@xemahq/contracts 0.72.0 → 0.73.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.source-stamp.json +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map +1 -1
- package/dist/authorization-module/lib/platform-authorization-modules.js.map +1 -1
- package/dist/authorization-module/platform/xema_capability.fga +3 -4
- package/dist/authorization-module/platform/xema_capability.fga.yaml +0 -10
- package/dist/authorization-module/platform/xema_core.fga +8 -15
- package/dist/authorization-module/platform/xema_core.fga.yaml +0 -51
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts +0 -1
- package/dist/authzen/lib/org-authority-contextual-tuple.d.ts.map +1 -1
- package/dist/authzen/lib/org-authority-contextual-tuple.js +3 -17
- package/dist/authzen/lib/org-authority-contextual-tuple.js.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.d.ts +8 -16
- package/dist/authzen/lib/xema-authzen-profile.d.ts.map +1 -1
- package/dist/authzen/lib/xema-authzen-profile.js +6 -9
- package/dist/authzen/lib/xema-authzen-profile.js.map +1 -1
- package/package.json +1 -1
package/dist/.source-stamp.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAS7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAG9C,eAAO,MAAM,yBAAyB,EAAE,SAAS,2BAA2B,EACtB,CAAC;AAGvD,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAQZ,eAAO,MAAM,4BAA4B,2BAA2C,CAAC;AAGrF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAU7C,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAeH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC;AAGH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAsBD,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA2D3E,CAAC;AAGL,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAQ7C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAiOA,kEAUC;AA3OD,6BAAwB;AAExB,2CAGuB;AAuBvB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAShD,QAAA,kBAAkB,GAAG,WAAW,CAAC;AAGjC,QAAA,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAG1C,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAQC,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAU,CAAC,CAAC;AAGxE,QAAA,oBAAoB,GAAG,QAAQ,CAAC;AAU7C,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAeU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC;AA4BU,QAAA,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC3E,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;KACjF,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;IAUF,CAAC,sCAA4B,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5C,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,MAAM;YAC9B,iCAAuB,CAAC,UAAU;YAClC,iCAAuB,CAAC,UAAU;SACnC,CAAC;KACH,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;KAC3F,CAAC;IACF,GAAG,MAAM,CAAC,WAAW,CAEjB;QACE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACnC,CAAC,cAAc,EAAE,SAAS,CAAC;QAG3B,CAAC,0BAA0B,EAAE,gBAAgB,CAAC;QAC9C,CAAC,oBAAoB,EAAE,YAAY,CAAC;QACpC,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC/C,CAAC,aAAa,EAAE,QAAQ,CAAC;QACzB,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC1C,CAAC,mBAAmB,EAAE,eAAe,CAAC;KAEzC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,IAAI;QACJ,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACjF,CAAC;KACH,CAAC,CACH;CACF,CAAC,CAAC;AAGL,SAAgB,2BAA2B,CACzC,OAAe;IAEf,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAAqB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -13,10 +13,9 @@ module xema_capability
