@xemahq/contracts 0.45.0 → 0.47.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +1 -1
- package/dist/agent-session/lib/lifecycle.d.ts +2 -0
- package/dist/agent-session/lib/lifecycle.d.ts.map +1 -1
- package/dist/agent-session/lib/lifecycle.js +1 -0
- package/dist/agent-session/lib/lifecycle.js.map +1 -1
- package/dist/authorization-facts/lib/facts-apply.d.ts +1 -3
- package/dist/authorization-facts/lib/facts-apply.d.ts.map +1 -1
- package/dist/authorization-facts/lib/facts-apply.js +2 -22
- package/dist/authorization-facts/lib/facts-apply.js.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts +2 -0
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js +4 -2
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authorization-module/platform/xema_core.fga +15 -1
- package/dist/authorization-module/platform/xema_core.fga.yaml +35 -0
- package/dist/authorization-module/server/platform-module-files.d.ts.map +1 -1
- package/dist/authorization-module/server/platform-module-files.js +2 -1
- package/dist/authorization-module/server/platform-module-files.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts +23 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js +18 -1
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/package.json +1 -1
package/dist/.source-stamp.json
CHANGED
|
@@ -25,9 +25,11 @@ export declare const SessionLifecycleStateSchema: z.ZodEnum<{
|
|
|
25
25
|
export declare const SessionOwnerKind: {
|
|
26
26
|
readonly interactive_session: "interactive_session";
|
|
27
27
|
readonly pipeline_run: "pipeline_run";
|
|
28
|
+
readonly organization: "organization";
|
|
28
29
|
};
|
|
29
30
|
export type SessionOwnerKindValue = (typeof SessionOwnerKind)[keyof typeof SessionOwnerKind];
|
|
30
31
|
export declare const SessionOwnerKindSchema: z.ZodEnum<{
|
|
32
|
+
organization: "organization";
|
|
31
33
|
interactive_session: "interactive_session";
|
|
32
34
|
pipeline_run: "pipeline_run";
|
|
33
35
|
}>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;;;;;;;CAUxB,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,eAAO,MAAM,2BAA2B;;;;;;;;;;EAKvC,CAAC;AAcF,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,eAAO,MAAM,sBAAsB;;;;EAKlC,CAAC;AAiDF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,0BAA0B,EAChC,EAAE,EAAE,0BAA0B,GAC7B,OAAO,CAET;AAOD,wBAAgB,UAAU,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAMrE;AAQD,wBAAgB,UAAU,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAErE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAEtE"}
|
|
@@ -21,6 +21,7 @@ exports.SessionLifecycleStateSchema = zod_1.z.enum(Object.values(exports.Session
|
|
|
21
21
|
exports.SessionOwnerKind = {
|
|
22
22
|
interactive_session: 'interactive_session',
|
|
23
23
|
pipeline_run: 'pipeline_run',
|
|
24
|
+
organization: 'organization',
|
|
24
25
|
};
|
|
25
26
|
exports.SessionOwnerKindSchema = zod_1.z.enum(Object.values(exports.SessionOwnerKind));
|
|
26
27
|
