@xemahq/contracts 0.34.0 → 0.36.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +2 -2
- package/dist/authorization-module/lib/authorization-module-contribution.d.ts +8 -2
- package/dist/authorization-module/lib/authorization-module-contribution.d.ts.map +1 -1
- package/dist/authorization-module/lib/authorization-module-contribution.js +23 -4
- package/dist/authorization-module/lib/authorization-module-contribution.js.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts +6 -0
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js +38 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authzen/index.d.ts +1 -0
- package/dist/authzen/index.d.ts.map +1 -1
- package/dist/authzen/index.js +1 -0
- package/dist/authzen/index.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts +28 -0
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js +20 -1
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/dist/authzen/lib/xema-capability-resource.d.ts +12 -0
- package/dist/authzen/lib/xema-capability-resource.d.ts.map +1 -0
- package/dist/authzen/lib/xema-capability-resource.js +80 -0
- package/dist/authzen/lib/xema-capability-resource.js.map +1 -0
- package/package.json +1 -1
package/dist/.source-stamp.json
CHANGED
|
@@ -136,8 +136,14 @@ export declare class AuthorizationModuleContributionError extends Error {
|
|
|
136
136
|
constructor(message: string);
|
|
137
137
|
}
|
|
138
138
|
export declare function stampAuthorizationModuleContribution(source: unknown, signedBiome: SignedBiomeAuthorizationFacts): AuthorizationModuleContributionManifest;
|
|
139
|
-
export
|
|
139
|
+
export interface FactsWriterClaim {
|
|
140
|
+
readonly biomeId: string;
|
|
141
|
+
readonly serviceNames: readonly string[];
|
|
142
|
+
}
|
|
143
|
+
export declare function resolveFactsWriterBiome(callerServiceName: string, claims: ReadonlyArray<FactsWriterClaim>): string | null;
|
|
144
|
+
export declare function factsWriterClaimsOfModules(modules: ReadonlyArray<{
|
|
140
145
|
readonly biomeId: string;
|
|
141
146
|
readonly manifest: AuthorizationModuleContributionManifest;
|
|
142
|
-
}>):
|
|
147
|
+
}>): FactsWriterClaim[];
|
|
148
|
+
export declare function factsWriterRelationsOf(biomeId: string, manifest: AuthorizationModuleContributionManifest | undefined): Readonly<Record<string, readonly string[]>> | null;
|
|
143
149
|
//# sourceMappingURL=authorization-module-contribution.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorization-module-contribution.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"authorization-module-contribution.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,6BAA6B;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAGF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BhD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAsBF,eAAO,MAAM,mCAAmC;;;;kBAQrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgBtD,CAAC;AACL,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAC;AAGF,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM;CAI5B;AAOD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,6BAA6B,GACzC,uCAAuC,CAsBzC;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAYD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACtC,MAAM,GAAG,IAAI,CAcf;AAGD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;CAC5D,CAAC,GACD,gBAAgB,EAAE,CAKpB;AAQD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,uCAAuC,GAAG,SAAS,GAC5D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAOpD"}
|
|
@@ -3,9 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.AuthorizationModuleContributionError = exports.AuthorizationModuleContributionManifestSchema = exports.SignedBiomeAuthorizationFactsSchema = exports.AuthorizationModuleSourceManifestSchema = exports.AuthorizationModuleTestFileSchema = exports.AuthorizationModuleFileSchema = void 0;
