
+	};
+	for (const permission of grant === "all" ? PERMISSIONS : grant) add(permission);
+	return out;
+}
+const NOTHING = /* @__PURE__ */ new Set();
+function compile(entries) {
+	let all = null;
+	const exact = /* @__PURE__ */ new Map();
+	const subtrees = [];
+	for (const [pattern, permissions] of entries) if (pattern.kind === "all") all = permissions;
+	else if (pattern.kind === "exact") exact.set(pattern.path, permissions);
+	else subtrees.push([pattern.path, permissions]);
+	subtrees.sort((a, b) => b[0].length - a[0].length);
+	return {
+		all,
+		exact,
+		subtrees
+	};
+}
+const under = (channel, path) => channel === path || channel.startsWith(`${path}/`);
+/** What the most specific pattern covering `channel` gives; with `subtreeOnly`, ignoring an exact rule for it. */
+function resolve(rules, channel, subtreeOnly = false) {
+	if (!subtreeOnly) {
+		const exact = rules.exact.get(channel);
+		if (exact) return exact;
+	}
+	for (const [path, permissions] of rules.subtrees) if (under(channel, path)) return permissions;
+	return rules.all ?? NOTHING;
+}
+/**
+* What `rules` gives every channel `pattern` governs where nothing more
+* specific does. The patterns matching one channel form a chain, so that's one
+* answer: an exact channel resolves as itself, a subtree as whatever covers the
+* subtree's root, ignoring an exact rule for the root.
+*/
+const at = (rules, pattern) => pattern.kind === "all" ? rules.all ?? NOTHING : resolve(rules, pattern.path, pattern.kind === "subtree");
+const equal = (a, b) => a.size === b.size && [...a].every((permission) => b.has(permission));
+/** The answer of the pattern next less specific than `pattern` in `rules`. */
+function parent(rules, pattern) {
+	if (pattern.kind === "exact") return resolve(rules, pattern.path, true);
+	if (pattern.kind === "subtree") {
+		for (const [path, permissions] of rules.subtrees) if (path !== pattern.path && under(pattern.path, path)) return permissions;
+	}
+	return rules.all ?? NOTHING;
+}
+/** Drops rules that say what their parent says, and an empty `*`, so equal access has one summary. */
+function canonical(entries) {
+	const rules = compile(entries);
+	return compile(entries.filter(([pattern, permissions]) => pattern.kind === "all" ? permissions.size > 0 : !equal(permissions, parent(rules, pattern))));
+}
+function entriesOf(can) {
+	if (can === "all" || Array.isArray(can)) return [[{ kind: "all" }, expand(can)]];
+	return Object.entries(can).map(([pattern, grant]) => [parsePattern(pattern), expand(grant)]);
+}
+const entriesIn = (rules) => [
+	...rules.all ? [[{ kind: "all" }, rules.all]] : [],
+	...rules.subtrees.map(([path, permissions]) => [{
+		kind: "subtree",
+		path
+	}, permissions]),
+	...[...rules.exact].map(([path, permissions]) => [{
+		kind: "exact",
+		path
+	}, permissions])
+];
+const RULES = Symbol("board.access");
+const isAccess = (value) => typeof value === "object" && RULES in value;
+function fromRules(rules) {
+	const entries = entriesIn(rules);
+	const everywhere = (permission) => (rules.all?.has(permission) ?? false) && entries.every(([, permissions]) => permissions.has(permission));
+	const readable = /* @__PURE__ */ new Map();
+	const compiled = {
+		[RULES]: rules,
+		can: (permission, channel) => resolve(rules, channel).has(permission),
+		readable(channel) {
+			let found = readable.get(channel);
+			if (found === void 0) readable.set(channel, found = resolve(rules, channel).has("read"));
+			return found;
+		},
+		readsAll: everywhere("read"),
+		everywhere,
+		anywhere: (permission) => entries.some(([, permissions]) => permissions.has(permission)),
+		narrow(scope) {
+			const other = isAccess(scope) ? scope[RULES] : canonical(entriesOf(scope));
+			const patterns = /* @__PURE__ */ new Map([["*", { kind: "all" }]]);
+			for (const [pattern] of [...entries, ...entriesIn(other)]) patterns.set(key(pattern), pattern);
+			return fromRules(canonical([...patterns.values()].map((pattern) => {
+				const theirs = at(other, pattern);
+				return [pattern, new Set([...at(rules, pattern)].filter((permission) => theirs.has(permission)))];
+			})));
+		},
+		summary() {