const TRANSITIONS = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":";;;AA0IA,sCAKC;AAOD,gCAMC;AAQD,gCAEC;AAQD,kCAEC;AA7ID,6BAAwB;AAMX,QAAA,qBAAqB,GAAG;IACnC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAKE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,MAAM,CAAC,6BAAqB,CAGlC,CACF,CAAC;AAcW,QAAA,gBAAgB,GAAG;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC;AAKE,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAG7B,CACF,CAAC;AAcF,MAAM,WAAW,GAEb;IACF,QAAQ,EAAE,IAAI,GAAG,CAAC;QAChB,6BAAqB,CAAC,YAAY;QAClC,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,UAAU;QAChC,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,6BAAqB,CAAC,UAAU;QAChC,6BAAqB,CAAC,QAAQ;QAC9B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,UAAU,EAAE,IAAI,GAAG,CAAC;QAClB,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,UAAU,EAAE,IAAI,GAAG,CAAC;QAClB,6BAAqB,CAAC,SAAS;QAC/B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,6BAAqB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,6BAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,QAAQ,EAAE,IAAI,GAAG,EAAE;CACpB,CAAC;AAEF,SAAgB,aAAa,CAC3B,IAAgC,EAChC,EAA8B;IAE9B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAOD,SAAgB,UAAU,CAAC,KAAiC;IAC1D,OAAO,CACL,KAAK,KAAK,6BAAqB,CAAC,SAAS;QACzC,KAAK,KAAK,6BAAqB,CAAC,MAAM;QACtC,KAAK,KAAK,6BAAqB,CAAC,QAAQ,CACzC,CAAC;AACJ,CAAC;AAQD,SAAgB,UAAU,CAAC,KAAiC;IAC1D,OAAO,KAAK,KAAK,6BAAqB,CAAC,MAAM,CAAC;AAChD,CAAC;AAQD,SAAgB,WAAW,CAAC,KAAiC;IAC3D,OAAO,KAAK,KAAK,6BAAqB,CAAC,MAAM,CAAC;AAChD,CAAC"}
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
export declare const FACTS_APPLY_MAX_TUPLES = 100;
|
|
3
2
|
export declare const FactsVersionSchema: z.ZodNumber;
|
|
4
3
|
export declare enum FactChangeKind {
|
|
5
4
|
Delta = "delta",
|
|
@@ -139,7 +138,6 @@ export declare const FactChangeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
|
139
138
|
version: z.ZodNumber;
|
|
140
139
|
}, z.core.$strict>], "kind">;
|
|
141
140
|
export type FactChange = z.infer<typeof FactChangeSchema>;
|
|
142
|
-
export declare function namedTupleCount(change: FactChange): number;
|
|
143
141
|
export declare const FactsApplyRequestSchema: z.ZodObject<{
|
|
144
142
|
orgId: z.ZodString;
|
|
145
143
|
biomeId: z.ZodString;
|
|
@@ -237,7 +235,7 @@ export declare enum FactsApplyRefusal {
|
|
|
237
235
|
TypeNotWritable = "type_not_writable",
|
|
238
236
|
RelationNotWritable = "relation_not_writable",
|
|
239
237
|
TenantMismatch = "tenant_mismatch",
|
|
240
|
-
|
|
238
|
+
SplitWouldWiden = "split_would_widen",
|
|
241
239
|
TupleNotAdmittedByModel = "tuple_not_admitted_by_model"
|
|
242
240
|
}
|
|
243
241
|
export declare const FactsApplyRefusalSchema: z.ZodEnum<typeof FactsApplyRefusal>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"facts-apply.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"facts-apply.d.ts","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2DxB,eAAO,MAAM,kBAAkB,aAA8B,CAAC;AAe9D,oBAAY,cAAc;IACxB,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,YAAY,kBAAkB;CAC/B;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAa9B,CAAC;AAEL,eAAO,MAAM,wBAAwB;;;;;;;;;;kBAK1B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAQ9B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;kBAM9B,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkChC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,oBAAY,iBAAiB;IAE3B,OAAO,YAAY;IAEnB,UAAU,eAAe;IAEzB,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;;;kBAOxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,oBAAY,iBAAiB;IAE3B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,mBAAmB,0BAA0B;IAE7C,cAAc,oBAAoB;IAOlC,eAAe,sBAAsB;IAErC,uBAAuB,gCAAgC;CACxD;AAED,eAAO,MAAM,uBAAuB,qCAAkC,CAAC"}