|
|
4
4
|
exports.stampAuthorizationModuleContribution = stampAuthorizationModuleContribution;
|
|
5
5
|
exports.resolveFactsWriterBiome = resolveFactsWriterBiome;
|
|
6
|
+
exports.factsWriterClaimsOfModules = factsWriterClaimsOfModules;
|
|
7
|
+
exports.factsWriterRelationsOf = factsWriterRelationsOf;
|
|
6
8
|
const zod_1 = require("zod");
|
|
7
9
|
const biome_1 = require("../../biome");
|
|
8
10
|
const authorization_module_envelope_1 = require("./authorization-module-envelope");
|
|
11
|
+
const platform_authorization_modules_1 = require("./platform-authorization-modules");
|
|
9
12
|
exports.AuthorizationModuleFileSchema = zod_1.z
|
|
10
13
|
.object({
|
|
11
14
|
name: zod_1.z.string().regex(authorization_module_envelope_1.AUTHORIZATION_MODULE_FILE_PATTERN),
|
|
@@ -99,13 +102,29 @@ function stampAuthorizationModuleContribution(source, signedBiome) {
|
|
|
99
102
|
signedBiome: exports.SignedBiomeAuthorizationFactsSchema.parse(signedBiome),
|
|
100
103
|
});
|
|
101
104
|
}
|
|
102
|
-
function resolveFactsWriterBiome(callerServiceName,
|
|
103
|
-
const owners =
|
|
104
|
-
|
|
105
|
-
|
|
105
|
+
function resolveFactsWriterBiome(callerServiceName, claims) {
|
|
106
|
+
const owners = [
|
|
107
|
+
...new Set(claims
|
|
108
|
+
.filter((c) => c.serviceNames.includes(callerServiceName))
|
|
109
|
+
.map((c) => c.biomeId)),
|
|
110
|
+
];
|
|
106
111
|
if (owners.length > 1) {
|
|
107
112
|
throw new AuthorizationModuleContributionError(`service "${callerServiceName}" is claimed by more than one biome (${owners.sort().join(', ')}); refusing to choose.`);
|
|
108
113
|
}
|
|
109
114
|
return owners[0] ?? null;
|
|
110
115
|
}
|
|
116
|
+
function factsWriterClaimsOfModules(modules) {
|
|
117
|
+
return modules.map((m) => ({
|
|
118
|
+
biomeId: m.biomeId,
|
|
119
|
+
serviceNames: m.manifest.signedBiome.serviceNames,
|
|
120
|
+
}));
|
|
121
|
+
}
|
|
122
|
+
function factsWriterRelationsOf(biomeId, manifest) {
|
|
123
|
+
const platform = (0, platform_authorization_modules_1.platformWritableRelationsOf)(biomeId);
|
|
124
|
+
const own = manifest?.envelope.writableRelations ?? {};
|
|
125
|
+
if (manifest === undefined && Object.keys(platform).length === 0) {
|
|
126
|
+
return null;
|
|
127
|
+
}
|
|
128
|
+
return Object.freeze({ ...own, ...platform });
|
|
129
|
+
}
|
|
111
130
|
//# sourceMappingURL=authorization-module-contribution.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorization-module-contribution.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"authorization-module-contribution.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-contribution.ts"],"names":[],"mappings":";;;AAoJA,oFAyBC;AAkBD,0DAiBC;AAGD,gEAUC;AAQD,wDAUC;AA/OD,6BAAwB;AAExB,uCAA8C;AAE9C,mFAIyC;AACzC,qFAA+E;AAkBlE,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiC,CAAC;IACzD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sEAAsC,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,uCAAuC,GAAG,OAAC;KACrD,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC1B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,IAAI,kCAAkC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;SACvH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC1D,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACP,CAAC;AAcY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,yBAAyB,EAAE,qBAAqB,CAC9C,2BAA2B,CAC5B;IACD,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6CAA6C,GAAG,OAAC;KAC3D,MAAM,CAAC;IACN,QAAQ,EAAE,iEAAiC;IAC3C,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,yCAAiC;IAC3C,WAAW,EAAE,2CAAmC;CACjD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC1D,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAML,MAAa,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AALD,oFAKC;AAOD,SAAgB,oCAAoC,CAClD,MAAe,EACf,WAA0C