+			const named = entries.map(([pattern, permissions]) => [key(pattern), permissions]);
+			named.sort(([a], [b]) => a === "*" ? -1 : b === "*" ? 1 : a.localeCompare(b));
+			const out = {};
+			for (const [name, permissions] of named) out[name] = [...permissions].sort((a, b) => ORDER.get(a) - ORDER.get(b));
+			return out;
+		}
+	};
+	return Object.freeze(compiled);
+}
+/** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
+function compileAccess(can) {
+	return fromRules(canonical(entriesOf(can)));
+}
+const FULL_ACCESS = compileAccess("all");
+const NO_ACCESS = compileAccess([]);
+/** What any of `accesses` allows, channel by channel: grants that match one principal add up. */
+function union(accesses) {
+	const all = accesses.filter(isAccess);
+	if (all.length === 0) return NO_ACCESS;
+	const rules = all.map((access) => access[RULES]);
+	const patterns = /* @__PURE__ */ new Map([["*", { kind: "all" }]]);
+	for (const side of rules) for (const [pattern] of entriesIn(side)) patterns.set(key(pattern), pattern);
+	return fromRules(canonical([...patterns.values()].map((pattern) => [pattern, new Set(rules.flatMap((side) => [...at(side, pattern)]))])));
+}
+/** An access as `x-board-scope` writes it, `dev/=read,post;ci/=read`, or `*=` for nothing: what a stored principal keeps. */
+function scopeOf(access) {
+	const entries = Object.entries(access.summary()).map(([pattern, permissions]) => `${pattern}=${permissions.join(",")}`);
+	return entries.length > 0 ? entries.join(";") : "*=";
+}
+/**
+* `x-board-scope`: `dev/=read,post,react,label;ci/=read`. Each entry is a
+* pattern and its permissions (or `all`). It's meant for a proxy that holds the
+* credential, like Pi's sandbox: the board intersects it with the principal's
+* access, so it can only narrow, and a caller holding its own token gains
+* nothing by sending it.
+*/
+function parseScope(header) {
+	if (header.length > 4e3) throw new Error(`x-board-scope is longer than ${SCOPE_MAX} characters`);
+	const out = {};
+	const entries = header.split(";").map((entry) => entry.trim());
+	if (entries.every((entry) => entry === "")) throw new Error("x-board-scope is empty: write pattern=permissions, like dev/=read,post");
+	for (const entry of entries) {
+		if (entry === "") continue;
+		const split = entry.indexOf("=");
+		if (split < 0) throw new Error(`x-board-scope entry ${entry} needs =: write pattern=permissions, like dev/=read,post`);
+		const pattern = entry.slice(0, split).trim();
+		const list = entry.slice(split + 1).trim();
+		if (Object.hasOwn(out, pattern)) throw new Error(`x-board-scope lists ${pattern} twice`);
+		parsePattern(pattern);
+		const permissions = list === "" ? [] : list.split(",").map((permission) => permission.trim());
+		if (permissions.length === 1 && permissions[0] === "all") {
+			out[pattern] = "all";
+			continue;
+		}
+		for (const permission of permissions) if (!ORDER.has(permission)) throw new Error(`x-board-scope: unknown permission ${permission || "(empty)"}: use ${PERMISSIONS.join(", ")}, or all`);
+		out[pattern] = permissions;
+	}
+	return out;
+}
+const PHRASE = {
+	read: (channel) => `read ${channel}`,
+	post: (channel) => `post in ${channel}`,
+	react: (channel) => `react in ${channel}`,
+	label: (channel) => `label in ${channel}`,
+	sync: (channel) => `sync in ${channel}`,
+	manage: (channel) => `manage ${channel}`
+};
+/**
+* A proof that `access` allows `permission` in `channel`, or a 403 naming what's
+* missing: `this token can't label in dev`. Pass the channel the board looked
+* up, never one the request named. What the caller can't read should answer as
+* if it didn't exist: pass that error as `hidden`, and it's thrown instead
+* whenever `channel` isn't readable.
+*/
+function authorize(access, permission, channel, hidden) {
+	if (hidden && !access.readable(channel)) throw hidden();
+	if (!access.can(permission, channel)) throw forbidden(`this token can't ${PHRASE[permission](channel)}`);
+	return Object.freeze({
+		permission,
+		channel
+	});
+}
+//#endregion
+export { scopeOf as a, parseScope as i, authorize as n, union as o, compileAccess as r, FULL_ACCESS as t };

