@wtfalch/authz-store 0.1.0

package/dist/grants.js

@@ -0,0 +1,68 @@
+import { and, asc, eq, sql } from 'drizzle-orm';
+import { boolean, check, index, jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+/**
+ * Grants to one person, stored rather than compiled from a role. Guests live here: an invitation
+ * mints rows inside the catalogue's `guest` ceiling, and the engine refuses anything above it.
+ */
+export const policyGrants = pgTable('authz_grants', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    permission: text('permission').notNull(),
+    principalId: text('principal_id').notNull(),
+    principalClass: text('principal_class').$type().notNull(),
+    boundary: jsonb('boundary').$type().notNull(),
+    scope: jsonb('scope').$type().notNull(),
+    constraints: jsonb('constraints').$type(),
+    relation: text('relation').$type().notNull().default('any'),
+    guest: boolean('guest').notNull().default(false),
+    /** Why the outsider was invited. Not the engine's access-time `purpose`. */
+    reason: text('reason'),
+    expiresAt: timestamp('expires_at', { withTimezone: true }),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    createdBy: text('created_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('authz_grants_principal_idx').on(t.tenantId, t.principalClass, t.principalId),
+    index('authz_grants_guest_idx').on(t.tenantId, t.guest),
+    // The engine refuses a guest grant with no end date, so the table does too.
+    check('authz_grants_guest_expires', sql `not ${t.guest} or ${t.expiresAt} is not null`),
+]);
+/**
+ * Every guest grant a tenant has issued in one application, lapsed and revoked ones included, so a
+ * caller that acts on expiry sees the lapse rather than a row that silently disappeared.
+ */
+export async function guestGrants(tx, binding, tenantId, now = new Date()) {
+    const g = policyGrants;
+    const rows = await tx
+        .select()
+        .from(g)
+        .where(and(eq(g.tenantId, tenantId), eq(g.applicationId, binding.applicationId), eq(g.platformId, binding.platformId), eq(g.guest, true)))
+        .orderBy(asc(g.createdAt), asc(g.id));
+    return rows.map((row) => ({
+        grant: {
+            id: row.id,
+            applicationId: row.applicationId,
+            platformId: row.platformId,
+            boundary: row.boundary,
+            permission: row.permission,
+            recipient: {
+                kind: 'principal',
+                principal: { id: row.principalId, class: row.principalClass },
+            },
+            scope: row.scope,
+            ...(row.constraints === null ? {} : { constraints: row.constraints }),
+            relation: row.relation,
+            ...(row.expiresAt === null ? {} : { expiresAt: row.expiresAt.getTime() }),
+            guest: true,
+        },
+        reason: row.reason,
+        status: row.revokedAt !== null
+            ? 'revoked'
+            : row.expiresAt !== null && row.expiresAt > now
+                ? 'current'
+                : 'lapsed',
+        revokedAt: row.revokedAt,
+    }));
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { ReadOnlyAccessError, ScopedDb, UnscopedTableError, openScopedDb, scopeColumnOf, type DbOrTx, type Scope, } from './scoped.js';
+export { CREDENTIAL_PREFIX, CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_SECRET_BYTES, bearerFromHeader, generateCredentialSecret, hashCredentialSecret, looksLikeCredentialSecret, type GeneratedCredentialSecret, } from './credential-secret.js';
+export { policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
+export { accessTeamMembers, accessTeams, type AppRolePermission, } from './resource-schema.js';
+export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, type AttachProposal, type AuthzEvent, type BreakGlassSession, type Credential, type Invitation, type Membership, type NewAttachProposal, type NewAuthzEvent, type NewBreakGlassSession, type NewCredential, type NewInvitation, type NewMembership, type NewTenant, type Tenant, } from './schema.js';
+export { ownerCoverage, ownerSeatCovered, principalIsReachable, type OwnerCoverage, type OwnerCoverageOptions, type PolicyBinding, } from './owners.js';
+export { migrateStore } from './migrate.js';
+export { guestGrants, policyGrants, type GrantStatus, type GuestGrant } from './grants.js';

package/dist/index.js

@@ -0,0 +1,8 @@
+export { ReadOnlyAccessError, ScopedDb, UnscopedTableError, openScopedDb, scopeColumnOf, } from './scoped.js';
+export { CREDENTIAL_PREFIX, CREDENTIAL_PREFIX_LENGTH, CREDENTIAL_SECRET_BYTES, bearerFromHeader, generateCredentialSecret, hashCredentialSecret, looksLikeCredentialSecret, } from './credential-secret.js';
+export { policyAssignments, policyRoles, policyVersion, } from './policy-schema.js';
+export { accessTeamMembers, accessTeams, } from './resource-schema.js';
+export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, } from './schema.js';
+export { ownerCoverage, ownerSeatCovered, principalIsReachable, } from './owners.js';
+export { migrateStore } from './migrate.js';
+export { guestGrants, policyGrants } from './grants.js';

package/dist/migrate.d.ts

@@ -0,0 +1,9 @@
+import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+type HostDb = PgDatabase<PgQueryResultHKT, any, any>;
+/**
+ * Applies the package's migrations that `authz_store_migrations` has no row for, in file-name
+ * order, one transaction per file. Returns the names it applied. The host runs this before its own
+ * migrations, so everything the package owns exists before a host migration references it.
+ */
+export declare function migrateStore(db: HostDb): Promise<string[]>;
+export {};

