@xemahq/contracts 0.46.0 → 0.47.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +1 -1
- package/dist/agent-session/lib/lifecycle.d.ts +2 -0
- package/dist/agent-session/lib/lifecycle.d.ts.map +1 -1
- package/dist/agent-session/lib/lifecycle.js +1 -0
- package/dist/agent-session/lib/lifecycle.js.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts +2 -0
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js +4 -2
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authorization-module/platform/xema_core.fga +15 -1
- package/dist/authorization-module/platform/xema_core.fga.yaml +35 -0
- package/dist/authorization-module/server/platform-module-files.d.ts.map +1 -1
- package/dist/authorization-module/server/platform-module-files.js +2 -1
- package/dist/authorization-module/server/platform-module-files.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts +23 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js +18 -1
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/package.json +1 -1
package/dist/.source-stamp.json
CHANGED
|
@@ -25,9 +25,11 @@ export declare const SessionLifecycleStateSchema: z.ZodEnum<{
|
|
|
25
25
|
export declare const SessionOwnerKind: {
|
|
26
26
|
readonly interactive_session: "interactive_session";
|
|
27
27
|
readonly pipeline_run: "pipeline_run";
|
|
28
|
+
readonly organization: "organization";
|
|
28
29
|
};
|
|
29
30
|
export type SessionOwnerKindValue = (typeof SessionOwnerKind)[keyof typeof SessionOwnerKind];
|
|
30
31
|
export declare const SessionOwnerKindSchema: z.ZodEnum<{
|
|
32
|
+
organization: "organization";
|
|
31
33
|
interactive_session: "interactive_session";
|
|
32
34
|
pipeline_run: "pipeline_run";
|
|
33
35
|
}>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;;;;;;;CAUxB,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,eAAO,MAAM,2BAA2B;;;;;;;;;;EAKvC,CAAC;AAcF,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,eAAO,MAAM,sBAAsB;;;;EAKlC,CAAC;AAiDF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,0BAA0B,EAChC,EAAE,EAAE,0BAA0B,GAC7B,OAAO,CAET;AAOD,wBAAgB,UAAU,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAMrE;AAQD,wBAAgB,UAAU,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAErE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAEtE"}
|
|
@@ -21,6 +21,7 @@ exports.SessionLifecycleStateSchema = zod_1.z.enum(Object.values(exports.Session
|
|
|
21
21
|
exports.SessionOwnerKind = {
|
|
22
22
|
interactive_session: 'interactive_session',
|
|
23
23
|
pipeline_run: 'pipeline_run',
|
|
24
|
+
organization: 'organization',
|
|
24
25
|
};
|
|
25
26
|
exports.SessionOwnerKindSchema = zod_1.z.enum(Object.values(exports.SessionOwnerKind));
|
|
26
27
|
const TRANSITIONS = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/agent-session/lib/lifecycle.ts"],"names":[],"mappings":";;;AA0IA,sCAKC;AAOD,gCAMC;AAQD,gCAEC;AAQD,kCAEC;AA7ID,6BAAwB;AAMX,QAAA,qBAAqB,GAAG;IACnC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAKE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,MAAM,CAAC,6BAAqB,CAGlC,CACF,CAAC;AAcW,QAAA,gBAAgB,GAAG;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC;AAKE,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAG7B,CACF,CAAC;AAcF,MAAM,WAAW,GAEb;IACF,QAAQ,EAAE,IAAI,GAAG,CAAC;QAChB,6BAAqB,CAAC,YAAY;QAClC,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,UAAU;QAChC,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,6BAAqB,CAAC,UAAU;QAChC,6BAAqB,CAAC,QAAQ;QAC9B