@voltro/protocol 0.32.0 → 0.34.0

package/dist/auth-B6YZuSBr.js

@@ -0,0 +1,303 @@
+import { Context as e, Effect as t, Schema as n } from "effect";
+import { RpcMiddleware as r } from "@effect/rpc";
+//#region src/scopes.ts
+var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "apikeys:issue:other", c = class extends n.TaggedError()("ScopeError", {
+	required: n.String,
+	message: n.String
+}) {}, l = (e) => "scopes" in e && e.scopes ? e.scopes : [], u = /* @__PURE__ */ new WeakMap(), d = (e, t) => {
+	typeof e == "object" && e && u.set(e, t);
+}, f = (e) => {
+	if (typeof e == "object" && e) {
+		let t = u.get(e);
+		if (t) return t;
+	}
+	return l(e);
+}, p = (e, t) => {
+	let n = f(e);
+	return n.includes("admin:full") || n.includes(t);
+}, ee = (e, t) => {
+	let n = l(e);
+	return n.includes("admin:full") || n.includes(t);
+}, te = (e, n) => p(e, n) ? t.void : t.fail(new c({
+	required: n,
+	message: `missing required scope '${n}'`
+})), m = (e) => typeof e.action == "string" && typeof e.resourceType == "string", h = (e) => typeof e.open == "string", g = (e) => ({ open: e }), _ = (e) => typeof e == "string" ? [e] : e, v, y = (e) => {
+	v = e;
+}, b = (e) => v === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !m(e) && e.resource !== void 0)).map((e) => e.tag) : [], x = (e) => [
+	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
+	...e.slice(0, 10).map((e) => `    ${e}`),
+	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
+	"",
+	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
+	"  but with no resource-scope resolver registered the extractor is advisory and",
+	"  the check runs against the caller's GLOBAL scopes. For an app whose",
+	"  authorization is per-resource, that guard passes callers it should refuse.",
+	"",
+	"  Fix it one of two ways:",
+	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
+	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
+	"    • Drop the `resource` extractor if a global scope check is what you meant."
+].join("\n"), S = () => v, C, ne = (e) => {
+	C = e;
+}, w = () => C, T = (e) => new c({
+	required: "access-decision",
+	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
+}), E = (e, t, n) => {
+	if (!t || t.length === 0) return n?.defaultDeny === !0 ? T(n.procedure) : null;
+	for (let n of t) {
+		if (h(n)) continue;
+		if (m(n)) {
+			if (p(e, "admin:full")) continue;
+			return new c({
+				required: `${n.resourceType}:${n.action}`,
+				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
+			});
+		}
+		let t = _(n.scope);
+		if (t.length === 0) continue;
+		let r = t.filter((t) => p(e, t));
+		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
+			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !p(e, t));
+			return new c({
+				required: r,
+				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
+			});
+		}
+	}
+	return null;
+}, D = (e, n, r) => {
+	let i = (e) => new c({
+		required: `${n.resourceType}:${n.action}`,
+		message: e
+	});
+	if (p(e, "admin:full")) return t.succeed(null);
+	let a = C;
+	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
+	let o = n.resource(r);
+	return o === void 0 || o === "" ? t.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => a({
+		subject: e,
+		action: n.action,
+		resourceType: n.resourceType,
+		resourceId: o
+	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
+}, O = (e, n, r, i) => {
+	if (!n || n.length === 0) return t.succeed(E(e, n, i));
+	let a = v;
+	return !n.some(m) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed(E(e, n, i)) : t.gen(function* () {
+		for (let i of n) {
+			if (h(i)) continue;
+			if (m(i)) {
+				let t = yield* D(e, i, r);
+				if (t) return t;
+				continue;
+			}
+			let n = _(i.scope);
+			if (n.length === 0) continue;
+			let o = i.resource ? i.resource(r) : void 0, s = [];
+			for (let r of n) {
+				if (p(e, r)) {
+					s.push(!0);
+					continue;
+				}
+				if (o !== void 0 && a !== void 0) {
+					let n = yield* t.suspend(() => a({
+						subject: e,
+						scope: r,
+						resource: o
+					})).pipe(t.catchAllCause(() => t.succeed(!1)));
+					s.push(n);
+				} else s.push(!1);
+			}
+			let l = i.mode ?? "all";
+			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
+				let e = l === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
+				return new c({
+					required: e,
+					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (o === void 0 ? "" : ` on resource '${o}'`)
+				});
+			}
+		}
+		return null;
+	});
+}, k = n.Record({
+	key: n.String,
+	value: n.Unknown
+}), A = n.optional(n.Array(n.String)), j = n.Struct({
+	type: n.Literal("user"),
+	id: n.String,
+	tenantId: n.String,
+	scopes: A,
+	metadata: n.optional(k)
+}), M = n.Struct({
+	type: n.Literal("apiKey"),
+	id: n.String,
+	tenantId: n.String,
+	scopes: A,
+	metadata: n.optional(k)
+}), N = n.Struct({
+	type: n.Literal("serviceAccount"),
+	id: n.String,
+	tenantId: n.String,