|
|
@@ -1,10 +1,8 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.FactsApplyRefusalSchema = exports.FactsApplyRefusal = exports.FactsApplyResponseSchema = exports.FactChangeResultSchema = exports.FactChangeOutcomeSchema = exports.FactChangeOutcome = exports.FactsApplyRequestSchema = exports.FactChangeSchema = exports.DeleteObjectFactChangeSchema = exports.DesiredStateFactChangeSchema = exports.DesiredFactSubjectSchema = exports.DeltaFactChangeSchema = exports.FactChangeKindSchema = exports.FactChangeKind = exports.FactsVersionSchema =
|
|
4
|
-
exports.namedTupleCount = namedTupleCount;
|
|
3
|
+
exports.FactsApplyRefusalSchema = exports.FactsApplyRefusal = exports.FactsApplyResponseSchema = exports.FactChangeResultSchema = exports.FactChangeOutcomeSchema = exports.FactChangeOutcome = exports.FactsApplyRequestSchema = exports.FactChangeSchema = exports.DeleteObjectFactChangeSchema = exports.DesiredStateFactChangeSchema = exports.DesiredFactSubjectSchema = exports.DeltaFactChangeSchema = exports.FactChangeKindSchema = exports.FactChangeKind = exports.FactsVersionSchema = void 0;
|
|
5
4
|
const zod_1 = require("zod");
|
|
6
5
|
const fact_tuple_1 = require("./fact-tuple");
|
|
7
|
-
exports.FACTS_APPLY_MAX_TUPLES = 100;
|
|
8
6
|
exports.FactsVersionSchema = zod_1.z.number().int().positive();
|
|
9
7
|
var FactChangeKind;
|
|
10
8
|
(function (FactChangeKind) {
|
|
@@ -53,16 +51,6 @@ exports.FactChangeSchema = zod_1.z.discriminatedUnion('kind', [
|
|
|
53
51
|
exports.DesiredStateFactChangeSchema,
|
|
54
52
|
exports.DeleteObjectFactChangeSchema,
|
|
55
53
|
]);
|
|
56
|
-
function namedTupleCount(change) {
|
|
57
|
-
switch (change.kind) {
|
|
58
|
-
case FactChangeKind.Delta:
|
|
59
|
-
return change.writes.length + change.deletes.length;
|
|
60
|
-
case FactChangeKind.DesiredState:
|
|
61
|
-
return Object.values(change.relations).reduce((sum, subjects) => sum + subjects.length, 0);
|
|
62
|
-
case FactChangeKind.DeleteObject:
|
|
63
|
-
return 0;
|
|
64
|
-
}
|
|
65
|
-
}
|
|
66
54
|
function objectKey(object) {
|
|
67
55
|
return `${object.type}:${object.id}`;
|
|
68
56
|
}
|
|
@@ -98,14 +86,6 @@ exports.FactsApplyRequestSchema = zod_1.z
|
|
|
98
86
|
}
|
|
99
87
|
}
|
|
100
88
|
});
|
|
101
|
-
const named = request.changes.reduce((s, c) => s + namedTupleCount(c), 0);
|
|
102
|
-
if (named > exports.FACTS_APPLY_MAX_TUPLES) {
|
|
103
|
-
ctx.addIssue({
|
|
104
|
-
code: 'custom',
|
|
105
|
-
path: ['changes'],
|
|
106
|
-
message: `the request names ${named} tuples; the limit is ${exports.FACTS_APPLY_MAX_TUPLES} and a request is refused, never split.`,
|
|
107
|
-
});
|
|
108
|
-
}
|
|
109
89
|
});
|
|
110
90
|
var FactChangeOutcome;
|
|
111
91
|
(function (FactChangeOutcome) {
|
|
@@ -134,7 +114,7 @@ var FactsApplyRefusal;
|
|
|
134
114
|
FactsApplyRefusal["TypeNotWritable"] = "type_not_writable";
|
|
135
115
|
FactsApplyRefusal["RelationNotWritable"] = "relation_not_writable";
|
|
136
116
|
FactsApplyRefusal["TenantMismatch"] = "tenant_mismatch";
|
|
137
|
-
FactsApplyRefusal["
|
|
117
|
+
FactsApplyRefusal["SplitWouldWiden"] = "split_would_widen";
|
|
138
118
|
FactsApplyRefusal["TupleNotAdmittedByModel"] = "tuple_not_admitted_by_model";
|
|
139
119
|
})(FactsApplyRefusal || (exports.FactsApplyRefusal = FactsApplyRefusal = {}));