|
|
|
13
13
|
# wildcard, written only by authorization-api's grant door.
|
|
14
14
|
#
|
|
15
15
|
# `org#admin` is the org's ADMINISTRATORS — org owner or org admin. A grant to
|
|
16
|
-
# `org:<o>#admin` never admits installation authority (
|
|
17
|
-
#
|
|
18
|
-
#
|
|
19
|
-
# as a CONTEXTUAL tuple from the verified org-authority instrument
|
|
16
|
+
# `org:<o>#admin` never admits installation authority (owner directive 2026-10-08: no
|
|
17
|
+
# implication across scopes). It is never a stored tuple: the PDP adds it per
|
|
18
|
+
# decision as a CONTEXTUAL tuple from the verified org-authority instrument
|
|
20
19
|
# (`buildOrgAuthorityContextualTuples`, `@xemahq/contracts/authzen`), so a
|
|
21
20
|
# grant to `org:<o>#admin` admits exactly the subjects that instrument names
|
|
22
21
|
# for THIS decision, and nobody once their authority is withdrawn.
|
|
@@ -130,16 +130,6 @@ tests:
|
|
|
130
130
|
object: capability:o1|notification~3aannouncement.publish@1|org
|
|
131
131
|
assertions:
|
|
132
132
|
granted_to: false
|
|
133
|
-
- name: an administrator grant denies a platform admin of the SAME org (installation authority is not org#admin)
|
|
134
|
-
tuples:
|
|
135
|
-
- user: user:carol
|
|
136
|
-
relation: platform_admin
|
|
137
|
-
object: org:o1
|
|
138
|
-
check:
|
|
139
|
-
- user: user:carol
|
|
140
|
-
object: capability:o1|notification~3aannouncement.publish@1|org
|
|
141
|
-
assertions:
|
|
142
|
-
granted_to: false
|
|
143
133
|
- name: an administrator grant denies an administrator of a DIFFERENT org
|
|
144
134
|
tuples:
|
|
145
135
|
- user: user:carol
|
|
@@ -11,10 +11,9 @@ module xema_core
|
|
|
11
11
|
#
|
|
12
12
|
# DEFAULT DENY. Org membership grants nothing by itself: a relation that
|
|
13
13
|
# admits org members says so (`org#member` as a direct subject type), and is
|
|
14
|
-
# evaluated by READING a tuple. `org#owner
|
|
15
|
-
#
|
|
16
|
-
#
|
|
17
|
-
# `buildOrgAuthorityContextualTuples`).
|
|
14
|
+
# evaluated by READING a tuple. `org#owner` and `org#admin` are never written:
|
|
15
|
+
# each reaches the PDP as a CONTEXTUAL tuple derived per request from the
|
|
16
|
+
# verified token (D2, `buildOrgAuthorityContextualTuples`).
|
|
18
17
|
#
|
|
19
18
|
# NO IMPLICATION ACROSS SCOPES (owner directive 2026-10-08, binding):
|
|
20
19
|
# - `owner` — the org OWNER. Owner >= admin is stated HERE, in the
|
|
@@ -22,16 +21,11 @@ module xema_core
|
|
|
22
21
|
# writer; an application's top role (`owner from org`)
|
|
23
22
|
# is this.
|
|
24
23
|
# - `admin` — the org's OWN administrators (org owner or org admin).
|
|
25
|
-
#
|
|
26
|
-
#
|
|
27
|
-
#
|
|
28
|
-
#
|
|
29
|
-
#
|
|
30
|
-
# operator gains authority in an org is identity-api's
|
|
31
|
-
# explicit, audited recovery grant (which makes them an
|
|
32
|
-
# org owner/admin, i.e. `owner`/`admin` here). The
|
|
33
|
-
# relation stays defined only so a PDP that still states
|
|
34
|
-
# the fact as a contextual tuple is not refused.
|
|
24
|
+
#
|
|
25
|
+
# The org type has NO installation relation. Installation authority is not org
|
|
26
|
+
# authority; the ONLY way an installation operator gains authority in an org is
|
|
27
|
+
# identity-api's explicit, audited recovery grant (which makes them an org
|
|
28
|
+
# owner/admin, i.e. `owner`/`admin` here).
|
|
35
29
|
#
|
|
36
30
|
# `org` implements `xema.parent` as the ROOT parent: an object parented by the
|
|
37
31
|
# org (an org-level project, artifact or session) inherits only the org
|
|
@@ -71,7 +65,6 @@ type org
|
|
|
71
65
|
define member: [user, agent, app, service]
|
|
72
66
|
define owner: [user]
|
|
73
67
|
define admin: [user] or owner
|
|
74
|
-
define platform_admin: [user]
|
|
75
68
|
define xema_admin: admin
|
|
76
69
|
define xema_write: admin
|
|
77
70
|
define xema_read: admin
|
|
@@ -20,12 +20,6 @@ tuples:
