bazis 0.138.0 → 0.140.0

package/core/access/catalog/permissions.ts

@@ -1,7 +1,7 @@
 import type { Class } from "../../di";
 import type { AttributeLookup } from "../contracts/AttributeLookup";
 import type { LocalizedText } from "../contracts/types";
-import type { BazisPermissions } from "../index";
+import type { BazisPermissions, BazisPermissionSources } from "../index";
 
 /** An attribute of the object of a permission: what a condition may test (ACCESS-001 §3). */
 export interface AttributeSpec {
@@ -46,6 +46,16 @@ export type PermissionsOf<T extends PermissionDeclarations> = { readonly [K in k
 /** A declared permission. */
 export type PermissionKey = Extract<keyof BazisPermissions, string>;
 
+/**
+ * A permission of a source (ACCESS-001 §3.1): any key under a prefix of
+ * `@Module({ permissionSources })`. Whether it exists is known only while the
+ * application runs; a key the source does not give is a permission nobody has.
+ */
+export type SourcePermissionKey = `${Extract<keyof BazisPermissionSources, string>}.${string}`;
+
+/** What `can`, `access.can`, `access.filter` and `access.fields` accept. */
+export type AnyPermissionKey = PermissionKey | SourcePermissionKey;
+
 /** A permission with an `owner`: the only kind `"<key>:own"` makes sense for. */
 export type OwnPermissionKey = { [K in keyof BazisPermissions]: BazisPermissions[K] extends { readonly owner: string } ? Extract<K, string> : never }[keyof BazisPermissions];
 
@@ -81,6 +91,8 @@ const RESERVED = new Set(["all", "any", "not", "own", "scope"]);
 export function permissionProblems(key: string, spec: PermissionSpec): string[] {
   const problems: string[] = [];
   const at = `permission "${key}"`;
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) return [`${at}: must be an object with a title`];
+  if (spec.on !== undefined && (typeof spec.on !== "object" || spec.on === null || Array.isArray(spec.on))) return [`${at}: on must map attribute names to their descriptions`];
   if (!KEY.test(key) || key.length > 128) problems.push(`${at}: the key must look like "<module>.<object>.<action>" in lower case`);
   if (!isText(spec.title, 200)) problems.push(`${at}: title must be a non-empty text up to 200 characters`);
   if (spec.description !== undefined && !isText(spec.description, 2000)) problems.push(`${at}: description must be a non-empty text up to 2000 characters`);
@@ -95,6 +107,10 @@ export function permissionProblems(key: string, spec: PermissionSpec): string[]
   for (const [name, attribute] of Object.entries(spec.on ?? {})) {
     if (!NAME.test(name)) problems.push(`${at}: attribute "${name}" must be a name of letters, digits and _`);
     else if (RESERVED.has(name)) problems.push(`${at}: attribute "${name}" is a reserved word of conditions`);
+    if (typeof attribute !== "object" || attribute === null) {
+      problems.push(`${at}: attribute "${name}" must be an object with ref or type`);
+      continue;
+    }
     if ((attribute.ref === undefined) === (attribute.type === undefined)) problems.push(`${at}: attribute "${name}" needs exactly one of ref and type`);
     if (attribute.ref !== undefined && !KEY.test(attribute.ref)) problems.push(`${at}: attribute "${name}": ref must be a reference kind like "<module>.<kind>"`);
     if (attribute.type !== undefined && !["string", "number", "boolean"].includes(attribute.type)) problems.push(`${at}: attribute "${name}": type must be string, number or boolean`);
@@ -119,6 +135,34 @@ export function isReferenceKind(value: string): boolean {
   return KEY.test(value) && value.length <= 128;
 }
 
