@voltro/protocol 0.11.4 → 0.13.0

package/dist/rest.d.ts

@@ -425,6 +425,18 @@ declare interface QueryProcedureDescriptor<Name extends string, Input extends Sc
     readonly exposeAsTool: ExposeAsTool | undefined;
 }
 
+/**
+ * Passes when the subject holds ANY of `scopes` (or `admin:full`).
+ *
+ * For a route whose permitted callers differ by REQUEST SHAPE rather than by
+ * route — issuing an api key for yourself, for the org, or on behalf of someone
+ * else are three different rights on one endpoint. The guard establishes "may
+ * mint something"; the handler decides which, because only the body says which
+ * was asked for. Splitting them into three routes instead would move a decision
+ * that depends on the body into the URL, where a client could pick.
+ */
+export declare const requireAnyScope: (scopes: ReadonlyArray<string>) => RestGuard;
+
 /**
  * Guard that requires the resolved subject to carry `scope`. Anonymous /
  * scope-less subjects are rejected with `403`. The blanket admin scope

package/dist/rest.js

@@ -1,20 +1,20 @@
-import { a as e, i as t, o as n, r, t as i } from "./serverErrorBus-B3hDwGoL.js";
-import { s as a } from "./auth-DCE6m7Bo.js";
+import { a as e, i as t, o as n, r, t as i } from "./serverErrorBus-DhIVDkCi.js";
+import { s as a } from "./auth-DVrHg739.js";
 import { Effect as o, Schema as s } from "effect";
 //#region src/publicApi.ts
 var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.path ?? `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`, u = (e, t, n) => {
 	let r = e.publicApi;
 	if (r === void 0) throw Error(`publicApiRoute: descriptor '${e.name}' has no publicApi annotation`);
-	let i = c(e.kind, r), a = l(e.name, r), o = i === "GET" ? "query" : "body", u = s.Struct({ [o]: e.input }), d = (r.scopes ?? []).map((e) => f(e)), g = r.stream === "sse" && e.kind === "query" && n !== void 0, _ = g ? (e, t) => m((r) => n(e[o], t, (e) => {
-		r(h(String(e._tag ?? "message"), e));
+	let i = c(e.kind, r), a = l(e.name, r), o = i === "GET" ? "query" : "body", u = s.Struct({ [o]: e.input }), d = (r.scopes ?? []).map((e) => f(e)), p = r.stream === "sse" && e.kind === "query" && n !== void 0, _ = p ? (e, t) => h((r) => n(e[o], t, (e) => {
+		r(g(String(e._tag ?? "message"), e));
 	})) : (e, n) => t(e[o], n);
-	return p({
+	return m({
 		method: i,
 		path: a,
 		input: u,
 		output: e.output,
 		handler: _,
-		...g ? { streaming: !0 } : {},
+		...p ? { streaming: !0 } : {},
 		...d.length > 0 ? { guards: d } : {},
 		...r.summary === void 0 ? {} : { summary: r.summary },
 		...r.description === void 0 ? {} : { description: r.description },
@@ -27,26 +27,32 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 		status: 403,
 		message: `Missing required scope: ${e}`
 	};
-}, p = (e) => e, m = (e, t = {}) => ({
+}, p = (e) => (t) => {
+	let n = t.subject.scopes;
+	if (!(n && (n.includes("admin:full") || e.some((e) => n.includes(e))))) return {
+		status: 403,
+		message: `Missing required scope: one of ${e.join(", ")}`
+	};
+}, m = (e) => e, h = (e, t = {}) => ({
 	__voltroRestStream: !0,
 	stream: {
 		subscribe: e,
 		...t.keepAliveMs === void 0 ? {} : { keepAliveMs: t.keepAliveMs }
 	}
-}), h = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, g = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, _ = (e, t, n) => ({
+}), g = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, _ = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, v = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), v = (e) => {
+}), y = (e) => {
 	if (e.length === 0) return;
 	let t = new TextDecoder().decode(e);
 	if (t.trim() !== "") return JSON.parse(t);
-}, y = (e) => {
+}, b = (e) => {
 	let t = {};
 	for (let [n, r] of new URLSearchParams(e)) t[n] = r;
 	return t;
-}, b = (e, t) => {
+}, x = (e, t) => {
 	let n = e.split("/").filter((e) => e.length > 0), r = t.split("/").filter((e) => e.length > 0), i = {};
 	for (let e = 0; e < n.length; e++) {
 		let t = n[e];
@@ -60,22 +66,22 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 		}
 	}
 	return i;
-}, x = (e, t) => ({
-	query: y(e.query),
+}, S = (e, t) => ({
+	query: b(e.query),
 	params: t,
-	body: v(e.rawBody)
-}), S = /* @__PURE__ */ new Set([
+	body: y(e.rawBody)
+}), C = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",
 	"DELETE"
-]), C = (c, l) => {
+]), w = (c, l) => {