|
|
|
20
20
|
- user: user:root
|
|
21
21
|
relation: admin
|
|
22
22
|
object: org:org1
|
|
23
|
-
# The INSTALLATION operator's realm role as the PDP states it for org1
|
|
24
|
-
# (contextual in production). INERT: it admits nothing in the org (owner
|
|
25
|
-
# directive 2026-10-08, no implication across scopes).
|
|
26
|
-
- user: user:ops
|
|
27
|
-
relation: platform_admin
|
|
28
|
-
object: org:org1
|
|
29
23
|
# The org OWNER alone, with NO `admin` tuple: the model itself derives
|
|
30
24
|
# owner >= admin (`admin: [user] or owner`).
|
|
31
25
|
- user: user:own
|
|
@@ -422,49 +416,6 @@ tests:
|
|
|
422
416
|
object: xema_integration:org1|i1
|
|
423
417
|
assertions:
|
|
424
418
|
bound_scope: false
|
|
425
|
-
- name: installation authority alone admits nothing in the org (no implication across scopes)
|
|
426
|
-
check:
|
|
427
|
-
- user: user:ops
|
|
428
|
-
object: org:org1
|
|
429
|
-
assertions:
|
|
430
|
-
owner: false
|
|
431
|
-
admin: false
|
|
432
|
-
platform_admin: true
|
|
433
|
-
xema_admin: false
|
|
434
|
-
xema_write: false
|
|
435
|
-
xema_read: false
|
|
436
|
-
may_delegate_for: false
|
|
437
|
-
- user: user:ops
|
|
438
|
-
object: project:org1|p1
|
|
439
|
-
assertions:
|
|
440
|
-
xema_admin: false
|
|
441
|
-
xema_write: false
|
|
442
|
-
xema_read: false
|
|
443
|
-
- user: user:ops
|
|
444
|
-
object: xema_artifact:org1|a1
|
|
445
|
-
assertions:
|
|
446
|
-
can_read: false
|
|
447
|
-
can_write: false
|
|
448
|
-
can_delete: false
|
|
449
|
-
- user: user:ops
|
|
450
|
-
object: xema_artifact:org1|a2
|
|
451
|
-
assertions:
|
|
452
|
-
can_read: false
|
|
453
|
-
can_delete: false
|
|
454
|
-
- user: user:ops
|
|
455
|
-
object: xema_session:org1|s1
|
|
456
|
-
assertions:
|
|
457
|
-
xema_read: false
|
|
458
|
-
can_act: false
|
|
459
|
-
- user: user:ops
|
|
460
|
-
object: xema_artifact:org2|a9
|
|
461
|
-
assertions:
|
|
462
|
-
can_read: false
|
|
463
|
-
list_objects:
|
|
464
|
-
- user: user:ops
|
|
465
|
-
type: xema_artifact
|
|
466
|
-
assertions:
|
|
467
|
-
can_read: []
|
|
468
419
|
- name: an org admin administers the org, and is not its owner
|
|
469
420
|
check:
|
|
470
421
|
- user: user:root
|
|
@@ -472,7 +423,6 @@ tests:
|
|
|
472
423
|
assertions:
|
|
473
424
|
owner: false
|
|
474
425
|
admin: true
|
|
475
|
-
platform_admin: false
|
|
476
426
|
xema_admin: true
|
|
477
427
|
xema_write: true
|
|
478
428
|
xema_read: true
|
|
@@ -492,7 +442,6 @@ tests:
|
|
|
492
442
|
assertions:
|
|
493
443
|
owner: true
|
|
494
444
|
admin: true
|
|
495
|
-
platform_admin: false
|
|
496
445
|
xema_admin: true
|
|
497
446
|
xema_write: true
|
|
498
447
|
xema_read: true
|
|
@@ -2,7 +2,6 @@ import type { XemaOrgAuthorityInstrument } from './xema-authzen-profile';