|
|
140
120
|
exports.FactsApplyRefusalSchema = zod_1.z.nativeEnum(FactsApplyRefusal);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"facts-apply.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"facts-apply.js","sourceRoot":"","sources":["../../../src/authorization-facts/lib/facts-apply.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAQsB;AAiDT,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAe9D,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,gDAA8B,CAAA;IAC9B,gDAA8B,CAAA;AAChC,CAAC,EAJW,cAAc,8BAAd,cAAc,QAIzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEpD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAe,CAAC;IAEjC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;IACrD,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEQ,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,iCAAoB;IAC7B,SAAS,EAAE,gCAAmB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,+BAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,gCAAwB,CAAC,CAAC;IAC1E,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC;IAC5C,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,0BAAkB;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,oCAA4B;IAC5B,oCAA4B;CAC7B,CAAC,CAAC;AAGH,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAEY,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAEN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAExB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;gBAClC,OAAO,EAAE,UAAU,GAAG,qGAAqG;aAC5H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;wBACxB,OAAO,EAAE,SAAS,IAAA,yBAAY,EAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,6CAA6C;qBAClG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAE3B,wCAAmB,CAAA;IAEnB,8CAAyB,CAAA;IAEzB,8CAAyB,CAAA;AAC3B,CAAC,EAPW,iBAAiB,iCAAjB,iBAAiB,QAO5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;AAE1D,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,gCAAmB;IAC3B,OAAO,EAAE,+BAAuB;IAEhC,eAAe,EAAE,0BAAkB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,8BAAsB,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,IAAY,iBAkBX;AAlBD,WAAY,iBAAiB;IAE3B,uDAAkC,CAAA;IAElC,0DAAqC,CAAA;IAErC,kEAA6C,CAAA;IAE7C,uDAAkC,CAAA;IAOlC,0DAAqC,CAAA;IAErC,4EAAuD,CAAA;AACzD,CAAC,EAlBW,iBAAiB,iCAAjB,iBAAiB,QAkB5B;AAEY,QAAA,uBAAuB,GAAG,OAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC"}
|
|
@@ -9,6 +9,8 @@ export declare const XEMA_PARENT_TYPES_SLOT = "${XEMA_PARENT_TYPES}";
|
|
|
9
9
|
export declare const XEMA_READ_RELATION = "xema_read";
|
|
10
10
|
export declare const PLATFORM_RESOURCE_MODULES: readonly PlatformAuthorizationModule[];
|
|
11
11
|
export declare const XEMA_INHERITING_PLATFORM_TYPES: readonly ["project", "xema_artifact", "xema_session"];
|
|
12
|
+
export declare const XEMA_ANCHORED_PLATFORM_TYPES: readonly ["xema_session"];
|
|
13
|
+
export declare const XEMA_ANCHOR_RELATION = "anchor";
|
|
12
14
|
export declare enum XemaAuthorizationInterface {
|
|
13
15
|
Parent = "xema.parent"
|
|
14
16
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwC3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.PLATFORM_FACT_WRITERS = exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
3
|
+
exports.PLATFORM_FACT_WRITERS = exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_ANCHOR_RELATION = exports.XEMA_ANCHORED_PLATFORM_TYPES = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