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,UAAU,EAAE,IAAI,GAAG,CAAC;QAClB,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;QAC5B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,UAAU,EAAE,IAAI,GAAG,CAAC;QAClB,6BAAqB,CAAC,SAAS;QAC/B,6BAAqB,CAAC,MAAM;KAC7B,CAAC;IACF,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,6BAAqB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,6BAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,QAAQ,EAAE,IAAI,GAAG,EAAE;CACpB,CAAC;AAEF,SAAgB,aAAa,CAC3B,IAAgC,EAChC,EAA8B;IAE9B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAOD,SAAgB,UAAU,CAAC,KAAiC;IAC1D,OAAO,CACL,KAAK,KAAK,6BAAqB,CAAC,SAAS;QACzC,KAAK,KAAK,6BAAqB,CAAC,MAAM;QACtC,KAAK,KAAK,6BAAqB,CAAC,QAAQ,CACzC,CAAC;AACJ,CAAC;AAQD,SAAgB,UAAU,CAAC,KAAiC;IAC1D,OAAO,KAAK,KAAK,6BAAqB,CAAC,MAAM,CAAC;AAChD,CAAC;AAQD,SAAgB,WAAW,CAAC,KAAiC;IAC3D,OAAO,KAAK,KAAK,6BAAqB,CAAC,MAAM,CAAC;AAChD,CAAC"}
|
|
@@ -9,6 +9,8 @@ export declare const XEMA_PARENT_TYPES_SLOT = "${XEMA_PARENT_TYPES}";
|
|
|
9
9
|
export declare const XEMA_READ_RELATION = "xema_read";
|
|
10
10
|
export declare const PLATFORM_RESOURCE_MODULES: readonly PlatformAuthorizationModule[];
|
|
11
11
|
export declare const XEMA_INHERITING_PLATFORM_TYPES: readonly ["project", "xema_artifact", "xema_session"];
|
|
12
|
+
export declare const XEMA_ANCHORED_PLATFORM_TYPES: readonly ["xema_session"];
|
|
13
|
+
export declare const XEMA_ANCHOR_RELATION = "anchor";
|
|
12
14
|
export declare enum XemaAuthorizationInterface {
|
|
13
15
|
Parent = "xema.parent"
|
|
14
16
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwC3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.PLATFORM_FACT_WRITERS = exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
3
|
+
exports.PLATFORM_FACT_WRITERS = exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_ANCHOR_RELATION = exports.XEMA_ANCHORED_PLATFORM_TYPES = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.PLATFORM_RESOURCE_MODULES = exports.XEMA_READ_RELATION = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
|
|
4
4
|
exports.platformWritableRelationsOf = platformWritableRelationsOf;
|
|
5
5
|
const zod_1 = require("zod");
|
|
6
6
|
var PlatformAuthorizationModule;
|
|
@@ -18,6 +18,8 @@ exports.XEMA_INHERITING_PLATFORM_TYPES = Object.freeze([
|
|
|
18
18
|
'xema_artifact',
|
|
19
19
|
'xema_session',
|
|
20
20
|
]);
|
|
21
|
+
exports.XEMA_ANCHORED_PLATFORM_TYPES = Object.freeze(['xema_session']);
|
|
22
|
+
exports.XEMA_ANCHOR_RELATION = 'anchor';
|
|
21
23
|
var XemaAuthorizationInterface;
|
|
22
24
|
(function (XemaAuthorizationInterface) {
|
|
23
25
|
XemaAuthorizationInterface["Parent"] = "xema.parent";
|
|
@@ -53,7 +55,7 @@ exports.PLATFORM_FACT_WRITERS = Object.freeze({
|
|
|
53
55
|
}),
|
|
54
56
|
xema_session: Object.freeze({
|
|
55
57
|
biome: 'agent-runtime',
|
|
56
|
-
relations: Object.freeze(['parent', 'owner', 'participant']),
|
|
58
|
+
relations: Object.freeze(['parent', 'anchor', 'owner', 'participant']),
|
|
57
59
|
}),
|
|
58
60
|
xema_artifact: Object.freeze({
|
|
59
61
|
biome: 'agent-runtime',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAsMA,kEAUC;AAhND,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;KACvE,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAGF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAC3B,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;QAClD,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -27,6 +27,13 @@ type runner
