@voltro/protocol 0.85.0 → 0.87.0

package/dist/scopes-ClywBij8.js

@@ -1,548 +0,0 @@
-import { Context as e, Effect as t, Schema as n, Struct as r } from "effect";
-import { RpcMiddleware as i } from "effect/rpc";
-//#region src/tenantSelection.ts
-var a = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAccount", o = class extends n.TaggedError()("TenantSelectionRefused", {
-	subjectType: n.String,
-	subjectId: n.NullOr(n.String),
-	tenantId: n.String,
-	reason: n.Literals(["not-a-member", "subject-has-no-tenant"])
-}) {}, s = (e, t, n) => {
-	if (!a(e)) throw new o({
-		subjectType: e.type,
-		subjectId: e.id,
-		tenantId: t,
-		reason: "subject-has-no-tenant"
-	});
-	if (!n.some((e) => e.tenantId === t)) throw new o({
-		subjectType: e.type,
-		subjectId: e.id,
-		tenantId: t,
-		reason: "not-a-member"
-	});
-	return {
-		...e,
-		tenantId: t,
-		metadata: {
-			...e.metadata,
-			memberships: n.map((e) => e.role === void 0 ? { tenantId: e.tenantId } : {
-				tenantId: e.tenantId,
-				role: e.role
-			})
-		}
-	};
-}, c = n.Record(n.String, n.Unknown), l = n.optional(n.Array(n.String)), u = n.Struct({
-	type: n.Literal("user"),
-	id: n.String,
-	tenantId: n.String,
-	scopes: l,
-	metadata: n.optional(c)
-}), d = n.Struct({
-	type: n.Literal("apiKey"),
-	id: n.String,
-	tenantId: n.String,
-	scopes: l,
-	metadata: n.optional(c)
-}), f = n.Struct({
-	type: n.Literal("serviceAccount"),
-	id: n.String,
-	tenantId: n.String,
-	auditActorId: n.optionalKey(n.NullOr(n.String)),
-	scopes: l,
-	metadata: n.optional(c)
-}), p = n.Struct({
-	type: n.Literal("anonymous"),
-	id: n.Null,
-	tenantId: n.NullOr(n.String),
-	credentialRejected: n.optional(n.String)
-}), m = n.Struct({
-	type: n.Literal("system"),
-	id: n.String,
-	tenantId: n.Null,
-	scopes: l,
-	metadata: n.optional(c)
-}), h = n.Struct({
-	type: n.Literal("service"),
-	id: n.String,
-	service: n.String,
-	tenantId: n.Null,
-	scopes: l,
-	metadata: n.optional(c)
-}), ee = n.Union([
-	u,
-	d,
-	f,
-	p,
-	m,
-	h
-]), te = n.Union([
-	u.mapFields(r.omit(["scopes"])),
-	d.mapFields(r.omit(["scopes"])),
-	f.mapFields(r.omit(["scopes"])),
-	p,
-	m.mapFields(r.omit(["scopes"])),
-	h.mapFields(r.omit(["scopes"]))
-]), ne = (e) => {
-	if (e.type === "anonymous") return e;
-	let { scopes: t, ...n } = e;
-	return n;
-}, g = (e) => e.scopes ?? [], _ = (e, t) => ({
-	type: "anonymous",
-	id: null,
-	tenantId: e,
-	...t === void 0 ? {} : { credentialRejected: t }
-}), re = (e, t = ["admin:full"]) => ({
-	type: "system",
-	id: e,
-	tenantId: null,
-	scopes: t
-}), ie = (e) => ({
-	type: "service",
-	id: `service:${e}`,
-	service: e,
-	tenantId: null,
-	scopes: []
-}), ae = (e) => e.type === "service", oe = (e) => e.type === "system" || e.type === "service", v = (e) => {
-	if (e.type === "system") return null;
-	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
-	if (e.type !== "apiKey") return e.id;
-	let t = e.metadata?.userId;
-	return typeof t == "string" && t !== "" ? t : e.id;
-}, se = (e, t) => {
-	let n = e;
-	return {
-		type: "serviceAccount",
-		id: e.id ?? "system",
-		tenantId: t,
-		auditActorId: v(e),
-		scopes: g(e),
-		...n.metadata === void 0 ? {} : { metadata: n.metadata }
-	};
-}, ce = (e) => e.type === "system", le = "impersonation", ue = (e) => e.metadata?.impersonation ?? null, de = class extends e.Service()("@voltro/Subject") {}, fe = class extends e.Service()("@voltro/ConnectionInfo") {}, y = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {
-	get message() {
-		return this.reason ?? "Unauthenticated";
-	}
-}, pe = class extends i.Service()("@voltro/AuthMiddleware", { error: y }) {}, me = class extends i.Service()("@voltro/ConnectionInfoMiddleware") {}, he = (e) => typeof e.mountRoutes == "function", ge = (e) => Array.isArray(e) ? {
