@voltro/protocol 0.84.0 → 0.86.0

package/dist/scopes-Di756ENh.js

@@ -1,518 +0,0 @@
-import { Context as e, Effect as t, Schema as n } from "effect";
-import { RpcMiddleware as r } from "@effect/rpc";
-//#region src/tenantSelection.ts
-var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAccount", a = class extends n.TaggedError()("TenantSelectionRefused", {
-	subjectType: n.String,
-	subjectId: n.NullOr(n.String),
-	tenantId: n.String,
-	reason: n.Literal("not-a-member", "subject-has-no-tenant")
-}) {}, o = (e, t, n) => {
-	if (!i(e)) throw new a({
-		subjectType: e.type,
-		subjectId: e.id,
-		tenantId: t,
-		reason: "subject-has-no-tenant"
-	});
-	if (!n.some((e) => e.tenantId === t)) throw new a({
-		subjectType: e.type,
-		subjectId: e.id,
-		tenantId: t,
-		reason: "not-a-member"
-	});
-	return {
-		...e,
-		tenantId: t,
-		metadata: {
-			...e.metadata,
-			memberships: n.map((e) => e.role === void 0 ? { tenantId: e.tenantId } : {
-				tenantId: e.tenantId,
-				role: e.role
-			})
-		}
-	};
-}, s = n.Record({
-	key: n.String,
-	value: n.Unknown
-}), c = n.optional(n.Array(n.String)), l = n.Struct({
-	type: n.Literal("user"),
-	id: n.String,
-	tenantId: n.String,
-	scopes: c,
-	metadata: n.optional(s)
-}), u = n.Struct({
-	type: n.Literal("apiKey"),
-	id: n.String,
-	tenantId: n.String,
-	scopes: c,
-	metadata: n.optional(s)
-}), d = n.Struct({
-	type: n.Literal("serviceAccount"),
-	id: n.String,
-	tenantId: n.String,
-	auditActorId: n.optionalWith(n.NullOr(n.String), { exact: !0 }),
-	scopes: c,
-	metadata: n.optional(s)
-}), f = n.Struct({
-	type: n.Literal("anonymous"),
-	id: n.Null,
-	tenantId: n.NullOr(n.String),
-	credentialRejected: n.optional(n.String)
-}), p = n.Struct({
-	type: n.Literal("system"),
-	id: n.String,
-	tenantId: n.Null,
-	scopes: c,
-	metadata: n.optional(s)
-}), m = n.Struct({
-	type: n.Literal("service"),
-	id: n.String,
-	service: n.String,
-	tenantId: n.Null,
-	scopes: c,
-	metadata: n.optional(s)
-}), ee = n.Union(l, u, d, f, p, m), te = n.Union(l.omit("scopes"), u.omit("scopes"), d.omit("scopes"), f, p.omit("scopes"), m.omit("scopes")), ne = (e) => {
-	if (e.type === "anonymous") return e;
-	let { scopes: t, ...n } = e;
-	return n;
-}, h = (e) => e.scopes ?? [], g = (e, t) => ({
-	type: "anonymous",
-	id: null,
-	tenantId: e,
-	...t === void 0 ? {} : { credentialRejected: t }
-}), re = (e, t = ["admin:full"]) => ({
-	type: "system",
-	id: e,
-	tenantId: null,
-	scopes: t
-}), ie = (e) => ({
-	type: "service",
-	id: `service:${e}`,
-	service: e,
-	tenantId: null,
-	scopes: []
-}), ae = (e) => e.type === "service", oe = (e) => e.type === "system" || e.type === "service", _ = (e) => {
-	if (e.type === "system") return null;
-	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
-	if (e.type !== "apiKey") return e.id;
-	let t = e.metadata?.userId;
-	return typeof t == "string" && t !== "" ? t : e.id;
-}, v = (e, t) => {
-	let n = e;
-	return {
-		type: "serviceAccount",
-		id: e.id ?? "system",
-		tenantId: t,
-		auditActorId: _(e),
-		scopes: h(e),
-		...n.metadata === void 0 ? {} : { metadata: n.metadata }
-	};
-}, se = (e) => e.type === "system", ce = "impersonation", le = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, ue = class extends r.Tag()("@voltro/AuthMiddleware", {
-	provides: y,
-	failure: x
-}) {}, de = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, fe = (e) => typeof e.mountRoutes == "function", pe = (e) => Array.isArray(e) ? {