;IAE1C,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,oCAAoC,CAC5C,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,+CAAuC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oCAAoC,CAC5C,yDAAyD,MAAM,CAAC,KAAK,CAAC,MAAM;aACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,qDAA6C,CAAC,KAAK,CAAC;QACzD,GAAG,MAAM,CAAC,IAAI;QACd,WAAW,EAAE,2CAAmC,CAAC,KAAK,CAAC,WAAW,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAkBD,SAAgB,uBAAuB,CACrC,iBAAyB,EACzB,MAAuC;IAEvC,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CACR,MAAM;aACH,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB;KACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oCAAoC,CAC5C,YAAY,iBAAiB,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3B,CAAC;AAGD,SAAgB,0BAA0B,CACxC,OAGE;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY;KAClD,CAAC,CAAC,CAAC;AACN,CAAC;AAQD,SAAgB,sBAAsB,CACpC,OAAe,EACf,QAA6D;IAE7D,MAAM,QAAQ,GAAG,IAAA,4DAA2B,EAAC,OAAO,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC"}
|
|
@@ -16,4 +16,10 @@ export declare const XemaAuthorizationInterfaceSchema: z.ZodEnum<typeof XemaAuth
|
|
|
16
16
|
export declare const XEMA_PARENT_INTERFACE_RELATIONS: readonly ["xema_read", "xema_write", "xema_admin"];
|
|
17
17
|
export declare const XEMA_AUTHORIZATION_INTERFACE_RELATIONS: Readonly<Record<XemaAuthorizationInterface, readonly string[]>>;
|
|
18
18
|
export declare const PLATFORM_AUTHORIZATION_EXPORTS: Readonly<Record<PlatformAuthorizationModule, Readonly<Record<string, readonly string[]>>>>;
|
|
19
|
+
export interface PlatformFactWriter {
|
|
20
|
+
readonly biome: string;
|
|
21
|
+
readonly relations: readonly string[];
|
|
22
|
+
}
|
|
23
|
+
export declare const PLATFORM_FACT_WRITERS: Readonly<Record<string, PlatformFactWriter>>;
|
|
24
|
+
export declare function platformWritableRelationsOf(biomeId: string): Readonly<Record<string, readonly string[]>>;
|
|
19
25
|
//# sourceMappingURL=platform-authorization-modules.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAUZ,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC"}
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAUZ,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAmC3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
3
|
+
exports.PLATFORM_FACT_WRITERS = exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
4
|
+
exports.platformWritableRelationsOf = platformWritableRelationsOf;
|
|
4
5
|
const zod_1 = require("zod");
|
|
5
6
|
var PlatformAuthorizationModule;
|
|
6
7
|
(function (PlatformAuthorizationModule) {
|
|
@@ -45,4 +46,40 @@ exports.PLATFORM_AUTHORIZATION_EXPORTS = Object.freeze({
|
|
|
45
46
|
[PlatformAuthorizationModule.Capability]: Object.freeze({}),
|
|
46
47
|
[PlatformAuthorizationModule.Sharing]: Object.freeze({}),
|
|
47
48
|
});
|
|
49
|
+
exports.PLATFORM_FACT_WRITERS = Object.freeze({
|
|
50
|
+
project: Object.freeze({
|
|
51
|
+
biome: 'project-registry',
|
|
52
|
+
relations: Object.freeze(['parent', 'owner', 'admin', 'editor', 'viewer']),
|
|
53
|
+
}),
|
|
54
|
+
xema_session: Object.freeze({
|
|
55
|
+
biome: 'agent-runtime',
|
|
56
|
+
relations: Object.freeze(['parent', 'owner', 'participant']),
|
|
57
|
+
}),
|
|
58
|
+
xema_artifact: Object.freeze({
|
|
59
|
+
biome: 'agent-runtime',
|
|
60
|
+
relations: Object.freeze(['parent', 'owner']),
|
|
61
|
+
}),
|
|
62
|
+
...Object.fromEntries([
|
|
63
|
+
['xema_document', 'knowledge-base'],
|
|
64
|
+
['xema_mailbox', 'mailops'],
|
|
65
|
+
['xema_portal', 'app-platform'],
|
|
66
|
+
['xema_connector-migration', 'connector-platform'],
|
|
67
|
+
['xema_store-listing', 'xema-store'],
|
|
68
|
+
['xema_biome-lifecycle-approval', 'biome-host'],
|
|
69
|
+
['xema_memory', 'memory'],
|
|
70
|
+
['xema_capability-grant', 'authorization'],
|
|
71
|
+
['xema_output-route', 'authorization'],