-	kind: "grant",
-	scopes: e
-} : e, b = (e, t) => {
-	if (t.kind === "vetoed") throw new y({ reason: `${t.code}: ${t.message}` });
-	if (e.type === "anonymous") return {
-		subject: e,
-		removed: []
-	};
-	let n = g(e);
-	if (t.kind === "grant") {
-		if (t.scopes.length === 0) return {
-			subject: e,
-			removed: []
-		};
-		let r = [.../* @__PURE__ */ new Set([...n, ...t.scopes])];
-		return {
-			subject: {
-				...e,
-				scopes: r
-			},
-			removed: []
-		};
-	}
-	let r = new Set(t.scopes), i = n.filter((e) => !r.has(e));
-	return {
-		subject: {
-			...e,
-			scopes: [...r]
-		},
-		removed: i
-	};
-}, _e = 3e4, ve = 1e4, x = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ye = () => {
-	if (typeof process > "u") return;
-	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
-	if (e === void 0 || e === "") return;
-	let t = Number(e);
-	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, S = (e = {}) => {
-	let t = e.ttlMs ?? ye() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
-		if (i.size <= n) return;
-		let e = r();
-		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
-		for (let e of i.keys()) {
-			if (i.size <= n) break;
-			i.delete(e);
-		}
-	};
-	return {
-		ttlMs: t,
-		invalidate: (e) => {
-			i.delete(e);
-		},
-		invalidateAll: () => {
-			i.clear();
-		},
-		resolve: async (e, n) => {
-			let o = r();
-			if (t > 0) {
-				let t = i.get(e);
-				if (t && t.freshUntil > o) return {
-					decision: t.decision,
-					fresh: !1
-				};
-			}
-			let s = await n();
-			return t > 0 && s.kind !== "unavailable" && (i.set(e, {
-				decision: s,
-				freshUntil: o + t
-			}), a()), {
-				decision: s,
-				fresh: !0
-			};
-		}
-	};
-}, be = (e) => typeof e.resolve == "function", xe = (e) => {
-	let t = e.authorization ?? e.Authorization;
-	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
-}, Se = async (e, t, n, r) => {
-	if (!a(e)) return e;
-	let i = {
-		type: e.type,
-		id: e.id
-	}, c;
-	try {
-		c = await n.store.read(i);
-	} catch (e) {
-		throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (c === null || c === e.tenantId) return e;
-	let l;
-	try {
-		l = await n.memberships(e, t);
-	} catch (e) {
-		throw r(`memberships unavailable: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	try {
-		return s(e, c, l);
-	} catch (t) {
-		if (!(t instanceof o)) throw t;
-		try {
-			await n.store.clear(i);
-		} catch (e) {
-			throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
-		}
-		return e;
-	}
-}, C = (e, t) => {
-	let n = xe(t);
-	if (n === void 0) return e;
-	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
-	if (r.length === 0) return e;
-	let i = new Set(r);
-	return [...r, ...e.filter((e) => !i.has(e))];
-}, Ce = (e, t) => {
-	if (e === "refuse") throw new y({ reason: "anonymous callers are refused" });
-	if (e === "no-tenant") return "";
-	if (e === "header") {
-		if (t === void 0 || t === "") throw new y({ reason: "tenant required (x-tenant header missing)" });
-		return t;
-	}
-	return "tenantId" in e ? e.tenantId : t !== void 0 && t !== "" ? t : e.headerOrTenant;
-}, w = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [];
-	if (t?.memberships === void 0 != (t?.tenantSelection === void 0)) throw Error("composeAuthStrategies: `memberships` and `tenantSelection` come together — a tenant selection is verified against the memberships and read from the store; configure both or neither.");
-	let i = t?.memberships !== void 0 && t.tenantSelection !== void 0 ? {
-		memberships: t.memberships,
-		store: t.tenantSelection
-	} : void 0, a = n !== void 0 || r.length > 0, o = !a || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && be(t.scopeCache) ? t.scopeCache : S(t?.scopeCache ?? {});