|
|
|
27
27
|
type app
|
|
28
28
|
type external-subject
|
|
29
29
|
|
|
30
|
+
# An ORGANIZATION as a DELEGATOR — never a member of anything, never granted
|
|
31
|
+
# anything. It appears only as the OWNER of an org-owned session, which derives
|
|
32
|
+
# no human rights: no relation evaluates `owner` for a user, and an org-owned
|
|
33
|
+
# session has no `parent` to inherit from. Access to such a session is by the
|
|
34
|
+
# delegation it is bound to, checked by the service that owns it.
|
|
35
|
+
type organization
|
|
36
|
+
|
|
30
37
|
type org
|
|
31
38
|
relations
|
|
32
39
|
define member: [user, agent, app, service]
|
|
@@ -61,10 +68,17 @@ type project
|
|
|
61
68
|
define xema_write: editor or xema_admin or xema_write from parent
|
|
62
69
|
define xema_read: viewer or xema_write or xema_read from parent
|
|
63
70
|
|
|
71
|
+
# `anchor` is CONTAINMENT WITHOUT INHERITANCE: the object an org-owned session
|
|
72
|
+
# was launched for. No relation derives from it — an org admin or a reader of
|
|
73
|
+
# the anchored object gains nothing — and it exists so the PDP's delegation
|
|
74
|
+
# scope walk (which follows `parent` AND `anchor`) keeps the session and its
|
|
75
|
+
# descendants inside the delegation's scope. An org-owned session writes
|
|
76
|
+
# `owner` (organization) and `anchor`, and no `parent` and no `participant`.
|
|
64
77
|
type xema_session
|
|
65
78
|
relations
|
|
66
79
|
define parent: [org, project, ${XEMA_PARENT_TYPES}]
|
|
67
|
-
define
|
|
80
|
+
define anchor: [org, project, ${XEMA_PARENT_TYPES}]
|
|
81
|
+
define owner: [user, agent, organization]
|
|
68
82
|
define participant: [user, agent]
|
|
69
83
|
define xema_admin: owner or xema_admin from parent
|
|
70
84
|
define xema_write: owner or xema_write from parent
|
|
@@ -41,6 +41,17 @@ tuples:
|
|
|
41
41
|
- user: xema_session:org1|s1
|
|
42
42
|
relation: parent
|
|
43
43
|
object: xema_artifact:org1|a3
|
|
44
|
+
# An ORG-OWNED session: owner is the organization, ANCHORED to the project
|
|
45
|
+
# (containment only), with no parent and no participant.
|
|
46
|
+
- user: organization:org1
|
|
47
|
+
relation: owner
|
|
48
|
+
object: xema_session:org1|s2
|
|
49
|
+
- user: project:org1|p1
|
|
50
|
+
relation: anchor
|
|
51
|
+
object: xema_session:org1|s2
|
|
52
|
+
- user: xema_session:org1|s2
|
|
53
|
+
relation: parent
|
|
54
|
+
object: xema_artifact:org1|a4
|
|
44
55
|
tests:
|
|
45
56
|
- name: an artifact inherits from its project, never copied
|
|
46
57
|
check:
|
|
@@ -121,3 +132,27 @@ tests:
|
|
|
121
132
|
assertions:
|
|
122
133
|
can_read: true
|
|
123
134
|
can_write: false
|
|
135
|
+
- name: an org-owned session derives no human rights — not even the org admin's
|
|
136
|
+
check:
|
|
137
|
+
- user: user:root
|
|
138
|
+
object: xema_session:org1|s2
|
|
139
|
+
assertions:
|
|
140
|
+
can_read: false
|
|
141
|
+
can_write: false
|
|
142
|
+
- user: user:bob
|
|
143
|
+
object: xema_session:org1|s2
|
|
144
|
+
assertions:
|
|
145
|
+
can_read: false
|
|
146
|
+
- user: user:dave
|
|
147
|
+
object: xema_session:org1|s2
|
|
148
|
+
assertions:
|
|
149
|
+
can_read: false
|
|
150
|
+
- user: user:root
|
|
151
|
+
object: xema_artifact:org1|a4
|
|
152
|
+
assertions:
|
|
153
|
+
can_read: false
|
|
154
|
+
can_delete: false
|
|
155
|
+
- user: user:bob
|
|
156
|
+
object: xema_artifact:org1|a4
|
|
157
|
+
assertions:
|
|
158
|
+
can_read: false
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-module-files.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,
|
|
1
|
+
{"version":3,"file":"platform-module-files.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,2BAA2B,EAI5B,MAAM,uCAAuC,CAAC;AAO/C,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAE7C,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAE1E,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAGD,eAAO,MAAM,uCAAuC,QAInD,CAAC;AAGF,wBAAgB,oCAAoC,IAAI,SAAS,gCAAgC,EAAE,CAelG;AAeD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,GAAG,IAAI,CAoBf"}
|
|
@@ -27,7 +27,8 @@ function fillXemaCoreParentSlots(template, implementers) {
|
|
|
27
27
|
const executable = lines.filter((line) => !isComment(line)).join('\n');
|
|
28
28
|
const occurrences = executable.split(platform_authorization_modules_1.XEMA_PARENT_TYPES_SLOT).length - 1;
|
|
29
29
|
const slotted = executable.split(SLOT_TEXT).length - 1;
|
|
30
|
-
if (occurrences !==
|
|
30
|
+
if (occurrences !==
|
|
31
|
+
platform_authorization_modules_1.XEMA_INHERITING_PLATFORM_TYPES.length + platform_authorization_modules_1.XEMA_ANCHORED_PLATFORM_TYPES.length ||
|
|
31
32
|
slotted !== occurrences) {
|
|
32
33
|
return null;
|
|
33
34
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-module-files.js","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-module-files.js","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":";;;AA+BA,oFAeC;AAeD,0DAuBC;AApFD,qCAAuC;AACvC,yCAAiC;AAEjC,0FAK+C;AAgBlC,QAAA,uCAAuC,GAAG,IAAA,gBAAI,EACzD,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;AAGF,SAAgB,oCAAoC;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,4DAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI;YACJ,QAAQ,EAAE,IAAA,sBAAY,EACpB,IAAA,gBAAI,EAAC,+CAAuC,EAAE,IAAI,CAAC,EACnD,MAAM,CACP;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,SAAS,GAAG,KAAK,uDAAsB,EAAE,CAAC;AAYhD,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,YAA+B;IAE/B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,uDAAsB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IACE,WAAW;QACT,+DAA8B,CAAC,MAAM,GAAG,6DAA4B,CAAC,MAAM;QAC7E,OAAO,KAAK,WAAW,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
|
|
@@ -45,6 +45,14 @@ export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
|
45
45
|
}, z.core.$strict>>;
|
|
46
46
|
}, z.core.$strict>;
|
|
47
47
|
export type XemaAuthzenSubject = z.infer<typeof XemaAuthzenSubjectSchema>;
|
|
48
|
+
export declare const XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS: readonly [SubjectKind.Organization];
|
|
49
|
+
export declare const XemaAuthzenDelegatorSubjectSchema: z.ZodObject<{
|
|
50
|
+
type: z.ZodEnum<{
|
|
51
|
+
organization: SubjectKind.Organization;
|
|
52
|
+
}>;
|
|
53
|
+
id: z.ZodString;
|
|
54
|
+
}, z.core.$strict>;
|
|
55
|
+
export type XemaAuthzenDelegatorSubject = z.infer<typeof XemaAuthzenDelegatorSubjectSchema>;
|
|
48
56
|
export declare const XEMA_ORG_RESOURCE_TYPE = "org";
|
|
49
57
|
export declare const XEMA_QUALIFIED_ID_SEPARATOR = "|";
|
|
50
58
|
export declare const XEMA_QUALIFIED_ID_SEGMENT_PATTERN: RegExp;
|
|
@@ -81,11 +89,20 @@ export declare const XemaAuthzenInvocationSchema: z.ZodObject<{
|
|
|
81
89
|
resourceClassification: z.ZodOptional<z.ZodEnum<typeof import("../../space").DataClassification>>;
|
|
82
90
|
}, z.core.$strict>;
|
|
83
91
|