|
|
72
|
+
].map(([type, biome]) => [
|
|
73
|
+
type,
|
|
74
|
+
Object.freeze({
|
|
75
|
+
biome,
|
|
76
|
+
relations: Object.freeze(['owner', 'manager', 'editor', 'viewer', 'org_viewer']),
|
|
77
|
+
}),
|
|
78
|
+
])),
|
|
79
|
+
});
|
|
80
|
+
function platformWritableRelationsOf(biomeId) {
|
|
81
|
+
return Object.freeze(Object.fromEntries(Object.entries(exports.PLATFORM_FACT_WRITERS)
|
|
82
|
+
.filter(([, writer]) => writer.biome === biomeId)
|
|
83
|
+
.map(([type, writer]) => [type, writer.relations])));
|
|
84
|
+
}
|
|
48
85
|
//# sourceMappingURL=platform-authorization-modules.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAsLA,kEAUC;AAhMD,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAUZ,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;KAC7D,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAC3B,CAAC,aAAa,EAAE,cAAc,CAAC;QAC/B,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;QAClD,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
|
package/dist/authzen/index.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}
|
package/dist/authzen/index.js
CHANGED
|
@@ -20,4 +20,5 @@ __exportStar(require("./lib/authzen-search"), exports);
|
|
|
20
20
|
__exportStar(require("./lib/authzen-metadata"), exports);
|
|
21
21
|
__exportStar(require("./lib/xema-authzen-profile"), exports);
|
|
22
22
|
__exportStar(require("./lib/authzen-snapshot"), exports);
|
|
23
|
+
__exportStar(require("./lib/xema-capability-resource"), exports);
|
|
23
24
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC;AACvC,iEAA+C"}
|
|
@@ -69,11 +69,30 @@ export declare const XemaAuthzenActionSchema: z.ZodObject<{
|
|
|
69
69
|
properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
|
|
70
70
|
name: z.ZodString;
|
|
71
71
|
}, z.core.$strict>;
|
|
72
|
+
export declare const XemaAuthzenInvocationSchema: z.ZodObject<{
|
|
73
|
+
projectId: z.ZodOptional<z.ZodString>;
|
|
74
|
+
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
75
|
+
biome: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextBiome, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextBiome, unknown>>>;
|
|
76
|
+
actingAgent: z.ZodOptional<z.ZodType<import("../../execution-context").AgentSubjectRef, unknown, z.core.$ZodTypeInternals<import("../../execution-context").AgentSubjectRef, unknown>>>;
|
|
77
|
+
aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
|
|
78
|
+
constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
|
|
79
|
+
resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
|
|
80
|
+
}, z.core.$strict>;
|
|
81
|
+
export type XemaAuthzenInvocation = z.infer<typeof XemaAuthzenInvocationSchema>;
|
|
72
82
|
export declare const XemaAuthzenContextSchema: z.ZodObject<{
|
|
73
83
|
orgId: z.ZodString;
|
|
74
84
|
capability: z.ZodOptional<z.ZodString>;
|
|
75
85
|
environment: z.ZodOptional<z.ZodString>;
|
|
76
86
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
87
|
+
invocation: z.ZodOptional<z.ZodObject<{
|
|
88
|
+
projectId: z.ZodOptional<z.ZodString>;
|
|
89
|
+
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
90
|
+
biome: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextBiome, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextBiome, unknown>>>;
|
|
91
|
+
actingAgent: z.ZodOptional<z.ZodType<import("../../execution-context").AgentSubjectRef, unknown, z.core.$ZodTypeInternals<import("../../execution-context").AgentSubjectRef, unknown>>>;
|
|
92
|
+
aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
|
|
93
|
+
constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
|
|
94
|
+
resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
|
|
95
|
+
}, z.core.$strict>>;
|
|
77
96
|
snapshot: z.ZodOptional<z.ZodString>;
|
|
78
97
|
}, z.core.$strict>;
|
|
79
98
|
export type XemaAuthzenContext = z.infer<typeof XemaAuthzenContextSchema>;