-	return async (s) => {
-		let c = t?.getStore?.(), l = c === void 0 ? s : {
-			...s,
-			store: c
-		}, u;
-		for (let s of C(e, l.headers)) {
-			let e = await s.resolve(l);
-			if (e.kind === "matched") {
-				if (e.subject.type === "service") return { subject: {
-					...e.subject,
-					scopes: []
-				} };
-				let c = i === void 0 ? e.subject : await Se(e.subject, l, i, (e) => (t?.onStrategyFailed?.({
-					strategyId: s.id,
-					reason: e
-				}), new y({ reason: e }))), u = c;
-				if (a) {
-					let e = async () => {
-						let e = n === void 0 ? {
-							kind: "grant",
-							scopes: []
-						} : ge(await n(c, l));
-						if (e.kind === "unavailable" || r.length === 0) return e;
-						let t = b(c, e).subject, i = {
-							origin: "request",
-							headers: l.headers,
-							clientId: l.clientId,
-							store: l.store
-						};
-						for (let e of r) {
-							let n = await e(t, i);
-							if (!n.ok) return {
-								kind: "vetoed",
-								code: n.code,
-								message: n.message
-							};
-						}
-						return e;
-					}, { decision: i, fresh: a } = o === null ? {
-						decision: await e(),
-						fresh: !0
-					} : await o.resolve(x(c), e);
-					if (i.kind === "vetoed") {
-						let e = `${i.code}: ${i.message}`;
-						throw t?.onStrategyFailed?.({
-							strategyId: s.id,
-							reason: e
-						}), new y({ reason: e });
-					}
-					if (i.kind === "unavailable") {
-						let e = `scope resolution unavailable: ${i.reason}`;
-						throw t?.onStrategyFailed?.({
-							strategyId: s.id,
-							reason: e
-						}), new y({ reason: e });
-					}
-					let d = b(c, i);
-					a && d.removed.length > 0 && t?.onScopesNarrowed?.({
-						strategyId: s.id,
-						subjectType: c.type,
-						subjectId: c.id,
-						removed: d.removed,
-						granted: i.scopes
-					}), u = d.subject;
-				}
-				return e.credentialExpiresAt === void 0 ? { subject: u } : {
-					subject: u,
-					credentialExpiresAt: e.credentialExpiresAt
-				};
-			}
-			if (e.kind === "failed") {
-				t?.onStrategyFailed?.({
-					strategyId: s.id,
-					reason: e.reason
-				}), u = e.reason;
-				break;
-			}
-		}
-		if (t?.fallback) {
-			let e = await t.fallback(l);
-			return { subject: u !== void 0 && e.type === "anonymous" ? {
-				...e,
-				credentialRejected: u
-			} : e };
-		}
-		if (u !== void 0) throw new y({ reason: `credential rejected: ${u}` });
-		return { subject: _(Ce(t?.anonymous ?? "no-tenant", l.headers["x-tenant"])) };
-	};
-}, T = (e, t) => {
-	if (e.type === "anonymous") throw new y(t === void 0 ? {} : { reason: t });
-}, E = "admin:full", D = "apikeys:issue:self", O = "apikeys:issue:org", k = "apikeys:issue:other", A = "devices:manage", j = class extends n.TaggedError()("ScopeError", {
-	required: n.String,
-	message: n.String
-}) {}, M = class extends n.TaggedError()("NoSuchResource", {
-	resourceType: n.NullOr(n.String),
-	resourceId: n.String,
-	message: n.String
-}) {}, N = (e) => "scopes" in e && e.scopes ? e.scopes : [], P = /* @__PURE__ */ new WeakMap(), we = (e, t) => {
-	typeof e == "object" && e && P.set(e, t);
-}, F = (e) => {
-	if (typeof e == "object" && e) {
-		let t = P.get(e);
-		if (t) return t;
-	}
-	return N(e);
-}, I = (e, t) => {
-	let n = F(e);
-	return n.includes("admin:full") || n.includes(t);
-}, Te = (e, t) => {
-	let n = N(e);
-	return n.includes("admin:full") || n.includes(t);
-}, Ee = (e, n) => I(e, n) ? t.void : t.fail(new j({
-	required: n,
-	message: `missing required scope '${n}'`
-})), L = (e, t) => {
-	let n;
-	try {
-		n = typeof e.action == "function" ? e.action(t) : e.action;
-	} catch {
-		throw new j({
-			required: e.resourceType,
-			message: "policy action selector failed"
-		});
-	}