 	let u = c.input ? s.decodeUnknown(c.input) : void 0, d = s.encode(c.output), f = {};
 	return c.deprecated !== void 0 && (f.Deprecation = "true"), c.sunset !== void 0 && (f.Sunset = c.sunset), {
 		method: "*",
 		path: c.path,
 		handle: async (s) => {
-			if (s.method.toUpperCase() !== c.method) return _(405, {
+			if (s.method.toUpperCase() !== c.method) return v(405, {
 				error: "Method Not Allowed",
 				allow: c.method
 			}, {
@@ -84,21 +90,21 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 			});
 			if (c.sunset !== void 0) {
 				let e = Date.parse(c.sunset);
-				if (!Number.isNaN(e) && Date.now() >= e) return _(410, {
+				if (!Number.isNaN(e) && Date.now() >= e) return v(410, {
 					error: "Gone",
 					...c.deprecated === void 0 ? {} : { replacement: c.deprecated }
 				}, f);
 			}
 			let p;
 			if (u) {
-				let e = x(s, b(c.path, s.path)), t = await o.runPromise(u(e).pipe(o.map((e) => ({
+				let e = S(s, x(c.path, s.path)), t = await o.runPromise(u(e).pipe(o.map((e) => ({
 					ok: !0,
 					value: e
 				})), o.catchAll((e) => o.succeed({
 					ok: !1,
 					cause: e
 				}))));
-				if (!t.ok) return _(400, {
+				if (!t.ok) return v(400, {
 					error: "Invalid request",
 					detail: String(t.cause)
 				}, f);
@@ -111,47 +117,47 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 			};
 			if (c.guards) for (let e of c.guards) {
 				let t = await e(h);
-				if (t) return _(t.status, { error: t.message }, f);
+				if (t) return v(t.status, { error: t.message }, f);
 			}
-			let v = l.idempotency, y = v && S.has(c.method) ? s.headers[v.header.toLowerCase()] : void 0, C = v && y ? n(m.tenantId, c.method, c.path) : "";
-			if (v && y) {
-				let e = await r(v.store, C, y, v.ttlMs, Date.now());
-				if (e.kind === "replay") return _(e.response.status, e.response.body, {
+			let g = l.idempotency, y = g && C.has(c.method) ? s.headers[g.header.toLowerCase()] : void 0, b = g && y ? n(m.tenantId, c.method, c.path) : "";
+			if (g && y) {
+				let e = await r(g.store, b, y, g.ttlMs, Date.now());
+				if (e.kind === "replay") return v(e.response.status, e.response.body, {
 					...f,
 					"Idempotency-Replayed": "true"
 				});
-				if (e.kind === "conflict") return _(409, { error: "A request with this Idempotency-Key is already being processed" }, f);
+				if (e.kind === "conflict") return v(409, { error: "A request with this Idempotency-Key is already being processed" }, f);
 			}
 			try {
 				let t = await c.handler(p, h);
-				if (g(t)) return {
+				if (_(t)) return {
 					status: 200,
 					headers: f,
 					stream: t.stream
 				};
 				let n = await o.runPromise(d(t));
-				return v && y && await e(v.store, C, y, {
+				return g && y && await e(g.store, b, y, {
 					status: 200,
 					body: n
-				}, Date.now()), _(200, n, f);
+				}, Date.now()), v(200, n, f);
 			} catch (e) {
-				if (v && y && await t(v.store, C, y), typeof e == "object" && e && typeof e.status == "number") {
+				if (g && y && await t(g.store, b, y), typeof e == "object" && e && typeof e.status == "number") {
 					let t = e;
-					return _(t.status, { error: t.message ?? "Error" }, f);
+					return v(t.status, { error: t.message ?? "Error" }, f);
 				}
 				return i({
 					error: e,
 					source: "rest",
 					name: `${c.method} ${c.path}`,
 					fields: { status: 500 }
-				}), _(500, { error: "Internal Server Error" }, f);
+				}), v(500, { error: "Internal Server Error" }, f);
 			}
 		}
 	};
-}, w = (e, t = {}) => e.map((e) => C(e, t)), T = async (e, t) => {
+}, T = (e, t = {}) => e.map((e) => w(e, t)), E = async (e, t) => {
 	let n = await e[0].handle(t);
 	for (let r = 1; r < e.length && n.status === 405; r++) n = await e[r].handle(t);
 	return n;
 };
 //#endregion
-export { d as collectPublicApiRoutes, p as defineRestRoute, c as derivePublicMethod, l as derivePublicPath, T as dispatchSharedPath, g as isRestStreamResponse, b as matchPathParams, u as publicApiRoute, f as requireScope, w as restRoutesToHttpRoutes, m as sse, h as sseFrame };
+export { d as collectPublicApiRoutes, m as defineRestRoute, c as derivePublicMethod, l as derivePublicPath, E as dispatchSharedPath, _ as isRestStreamResponse, x as matchPathParams, u as publicApiRoute, p as requireAnyScope, f as requireScope, T as restRoutesToHttpRoutes, h as sse, g as sseFrame };