-	kind: "grant",
-	scopes: e
-} : e, S = (e, t) => {
-	if (t.kind === "vetoed") throw new x({ reason: `${t.code}: ${t.message}` });
-	if (e.type === "anonymous") return {
-		subject: e,
-		removed: []
-	};
-	let n = h(e);
-	if (t.kind === "grant") {
-		if (t.scopes.length === 0) return {
-			subject: e,
-			removed: []
-		};
-		let r = [.../* @__PURE__ */ new Set([...n, ...t.scopes])];
-		return {
-			subject: {
-				...e,
-				scopes: r
-			},
-			removed: []
-		};
-	}
-	let r = new Set(t.scopes), i = n.filter((e) => !r.has(e));
-	return {
-		subject: {
-			...e,
-			scopes: [...r]
-		},
-		removed: i
-	};
-}, me = 3e4, he = 1e4, C = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ge = () => {
-	if (typeof process > "u") return;
-	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
-	if (e === void 0 || e === "") return;
-	let t = Number(e);
-	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, w = (e = {}) => {
-	let t = e.ttlMs ?? ge() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
-		if (i.size <= n) return;
-		let e = r();
-		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
-		for (let e of i.keys()) {
-			if (i.size <= n) break;
-			i.delete(e);
-		}
-	};
-	return {
-		ttlMs: t,
-		invalidate: (e) => {
-			i.delete(e);
-		},
-		invalidateAll: () => {
-			i.clear();
-		},
-		resolve: async (e, n) => {
-			let o = r();
-			if (t > 0) {
-				let t = i.get(e);
-				if (t && t.freshUntil > o) return {
-					decision: t.decision,
-					fresh: !1
-				};
-			}
-			let s = await n();
-			return t > 0 && s.kind !== "unavailable" && (i.set(e, {
-				decision: s,
-				freshUntil: o + t
-			}), a()), {
-				decision: s,
-				fresh: !0
-			};
-		}
-	};
-}, _e = (e) => typeof e.resolve == "function", ve = (e) => {
-	let t = e.authorization ?? e.Authorization;
-	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
-}, ye = async (e, t, n, r) => {
-	if (!i(e)) return e;
-	let s = {
-		type: e.type,
-		id: e.id
-	}, c;
-	try {
-		c = await n.store.read(s);
-	} catch (e) {
-		throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (c === null || c === e.tenantId) return e;
-	let l;
-	try {
-		l = await n.memberships(e, t);
-	} catch (e) {
-		throw r(`memberships unavailable: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	try {
-		return o(e, c, l);
-	} catch (t) {
-		if (!(t instanceof a)) throw t;
-		try {
-			await n.store.clear(s);
-		} catch (e) {
-			throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
-		}
-		return e;
-	}
-}, T = (e, t) => {
-	let n = ve(t);
-	if (n === void 0) return e;
-	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
-	if (r.length === 0) return e;
-	let i = new Set(r);
-	return [...r, ...e.filter((e) => !i.has(e))];
-}, be = (e, t) => {
-	if (e === "refuse") throw new x({ reason: "anonymous callers are refused" });
-	if (e === "no-tenant") return "";
-	if (e === "header") {
-		if (t === void 0 || t === "") throw new x({ reason: "tenant required (x-tenant header missing)" });
-		return t;
-	}
-	return "tenantId" in e ? e.tenantId : t !== void 0 && t !== "" ? t : e.headerOrTenant;
-}, E = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [];
-	if (t?.memberships === void 0 != (t?.tenantSelection === void 0)) throw Error("composeAuthStrategies: `memberships` and `tenantSelection` come together — a tenant selection is verified against the memberships and read from the store; configure both or neither.");