-	if (typeof n != "string" || n.trim() === "") throw new j({
-		required: e.resourceType,
-		message: "policy action selector returned no action"
-	});
-	return n;
-}, R = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", De = (e) => e !== void 0 && e.some((e) => R(e) || typeof e.resource == "function"), z = (e) => typeof e.open == "string", B = (e) => Array.isArray(e.service), Oe = (e) => ({ service: [...e] }), V = (e) => e?.find(B)?.service, H = (e, t) => {
-	let n = V(t);
-	if (e.type === "service") return n !== void 0 && n.includes(e.service) ? null : new j({
-		required: "service-procedure",
-		message: n === void 0 ? `service '${e.service}' may only call procedures that declare it in \`service: { callers }\`` : `service '${e.service}' is not among this procedure's callers [${n.join(", ")}]`
-	});
-	if (n !== void 0) return Y(e, new j({
-		required: `service:${n.join("|")}`,
-		message: `this procedure is callable only by the service${n.length === 1 ? "" : "s"} [${n.join(", ")}]`
-	}));
-}, U = (e) => e.authenticated === !0, ke = (e) => ({ open: e }), W = (e) => typeof e == "string" ? [e] : e, G, Ae = (e) => {
-	G = e;
-}, je = (e) => G === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !R(e) && e.resource !== void 0)).map((e) => e.tag) : [], Me = (e) => [
-	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
-	...e.slice(0, 10).map((e) => `    ${e}`),
-	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
-	"",
-	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
-	"  but with no resource-scope resolver registered the extractor is advisory and",
-	"  the check runs against the caller's GLOBAL scopes. For an app whose",
-	"  authorization is per-resource, that guard passes callers it should refuse.",
-	"",
-	"  Fix it one of two ways:",
-	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
-	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
-	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), Ne = () => G, K, q = (e) => {
-	K = e;
-}, Pe = () => K, J = (e) => new j({
-	required: "access-decision",
-	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
-}), Y = (e, t) => {
-	let n = e.credentialRejected;
-	return n === void 0 ? t : new y({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
-}, X = (e) => {
-	let t = Array.isArray(e), n = Object.getPrototypeOf(e);
-	if (t ? n !== Array.prototype : n !== Object.prototype && n !== null) return !1;
-	for (let n of Reflect.ownKeys(e)) if (t && (typeof n != "string" || n !== "length" && !/^(0|[1-9][0-9]*)$/.test(n)) || !("value" in Object.getOwnPropertyDescriptor(e, n))) return !1;
-	return !0;
-}, Z = (e, t) => {
-	let n, r = 0, i, a = 0, o;
-	return (s) => {
-		let c = F(e);
-		return (c !== n || c.length !== r) && (n = c, r = c.length, i = void 0, a = 0, o = void 0), i === void 0 && c.length >= 32 && ++a > 1 && (o ??= X(c) && X(e) && X(t) && t.every((e) => X(e) && (!("scope" in e) || typeof e.scope == "string" || X(e.scope))), o && (i = new Set(c))), i === void 0 ? c.includes("admin:full") || c.includes(s) : i.has("admin:full") || i.has(s);
-	};
-}, Q = (e, t, n) => {
-	let r = H(e, t);
-	if (r !== void 0) return r;
-	if (!t || t.length === 0) return n?.defaultDeny === !0 ? J(n.procedure) : null;
-	let i = 0, a;
-	for (let n of t) {
-		if (z(n) || B(n)) continue;
-		if (U(n)) {
-			if (e.id !== null && e.id !== void 0) continue;
-			return Y(e, new j({
-				required: "authenticated",
-				message: "this procedure requires an authenticated caller"
-			}));
-		}
-		if (R(n)) {
-			if (i++, a === void 0 && (t.length >= 512 || i >= 512) && (a = Z(e, t)), a === void 0 ? I(e, "admin:full") : a("admin:full")) continue;
-			return Y(e, new j({
-				required: `${n.resourceType}:${n.action}`,
-				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