export type XemaAuthzenInvocation = z.infer<typeof XemaAuthzenInvocationSchema>;
|
|
92
|
+
export declare const XemaAuthzenInstanceSchema: z.ZodObject<{
|
|
93
|
+
type: z.ZodString;
|
|
94
|
+
id: z.ZodString;
|
|
95
|
+
}, z.core.$strict>;
|
|
96
|
+
export type XemaAuthzenInstance = z.infer<typeof XemaAuthzenInstanceSchema>;
|
|
84
97
|
export declare const XemaAuthzenContextSchema: z.ZodObject<{
|
|
85
98
|
orgId: z.ZodOptional<z.ZodString>;
|
|
86
99
|
capability: z.ZodOptional<z.ZodString>;
|
|
87
100
|
environment: z.ZodOptional<z.ZodString>;
|
|
88
101
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
102
|
+
instance: z.ZodOptional<z.ZodObject<{
|
|
103
|
+
type: z.ZodString;
|
|
104
|
+
id: z.ZodString;
|
|
105
|
+
}, z.core.$strict>>;
|
|
89
106
|
invocation: z.ZodOptional<z.ZodObject<{
|
|
90
107
|
projectId: z.ZodOptional<z.ZodString>;
|
|
91
108
|
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
@@ -131,6 +148,10 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
|
|
|
131
148
|
capability: z.ZodOptional<z.ZodString>;
|
|
132
149
|
environment: z.ZodOptional<z.ZodString>;
|
|
133
150
|
delegation: z.ZodOptional<z.ZodType<import("../../subject").DelegatedAuthority, unknown, z.core.$ZodTypeInternals<import("../../subject").DelegatedAuthority, unknown>>>;
|
|
151
|
+
instance: z.ZodOptional<z.ZodObject<{
|
|
152
|
+
type: z.ZodString;
|
|
153
|
+
id: z.ZodString;
|
|
154
|
+
}, z.core.$strict>>;
|
|
134
155
|
invocation: z.ZodOptional<z.ZodObject<{
|
|
135
156
|
projectId: z.ZodOptional<z.ZodString>;
|
|
136
157
|
caller: z.ZodOptional<z.ZodType<import("../../execution-context").Caller, unknown, z.core.$ZodTypeInternals<import("../../execution-context").Caller, unknown>>>;
|
|
@@ -152,7 +173,8 @@ export declare enum XemaAuthzenReasonCode {
|
|
|
152
173
|
CapabilityNotDelegated = "capability_not_delegated",
|
|
153
174
|
ResourceOutsideDelegatedScope = "resource_outside_delegated_scope",
|
|
154
175
|
CeilingRefused = "ceiling_refused",
|
|
155
|
-
NamespaceWithdrawn = "namespace_withdrawn"
|
|
176
|
+
NamespaceWithdrawn = "namespace_withdrawn",
|
|
177
|
+
SubjectNotEvaluable = "subject_not_evaluable"
|
|
156
178
|
}
|
|
157
179
|
export declare const XemaAuthzenReasonCodeSchema: z.ZodEnum<typeof XemaAuthzenReasonCode>;
|
|
158
180
|
export declare enum XemaAuthzenErrorCode {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAc/E,eAAO,MAAM,gCAAgC;;;;;4BAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA0BH,eAAO,MAAM,2BAA2B;;;;;;;;kBAU7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenInvocationSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
3
|
+
exports.XemaAuthzenErrorBodySchema = exports.XemaAuthzenDecisionContextSchema = exports.XemaAuthzenItemErrorSchema = exports.XemaAuthzenErrorCodeSchema = exports.XemaAuthzenErrorCode = exports.XemaAuthzenReasonCodeSchema = exports.XemaAuthzenReasonCode = exports.XemaAccessEvaluationRequestSchema = exports.XemaAuthzenContextSchema = exports.XemaAuthzenInstanceSchema = exports.XemaAuthzenInvocationSchema = exports.XemaAuthzenActionSchema = exports.XemaAuthzenResourceSchema = exports.XemaQualifiedResourceIdError = exports.XemaQualifiedResourceIdSchema = exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = exports.XEMA_QUALIFIED_ID_SEPARATOR = exports.XEMA_ORG_RESOURCE_TYPE = exports.XemaAuthzenDelegatorSubjectSchema = exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS = exports.XemaAuthzenSubjectSchema = exports.XemaAuthzenSubjectPropertiesSchema = exports.XemaOrgAuthorityInstrumentSchema = exports.XemaAuthzenSubjectKindSchema = exports.XEMA_AUTHZEN_SUBJECT_KINDS = void 0;