+const PREFIX = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/;
+
+/** A prefix of a permission source: one or several segments of a key (`data`, `dm.records`). */
+export function isSourcePrefix(value: string): boolean {
+  return PREFIX.test(value) && value.length <= 64;
+}
+
+/** Whether the key lies under the prefix: `data.orders.read` under `data`. */
+export function underPrefix(key: string, prefix: string): boolean {
+  return key.startsWith(`${prefix}.`);
+}
+
+/** A frozen copy of a specification a source gave: the catalog keeps it, the source may change its own. */
+export function frozenSpec(spec: PermissionSpec): PermissionSpec {
+  const scope = typeof spec.scope === "object" ? { ...spec.scope } : spec.scope;
+  const on = spec.on === undefined ? undefined : Object.fromEntries(Object.entries(spec.on).map(([name, attribute]) => [name, { ...attribute }]));
+  const title = typeof spec.title === "object" ? { ...spec.title } : spec.title;
+  const description = typeof spec.description === "object" ? { ...spec.description } : spec.description;
+  return deepFreeze({
+    title,
+    ...(description === undefined ? {} : { description }),
+    ...(scope === undefined ? {} : { scope }),
+    ...(on === undefined ? {} : { on }),
+    ...(spec.owner === undefined ? {} : { owner: spec.owner }),
+    ...(spec.fields === undefined ? {} : { fields: spec.fields }),
+  } as PermissionSpec);
+}
+
 function isText(value: unknown, max: number): boolean {
   if (typeof value === "string") return value.trim() !== "" && value.length <= max;
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -132,6 +176,7 @@ function isName(value: unknown): value is string {
 
 function deepFreeze<T>(value: T): T {
   if (typeof value !== "object" || value === null || Object.isFrozen(value)) return value;
+  // A lookup is a class: a function, left as it is.
   for (const item of Object.values(value)) if (typeof item === "object") deepFreeze(item);
   return Object.freeze(value);
 }

package/core/access/check/Access.ts

@@ -3,7 +3,8 @@ import { UnauthorizedError, type AuthorizeContext } from "../../http";
 import { LOGGER, type ConfigView } from "../../kernel";
 import type { AccessConfig } from "./accessConfig";
 import type { IAccessCatalog } from "../catalog/IAccessCatalog.service";
-import type { PermissionKey, PermissionSpec } from "../catalog/permissions";
+import type { OwnedPermission } from "../catalog/AccessCatalog";
+import type { AnyPermissionKey, PermissionSpec } from "../catalog/permissions";
 import { AccessPolicy, type ScopePrincipals } from "../contracts/AccessPolicy";
 import type { AttributeLookup } from "../contracts/AttributeLookup";
 import type { AccessObject, AccessSubject, Condition, Grant, Grants, Scope } from "../contracts/types";
@@ -56,9 +57,19 @@ export class Access extends IAccess {
   }
 }
 
-/** What one subject may do; grants are asked once per permission. */
+/** The grants of a permission with the specification they were checked against. */
+interface Given {
+  readonly spec: PermissionSpec;
+  readonly grants: Grants;
+}
+
+/**
+ * What one subject may do; grants are asked once per permission. A permission
+ * of a source that the source does not give now does not exist: nobody has it,
+ * and the rights system is not asked (ACCESS-001 §3.1).
+ */
 export class SubjectAccess {
-  private readonly grantCache = new Map<string, Promise<Grants>>();
+  private readonly grantCache = new Map<string, Promise<Given | undefined>>();
   private owners: Promise<readonly string[]> | undefined;
 
   constructor(
@@ -70,31 +81,28 @@ export class SubjectAccess {
   ) {}
 
   /** The grants of the permission; a grant the permission cannot use is dropped with a warning. */
-  grants(permission: PermissionKey): Promise<Grants> {
-    let grants = this.grantCache.get(permission);
-    if (grants === undefined) {
-      grants = this.load(permission);
-      this.grantCache.set(permission, grants);
-    }
-    return grants;
+  async grants(permission: AnyPermissionKey): Promise<Grants> {
+    return (await this.given(permission))?.grants ?? [];
   }
 