4
4
|
exports.platformWritableRelationsOf = platformWritableRelationsOf;
|
|
5
5
|
const zod_1 = require("zod");
|
|
6
6
|
var PlatformAuthorizationModule;
|
|
@@ -18,6 +18,8 @@ exports.XEMA_INHERITING_PLATFORM_TYPES = Object.freeze([
|
|
|
18
18
|
'xema_artifact',
|
|
19
19
|
'xema_session',
|
|
20
20
|
]);
|
|
21
|
+
exports.XEMA_ANCHORED_PLATFORM_TYPES = Object.freeze(['xema_session']);
|
|
22
|
+
exports.XEMA_ANCHOR_RELATION = 'anchor';
|
|
21
23
|
var XemaAuthorizationInterface;
|
|
22
24
|
(function (XemaAuthorizationInterface) {
|
|
23
25
|
XemaAuthorizationInterface["Parent"] = "xema.parent";
|
|
@@ -53,7 +55,7 @@ exports.PLATFORM_FACT_WRITERS = Object.freeze({
|
|
|
53
55
|
}),
|
|
54
56
|
xema_session: Object.freeze({
|
|
55
57
|
biome: 'agent-runtime',
|
|
56
|
-
relations: Object.freeze(['parent', 'owner', 'participant']),
|
|
58
|
+
relations: Object.freeze(['parent', 'anchor', 'owner', 'participant']),
|
|
57
59
|
}),
|
|
58
60
|
xema_artifact: Object.freeze({
|
|
59
61
|
biome: 'agent-runtime',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAsMA,kEAUC;AAhND,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;KACvE,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAGF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAC3B,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;QAClD,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -27,6 +27,13 @@ type runner
|
|
|
27
27
|
type app
|
|
28
28
|
type external-subject
|
|
29
29
|
|
|
30
|
+
# An ORGANIZATION as a DELEGATOR — never a member of anything, never granted
|
|
31
|
+
# anything. It appears only as the OWNER of an org-owned session, which derives
|
|
32
|
+
# no human rights: no relation evaluates `owner` for a user, and an org-owned
|
|
33
|
+
# session has no `parent` to inherit from. Access to such a session is by the
|
|
34
|
+
# delegation it is bound to, checked by the service that owns it.
|
|
35
|
+
type organization
|
|
36
|
+
|
|
30
37
|
type org
|
|
31
38
|
relations
|
|
32
39
|
define member: [user, agent, app, service]
|
|
@@ -61,10 +68,17 @@ type project
|
|
|
61
68
|
define xema_write: editor or xema_admin or xema_write from parent
|
|
62
69
|
define xema_read: viewer or xema_write or xema_read from parent
|
|
63
70
|
|
|
71
|
+
# `anchor` is CONTAINMENT WITHOUT INHERITANCE: the object an org-owned session
|
|
72
|
+
# was launched for. No relation derives from it — an org admin or a reader of
|
|
73
|
+
# the anchored object gains nothing — and it exists so the PDP's delegation
|
|
74
|
+
# scope walk (which follows `parent` AND `anchor`) keeps the session and its
|
|
75
|
+
# descendants inside the delegation's scope. An org-owned session writes
|
|
76
|
+
# `owner` (organization) and `anchor`, and no `parent` and no `participant`.
|
|
64
77
|
type xema_session
|
|
65
78
|
relations
|
|
66
79
|
define parent: [org, project, ${XEMA_PARENT_TYPES}]
|
|
67
|
-
define
|
|
80
|
+
define anchor: [org, project, ${XEMA_PARENT_TYPES}]
|
|
81
|
+
define owner: [user, agent, organization]
|
|
68
82
|
define participant: [user, agent]
|
|
69
83
|
define xema_admin: owner or xema_admin from parent
|
|
70
84
|
define xema_write: owner or xema_write from parent
|
|
@@ -41,6 +41,17 @@ tuples:
|
|
|
41
41
|
- user: xema_session:org1|s1
|
|
42
42
|
relation: parent
|
|
43
43
|
object: xema_artifact:org1|a3
|
|
44
|
+
# An ORG-OWNED session: owner is the organization, ANCHORED to the project
|
|
45
|
+
# (containment only), with no parent and no participant.
|
|
46
|
+
- user: organization:org1
|
|
47
|
+
relation: owner
|
|
48
|
+
object: xema_session:org1|s2
|
|
49
|
+
- user: project:org1|p1
|
|
50
|
+
relation: anchor
|
|
51
|
+
object: xema_session:org1|s2
|
|
52
|
+
- user: xema_session:org1|s2
|
|
53
|
+
relation: parent
|
|
54
|
+
object: xema_artifact:org1|a4
|
|
44
55
|
tests:
|
|
45
56
|
- name: an artifact inherits from its project, never copied
|
|
46
57
|
check:
|
|
@@ -121,3 +132,27 @@ tests:
|
|
|
121
132
|
assertions:
|
|
122
133
|
can_read: true
|
|
123
134
|
can_write: false
|
|
135
|
+
- name: an org-owned session derives no human rights — not even the org admin's
|
|
136
|
+
check:
|
|
137
|
+
- user: user:root
|
|
138
|
+
object: xema_session:org1|s2
|
|
139
|
+
assertions:
|
|
140
|
+
can_read: false
|
|
141
|
+
can_write: false
|
|
142
|
+
- user: user:bob
|
|
143
|
+
object: xema_session:org1|s2
|
|
144
|
+
assertions:
|
|
145
|
+
can_read: false
|
|
146
|
+
- user: user:dave
|
|
147
|
+
object: xema_session:org1|s2
|
|
148
|
+
assertions:
|
|
149
|
+
can_read: false
|
|
150
|
+
- user: user:root
|
|
151
|
+
object: xema_artifact:org1|a4
|
|
152
|
+
assertions:
|
|
153
|
+
can_read: false
|
|
154
|
+
can_delete: false
|
|
155
|
+
- user: user:bob
|
|
156
|
+
object: xema_artifact:org1|a4
|
|
157
|
+
assertions:
|
|
158
|
+
can_read: false
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-module-files.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,
|
|
1
|
+
{"version":3,"file":"platform-module-files.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,EAI5B,MAAM,uCAAuC,CAAC;AAO/C,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAE7C,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAE1E,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAGD,eAAO,MAAM,uCAAuC,QAInD,CAAC;AAGF,wBAAgB,oCAAoC,IAAI,SAAS,gCAAgC,EAAE,CAelG;AAeD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,GAAG,IAAI,CAoBf"}
|
|
@@ -27,7 +27,8 @@ function fillXemaCoreParentSlots(template, implementers) {
|
|
|
27
27
|
const executable = lines.filter((line) => !isComment(line)).join('\n');
|
|
28
28
|
const occurrences = executable.split(platform_authorization_modules_1.XEMA_PARENT_TYPES_SLOT).length - 1;
|
|
29
29
|
const slotted = executable.split(SLOT_TEXT).length - 1;
|
|
30
|
-
if (occurrences !==
|
|
30
|
+
if (occurrences !==
|
|
31
|
+
platform_authorization_modules_1.XEMA_INHERITING_PLATFORM_TYPES.length + platform_authorization_modules_1.XEMA_ANCHORED_PLATFORM_TYPES.length ||
|
|
31
32
|
slotted !== occurrences) {
|
|
32
33
|
return null;
|
|
33
34
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-module-files.js","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-module-files.js","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":";;;AA+BA,oFAeC;AAeD,0DAuBC;AApFD,qCAAuC;AACvC,yCAAiC;AAEjC,0FAK+C;AAgBlC,QAAA,uCAAuC,GAAG,IAAA,gBAAI,EACzD,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;AAGF,SAAgB,oCAAoC;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,4DAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI;YACJ,QAAQ,EAAE,IAAA,sBAAY,EACpB,IAAA,gBAAI,EAAC,+CAAuC,EAAE,IAAI,CAAC,EACnD,MAAM,CACP;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,SAAS,GAAG,KAAK,uDAAsB,EAAE,CAAC;AAYhD,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,YAA+B;IAE/B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,uDAAsB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IACE,WAAW;QACT,+DAA8B,CAAC,MAAM,GAAG,6DAA4B,CAAC,MAAM;QAC7E,OAAO,KAAK,WAAW,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