|
|
4
4
|
exports.qualifyResourceId = qualifyResourceId;
|
|
5
5
|
exports.parseQualifiedResourceId = parseQualifiedResourceId;
|
|
6
6
|
exports.resourceBelongsToOrg = resourceBelongsToOrg;
|
|
@@ -43,6 +43,15 @@ exports.XemaAuthzenSubjectSchema = zod_1.z
|
|
|
43
43
|
properties: exports.XemaAuthzenSubjectPropertiesSchema.optional(),
|
|
44
44
|
})
|
|
45
45
|
.strict();
|
|
46
|
+
exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS = Object.freeze([
|
|
47
|
+
subject_1.SubjectKind.Organization,
|
|
48
|
+
]);
|
|
49
|
+
exports.XemaAuthzenDelegatorSubjectSchema = zod_1.z
|
|
50
|
+
.object({
|
|
51
|
+
type: zod_1.z.enum(exports.XEMA_AUTHZEN_DELEGATOR_SUBJECT_KINDS),
|
|
52
|
+
id: zod_1.z.string().min(1),
|
|
53
|
+
})
|
|
54
|
+
.strict();
|
|
46
55
|
exports.XEMA_ORG_RESOURCE_TYPE = 'org';
|
|
47
56
|
exports.XEMA_QUALIFIED_ID_SEPARATOR = '|';
|
|
48
57
|
exports.XEMA_QUALIFIED_ID_SEGMENT_PATTERN = /^[^|:\s]+$/;
|
|
@@ -110,12 +119,19 @@ exports.XemaAuthzenInvocationSchema = zod_1.z
|
|
|
110
119
|
resourceClassification: space_1.DataClassificationSchema.optional(),
|
|
111
120
|
})
|
|
112
121
|
.strict();
|
|
122
|
+
exports.XemaAuthzenInstanceSchema = zod_1.z
|
|
123
|
+
.object({
|
|
124
|
+
type: zod_1.z.string().min(1),
|
|
125
|
+
id: zod_1.z.string().min(1),
|
|
126
|
+
})
|
|
127
|
+
.strict();
|
|
113
128
|
exports.XemaAuthzenContextSchema = zod_1.z
|
|
114
129
|
.object({
|
|
115
130
|
orgId: zod_1.z.string().min(1).optional(),
|
|
116
131
|
capability: zod_1.z.string().min(1).optional(),
|
|
117
132
|
environment: zod_1.z.string().min(1).optional(),
|
|
118
133
|
delegation: subject_1.DelegatedAuthoritySchema.optional(),
|
|
134
|
+
instance: exports.XemaAuthzenInstanceSchema.optional(),
|
|
119
135
|
invocation: exports.XemaAuthzenInvocationSchema.optional(),
|
|
120
136
|
snapshot: authzen_snapshot_1.XemaAuthzSnapshotTokenSchema.optional(),
|
|
121
137
|
})
|
|
@@ -138,6 +154,7 @@ var XemaAuthzenReasonCode;
|
|
|
138
154
|
XemaAuthzenReasonCode["ResourceOutsideDelegatedScope"] = "resource_outside_delegated_scope";
|
|
139
155
|
XemaAuthzenReasonCode["CeilingRefused"] = "ceiling_refused";
|
|
140
156
|
XemaAuthzenReasonCode["NamespaceWithdrawn"] = "namespace_withdrawn";
|
|
157
|
+
XemaAuthzenReasonCode["SubjectNotEvaluable"] = "subject_not_evaluable";
|
|
141
158
|
})(XemaAuthzenReasonCode || (exports.XemaAuthzenReasonCode = XemaAuthzenReasonCode = {}));
|
|
142
159
|
exports.XemaAuthzenReasonCodeSchema = zod_1.z.nativeEnum(XemaAuthzenReasonCode);
|
|
143
160
|
var XemaAuthzenErrorCode;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AA6KA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AA7OD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAclE,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,sBAAa;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAWU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA0BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBAyBX;AAzBD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EAzBW,qBAAqB,qCAArB,qBAAqB,QAyBhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.47.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|