   /**
    * Whether the subject may do `permission` on `object`. Without an object —
    * whether it has the permission anywhere (a route before the object is known).
    */
-  async can(permission: PermissionKey, object?: AccessObject): Promise<boolean> {
-    const spec = this.catalog.require(permission).spec;
-    const grants = await this.grants(permission);
+  async can(permission: AnyPermissionKey, object?: AccessObject): Promise<boolean> {
+    const given = await this.given(permission);
+    if (given === undefined) return false;
+    const { spec, grants } = given;
     if (grants === "all") return true;
     if (object === undefined) return grants.length > 0;
     return (await this.matching(permission, spec, grants, object)).length > 0;
   }
 
   /** Which rows of a list the subject may see; `scope` — the partition of the request for `scope: "request"`. */
-  async filter(permission: PermissionKey, options: { readonly scope?: Scope } = {}): Promise<AccessFilter> {
-    const spec = this.catalog.require(permission).spec;
-    const grants = await this.grants(permission);
+  async filter(permission: AnyPermissionKey, options: { readonly scope?: Scope } = {}): Promise<AccessFilter> {
+    const given = await this.given(permission);
+    if (given === undefined) return { kind: "none" };
+    const { spec, grants } = given;
     return await buildFilter({
       permission,
       spec,
@@ -107,9 +115,10 @@ export class SubjectAccess {
   }
 
   /** The fields of `object` the subject may read and write (ACCESS-001 §4.4). */
-  async fields(permission: PermissionKey, object: AccessObject): Promise<FieldAccess> {
-    const spec = this.catalog.require(permission).spec;
-    const grants = await this.grants(permission);
+  async fields(permission: AnyPermissionKey, object: AccessObject): Promise<FieldAccess> {
+    const given = await this.given(permission);
+    if (given === undefined) return { read: [], write: [] };
+    const { spec, grants } = given;
     if (grants === "all") return { read: "all", write: "all" };
     const matching = await this.matching(permission, spec, grants, object);
     return { read: union(matching, "read"), write: union(matching, "write") };
@@ -126,19 +135,37 @@ export class SubjectAccess {
     return this.owners;
   }
 
-  private async load(permission: string): Promise<Grants> {
-    const spec = this.catalog.require(permission).spec;
+  private given(permission: string): Promise<Given | undefined> {
+    let given = this.grantCache.get(permission);
+    if (given === undefined) {
+      given = this.load(permission);
+      this.grantCache.set(permission, given);
+    }
+    return given;
+  }
+
+  /** `undefined` — a permission of a source that does not exist now. */
+  private async load(permission: string): Promise<Given | undefined> {
+    let owned: OwnedPermission | undefined = await this.catalog.find(permission);
+    if (owned === undefined) return undefined;
     const grants = await this.policy.grants(this.subject, permission);
-    if (grants === "all") return "all";
+    if (grants === "all") return { spec: owned.spec, grants: "all" };
     if (!Array.isArray(grants)) {
       this.warn(permission, "the rights system must answer \"all\" or a list of grants");
-      return [];
+      return { spec: owned.spec, grants: [] };
     }
-    return grants.filter((grant) => {
-      const problem = grantProblem(spec, grant, this.maxInList);
-      if (problem !== undefined) this.warn(permission, problem);
-      return problem === undefined;
-    });
+    let problems = grants.map((grant) => grantProblem(owned!.spec, grant, this.maxInList));
+    if (owned.source !== undefined && problems.some((problem) => problem !== undefined)) {
+      // The rule may name a field another instance has just added: compare the source's version before dropping it.
+      const fresh = await this.catalog.find(permission, { verify: true });
+      if (fresh === undefined) return undefined;
+      if (fresh !== owned) {
+        owned = fresh;
+        problems = grants.map((grant) => grantProblem(fresh.spec, grant, this.maxInList));
+      }
+    }
+    problems.forEach((problem) => { if (problem !== undefined) this.warn(permission, problem); });
+    return { spec: owned.spec, grants: grants.filter((_, index) => problems[index] === undefined) };
   }
 
   private async matching(permission: string, spec: PermissionSpec, grants: readonly Grant[], object: AccessObject): Promise<Grant[]> {