|
|
@@ -109,6 +128,15 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
|
|
|
109
128
|
capability: z.ZodOptional<z.ZodString>;
|
|
110
129
|
environment: z.ZodOptional<z.ZodString>;
|
|
111
130
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
131
|
+
invocation: z.ZodOptional<z.ZodObject<{
|
|
132
|
+
projectId: z.ZodOptional<z.ZodString>;
|
|
133
|
+
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
134
|
+
biome: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextBiome, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextBiome, unknown>>>;
|
|
135
|
+
actingAgent: z.ZodOptional<z.ZodType<import("../../execution-context").AgentSubjectRef, unknown, z.core.$ZodTypeInternals<import("../../execution-context").AgentSubjectRef, unknown>>>;
|
|
136
|
+
aperture: z.ZodOptional<z.ZodType<import("../../capability").CapabilityAperture, unknown, z.core.$ZodTypeInternals<import("../../capability").CapabilityAperture, unknown>>>;
|
|
137
|
+
constraints: z.ZodOptional<z.ZodType<import("../../execution-context").ExecutionContextConstraints, unknown, z.core.$ZodTypeInternals<import("../../execution-context").ExecutionContextConstraints, unknown>>>;
|
|
138
|
+
resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
|
|
139
|
+
}, z.core.$strict>>;
|
|
112
140
|
snapshot: z.ZodOptional<z.ZodString>;
|
|
113
141
|
}, z.core.$strict>;
|
|
114
142
|
}, z.core.$strict>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,kGAK5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;EAKvC,CAAC;AAcH,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAS1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAQD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GACZ,OAAO,CAYT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA0BH,eAAO,MAAM,2BAA2B;;;;;;;;kBAU7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAoBhF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAS1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;CAC3C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
|
|
@@ -1,11 +1,15 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
3
|
+
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenInvocationSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
4
4
|
exports.qualifyResourceId = qualifyResourceId;
|
|
5
5
|
exports.parseQualifiedResourceId = parseQualifiedResourceId;
|
|
6
6
|
exports.resourceBelongsToOrg = resourceBelongsToOrg;
|
|
7
7
|
const zod_1 = require("zod");
|
|
8
|
+
const xema_capability_resource_1 = require("./xema-capability-resource");
|
|
8
9
|
const audit_1 = require("../../audit");
|
|
10
|
+
const capability_1 = require("../../capability");
|
|
11
|
+
const execution_context_1 = require("../../execution-context");
|
|
12
|
+
const space_1 = require("../../space");
|
|
9
13
|
const subject_1 = require("../../subject");
|
|
10
14
|
const tenant_1 = require("../../tenant");
|
|
11
15
|
const authzen_entities_1 = require("./authzen-entities");
|
|
@@ -80,6 +84,9 @@ function resourceBelongsToOrg(resource, orgId) {
|
|
|
80
84
|
if (resource.type === exports.XEMA_ORG_RESOURCE_TYPE) {
|
|
81
85
|
return resource.id === orgId;
|
|
82
86
|
}
|
|
87
|
+
if (resource.type === xema_capability_resource_1.XEMA_CAPABILITY_RESOURCE_TYPE) {
|
|
88
|
+
return (0, xema_capability_resource_1.parseCapabilityResourceId)(resource.id)?.orgId === orgId;
|
|
89
|
+
}
|
|
83
90
|
const parsed = exports.XemaQualifiedResourceIdSchema.safeParse(resource.id);
|
|
84
91
|
if (!parsed.success) {
|
|
85
92
|
return false;
|
|
@@ -92,12 +99,24 @@ exports.XemaAuthzenActionSchema = authzen_entities_1.AuthzenActionSchema.extend(
|
|
|
92
99
|
message: 'a Xema action name is an OpenFGA relation name.',
|
|
93
100
|
}),
|
|
94
101
|
});
|
|
102
|
+
exports.XemaAuthzenInvocationSchema = zod_1.z
