anbaric-state-machine 1.32.0 → 1.33.0

package/dist/entitlements/EntitlementsFactory.d.ts

@@ -0,0 +1,6 @@
+import { Entitlements } from "anbaric-tsapi";
+declare const EntitlementsFactory: {
+    instance(): Entitlements;
+};
+export { EntitlementsFactory };
+//# sourceMappingURL=EntitlementsFactory.d.ts.map

package/dist/entitlements/EntitlementsFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntitlementsFactory.d.ts","sourceRoot":"","sources":["../../src/entitlements/EntitlementsFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAI3C,QAAA,MAAM,mBAAmB;IACrB,QAAQ,IAAK,YAAY;CAS5B,CAAA;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/entitlements/EntitlementsFactory.js

@@ -0,0 +1,15 @@
+import { CloudEntitlements } from "anbaric-impl-cloud";
+import { PermissiveAuthorizer } from "./PermissiveAuthorizer.js";
+const EntitlementsFactory = {
+    instance() {
+        switch (process.env.ANBARIC_ENTITLEMENTS_TYPE) {
+            case "cloud":
+                return new CloudEntitlements();
+            case "permissive":
+            default:
+                return new PermissiveAuthorizer();
+        }
+    }
+};
+export { EntitlementsFactory };
+//# sourceMappingURL=EntitlementsFactory.js.map

package/dist/entitlements/EntitlementsFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntitlementsFactory.js","sourceRoot":"","sources":["../../src/entitlements/EntitlementsFactory.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAC,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAC,oBAAoB,EAAC,MAAM,2BAA2B,CAAC;AAE/D,MAAM,mBAAmB,GAAG;IACxB,QAAQ;QACJ,QAAQ,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC;YAC5C,KAAK,OAAO;gBACR,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACnC,KAAK,YAAY,CAAC;YAClB;gBACI,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC1C,CAAC;IACL,CAAC;CACJ,CAAA;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/entitlements/PermissiveAuthorizer.d.ts

@@ -0,0 +1,9 @@
+import { Entitlements } from "anbaric-tsapi";
+declare class PermissiveAuthorizer implements Entitlements {
+    private definitions;
+    register(appId: string, entitlementId: string, notes?: string): Promise<void>;
+    has(_appId: string, _userId: string, _entitlementId: string): Promise<boolean>;
+    get registered(): Array<string>;
+}
+export { PermissiveAuthorizer };
+//# sourceMappingURL=PermissiveAuthorizer.d.ts.map

package/dist/entitlements/PermissiveAuthorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissiveAuthorizer.d.ts","sourceRoot":"","sources":["../../src/entitlements/PermissiveAuthorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAI3C,cAAM,oBAAqB,YAAW,YAAY;IAE9C,OAAO,CAAC,WAAW,CAA6B;IAE1C,QAAQ,CAAC,KAAK,EAAG,MAAM,EAAE,aAAa,EAAG,MAAM,EAAE,KAAK,GAAG,MAAW,GAAI,OAAO,CAAC,IAAI,CAAC,CAE1F;IAEK,GAAG,CAAC,MAAM,EAAG,MAAM,EAAE,OAAO,EAAG,MAAM,EAAE,cAAc,EAAG,MAAM,GAAI,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,IAAI,UAAU,IAAK,KAAK,CAAC,MAAM,CAAC,CAE/B;CAEJ;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAA"}

package/dist/entitlements/PermissiveAuthorizer.js

@@ -0,0 +1,16 @@
+/* The local implementation: nobody is ever refused. Registrations are kept so
+   an app can see what it declared, but every check passes. */
+class PermissiveAuthorizer {
+    definitions = new Map();
+    async register(appId, entitlementId, notes = "") {
+        this.definitions.set(`${appId}/${entitlementId}`, notes);
+    }
+    async has(_appId, _userId, _entitlementId) {
+        return true;
+    }
+    get registered() {
+        return Array.from(this.definitions.keys());
+    }
+}
+export { PermissiveAuthorizer };
+//# sourceMappingURL=PermissiveAuthorizer.js.map

package/dist/entitlements/PermissiveAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissiveAuthorizer.js","sourceRoot":"","sources":["../../src/entitlements/PermissiveAuthorizer.ts"],"names":[],"mappings":"AAEA;8DAC8D;AAC9D,MAAM,oBAAoB;IAEd,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,KAAK,CAAC,QAAQ,CAAC,KAAc,EAAE,aAAsB,EAAE,KAAK,GAAY,EAAE;QACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAe,EAAE,OAAgB,EAAE,cAAuB;QAChE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,UAAU;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;CAEJ;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAA"}