|
|
@@ -45,6 +45,14 @@ export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
|
45
45
|
}, z.core.$strict>>;
|
|
46
46
|
}, z.core.$strict>;
|
|
47
47
|
export type XemaAuthzenSubject = z.infer<typeof XemaAuthzenSubjectSchema>;
|
|
48
|
+
export declare const XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS: readonly [SubjectKind.Organization];
|
|
49
|
+
export declare const XemaAuthzenDelegatorSubjectSchema: z.ZodObject<{
|
|
50
|
+
type: z.ZodEnum<{
|
|
51
|
+
organization: SubjectKind.Organization;
|
|
52
|
+
}>;
|
|
53
|
+
id: z.ZodString;
|
|
54
|
+
}, z.core.$strict>;
|
|
55
|
+
export type XemaAuthzenDelegatorSubject = z.infer<typeof XemaAuthzenDelegatorSubjectSchema>;
|
|
48
56
|
export declare const XEMA_ORG_RESOURCE_TYPE = "org";
|
|
49
57
|
export declare const XEMA_QUALIFIED_ID_SEPARATOR = "|";
|
|
50
58
|
export declare const XEMA_QUALIFIED_ID_SEGMENT_PATTERN: RegExp;
|
|
@@ -81,11 +89,20 @@ export declare const XemaAuthzenInvocationSchema: z.ZodObject<{
|
|
|
81
89
|
resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
|
|
82
90
|
}, z.core.$strict>;
|
|
83
91
|
export type XemaAuthzenInvocation = z.infer<typeof XemaAuthzenInvocationSchema>;
|
|
92
|
+
export declare const XemaAuthzenInstanceSchema: z.ZodObject<{
|
|
93
|
+
type: z.ZodString;
|
|
94
|
+
id: z.ZodString;
|
|
95
|
+
}, z.core.$strict>;
|
|
96
|
+
export type XemaAuthzenInstance = z.infer<typeof XemaAuthzenInstanceSchema>;
|
|
84
97
|
export declare const XemaAuthzenContextSchema: z.ZodObject<{
|
|
85
98
|
orgId: z.ZodOptional<z.ZodString>;
|
|
86
99
|
capability: z.ZodOptional<z.ZodString>;
|
|
87
100
|
environment: z.ZodOptional<z.ZodString>;
|
|
88
101
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
102
|
+
instance: z.ZodOptional<z.ZodObject<{
|
|
103
|
+
type: z.ZodString;
|
|
104
|
+
id: z.ZodString;
|
|
105
|
+
}, z.core.$strict>>;
|
|
89
106
|
invocation: z.ZodOptional<z.ZodObject<{
|
|
90
107
|
projectId: z.ZodOptional<z.ZodString>;
|
|
91
108
|
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
@@ -131,6 +148,10 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
|
|
|
131
148
|
capability: z.ZodOptional<z.ZodString>;
|
|
132
149
|
environment: z.ZodOptional<z.ZodString>;
|
|
133
150
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
151
|
+
instance: z.ZodOptional<z.ZodObject<{
|
|
152
|
+
type: z.ZodString;
|
|
153
|
+
id: z.ZodString;
|
|
154
|
+
}, z.core.$strict>>;
|
|
134
155
|
invocation: z.ZodOptional<z.ZodObject<{
|
|
135
156
|
projectId: z.ZodOptional<z.ZodString>;
|
|
136
157
|
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
@@ -152,7 +173,8 @@ export declare enum XemaAuthzenReasonCode {
|
|
|
152
173
|
CapabilityNotDelegated = "capability_not_delegated",
|
|
153
174
|
ResourceOutsideDelegatedScope = "resource_outside_delegated_scope",
|
|
154
175
|
CeilingRefused = "ceiling_refused",
|
|
155
|
-
NamespaceWithdrawn = "namespace_withdrawn"
|
|
176
|
+
NamespaceWithdrawn = "namespace_withdrawn",
|
|
177
|
+
SubjectNotEvaluable = "subject_not_evaluable"
|
|
156
178
|
}
|
|
157
179
|
export declare const XemaAuthzenReasonCodeSchema: z.ZodEnum<typeof XemaAuthzenReasonCode>;
|
|
158
180
|