|
|
103
|
+
.object({
|
|
104
|
+
projectId: zod_1.z.string().min(1).optional(),
|
|
105
|
+
caller: execution_context_1.CallerSchema.optional(),
|
|
106
|
+
biome: execution_context_1.ExecutionContextBiomeSchema.optional(),
|
|
107
|
+
actingAgent: subject_1.AgentSubjectRefSchema.optional(),
|
|
108
|
+
aperture: capability_1.CapabilityApertureSchema.optional(),
|
|
109
|
+
constraints: execution_context_1.ExecutionContextConstraintsSchema.optional(),
|
|
110
|
+
resourceClassification: space_1.DataClassificationSchema.optional(),
|
|
111
|
+
})
|
|
112
|
+
.strict();
|
|
95
113
|
exports.XemaAuthzenContextSchema = zod_1.z
|
|
96
114
|
.object({
|
|
97
115
|
orgId: zod_1.z.string().min(1),
|
|
98
116
|
capability: zod_1.z.string().min(1).optional(),
|
|
99
117
|
environment: zod_1.z.string().min(1).optional(),
|
|
100
118
|
delegation: subject_1.DelegatedAuthoritySchema.optional(),
|
|
119
|
+
invocation: exports.XemaAuthzenInvocationSchema.optional(),
|
|
101
120
|
snapshot: authzen_snapshot_1.XemaAuthzSnapshotTokenSchema.optional(),
|
|
102
121
|
})
|
|
103
122
|
.strict();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AAqJA,8CAYC;AAQD,4DAQC;AAQD,oDAeC;AAxMD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IACnB,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC;IACjD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IACnB,qBAAW,CAAC,eAAe;CAC5B,CAAC,CAAC;AAcU,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAUC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAQD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAa;IAEb,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,OAAO,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA0BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAqBC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBAiBX;AAjBD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;AAC5C,CAAC,EAjBW,qBAAqB,qCAArB,qBAAqB,QAiBhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
export declare const XEMA_CAPABILITY_RESOURCE_TYPE = "capability";
|
|
2
|
+
export declare const XEMA_CAPABILITY_INVOKE_ACTION = "invoke";
|
|
3
|
+
export declare function encodeXemaIdSegment(raw: string): string;
|
|
4
|
+
export declare function decodeXemaIdSegment(encoded: string): string;
|
|
5
|
+
export declare function capabilityResourceId(orgId: string, capabilityRef: string, environment: string): string;
|
|
6
|
+
export interface ParsedCapabilityResourceId {
|
|
7
|
+
readonly orgId: string;
|
|
8
|
+
readonly capabilityRef: string;
|
|
9
|
+
readonly environment: string;
|
|
10
|
+
}
|
|
11
|
+
export declare function parseCapabilityResourceId(id: string): ParsedCapabilityResourceId | null;
|
|
12
|
+
//# sourceMappingURL=xema-capability-resource.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"xema-capability-resource.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-capability-resource.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,6BAA6B,eAAe,CAAC;AAG1D,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAYtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQvD;AAGD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuB3D;AAGD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,MAAM,CAcR;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAevF"}
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.XEMA_CAPABILITY_INVOKE_ACTION = exports.XEMA_CAPABILITY_RESOURCE_TYPE = void 0;
|
|
4
|
+
exports.encodeXemaIdSegment = encodeXemaIdSegment;
|
|
5
|
+
exports.decodeXemaIdSegment = decodeXemaIdSegment;
|
|
6
|
+
exports.capabilityResourceId = capabilityResourceId;
|
|
7
|
+
exports.parseCapabilityResourceId = parseCapabilityResourceId;
|
|
8
|
+
exports.XEMA_CAPABILITY_RESOURCE_TYPE = 'capability';
|
|
9
|
+
exports.XEMA_CAPABILITY_INVOKE_ACTION = 'invoke';
|
|
10
|
+
const ESCAPE = '~';