package/core/access/check/accessConfig.ts

@@ -8,11 +8,19 @@ export interface AccessConfig {
   roleClaim: string;
   /** Values of one list condition and of a lookup result. */
   maxInList: number;
+  /**
+   * Seconds between two questions to the permission sources about their
+   * version (ACCESS-001 §3.1): how long another instance may keep a removed
+   * permission. `0` — never ask: one instance, or the application calls
+   * `IAccessCatalog.changed` on every instance itself.
+   */
+  sourcePollSeconds: number;
 }
 
 export const accessConfig = defineConfig<AccessConfig>("access", {
-  default: { kindClaim: "", roleClaim: "role", maxInList: 1000 },
+  default: { kindClaim: "", roleClaim: "role", maxInList: 1000, sourcePollSeconds: 5 },
   validate: {
     maxInList: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 100_000 ? undefined : "must be an integer 1–100000",
+    sourcePollSeconds: (value) => Number.isFinite(value) && value >= 0 && value <= 3600 ? undefined : "must be a number 0–3600",
   },
 });

package/core/access/check/can.ts

@@ -1,5 +1,5 @@
 import type { AuthorizeCheck, AuthorizeContext } from "../../http";
-import type { PermissionKey } from "../catalog/permissions";
+import type { AnyPermissionKey } from "../catalog/permissions";
 import type { AccessObject } from "../contracts/types";
 import { IAccess } from "./IAccess.service";
 