export declare enum XemaAuthzenErrorCode {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA0BH,eAAO,MAAM,2BAA2B;;;;;;;;kBAU7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenInvocationSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
3
|
+
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenInstanceSchema = exports.XemaAuthzenInvocationSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenDelegatorSubjectSchema = exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
4
4
|
exports.qualifyResourceId = qualifyResourceId;
|
|
5
5
|
exports.parseQualifiedResourceId = parseQualifiedResourceId;
|
|
6
6
|
exports.resourceBelongsToOrg = resourceBelongsToOrg;
|
|
@@ -43,6 +43,15 @@ exports.XemaAuthzenSubjectSchema = zod_1.z
|
|
|
43
43
|
properties: exports.XemaAuthzenSubjectPropertiesSchema.optional(),
|
|
44
44
|
})
|
|
45
45
|
.strict();
|
|
46
|
+
exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS = Object.freeze([
|
|
47
|
+
subject_1.SubjectKind.Organization,
|
|
48
|
+
]);
|
|
49
|
+
exports.XemaAuthzenDelegatorSubjectSchema = zod_1.z
|
|
50
|
+
.object({
|
|
51
|
+
type: zod_1.z.enum(exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS),
|
|
52
|
+
id: zod_1.z.string().min(1),
|
|
53
|
+
})
|
|
54
|
+
.strict();
|
|
46
55
|
exports.XEMA_ORG_RESOURCE_TYPE = 'org';
|
|
47
56
|
exports.XEMA_QUALIFIED_ID_SEPARATOR = '|';
|
|
48
57
|
exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = /^[^|:\s]+$/;
|
|
@@ -110,12 +119,19 @@ exports.XemaAuthzenInvocationSchema = zod_1.z
|
|
|
110
119
|
resourceClassification: space_1.DataClassificationSchema.optional(),
|
|
111
120
|
})
|
|
112
121
|
.strict();
|
|
122
|
+
exports.XemaAuthzenInstanceSchema = zod_1.z
|
|
123
|
+
.object({
|
|
124
|
+
type: zod_1.z.string().min(1),
|
|
125
|
+
id: zod_1.z.string().min(1),
|
|
126
|
+
})
|
|
127
|
+
.strict();
|
|
113
128
|
exports.XemaAuthzenContextSchema = zod_1.z
|
|
114
129
|
.object({
|
|
115
130
|
orgId: zod_1.z.string().min(1).optional(),
|
|
116
131
|
capability: zod_1.z.string().min(1).optional(),
|
|
117
132
|
environment: zod_1.z.string().min(1).optional(),
|
|
118
133
|
delegation: subject_1.DelegatedAuthoritySchema.optional(),
|
|
134
|
+
instance: exports.XemaAuthzenInstanceSchema.optional(),
|
|
119
135
|
invocation: exports.XemaAuthzenInvocationSchema.optional(),
|
|
120
136
|
snapshot: authzen_snapshot_1.XemaAuthzSnapshotTokenSchema.optional(),
|
|
121
137
|
})
|
|
@@ -138,6 +154,7 @@ var XemaAuthzenReasonCode;
|
|
|
138
154
|
XemaAuthzenReasonCode["ResourceOutsideDelegatedScope"] = "resource_outside_delegated_scope";
|
|
139
155
|
XemaAuthzenReasonCode["CeilingRefused"] = "ceiling_refused";
|
|
140
156
|
XemaAuthzenReasonCode["NamespaceWithdrawn"] = "namespace_withdrawn";
|
|
157
|
+
XemaAuthzenReasonCode["SubjectNotEvaluable"] = "subject_not_evaluable";
|
|
141
158
|
})(XemaAuthzenReasonCode || (exports.XemaAuthzenReasonCode = XemaAuthzenReasonCode = {}));
|
|
142
159
|
exports.XemaAuthzenReasonCodeSchema = zod_1.z.nativeEnum(XemaAuthzenReasonCode);
|
|
143
160
|
var XemaAuthzenErrorCode;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AA6KA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AA7OD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAclE,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA0BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBAyBX;AAzBD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EAzBW,qBAAqB,qCAArB,qBAAqB,QAyBhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.47.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|