package/dist/{access-CV96SYgr.d.mts → access-DPcrKIH_.d.mts}

@@ -28,5 +28,10 @@ type Access = {
   /** Each pattern and its permissions, `*` first and the rest sorted; an empty `*` is left out. */
   summary(): AccessSummary;
 };
+/** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
+declare function compileAccess(can: Can): Access;
+declare const FULL_ACCESS: Access;
+/** What any of `accesses` allows, channel by channel: grants that match one principal add up. */
+declare function union(accesses: readonly Access[]): Access;
 //#endregion
-export { Grant as a, ChannelPattern as i, AccessSummary as n, Permission as o, Can as r, Access as t };
+export { FULL_ACCESS as a, compileAccess as c, ChannelPattern as i, union as l, AccessSummary as n, Grant as o, Can as r, Permission as s, Access as t };

package/dist/access.d.mts

@@ -1,6 +1,6 @@
-import { a as Grant, i as ChannelPattern, n as AccessSummary, o as Permission, r as Can, t as Access } from "./access-CV96SYgr.mjs";
-import { _ as oidc, a as CallerRequest, c as HostPrincipal, d as OidcTokensOptions, f as Principal, g as githubActions, h as compileRules, i as AuthenticateContext, l as IssuerConfig, m as RuleFunction, n as AccessRule, o as Claims, p as PrincipalKind, r as Authenticate, t as AccessFunction, u as Known, v as vercelProject } from "./auth-CU56Q2Xh.mjs";
-import { C as Author, t as Actor } from "./folds-ZkHM4M-v.mjs";
+import { a as FULL_ACCESS, c as compileAccess, i as ChannelPattern, l as union, n as AccessSummary, o as Grant, r as Can, s as Permission, t as Access } from "./access-DPcrKIH_.mjs";
+import { a as CallerRequest, b as oidc, d as Known, f as OidcTokensOptions, g as RuleFunction, h as PrincipalKind, i as AuthenticateContext, l as HostPrincipal, m as Principal, n as AccessRule, o as Claims, r as Authenticate, s as DEFAULT_CAN, t as AccessFunction, u as IssuerConfig, v as compileRules, x as vercelProject, y as githubActions } from "./auth-DLYSt_-A.mjs";
+import { C as Author, t as Actor } from "./folds-DLUzfibJ.mjs";
 //#region src/server/tokens.d.ts
 /**
  * The OIDC tokens made out to this board: a request's bearer token, from Vercel (people and
@@ -26,4 +26,4 @@ type ResolvedActor = {
  */
 export declare function resolveActor(principal: Principal, claims: Claims, audience: string): ResolvedActor;
 //#endregion
-export { type Access, type AccessFunction, type AccessRule, type AccessSummary, type Authenticate, type AuthenticateContext, type CallerRequest, type Can, type ChannelPattern, type Claims, type Grant, type HostPrincipal, type IssuerConfig, type Known, type OidcTokensOptions, type Permission, type Principal, type PrincipalKind, type RuleFunction, compileRules, githubActions, oidc, vercelProject };
+export { type Access, type AccessFunction, type AccessRule, type AccessSummary, type Authenticate, type AuthenticateContext, type CallerRequest, type Can, type ChannelPattern, type Claims, DEFAULT_CAN, FULL_ACCESS, type Grant, type HostPrincipal, type IssuerConfig, type Known, type OidcTokensOptions, type Permission, type Principal, type PrincipalKind, type RuleFunction, compileAccess, compileRules, githubActions, oidc, union, vercelProject };

package/dist/access.mjs

@@ -1,4 +1,5 @@
-import { a as compileRules, c as githubActions, h as vercelProject, p as oidc } from "./auth-JO22iIwr.mjs";
-import { i as resolveActor } from "./actors-DcJhFbwJ.mjs";
-import { t as oidcTokens } from "./tokens-CC3izSNr.mjs";
-export { compileRules, githubActions, oidc, oidcTokens, resolveActor, vercelProject };
+import { o as union, r as compileAccess, t as FULL_ACCESS } from "./access-CY5xVMIK.mjs";
+import { i as resolveActor } from "./actors-Bm-ojWWT.mjs";
+import { _ as oidc, c as compileRules, d as githubActions, n as DEFAULT_CAN, x as vercelProject } from "./auth-CyO2aw5n.mjs";
+import { t as oidcTokens } from "./tokens-Dnyd_y1n.mjs";
+export { DEFAULT_CAN, FULL_ACCESS, compileAccess, compileRules, githubActions, oidc, oidcTokens, resolveActor, union, vercelProject };

package/dist/{actors-DcJhFbwJ.mjs → actors-Bm-ojWWT.mjs}

@@ -1,8 +1,8 @@
 import { C as toStorable } from "./schemas-DBmUO6pr.mjs";
-import { r as badRequest } from "./errors-CusN4x2l.mjs";
+import { r as badRequest } from "./errors-CJXhhzvT.mjs";
+import { i as parseScope } from "./access-CY5xVMIK.mjs";
 import { t as own } from "./own-OwgPWdmh.mjs";
 import { t as extractMentions } from "./mentions-CB6ShY4R.mjs";
-import { y as parseScope } from "./auth-JO22iIwr.mjs";
 //#region src/server/actors.ts
 /** Agents whose avatars the board serves itself. */
 const KNOWN_AGENTS = [