@@ -14,7 +14,7 @@ import { IAccess } from "./IAccess.service";
  * @Post() create(ctx: HttpContext) { … }
  * ```
  */
-export function can(permission: PermissionKey, objectOf?: (ctx: AuthorizeContext) => AccessObject | Promise<AccessObject>): AuthorizeCheck {
+export function can(permission: AnyPermissionKey, objectOf?: (ctx: AuthorizeContext) => AccessObject | Promise<AccessObject>): AuthorizeCheck {
   return async (ctx) => {
     const access = await ctx.services.resolve(IAccess).for(ctx);
     return await access.can(permission, objectOf === undefined ? undefined : await objectOf(ctx));

package/core/access/check/conditions.ts

@@ -1,5 +1,6 @@
-import type { PermissionSpec } from "../catalog/permissions";
-import type { AccessValue, Condition, Grant, Scope, ValueTest } from "../contracts/types";
+import type { AttributeSpec, PermissionSpec } from "../catalog/permissions";
+import type { AccessValue, CompareTest, Condition, Grant, Scope, ValueTest } from "../contracts/types";
+import { compareDecimals, decimalOf } from "./decimal";
 
 export const MAX_DEPTH = 8;
 export const MAX_NODES = 200;
@@ -41,30 +42,53 @@ function conditionProblem(spec: PermissionSpec, condition: Condition, depth: num
     if (value !== true) return "own must be true";
     return spec.owner === undefined ? "the permission declares no owner, own cannot be used" : undefined;
   }
-  if (spec.on?.[key] === undefined) return `unknown attribute "${key}"`;
-  return testProblem(key, value, maxInList);
+  const attribute = spec.on?.[key];
+  if (attribute === undefined) return `unknown attribute "${key}"`;
+  return testProblem(key, attribute, value, maxInList);
 }
 
-function testProblem(attribute: string, test: unknown, maxInList: number): string | undefined {
+function testProblem(attribute: string, spec: AttributeSpec, test: unknown, maxInList: number): string | undefined {
   if (typeof test !== "object" || test === null || Array.isArray(test)) return `the test of "${attribute}" must be an object`;
   const keys = Object.keys(test);
-  if (keys.length !== 1) return `the test of "${attribute}" must have exactly one of eq, in, notIn, isNull`;
+  if (keys.length !== 1) return `the test of "${attribute}" must have exactly one of eq, in, notIn, isNull, gt, gte, lt, lte`;
   const [op] = keys;
   const value = (test as Record<string, unknown>)[op!];
+  const numeric = spec.type === "number";
   switch (op) {
     case "eq":
+      if (numeric) return isNumeric(value) ? undefined : `${attribute}.eq must be a number: the attribute is a number`;
       return isValue(value) && value !== null ? undefined : `${attribute}.eq must be a string, number or boolean (an empty value is tested with isNull)`;
     case "in":
     case "notIn":
-      if (!Array.isArray(value) || !value.every((item) => isValue(item) && item !== null)) return `${attribute}.${op} must be a list of strings, numbers or booleans (an empty value is tested with isNull)`;
+      if (numeric) {
+        if (!Array.isArray(value) || !value.every(isNumeric)) return `${attribute}.${op} must be a list of numbers: the attribute is a number`;
+      } else if (!Array.isArray(value) || !value.every((item) => isValue(item) && item !== null)) {
+        return `${attribute}.${op} must be a list of strings, numbers or booleans (an empty value is tested with isNull)`;
+      }
       return value.length > maxInList ? `${attribute}.${op} has more than ${maxInList} values` : undefined;
     case "isNull":
       return typeof value === "boolean" ? undefined : `${attribute}.isNull must be true or false`;
+    case "gt":
+    case "gte":
+    case "lt":
+    case "lte":
+      if (!comparable(spec)) return `${attribute}.${op}: only an attribute of type "number" with a column can be compared${spec.lookup !== undefined ? " (this one has a lookup)" : ""}`;
+      return typeof value === "number" && Number.isFinite(value) ? undefined : `${attribute}.${op} must be a number`;
     default:
       return `unknown test "${op}" of "${attribute}"`;
   }
 }
 
+/** Whether `gt`, `gte`, `lt`, `lte` may test the attribute: a number in a column of the listed rows. */
+export function comparable(attribute: AttributeSpec): boolean {
+  return attribute.type === "number" && attribute.lookup === undefined;
+}
+
+/** A number, or a decimal string for a value a `double` cannot hold. */
+function isNumeric(value: unknown): boolean {
+  return (typeof value === "number" || typeof value === "string") && decimalOf(value) !== undefined;
+}
+
 /**
  * The value of a condition on an object, in SQL's three-valued logic so that a
  * check and a list filter agree: an attribute the object does not carry, or a