+	scopes: A,
+	metadata: n.optional(k)
+}), P = n.Struct({
+	type: n.Literal("anonymous"),
+	id: n.Null,
+	tenantId: n.NullOr(n.String)
+}), F = n.Struct({
+	type: n.Literal("system"),
+	id: n.String,
+	tenantId: n.Null,
+	scopes: A,
+	metadata: n.optional(k)
+}), I = n.Union(j, M, N, P, F), L = n.Union(j.omit("scopes"), M.omit("scopes"), N.omit("scopes"), P, F.omit("scopes")), R = (e) => {
+	if (e.type === "anonymous") return e;
+	let { scopes: t, ...n } = e;
+	return n;
+}, z = (e) => e.scopes ?? [], B = (e) => ({
+	type: "anonymous",
+	id: null,
+	tenantId: e
+}), V = (e, t = ["admin:full"]) => ({
+	type: "system",
+	id: e,
+	tenantId: null,
+	scopes: t
+}), H = (e, t) => {
+	let n = e;
+	return {
+		type: "serviceAccount",
+		id: e.id ?? "system",
+		tenantId: t,
+		scopes: n.scopes ?? ["admin:full"],
+		...n.metadata === void 0 ? {} : { metadata: n.metadata }
+	};
+}, U = (e) => e.type === "system", W = class extends e.Tag("@voltro/Subject")() {}, G = class extends e.Tag("@voltro/ConnectionInfo")() {}, K = class extends r.Tag()("@voltro/AuthMiddleware", { provides: W }) {}, q = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: G }) {}, J = (e) => typeof e.mountRoutes == "function", Y = (e) => Array.isArray(e) ? {
+	kind: "grant",
+	scopes: e
+} : e, X = (e, t) => {
+	if (e.type === "anonymous") return {
+		subject: e,
+		removed: []
+	};
+	let n = z(e);
+	if (t.kind === "grant") {
+		if (t.scopes.length === 0) return {
+			subject: e,
+			removed: []
+		};
+		let r = [.../* @__PURE__ */ new Set([...n, ...t.scopes])];
+		return {
+			subject: {
+				...e,
+				scopes: r
+			},
+			removed: []
+		};
+	}
+	let r = new Set(t.scopes), i = n.filter((e) => !r.has(e));
+	return {
+		subject: {
+			...e,
+			scopes: [...r]
+		},
+		removed: i
+	};
+}, re = 3e4, ie = 1e4, Z = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
+	if (typeof process > "u") return;
+	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? t : void 0;
+}, Q = (e = {}) => {
+	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+		if (i.size <= n) return;
+		let e = r();
+		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
+		for (let e of i.keys()) {
+			if (i.size <= n) break;
+			i.delete(e);
+		}
+	};
+	return {
+		ttlMs: t,
+		invalidate: (e) => {
+			i.delete(e);
+		},
+		invalidateAll: () => {
+			i.clear();
+		},
+		resolve: async (e, n) => {
+			let o = r();
+			if (t > 0) {
+				let t = i.get(e);
+				if (t && t.freshUntil > o) return {
+					decision: t.decision,
+					fresh: !1
+				};
+			}
+			let s = await n();
+			return t > 0 && s.kind !== "unavailable" && (i.set(e, {
+				decision: s,
+				freshUntil: o + t
+			}), a()), {
+				decision: s,
+				fresh: !0
+			};
+		}
+	};
+}, oe = (e) => typeof e.resolve == "function", se = (e, t) => {
+	let n = t?.resolveScopes, r = n === void 0 || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : Q(t?.scopeCache ?? {});
+	return async (i) => {
+		let a = t?.getStore?.(), o = a === void 0 ? i : {
+			...i,
+			store: a
+		};
+		for (let i of e) {
+			let e = await i.resolve(o);
+			if (e.kind === "matched") {
+				let a = e.subject;
+				if (n !== void 0) {
+					let s = async () => Y(await n(e.subject, o)), { decision: c, fresh: l } = r === null ? {
+						decision: await s(),
+						fresh: !0
+					} : await r.resolve(Z(e.subject), s);
+					if (c.kind === "unavailable") {
+						let e = `scope resolution unavailable: ${c.reason}`;
+						throw t?.onStrategyFailed?.({
+							strategyId: i.id,
+							reason: e
+						}), new $({ reason: e });
+					}
+					let u = X(e.subject, c);
+					l && u.removed.length > 0 && t?.onScopesNarrowed?.({
+						strategyId: i.id,
+						subjectType: e.subject.type,
+						subjectId: e.subject.id,
+						removed: u.removed,
+						granted: c.scopes
+					}), a = u.subject;
+				}
+				return e.credentialExpiresAt === void 0 ? { subject: a } : {
+					subject: a,
+					credentialExpiresAt: e.credentialExpiresAt
+				};
+			}
+			if (e.kind === "failed") {
+				t?.onStrategyFailed?.({
+					strategyId: i.id,
+					reason: e.reason
+				});
+				break;
+			}
+		}
+		if (t?.fallback) return { subject: await t.fallback(o) };
+		let s = o.headers["x-tenant"] ?? null;
+		if (s === null && t?.anonymousTenantRequired === !0) throw new $({ reason: "tenant required (x-tenant header missing)" });
+		return { subject: B(s) };
+	};
+}, $ = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, ce = (e, t) => {
+	if (e.type === "anonymous") throw new $(t === void 0 ? {} : { reason: t });
+};
+//#endregion
+export { b as A, d as B, s as C, E as D, x as E, h as F, y as H, m as I, T as L, S as M, p as N, O, ee as P, g as R, o as S, c as T, l as U, ne as V, Z as _, re as a, H as b, W as c, X as d, ce as f, Q as g, U as h, ie as i, w as j, f as k, $ as l, J as m, G as n, I as o, se as p, q as r, L as s, K as t, B as u, R as v, a as w, i as x, V as y, te as z };