-	let i = t?.memberships !== void 0 && t.tenantSelection !== void 0 ? {
-		memberships: t.memberships,
-		store: t.tenantSelection
-	} : void 0, a = n !== void 0 || r.length > 0, o = !a || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && _e(t.scopeCache) ? t.scopeCache : w(t?.scopeCache ?? {});
-	return async (s) => {
-		let c = t?.getStore?.(), l = c === void 0 ? s : {
-			...s,
-			store: c
-		}, u;
-		for (let s of T(e, l.headers)) {
-			let e = await s.resolve(l);
-			if (e.kind === "matched") {
-				if (e.subject.type === "service") return { subject: {
-					...e.subject,
-					scopes: []
-				} };
-				let c = i === void 0 ? e.subject : await ye(e.subject, l, i, (e) => (t?.onStrategyFailed?.({
-					strategyId: s.id,
-					reason: e
-				}), new x({ reason: e }))), u = c;
-				if (a) {
-					let e = async () => {
-						let e = n === void 0 ? {
-							kind: "grant",
-							scopes: []
-						} : pe(await n(c, l));
-						if (e.kind === "unavailable" || r.length === 0) return e;
-						let t = S(c, e).subject, i = {
-							origin: "request",
-							headers: l.headers,
-							clientId: l.clientId,
-							store: l.store
-						};
-						for (let e of r) {
-							let n = await e(t, i);
-							if (!n.ok) return {
-								kind: "vetoed",
-								code: n.code,
-								message: n.message
-							};
-						}
-						return e;
-					}, { decision: i, fresh: a } = o === null ? {
-						decision: await e(),
-						fresh: !0
-					} : await o.resolve(C(c), e);
-					if (i.kind === "vetoed") {
-						let e = `${i.code}: ${i.message}`;
-						throw t?.onStrategyFailed?.({
-							strategyId: s.id,
-							reason: e
-						}), new x({ reason: e });
-					}
-					if (i.kind === "unavailable") {
-						let e = `scope resolution unavailable: ${i.reason}`;
-						throw t?.onStrategyFailed?.({
-							strategyId: s.id,
-							reason: e
-						}), new x({ reason: e });
-					}
-					let d = S(c, i);
-					a && d.removed.length > 0 && t?.onScopesNarrowed?.({
-						strategyId: s.id,
-						subjectType: c.type,
-						subjectId: c.id,
-						removed: d.removed,
-						granted: i.scopes
-					}), u = d.subject;
-				}
-				return e.credentialExpiresAt === void 0 ? { subject: u } : {
-					subject: u,
-					credentialExpiresAt: e.credentialExpiresAt
-				};
-			}
-			if (e.kind === "failed") {
-				t?.onStrategyFailed?.({
-					strategyId: s.id,
-					reason: e.reason
-				}), u = e.reason;
-				break;
-			}
-		}
-		if (t?.fallback) {
-			let e = await t.fallback(l);
-			return { subject: u !== void 0 && e.type === "anonymous" ? {
-				...e,
-				credentialRejected: u
-			} : e };
-		}
-		if (u !== void 0) throw new x({ reason: `credential rejected: ${u}` });
-		return { subject: g(be(t?.anonymous ?? "no-tenant", l.headers["x-tenant"])) };
-	};
-}, D = (e, t) => {
-	if (e.type === "anonymous") throw new x(t === void 0 ? {} : { reason: t });
-}, O = "admin:full", k = "apikeys:issue:self", A = "apikeys:issue:org", j = "apikeys:issue:other", M = "devices:manage", N = class extends n.TaggedError()("ScopeError", {
-	required: n.String,
-	message: n.String
-}) {}, P = class extends n.TaggedError()("NoSuchResource", {
-	resourceType: n.NullOr(n.String),
-	resourceId: n.String,
-	message: n.String
-}) {}, F = (e) => "scopes" in e && e.scopes ? e.scopes : [], I = /* @__PURE__ */ new WeakMap(), xe = (e, t) => {
-	typeof e == "object" && e && I.set(e, t);
-}, L = (e) => {