|
|
|
2
2
|
export declare const XEMA_ORG_OBJECT_TYPE = "org";
|
|
3
3
|
export declare const XEMA_ORG_ADMIN_RELATION = "admin";
|
|
4
4
|
export declare const XEMA_ORG_OWNER_RELATION = "owner";
|
|
5
|
-
export declare const XEMA_ORG_PLATFORM_ADMIN_RELATION = "platform_admin";
|
|
6
5
|
export interface AuthzContextualTuple {
|
|
7
6
|
readonly user: string;
|
|
8
7
|
readonly relation: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"org-authority-contextual-tuple.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAoCzE,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAC1C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAM/C,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,oBAAY,kCAAkC;IAE5C,cAAc,qBAAqB;IAEnC,cAAc,qBAAqB;CACpC;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,kCAAkC;gBAA3C,OAAO,EAAE,kCAAkC;CAQjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAQD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAQD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAC7D,GAAG,SAAS,oBAAoB,EAAE,CAsBlC;AAGD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE5D,QAAQ,CAAC,MAAM,EACX;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAA;KAAE,GACpD;QAAE,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAA;KAAE,CAAC;CAC9D;AAOD,eAAO,MAAM,sCAAsC,EAAE,SAAS,iCAAiC,EA0C3F,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = exports.OrgAuthorityContextualTupleError = exports.OrgAuthorityContextualTupleRefusal = exports.
|
|
3
|
+
exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = exports.OrgAuthorityContextualTupleError = exports.OrgAuthorityContextualTupleRefusal = exports.XEMA_ORG_OWNER_RELATION = exports.XEMA_ORG_ADMIN_RELATION = exports.XEMA_ORG_OBJECT_TYPE = void 0;
|
|
4
4
|
exports.buildXemaOrgObject = buildXemaOrgObject;
|
|
5
5
|
exports.buildOrgAdministratorsUserset = buildOrgAdministratorsUserset;
|
|
6
6
|
exports.buildOrgAuthorityContextualTuples = buildOrgAuthorityContextualTuples;
|
|
@@ -11,7 +11,6 @@ const xema_capability_resource_1 = require("./xema-capability-resource");
|
|
|
11
11
|
exports.XEMA_ORG_OBJECT_TYPE = 'org';
|
|
12
12
|
exports.XEMA_ORG_ADMIN_RELATION = 'admin';
|
|
13
13
|
exports.XEMA_ORG_OWNER_RELATION = 'owner';
|
|
14
|
-
exports.XEMA_ORG_PLATFORM_ADMIN_RELATION = 'platform_admin';
|
|
15
14
|
var OrgAuthorityContextualTupleRefusal;
|
|
16
15
|
(function (OrgAuthorityContextualTupleRefusal) {
|
|
17
16
|
OrgAuthorityContextualTupleRefusal["SubjectNotUser"] = "subject_not_user";
|
|
@@ -41,15 +40,11 @@ function buildOrgAuthorityContextualTuples(input) {
|
|
|
41
40
|
if (subject.kind !== subject_1.SubjectKind.User) {
|
|
42
41
|
throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.SubjectNotUser);
|
|
43
42
|
}
|
|
44
|
-
if (instrument.