package/dist/entitlements/entitlements.d.ts

@@ -0,0 +1,6 @@
+import { IncomingMessage } from "node:http";
+import { Entitlements, SessionResolver } from "anbaric-tsapi";
+declare const registerEntitlement: (entitlementId: string, notes?: string, entitlements?: Entitlements) => Promise<void>;
+declare const hasEntitlement: (source: string | IncomingMessage, entitlementId: string, resolver?: SessionResolver, entitlements?: Entitlements) => Promise<boolean>;
+export { registerEntitlement, hasEntitlement };
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/entitlements/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/entitlements/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,EAAC,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAe,YAAY,EAAE,eAAe,EAAC,MAAM,eAAe,CAAC;AAY1E,QAAA,MAAM,mBAAmB,kBAA0B,MAAM,UAAU,MAAM,iBACvB,YAAY,KAA2B,OAAO,CAAC,IAAI,CAEpG,CAAC;AAMF,QAAA,MAAM,cAAc,WAAmB,MAAM,GAAG,eAAe,iBAAkB,MAAM,aAC9C,eAAe,iBACX,YAAY,KAA2B,OAAO,CAAC,OAAO,CAKlG,CAAC;AAEF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAA"}

package/dist/entitlements/entitlements.js

@@ -0,0 +1,25 @@
+import { currentAppId } from "anbaric-tsapi";
+import { sessionCookie } from "../sessions/sessionCookie.js";
+import { SessionResolverFactory } from "../sessions/SessionResolverFactory.js";
+import { EntitlementsFactory } from "./EntitlementsFactory.js";
+let shared;
+const sharedEntitlements = () => shared ??= EntitlementsFactory.instance();
+/* Declares an entitlement this app checks - a startup activity. The
+   definition is scoped to the current app; global entitlements are created
+   in the console, never by an app. */
+const registerEntitlement = async (entitlementId, notes = "", entitlements = sharedEntitlements()) => {
+    await entitlements.register(currentAppId(), entitlementId, notes);
+};
+/* Whether the user behind a session holds the entitlement for the current
+   app. Takes the incoming request (its anbaric_session cookie) or a raw
+   session token, exactly as Human.fromSession does. An unresolvable session
+   is simply not entitled. */
+const hasEntitlement = async (source, entitlementId, resolver = SessionResolverFactory.instance(), entitlements = sharedEntitlements()) => {
+    const token = typeof source === "string" ? source : sessionCookie(source);
+    const session = token ? await resolver.resolve(token) : undefined;
+    if (!session)
+        return false;
+    return entitlements.has(currentAppId(), session.id, entitlementId);
+};
+export { registerEntitlement, hasEntitlement };
+//# sourceMappingURL=entitlements.js.map

package/dist/entitlements/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../src/entitlements/entitlements.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,YAAY,EAAgC,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAC,sBAAsB,EAAC,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAC,mBAAmB,EAAC,MAAM,0BAA0B,CAAC;AAE7D,IAAI,MAAiC,CAAC;AAEtC,MAAM,kBAAkB,GAAG,GAAkB,EAAE,CAAC,MAAM,KAAK,mBAAmB,CAAC,QAAQ,EAAE,CAAC;AAE1F;;sCAEsC;AACtC,MAAM,mBAAmB,GAAG,KAAK,EAAE,aAAsB,EAAE,KAAK,GAAY,EAAE,EAC3C,YAAY,GAAkB,kBAAkB,EAAE,EAAkB,EAAE;IACrG,MAAM,YAAY,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF;;;6BAG6B;AAC7B,MAAM,cAAc,GAAG,KAAK,EAAE,MAAiC,EAAE,aAAsB,EACzD,QAAQ,GAAqB,sBAAsB,CAAC,QAAQ,EAAE,EAC9D,YAAY,GAAkB,kBAAkB,EAAE,EAAqB,EAAE;IACnG,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,CAAE,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAA"}

package/dist/index.d.ts

@@ -5,6 +5,9 @@ export * from "./actors/Human.js";
 export * from "./actors/agents/OpenAIAgent.js";
 export * from "./auditing/AuditorFactory.js";
 export * from "./auditing/ConsoleAuditor.js";
+export * from "./entitlements/PermissiveAuthorizer.js";
+export * from "./entitlements/EntitlementsFactory.js";
+export * from "./entitlements/entitlements.js";
 export * from "./persistence/InMemoryJobPersistence.js";
 export * from "./persistence/JobPersistenceFactory.js";
 export * from "./scheduling/InMemoryQueue.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qCAAqC,CAAC;AACpD,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qCAAqC,CAAC;AACpD,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC"}

package/dist/index.js

@@ -5,6 +5,9 @@ export * from "./actors/Human.js";
 export * from "./actors/agents/OpenAIAgent.js";
 export * from "./auditing/AuditorFactory.js";
 export * from "./auditing/ConsoleAuditor.js";
+export * from "./entitlements/PermissiveAuthorizer.js";
+export * from "./entitlements/EntitlementsFactory.js";
+export * from "./entitlements/entitlements.js";
 export * from "./persistence/InMemoryJobPersistence.js";
 export * from "./persistence/JobPersistenceFactory.js";
 export * from "./scheduling/InMemoryQueue.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qCAAqC,CAAC;AACpD,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qCAAqC,CAAC;AACpD,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-state-machine",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "This is the state machine library that one can use to add state management to an application. It will, by default, be locally runnable but can deployed to the Anbaric Cloud via the CLI",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -24,8 +24,8 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "anbaric-impl-cloud": "^1.32.0",
-    "anbaric-tsapi": "^1.32.0"
+    "anbaric-impl-cloud": "^1.33.0",
+    "anbaric-tsapi": "^1.33.0"
   },
   "files": [
     "dist"