@@ -100,16 +124,50 @@ export function evaluate(condition: Condition, object: Readonly<Record<string, u
     return ownerIds.includes(String(owner));
   }
   const [attribute, test] = Object.entries(condition)[0] as [string, ValueTest];
-  return testValue(object[attribute], test);
+  return testValue(object[attribute], test, spec.on?.[attribute]?.type === "number");
 }
 
-function testValue(raw: unknown, test: ValueTest): boolean | undefined {
+const COMPARE: Readonly<Record<CompareTest, (order: number) => boolean>> = {
+  gt: (order) => order > 0,
+  gte: (order) => order >= 0,
+  lt: (order) => order < 0,
+  lte: (order) => order <= 0,
+};
+
+function testValue(raw: unknown, test: ValueTest, numeric: boolean): boolean | undefined {
   if (raw === undefined) return undefined;
   if ("isNull" in test) return (raw === null) === test.isNull;
   if (raw === null) return undefined;
+  if (numeric) return testNumber(raw, test);
   if ("eq" in test) return same(raw, test.eq);
-  const found = ("in" in test ? test.in : test.notIn).some((value) => same(raw, value));
-  return "in" in test ? found : !found;
+  if ("in" in test || "notIn" in test) {
+    const found = ("in" in test ? test.in : test.notIn).some((value) => same(raw, value));
+    return "in" in test ? found : !found;
+  }
+  // A comparison of an attribute that is not a number: such a grant is dropped before it gets here.
+  return undefined;
+}
+
+/**
+ * A number attribute is compared as a number, the way the database does it:
+ * `"100000.00"` of a `numeric` column equals `100000`. The comparison is exact
+ * and decimal, so a check and a list filter agree. Not a number — unknown.
+ */
+function testNumber(raw: unknown, test: Exclude<ValueTest, { readonly isNull: boolean }>): boolean | undefined {
+  const left = decimalOf(raw);
+  if (left === undefined) return undefined;
+  const order = (value: unknown): number | undefined => {
+    const right = decimalOf(value);
+    return right === undefined ? undefined : compareDecimals(left, right);
+  };
+  if ("in" in test || "notIn" in test) {
+    const found = ("in" in test ? test.in : test.notIn).some((value) => order(value) === 0);
+    return "in" in test ? found : !found;
+  }
+  const [op, value] = Object.entries(test)[0] as ["eq" | CompareTest, unknown];
+  const result = order(value);
+  if (result === undefined) return undefined;
+  return op === "eq" ? result === 0 : COMPARE[op](result);
 }
 
 /** Ids come as numbers from one side and as strings from the other. */

package/core/access/check/decimal.ts

@@ -0,0 +1,61 @@
+/**
+ * Exact decimal numbers for the tests of a number attribute (ACCESS-001 §4.2).
+ * A `numeric` column comes from the database as a string; turning it into a
+ * `double` would make a check disagree with the list filter the database runs.
+ */
+export interface Decimal {
+  readonly negative: boolean;
+  /** Digits before the point, without leading zeros; `""` — zero. */
+  readonly integer: string;
+  /** Digits after the point, without trailing zeros. */
+  readonly fraction: string;
+}
+
+const FORM = /^([+-]?)(\d*)(?:\.(\d*))?(?:[eE]([+-]?\d+))?$/;
+/** Enough for a `double` (1e308, 5e-324) and far beyond a column of money. */
+const MAX_EXPONENT = 1000;
+const MAX_DIGITS = 1100;
+
+/** The decimal of a number, a bigint or a decimal string; `undefined` — not a number. */
+export function decimalOf(value: unknown): Decimal | undefined {
+  if (typeof value === "number") return Number.isFinite(value) ? parse(String(value)) : undefined;
+  if (typeof value === "bigint") return parse(String(value));
+  if (typeof value === "string") return parse(value.trim());
+  return undefined;
+}
+
+function parse(text: string): Decimal | undefined {
+  if (text.length > MAX_DIGITS) return undefined;
+  const match = FORM.exec(text);
+  if (match === null) return undefined;
+  const [, sign, whole = "", part = "", power] = match;
+  if (whole === "" && part === "") return undefined;
+  const exponent = power === undefined ? 0 : Number(power);
+  if (Math.abs(exponent) > MAX_EXPONENT) return undefined;
+  // Move the point by the exponent: digits = whole + part, the point stands after `whole.length + exponent` digits.
+  const digits = whole + part;
+  const point = whole.length + exponent;
+  const integer = (point <= 0 ? "" : point >= digits.length ? digits + "0".repeat(point - digits.length) : digits.slice(0, point)).replace(/^0+/, "");
+  const fraction = (point <= 0 ? "0".repeat(-point) + digits : point >= digits.length ? "" : digits.slice(point)).replace(/0+$/, "");
+  return { negative: sign === "-" && (integer !== "" || fraction !== ""), integer, fraction };
+}
+
+/** Below zero — `left` is less, above — greater, zero — the numbers are equal. */