|
|
45
|
-
!(0, tenant_1.orgRoleSatisfies)(instrument.orgRole, tenant_1.OrgRole.Admin)) {
|
|
43
|
+
if (!(0, tenant_1.orgRoleSatisfies)(instrument.orgRole, tenant_1.OrgRole.Admin)) {
|
|
46
44
|
throw new OrgAuthorityContextualTupleError(OrgAuthorityContextualTupleRefusal.RoleBelowAdmin);
|
|
47
45
|
}
|
|
48
46
|
const user = (0, subject_1.subjectRefToString)({ kind: subject_1.SubjectKind.User, id: subject.id });
|
|
49
47
|
const object = buildXemaOrgObject(orgId);
|
|
50
|
-
if (instrument.kind === audit_1.AuditAuthorityKind.PlatformAdmin) {
|
|
51
|
-
return [{ user, relation: exports.XEMA_ORG_PLATFORM_ADMIN_RELATION, object }];
|
|
52
|
-
}
|
|
53
48
|
if (instrument.orgRole === tenant_1.OrgRole.Owner) {
|
|
54
49
|
return [
|
|
55
50
|
{ user, relation: exports.XEMA_ORG_OWNER_RELATION, object },
|
|
@@ -85,15 +80,6 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
|
|
|
85
80
|
],
|
|
86
81
|
},
|
|
87
82
|
},
|
|
88
|
-
{
|
|
89
|
-
name: 'a platform admin with no org role is installation authority, never org#admin',
|
|
90
|
-
subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
|
|
91
|
-
orgId: 'o1',
|
|
92
|
-
instrument: { kind: audit_1.AuditAuthorityKind.PlatformAdmin },
|
|
93
|
-
expect: {
|
|
94
|
-
tuples: [{ user: 'user:u1', relation: exports.XEMA_ORG_PLATFORM_ADMIN_RELATION, object: 'org:o1' }],
|
|
95
|
-
},
|
|
96
|
-
},
|
|
97
83
|
{
|
|
98
84
|
name: 'a member instrument is refused',
|
|
99
85
|
subject: { kind: subject_1.SubjectKind.User, id: 'u1' },
|
|
@@ -105,7 +91,7 @@ exports.XEMA_ORG_AUTHORITY_CONFORMANCE_VECTORS = Object.freeze([
|
|
|
105
91
|
name: 'an instrument on a non-user subject is refused',
|
|
106
92
|
subject: { kind: subject_1.SubjectKind.Agent, id: 'a1' },
|
|
107
93
|
orgId: 'o1',
|
|
108
|
-
instrument: { kind: audit_1.AuditAuthorityKind.
|
|
94
|
+
instrument: { kind: audit_1.AuditAuthorityKind.OrgRole, orgRole: tenant_1.OrgRole.Admin },
|
|
109
95
|
expect: { refusal: OrgAuthorityContextualTupleRefusal.SubjectNotUser },
|
|
110
96
|
},
|
|
111
97
|
]);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"org-authority-contextual-tuple.js","sourceRoot":"","sources":["../../../src/authzen/lib/org-authority-contextual-tuple.ts"],"names":[],"mappings":";;;AA4EA,gDAEC;AAQD,sEAEC;AAQD,8EA0BC;AA1HD,uCAAiD;AACjD,2CAAgE;AAChE,yCAAyD;AAEzD,yEAAiE;AAqCpD,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAMlC,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAS/C,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAE5C,yEAAmC,CAAA;IAEnC,yEAAmC,CAAA;AACrC,CAAC,EALW,kCAAkC,kDAAlC,kCAAkC,QAK7C;AAED,MAAa,gCAAiC,SAAQ,KAAK;IACpC;IAArB,YAAqB,OAA2C;QAC9D,KAAK,CACH,OAAO,KAAK,kCAAkC,CAAC,cAAc;YAC3D,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,yFAAyF,CAC9F,CAAC;QALiB,YAAO,GAAP,OAAO,CAAoC;QAM9D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AATD,4EASC;AAGD,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,OAAO,GAAG,4BAAoB,IAAI,IAAA,8CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAQD,SAAgB,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,+BAAuB,EAAE,CAAC;AACnE,CAAC;AAQD,SAAgB,iCAAiC,CAAC,KAIjD;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAA,yBAAgB,EAAC,UAAU,CAAC,OAAO,EAAE,gBAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,gCAAgC,CACxC,kCAAkC,CAAC,cAAc,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,OAAO,KAAK,gBAAO,CAAC,KAAK,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;YACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAmBY,QAAA,sCAAsC,GACjD,MAAM,CAAC,MAAM,CAAC;IACZ;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACvB;IACD;QACE,IAAI,EAAE,6DAA6D;QACnE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE;KAC/F;IACD;QACE,IAAI,EAAE,wDAAwD;QAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACxE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE;aACzE;SACF;KACF;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE;QAC7C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,MAAM,EAAE;QACzE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;IACD;QACE,IAAI,EAAE,gDAAgD;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,EAAE,IAAI,EAAE,0BAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAO,CAAC,KAAK,EAAE;QACxE,MAAM,EAAE,EAAE,OAAO,EAAE,kCAAkC,CAAC,cAAc,EAAE;KACvE;CACF,CAAC,CAAC"}
|
|
@@ -10,20 +10,16 @@ export declare const XemaAuthzenSubjectKindSchema: z.ZodEnum<{
|
|
|
10
10
|
service: SubjectKind.Service;
|
|
11
11
|
"external-subject": SubjectKind.ExternalSubject;
|
|
12
12
|
}>;
|
|
13
|
-
export declare const XemaOrgAuthorityInstrumentSchema: z.