package/dist/migrate.js

@@ -0,0 +1,41 @@
+import { readFile, readdir } from 'node:fs/promises';
+import { sql } from 'drizzle-orm';
+/** The shipped SQL, next to `dist/` in the package and next to `src/` in this repository. */
+const MIGRATIONS = new URL('../migrations/', import.meta.url);
+/** Files split on this line, the marker drizzle-kit writes, so any driver can run them one statement at a time. */
+const BREAKPOINT = '--> statement-breakpoint';
+/** One key for every host, so two containers starting at once apply each file once between them. */
+const LOCK = 7_310_422_001;
+/**
+ * Applies the package's migrations that `authz_store_migrations` has no row for, in file-name
+ * order, one transaction per file. Returns the names it applied. The host runs this before its own
+ * migrations, so everything the package owns exists before a host migration references it.
+ */
+export async function migrateStore(db) {
+    const names = (await readdir(MIGRATIONS)).filter((n) => n.endsWith('.sql')).sort();
+    const applied = [];
+    for (const name of names) {
+        const text = await readFile(new URL(name, MIGRATIONS), 'utf8');
+        const ran = await db.transaction(async (tx) => {
+            await tx.execute(sql `select pg_advisory_xact_lock(${LOCK})`);
+            // Created under the lock: two runners creating it at once collide in pg_type.
+            await tx.execute(sql `create table if not exists authz_store_migrations (name text primary key, applied_at timestamptz not null default now())`);
+            const done = await tx.execute(sql `select 1 from authz_store_migrations where name = ${name}`);
+            if (rowsOf(done).length > 0)
+                return false;
+            for (const statement of text.split(BREAKPOINT)) {
+                if (statement.trim())
+                    await tx.execute(sql.raw(statement));
+            }
+            await tx.execute(sql `insert into authz_store_migrations (name) values (${name})`);
+            return true;
+        });
+        if (ran)
+            applied.push(name);
+    }
+    return applied;
+}
+/** postgres-js returns the rows as the result; node-postgres and PGlite wrap them in `rows`. */
+function rowsOf(result) {
+    return Array.isArray(result) ? result : (result.rows ?? []);
+}

package/dist/owners.d.ts

@@ -0,0 +1,23 @@
+import type { DbOrTx } from './scoped.js';
+/**
+ * Which application's policy a query is about. The hosts hold these as their
+ * own `APPLICATION_ID` and `PLATFORM_ID` constants, and they differ: `manage`
+ * and `tf-web` share a platform but not an application, so an owner count that
+ * read the wrong one would count another product's owners.
+ */
+export interface PolicyBinding {
+    readonly applicationId: string;
+    readonly platformId: string;
+}
+export interface OwnerCoverage {
+    readonly directOwners: number;
+    readonly pendingOwnerInvitations: number;
+}
+export interface OwnerCoverageOptions {
+    readonly excludePrincipalId?: string;
+    readonly excludePrincipalClass?: string;
+}
+/** A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority. */
+export declare function ownerCoverage(tx: DbOrTx, binding: PolicyBinding, tenantId: string, options?: OwnerCoverageOptions): Promise<OwnerCoverage>;
+export declare function ownerSeatCovered(coverage: OwnerCoverage): boolean;
+export declare function principalIsReachable(): import("drizzle-orm").SQL<unknown>;

package/dist/owners.js

@@ -0,0 +1,40 @@
+import { and, eq, gt, isNull, sql } from 'drizzle-orm';
+import { policyAssignments, policyRoles } from './policy-schema.js';
+import { credentials, invitations, memberships } from './schema.js';
+/** A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority. */
+export async function ownerCoverage(tx, binding, tenantId, options = {}) {
+    const a = policyAssignments;
+    const r = policyRoles;
+    const conditions = [
+        eq(a.tenantId, tenantId),
+        eq(a.applicationId, binding.applicationId),
+        eq(a.platformId, binding.platformId),
+        eq(a.source, 'direct'),
+        eq(a.principalClass, 'human'),
+        eq(r.builtIn, true),
+        eq(r.key, 'owner'),
+        isNull(a.expiresAt),
+        sql `${a.scope}->>'kind' = 'organisation'`,
+        sql `(${a.boundary}->>'kind' = 'platform' or (${a.boundary}->>'kind' = 'organisation' and ${a.boundary}->>'organisationId' = ${tenantId}) or (${a.boundary}->>'kind' = 'organisations' and ${a.boundary}->'organisationIds' ? ${tenantId}))`,
+    ];
+    if (options.excludePrincipalId !== undefined &&
+        (!options.excludePrincipalClass || options.excludePrincipalClass === 'human'))
+        conditions.push(sql `${a.principalId} <> ${options.excludePrincipalId}`);
+    const [owners] = await tx
+        .select({ count: sql `count(distinct ${a.principalId})::int` })
+        .from(a)
+        .innerJoin(r, eq(a.roleId, r.id))
+        .where(and(...conditions));
+    const [pending] = await tx
+        .select({ count: sql `count(*)::int` })
+        .from(invitations)
+        .innerJoin(r, eq(invitations.roleId, r.id))
+        .where(and(eq(invitations.tenantId, tenantId), eq(r.builtIn, true), eq(r.key, 'owner'), eq(invitations.status, 'pending'), gt(invitations.expiresAt, sql `now()`)));
+    return { directOwners: owners?.count ?? 0, pendingOwnerInvitations: pending?.count ?? 0 };
+}
+export function ownerSeatCovered(coverage) {
+    return coverage.directOwners >= 1 || coverage.pendingOwnerInvitations === 1;
+}
+export function principalIsReachable() {
+    return sql `(${memberships.principalClass} = 'human' or exists (select 1 from ${credentials} c where c.id::text=${memberships.principalId} and c.kind=${memberships.principalClass} and c.revoked_at is null and (c.expires_at is null or c.expires_at>now())))`;
+}