|
|
11
|
+
const ESCAPED_TILDE = '~7e';
|
|
12
|
+
const ESCAPED_COLON = '~3a';
|
|
13
|
+
const ESCAPED_PIPE = '~7c';
|
|
14
|
+
function encodeXemaIdSegment(raw) {
|
|
15
|
+
return raw
|
|
16
|
+
.split(ESCAPE)
|
|
17
|
+
.join(ESCAPED_TILDE)
|
|
18
|
+
.split(':')
|
|
19
|
+
.join(ESCAPED_COLON)
|
|
20
|
+
.split('|')
|
|
21
|
+
.join(ESCAPED_PIPE);
|
|
22
|
+
}
|
|
23
|
+
function decodeXemaIdSegment(encoded) {
|
|
24
|
+
let out = '';
|
|
25
|
+
for (let i = 0; i < encoded.length; i++) {
|
|
26
|
+
const ch = encoded[i];
|
|
27
|
+
if (ch !== ESCAPE) {
|
|
28
|
+
out += ch;
|
|
29
|
+
continue;
|
|
30
|
+
}
|
|
31
|
+
const seq = encoded.slice(i, i + 3);
|
|
32
|
+
if (seq === ESCAPED_TILDE) {
|
|
33
|
+
out += ESCAPE;
|
|
34
|
+
}
|
|
35
|
+
else if (seq === ESCAPED_COLON) {
|
|
36
|
+
out += ':';
|
|
37
|
+
}
|
|
38
|
+
else if (seq === ESCAPED_PIPE) {
|
|
39
|
+
out += '|';
|
|
40
|
+
}
|
|
41
|
+
else {
|
|
42
|
+
throw new Error(`decodeXemaIdSegment: malformed escape sequence "${seq}" at index ${i} in "${encoded}".`);
|
|
43
|
+
}
|
|
44
|
+
i += 2;
|
|
45
|
+
}
|
|
46
|
+
return out;
|
|
47
|
+
}
|
|
48
|
+
function capabilityResourceId(orgId, capabilityRef, environment) {
|
|
49
|
+
for (const [name, value] of [
|
|
50
|
+
['orgId', orgId],
|
|
51
|
+
['capabilityRef', capabilityRef],
|
|
52
|
+
['environment', environment],
|
|
53
|
+
]) {
|
|
54
|
+
if (value.length === 0) {
|
|
55
|
+
throw new Error(`capabilityResourceId: ${name} is empty.`);
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
if (/[|:\s]/.test(orgId)) {
|
|
59
|
+
throw new Error(`capabilityResourceId: orgId "${orgId}" contains \`|\`, \`:\` or whitespace.`);
|
|
60
|
+
}
|
|
61
|
+
return `${orgId}|${encodeXemaIdSegment(capabilityRef)}|${encodeXemaIdSegment(environment)}`;
|
|
62
|
+
}
|
|
63
|
+
function parseCapabilityResourceId(id) {
|
|
64
|
+
const parts = id.split('|');
|
|
65
|
+
if (parts.length !== 3 || parts.some((p) => p.length === 0 || /[:\s]/.test(p))) {
|
|
66
|
+
return null;
|
|
67
|
+
}
|
|
68
|
+
const [orgId, ref, env] = parts;
|
|
69
|
+
try {
|
|
70
|
+
return {
|
|
71
|
+
orgId,
|
|
72
|
+
capabilityRef: decodeXemaIdSegment(ref),
|
|
73
|
+
environment: decodeXemaIdSegment(env),
|
|
74
|
+
};
|
|
75
|
+
}
|
|
76
|
+
catch {
|
|
77
|
+
return null;
|
|
78
|
+
}
|
|
79
|
+
}
|
|
80
|
+
//# sourceMappingURL=xema-capability-resource.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"xema-capability-resource.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-capability-resource.ts"],"names":[],"mappings":";;;AAkCA,kDAQC;AAGD,kDAuBC;AAGD,oDAkBC;AASD,8DAeC;AA9FY,QAAA,6BAA6B,GAAG,YAAY,CAAC;AAG7C,QAAA,6BAA6B,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,GAAG,GAAG,CAAC;AACnB,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,YAAY,GAAG,KAAK,CAAC;AAO3B,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAGD,SAAgB,mBAAmB,CAAC,OAAe;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,GAAG,IAAI,MAAM,CAAC;QAChB,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACjC,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,cAAc,CAAC,QAAQ,OAAO,IAAI,CACzF,CAAC;QACJ,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAgB,oBAAoB,CAClC,KAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,eAAe,EAAE,aAAa,CAAC;QAChC,CAAC,aAAa,EAAE,WAAW,CAAC;KACpB,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,YAAY,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,wCAAwC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9F,CAAC;AASD,SAAgB,yBAAyB,CAAC,EAAU;IAClD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAiC,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO;YACL,KAAK;YACL,aAAa,EAAE,mBAAmB,CAAC,GAAG,CAAC;YACvC,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.36.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|