|
|
13
|
+
export declare const XemaOrgAuthorityInstrumentSchema: z.ZodObject<{
|
|
14
14
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
15
15
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
16
|
-
}, z.core.$strict
|
|
17
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
18
|
-
}, z.core.$strict>], "kind">;
|
|
16
|
+
}, z.core.$strict>;
|
|
19
17
|
export type XemaOrgAuthorityInstrument = z.infer<typeof XemaOrgAuthorityInstrumentSchema>;
|
|
20
18
|
export declare const XemaAuthzenSubjectPropertiesSchema: z.ZodObject<{
|
|
21
|
-
orgAuthority: z.ZodOptional<z.
|
|
19
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
22
20
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
23
21
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
24
|
-
}, z.core.$strict
|
|
25
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
26
|
-
}, z.core.$strict>], "kind">>;
|
|
22
|
+
}, z.core.$strict>>;
|
|
27
23
|
}, z.core.$strict>;
|
|
28
24
|
export type XemaAuthzenSubjectProperties = z.infer<typeof XemaAuthzenSubjectPropertiesSchema>;
|
|
29
25
|
export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
@@ -36,12 +32,10 @@ export declare const XemaAuthzenSubjectSchema: z.ZodObject<{
|
|
|
36
32
|
}>;
|
|
37
33
|
id: z.ZodString;
|
|
38
34
|
properties: z.ZodOptional<z.ZodObject<{
|
|
39
|
-
orgAuthority: z.ZodOptional<z.
|
|
35
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
40
36
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
41
37
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
42
|
-
}, z.core.$strict
|
|
43
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
44
|
-
}, z.core.$strict>], "kind">>;
|
|
38
|
+
}, z.core.$strict>>;
|
|
45
39
|
}, z.core.$strict>>;
|
|
46
40
|
}, z.core.$strict>;
|
|
47
41
|
export type XemaAuthzenSubject = z.infer<typeof XemaAuthzenSubjectSchema>;
|
|
@@ -128,12 +122,10 @@ export declare const XemaAccessEvaluationRequestSchema: z.ZodObject<{
|
|
|
128
122
|
}>;
|
|
129
123
|
id: z.ZodString;
|
|
130
124
|
properties: z.ZodOptional<z.ZodObject<{
|
|
131
|
-
orgAuthority: z.ZodOptional<z.