-	if (typeof e == "object" && e) {
-		let t = I.get(e);
-		if (t) return t;
-	}
-	return F(e);
-}, R = (e, t) => {
-	let n = L(e);
-	return n.includes("admin:full") || n.includes(t);
-}, Se = (e, t) => {
-	let n = F(e);
-	return n.includes("admin:full") || n.includes(t);
-}, Ce = (e, n) => R(e, n) ? t.void : t.fail(new N({
-	required: n,
-	message: `missing required scope '${n}'`
-})), z = (e, t) => {
-	let n;
-	try {
-		n = typeof e.action == "function" ? e.action(t) : e.action;
-	} catch {
-		throw new N({
-			required: e.resourceType,
-			message: "policy action selector failed"
-		});
-	}
-	if (typeof n != "string" || n.trim() === "") throw new N({
-		required: e.resourceType,
-		message: "policy action selector returned no action"
-	});
-	return n;
-}, B = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", we = (e) => e !== void 0 && e.some((e) => B(e) || typeof e.resource == "function"), V = (e) => typeof e.open == "string", H = (e) => Array.isArray(e.service), Te = (e) => ({ service: [...e] }), U = (e) => e?.find(H)?.service, W = (e, t) => {
-	let n = U(t);
-	if (e.type === "service") return n !== void 0 && n.includes(e.service) ? null : new N({
-		required: "service-procedure",
-		message: n === void 0 ? `service '${e.service}' may only call procedures that declare it in \`service: { callers }\`` : `service '${e.service}' is not among this procedure's callers [${n.join(", ")}]`
-	});
-	if (n !== void 0) return Z(e, new N({
-		required: `service:${n.join("|")}`,
-		message: `this procedure is callable only by the service${n.length === 1 ? "" : "s"} [${n.join(", ")}]`
-	}));
-}, G = (e) => e.authenticated === !0, Ee = (e) => ({ open: e }), K = (e) => typeof e == "string" ? [e] : e, q, De = (e) => {
-	q = e;
-}, Oe = (e) => q === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !B(e) && e.resource !== void 0)).map((e) => e.tag) : [], ke = (e) => [
-	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
-	...e.slice(0, 10).map((e) => `    ${e}`),
-	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
-	"",
-	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
-	"  but with no resource-scope resolver registered the extractor is advisory and",
-	"  the check runs against the caller's GLOBAL scopes. For an app whose",
-	"  authorization is per-resource, that guard passes callers it should refuse.",
-	"",
-	"  Fix it one of two ways:",
-	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
-	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
-	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), Ae = () => q, J, je = (e) => {
-	J = e;
-}, Y = () => J, X = (e) => new N({
-	required: "access-decision",
-	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
-}), Z = (e, t) => {
-	let n = e.credentialRejected;
-	return n === void 0 ? t : new x({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
-}, Q = (e, t, n) => {
-	let r = W(e, t);
-	if (r !== void 0) return r;
-	if (!t || t.length === 0) return n?.defaultDeny === !0 ? X(n.procedure) : null;
-	for (let n of t) {
-		if (V(n) || H(n)) continue;
-		if (G(n)) {
-			if (e.id !== null && e.id !== void 0) continue;
-			return Z(e, new N({
-				required: "authenticated",
-				message: "this procedure requires an authenticated caller"
-			}));
-		}
-		if (B(n)) {
-			if (R(e, "admin:full")) continue;
-			return Z(e, new N({
-				required: `${n.resourceType}:${n.action}`,
-				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