package/dist/session.d.ts

@@ -19,14 +19,32 @@ export declare const buildSetCookie: (name: string, value: string, options?: Set
 /**
  * Check an `Authorization: Bearer <token>` header against an expected token.
  *
- *   - `expected` unset/empty → `true` (no token configured = open; the caller
- *     decided not to gate this surface).
+ *   - `expected` unset/empty → `false`, UNLESS the caller passes
+ *     `{ openWhenUnset: true }`. See below.
  *   - header absent, or not using the `Bearer ` scheme → `false`.
  *   - presented token compared to `expected` in CONSTANT TIME.
  *
  * `headers` keys may be any casing (`authorization` / `Authorization`).
+ *
+ * **Why the default is closed.** It used to be open: an unset or empty
+ * `expected` returned `true`, on the reading that "no token configured" meant
+ * the caller chose not to gate the surface. That reading is only available to
+ * the caller, and one of them declared the opposite — `scimPlugin`'s `token` is
+ * a REQUIRED `string`, and `token: process.env.SCIM_TOKEN ?? ''` (the shape
+ * anyone writes) silently turned the gate off. The result was SCIM 2.0 Users
+ * and Groups readable with no credentials: a full directory dump plus the
+ * provisioning surface that can deactivate accounts. The failure was silent and
+ * likeliest exactly where it hurts — an env var set in production and unset in
+ * a preview environment or a fresh cluster.
+ *
+ * A two-argument helper cannot know its caller's intent, so it must not assume
+ * the permissive one. `openWhenUnset` makes the choice appear at the call site,
+ * where the caller who genuinely wants an ungated endpoint says so and the
+ * caller who forgot gets a 401 instead of an open door.
  */
-export declare const checkBearer: (headers: Readonly<Record<string, string | undefined>>, expected: string | undefined) => boolean;
+export declare const checkBearer: (headers: Readonly<Record<string, string | undefined>>, expected: string | undefined, options?: {
+    readonly openWhenUnset?: boolean;
+}) => boolean;
 
 /** Key id assigned to `VOLTRO_SESSION_SECRET_PREVIOUS` when no explicit
  *  `VOLTRO_SESSION_KID_PREVIOUS` is set. The kid is a non-secret label —

package/dist/session.js

@@ -1,4 +1,4 @@
-import { i as e } from "./auth-DCE6m7Bo.js";
+import { i as e } from "./auth-DVrHg739.js";
 import { Schema as t } from "effect";
 import { createHmac as n, timingSafeEqual as r } from "node:crypto";
 //#region src/session.ts
@@ -83,10 +83,10 @@ var i = t.Struct({
 }, E = (e, t) => {
 	let n = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
 	return n.length === i.length && r(n, i);
-}, D = (e, t) => {
-	if (!t || t.length === 0) return !0;
-	let n = e.authorization ?? e.Authorization;
-	return !n || !n.startsWith("Bearer ") ? !1 : E(n.slice(7).trim(), t);
+}, D = (e, t, n) => {
+	if (!t || t.length === 0) return n?.openWhenUnset === !0;
+	let r = e.authorization ?? e.Authorization;
+	return !r || !r.startsWith("Bearer ") ? !1 : E(r.slice(7).trim(), t);
 }, O = (e, t) => {
 	if (e) for (let n of e.split(";")) {
 		let e = n.indexOf("=");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.11.4",
+  "version": "0.13.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@effect/sql": "^0.51.1",
-    "@voltro/database": "0.11.4",
+    "@voltro/database": "0.13.0",
     "jose": "^6.2.3"
   },
   "peerDependencies": {