-			}));
-		}
-		let r = W(n.scope);
-		if (r.length === 0) continue;
-		i += r.length, a === void 0 && (t.length >= 512 || i >= 512) && (a = Z(e, t));
-		let o = n.mode ?? "all", s;
-		if (o === "any") {
-			if (a === void 0 ? r.some((t) => I(e, t)) : r.some(a)) continue;
-			s = r[0];
-		} else {
-			let t = a === void 0 ? r.find((t) => !I(e, t)) : r.find((e) => !a(e));
-			if (t === void 0) continue;
-			s = t;
-		}
-		return Y(e, new j({
-			required: s,
-			message: o === "any" ? `missing all of required scopes [${r.join(", ")}]` : `missing required scope '${s}'`
-		}));
-	}
-	return null;
-}, Fe = (e, n, r) => {
-	let i;
-	try {
-		i = L(n, r);
-	} catch (e) {
-		return t.succeed(e);
-	}
-	let a = (e) => new j({
-		required: `${n.resourceType}:${i}`,
-		message: e
-	});
-	if (I(e, "admin:full")) return t.succeed(null);
-	let o = K;
-	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
-	let s = n.resource(r);
-	return s === void 0 || s === "" ? t.succeed(a(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => o({
-		subject: e,
-		action: i,
-		resourceType: n.resourceType,
-		resourceId: s
-	})).pipe(t.catchCause(() => t.succeed(!1)), t.map((t) => $(e, t, n.resourceType, s, () => a(`no '${i}' relation on ${n.resourceType}:${s}`))));
-}, $ = (e, t, n, r, i) => t === !0 ? null : t === "missing" && e.id !== null && e.id !== void 0 ? new M({
-	resourceType: n,
-	resourceId: r,
-	message: n === null ? `no such resource '${r}'` : `no such ${n} '${r}'`
-}) : i(), Ie = (e, n, r, i) => {
-	let a = H(e, n);
-	if (a !== void 0) return t.succeed(a);
-	if (!n || n.length === 0) return t.succeed(Q(e, n, i));
-	let o = G;
-	return !n.some(R) && (!o || !n.some((e) => e.resource !== void 0)) ? t.succeed(Q(e, n, i)) : t.gen(function* () {
-		for (let i of n) {
-			if (z(i) || B(i)) continue;
-			if (U(i)) {
-				if (e.id !== null && e.id !== void 0) continue;
-				return Y(e, new j({
-					required: "authenticated",
-					message: "this procedure requires an authenticated caller"
-				}));
-			}
-			if (R(i)) {
-				let t = yield* Fe(e, i, r);
-				if (t) return t;
-				continue;
-			}
-			let n = W(i.scope);
-			if (n.length === 0) continue;
-			let a = i.resource ? i.resource(r) : void 0, s = [], c = !1;
-			for (let r of n) {
-				if (I(e, r)) {
-					s.push(!0);
-					continue;
-				}
-				if (a !== void 0 && o !== void 0) {
-					let n = yield* t.suspend(() => o({
-						subject: e,
-						scope: r,
-						resource: a
-					})).pipe(t.catchCause(() => t.succeed(!1)));
-					n === "missing" && (c = !0), s.push(n === !0);
-				} else s.push(!1);
-			}
-			let l = i.mode ?? "all";
-			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
-				let t = l === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				if (c && a !== void 0) {
-					let n = $(e, "missing", null, a, () => new j({
-						required: t,
-						message: `missing required scope '${t}' on resource '${a}'`
-					}));
-					if (n !== null) return n;
-				}
-				return new j({
-					required: t,
-					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${t}'` + (a === void 0 ? "" : ` on resource '${a}'`)
-				});
-			}
-		}
-		return null;
-	});
-};
-//#endregion
-export { x as $, Ae as A, de as B, ke as C, V as D, Oe as E, ve as F, w as G, _ as H, _e as I, ae as J, he as K, le as L, pe as M, fe as N, we as O, me as P, ue as Q, ee as R, J as S, L as T, b as U, y as V, T as W, S as X, ce as Y, C as Z, Te as _, A as a, o as at, R as b, Me as c, De as d, ie as et, F as f, I as g, Ne as h, D as i, se as it, N as j, q as k, Q as l, Pe as m, O as n, ne as nt, M as o, a as ot, je as p, oe as q, k as r, re as rt, j as s, s as st, E as t, v as tt, Ie as u, U as v, Ee as w, B as x, z as y, te as z };