-			}));
-		}
-		let t = K(n.scope);
-		if (t.length === 0) continue;
-		let r = t.filter((t) => R(e, t));
-		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !R(e, t));
-			return Z(e, new N({
-				required: r,
-				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
-			}));
-		}
-	}
-	return null;
-}, Me = (e, n, r) => {
-	let i;
-	try {
-		i = z(n, r);
-	} catch (e) {
-		return t.succeed(e);
-	}
-	let a = (e) => new N({
-		required: `${n.resourceType}:${i}`,
-		message: e
-	});
-	if (R(e, "admin:full")) return t.succeed(null);
-	let o = J;
-	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
-	let s = n.resource(r);
-	return s === void 0 || s === "" ? t.succeed(a(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => o({
-		subject: e,
-		action: i,
-		resourceType: n.resourceType,
-		resourceId: s
-	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((t) => $(e, t, n.resourceType, s, () => a(`no '${i}' relation on ${n.resourceType}:${s}`))));
-}, $ = (e, t, n, r, i) => t === !0 ? null : t === "missing" && e.id !== null && e.id !== void 0 ? new P({
-	resourceType: n,
-	resourceId: r,
-	message: n === null ? `no such resource '${r}'` : `no such ${n} '${r}'`
-}) : i(), Ne = (e, n, r, i) => {
-	let a = W(e, n);
-	if (a !== void 0) return t.succeed(a);
-	if (!n || n.length === 0) return t.succeed(Q(e, n, i));
-	let o = q;
-	return !n.some(B) && (!o || !n.some((e) => e.resource !== void 0)) ? t.succeed(Q(e, n, i)) : t.gen(function* () {
-		for (let i of n) {
-			if (V(i) || H(i)) continue;
-			if (G(i)) {
-				if (e.id !== null && e.id !== void 0) continue;
-				return Z(e, new N({
-					required: "authenticated",
-					message: "this procedure requires an authenticated caller"
-				}));
-			}
-			if (B(i)) {
-				let t = yield* Me(e, i, r);
-				if (t) return t;
-				continue;
-			}
-			let n = K(i.scope);
-			if (n.length === 0) continue;
-			let a = i.resource ? i.resource(r) : void 0, s = [], c = !1;
-			for (let r of n) {
-				if (R(e, r)) {
-					s.push(!0);
-					continue;
-				}
-				if (a !== void 0 && o !== void 0) {
-					let n = yield* t.suspend(() => o({
-						subject: e,
-						scope: r,
-						resource: a
-					})).pipe(t.catchAllCause(() => t.succeed(!1)));
-					n === "missing" && (c = !0), s.push(n === !0);
-				} else s.push(!1);
-			}
-			let l = i.mode ?? "all";
-			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
-				let t = l === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				if (c && a !== void 0) {
-					let n = $(e, "missing", null, a, () => new N({
-						required: t,
-						message: `missing required scope '${t}' on resource '${a}'`
-					}));
-					if (n !== null) return n;
-				}
-				return new N({
-					required: t,
-					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${t}'` + (a === void 0 ? "" : ` on resource '${a}'`)
-				});
-			}
-		}
-		return null;
-	});
-};
-//#endregion
-export { C as $, De as A, y as B, Ee as C, U as D, Te as E, he as F, E as G, g as H, me as I, ae as J, fe as K, ce as L, ue as M, b as N, xe as O, de as P, le as Q, ee as R, X as S, z as T, S as U, x as V, D as W, w as X, se as Y, T as Z, Se as _, M as a, a as at, B as b, ke as c, we as d, ie as et, L as f, R as g, Ae as h, k as i, v as it, F as j, je as k, Q as l, Y as m, A as n, ne as nt, P as o, i as ot, Oe as p, oe as q, j as r, re as rt, N as s, o as st, O as t, _ as tt, Ne as u, G as v, Ce as w, H as x, V as y, te as z };