|
|
125
|
+
orgAuthority: z.ZodOptional<z.ZodObject<{
|
|
132
126
|
kind: z.ZodLiteral<AuditAuthorityKind.OrgRole>;
|
|
133
127
|
orgRole: z.ZodEnum<typeof import("../../tenant").OrgRole>;
|
|
134
|
-
}, z.core.$strict
|
|
135
|
-
kind: z.ZodLiteral<AuditAuthorityKind.PlatformAdmin>;
|
|
136
|
-
}, z.core.$strict>], "kind">>;
|
|
128
|
+
}, z.core.$strict>>;
|
|
137
129
|
}, z.core.$strict>>;
|
|
138
130
|
}, z.core.$strict>;
|
|
139
131
|
action: z.ZodObject<{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAGL,WAAW,EACZ,MAAM,eAAe,CAAC;AA6BvB,eAAO,MAAM,0BAA0B,mHAS5B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,4BAA4B;;;;;;EAAqC,CAAC;AAa/E,eAAO,MAAM,gCAAgC;;;kBAKlC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAQF,eAAO,MAAM,kCAAkC;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAY1E,eAAO,MAAM,oCAAoC,qCAEtC,CAAC;AAGZ,eAAO,MAAM,iCAAiC;;;;;kBAKnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AASF,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAO5C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAG/C,eAAO,MAAM,iCAAiC,QAAe,CAAC;AAE9D,eAAO,MAAM,6BAA6B,aAKtC,CAAC;AAGL,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYxE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,CAQ5E;AAiBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAgBT;AAGD,eAAO,MAAM,yBAAyB;;;;kBAAwB,CAAC;AAM/D,eAAO,MAAM,uBAAuB;;;kBAIlC,CAAC;AA6BH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAW7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAahF,eAAO,MAAM,yBAAyB;;;kBAK3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA2B5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;kBAU1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAG1E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAWF,oBAAY,qBAAqB;IAE/B,cAAc,oBAAoB;IAElC,eAAe,sBAAsB;IAErC,oBAAoB,2BAA2B;IAE/C,kBAAkB,wBAAwB;IAE1C,sBAAsB,6BAA6B;IAEnD,6BAA6B,qCAAqC;IAElE,yBAAyB,gCAAgC;IAEzD,cAAc,oBAAoB;IAElC,kBAAkB,wBAAwB;IAQ1C,mBAAmB,0BAA0B;CAC9C;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAO/E,oBAAY,oBAAoB;IAE9B,YAAY,mBAAmB;IAE/B,eAAe,qBAAqB;IAEpC,oBAAoB,0BAA0B;IAE9C,WAAW,iBAAiB;IAE5B,aAAa,mBAAmB;IAEhC,gBAAgB,sBAAsB;CACvC;AAED,eAAO,MAAM,0BAA0B,wCAAqC,CAAC;AAG7E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AAOZ,eAAO,MAAM,gCAAgC;;;;;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAOF,eAAO,MAAM,0BAA0B;;;0DAKR,CAAC"}
|
|
@@ -22,15 +22,12 @@ exports.XEMA_AUTHZEN_SUBJECT_KINDS = Object.freeze([
|
|
|
22
22
|
subject_1.SubjectKind.ExternalSubject,
|
|
23
23
|
]);
|
|
24
24
|
exports.XemaAuthzenSubjectKindSchema = zod_1.z.enum(exports.XEMA_AUTHZEN_SUBJECT_KINDS);
|
|
25
|
-
exports.XemaOrgAuthorityInstrumentSchema = zod_1.z
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
.strict(),
|
|
32
|
-
zod_1.z.object({ kind: zod_1.z.literal(audit_1.AuditAuthorityKind.PlatformAdmin) }).strict(),
|
|
33
|
-
]);
|
|
25
|
+
exports.XemaOrgAuthorityInstrumentSchema = zod_1.z
|
|
26
|
+
.object({
|
|
27
|
+
kind: zod_1.z.literal(audit_1.AuditAuthorityKind.OrgRole),
|
|
28
|
+
orgRole: tenant_1.OrgRoleSchema,
|
|
29
|
+
})
|
|
30
|
+
.strict();
|
|
34
31
|
exports.XemaAuthzenSubjectPropertiesSchema = zod_1.z
|
|
35
32
|
.object({
|
|
36
33
|
orgAuthority: exports.XemaOrgAuthorityInstrumentSchema.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"xema-authzen-profile.js","sourceRoot":"","sources":["../../../src/authzen/lib/xema-authzen-profile.ts"],"names":[],"mappings":";;;AAyKA,8CAYC;AAQD,4DAQC;AAiBD,oDAmBC;AAzOD,6BAAwB;AAExB,yEAGoC;AAEpC,uCAAiD;AACjD,iDAA4D;AAC5D,+DAIiC;AACjC,uCAAuD;AACvD,2CAIuB;AACvB,yCAA6C;AAE7C,yDAI4B;AAC5B,yDAAkE;AAqBrD,QAAA,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,qBAAW,CAAC,IAAI;IAChB,qBAAW,CAAC,KAAK;IACjB,qBAAW,CAAC,OAAO;IAInB,qBAAW,CAAC,GAAG;IACf,qBAAW,CAAC,eAAe;CACnB,CAAC,CAAC;AAIC,QAAA,4BAA4B,GAAG,OAAC,CAAC,IAAI,CAAC,kCAA0B,CAAC,CAAC;AAalE,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,sBAAa;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAWC,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,YAAY,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,oCAA4B;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,0CAAkC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAaC,QAAA,oCAAoC,GAAG,MAAM,CAAC,MAAM,CAAC;IAChE,qBAAW,CAAC,YAAY;CAChB,CAAC,CAAC;AAGC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,4CAAoC,CAAC;IAClD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAYC,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAO/B,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAGlC,QAAA,iCAAiC,GAAG,YAAY,CAAC;AAEjD,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,EAAE;KACR,KAAK,CAAC,sBAAsB,EAAE;IAC7B,OAAO,EACL,8GAA8G;CACjH,CAAC,CAAC;AAGL,MAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AALD,oEAKC;AAGD,SAAgB,iBAAiB,CAAC,KAAa,EAAE,OAAe;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,SAAS,EAAE,OAAO,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,CAAC,yCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,IAAI,KAAK,OAAO,oDAAoD,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,GAAG,mCAA2B,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAQD,SAAgB,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,qCAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,4BAA4B,CACpC,8BAA8B,EAAE,iCAAiC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,mCAA2B,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAiBD,SAAgB,oBAAoB,CAClC,QAAwD,EACxD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,wDAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oDAAyB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAsB,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,qCAA6B,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;AAC/D,CAAC;AAGY,QAAA,yBAAyB,GAAG,wCAAqB,CAAC;AAMlD,QAAA,uBAAuB,GAAG,sCAAmB,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC1C,OAAO,EAAE,iDAAiD;KAC3D,CAAC;CACH,CAAC,CAAC;AA6BU,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,gCAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,+CAA2B,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,+BAAqB,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,qCAAwB,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,qDAAiC,CAAC,QAAQ,EAAE;IACzD,sBAAsB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IAC3D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAcC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AA4BC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,kCAAwB,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,iCAAyB,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IACN,OAAO,EAAE,gCAAwB;IACjC,MAAM,EAAE,+BAAuB;IAC/B,QAAQ,EAAE,iCAAyB;IACnC,OAAO,EAAE,gCAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,IAAY,qBA2BX;AA3BD,WAAY,qBAAqB;IAE/B,2DAAkC,CAAA;IAElC,8DAAqC,CAAA;IAErC,wEAA+C,CAAA;IAE/C,mEAA0C,CAAA;IAE1C,4EAAmD,CAAA;IAEnD,2FAAkE,CAAA;IAElE,kFAAyD,CAAA;IAEzD,2DAAkC,CAAA;IAElC,mEAA0C,CAAA;IAQ1C,sEAA6C,CAAA;AAC/C,CAAC,EA3BW,qBAAqB,qCAArB,qBAAqB,QA2BhC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAO/E,IAAY,oBAaX;AAbD,WAAY,oBAAoB;IAE9B,uDAA+B,CAAA;IAE/B,4DAAoC,CAAA;IAEpC,sEAA8C,CAAA;IAE9C,oDAA4B,CAAA;IAE5B,wDAAgC,CAAA;IAEhC,8DAAsC,CAAA;AACxC,CAAC,EAbW,oBAAoB,oCAApB,oBAAoB,QAa/B;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAGhE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,kCAA0B;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAOC,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,kCAA0B,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,+CAA4B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAUU,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,kCAA0B;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,GAAG,CAAC,0CAAuB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/contracts",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.73.0",
|
|
4
4
|
"description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|