+export function compareDecimals(left: Decimal, right: Decimal): number {
+  if (left.negative !== right.negative) return left.negative ? -1 : 1;
+  const order = compareMagnitudes(left, right);
+  return order === 0 ? 0 : left.negative ? -order : order;
+}
+
+function compareMagnitudes(left: Decimal, right: Decimal): number {
+  if (left.integer.length !== right.integer.length) return left.integer.length - right.integer.length;
+  if (left.integer !== right.integer) return left.integer < right.integer ? -1 : 1;
+  if (left.fraction === right.fraction) return 0;
+  const length = Math.max(left.fraction.length, right.fraction.length);
+  return left.fraction.padEnd(length, "0") < right.fraction.padEnd(length, "0") ? -1 : 1;
+}
+
+/** The decimal in plain notation, without an exponent: `-0.5`, `100000.01`. */
+export function decimalText(value: Decimal): string {
+  return `${value.negative ? "-" : ""}${value.integer === "" ? "0" : value.integer}${value.fraction === "" ? "" : `.${value.fraction}`}`;
+}

package/core/access/check/filter.ts

@@ -3,15 +3,21 @@ import type { Class } from "../../di";
 import type { PermissionSpec } from "../catalog/permissions";
 import type { AttributeLookup } from "../contracts/AttributeLookup";
 import { AccessFilterTooLargeError } from "../contracts/errors";
-import type { AccessValue, Condition, Grant, Scope, ValueTest } from "../contracts/types";
+import type { AccessValue, CompareTest, Condition, Grant, Scope, ValueTest } from "../contracts/types";
+import { decimalOf, decimalText } from "./decimal";
 
-/** A condition on the columns of the listed rows. */
+/**
+ * A condition on the columns of the listed rows. `op` — a comparison of a
+ * number column with a value (ACCESS-001 §4.2). A module that lists rows
+ * without the ORM translates this form itself.
+ */
 export type ColumnCondition =
   | { readonly all: readonly ColumnCondition[] }
   | { readonly any: readonly ColumnCondition[] }
   | { readonly not: ColumnCondition }
   | { readonly column: string; readonly in: readonly AccessValue[] }
-  | { readonly column: string; readonly isNull: boolean };
+  | { readonly column: string; readonly isNull: boolean }
+  | { readonly column: string; readonly op: CompareTest; readonly value: number };
 
 /** Which rows of a list the subject may see (ACCESS-001 §4.3). */
 export type AccessFilter =
@@ -67,13 +73,19 @@ async function whereCondition(input: FilterInput, condition: Condition): Promise
     if ("isNull" in test) return test.isNull ? await fromLookup(input, lookup, [null]) : not(await fromLookup(input, lookup, [null]));
     if ("eq" in test) return await fromLookup(input, lookup, [test.eq]);
     if ("in" in test) return await fromLookup(input, lookup, test.in);
-    return not(await fromLookup(input, lookup, test.notIn));
+    if ("notIn" in test) return not(await fromLookup(input, lookup, test.notIn));
+    // A lookup turns "one of the values" into a column and cannot turn a range: such a grant is dropped before it gets here.
+    throw new TypeError(`The list filter of "${input.permission}": attribute "${name}" has a lookup and cannot be compared.`);
   }
   const column = attribute.column ?? name;
   if ("isNull" in test) return { column, isNull: test.isNull };
-  if ("eq" in test) return { column, in: [test.eq] };
-  if ("in" in test) return test.in.length === 0 ? false : { column, in: test.in };
-  return test.notIn.length === 0 ? { column, isNull: false } : not({ column, in: test.notIn });
+  // A number given as a string ("1e3", "012.50") goes to the database in plain notation.
+  const values = (list: readonly AccessValue[]): readonly AccessValue[] => (attribute.type === "number" ? list.map(plainNumber) : list);
+  if ("eq" in test) return { column, in: values([test.eq]) };
+  if ("in" in test) return test.in.length === 0 ? false : { column, in: values(test.in) };
+  if ("notIn" in test) return test.notIn.length === 0 ? { column, isNull: false } : not({ column, in: values(test.notIn) });
+  const [op, value] = Object.entries(test)[0] as [CompareTest, number];
+  return { column, op, value };
 }
 
 async function fromLookup(input: FilterInput, type: Class<AttributeLookup>, values: readonly AccessValue[]): Promise<Built> {
@@ -84,6 +96,12 @@ async function fromLookup(input: FilterInput, type: Class<AttributeLookup>, valu
   return inColumn(found.column, found.in);
 }
 
+function plainNumber(value: AccessValue): AccessValue {
+  if (typeof value !== "string") return value;
+  const decimal = decimalOf(value);
+  return decimal === undefined ? value : decimalText(decimal);
+}
+
 /** `column in values`; `null` among them means an empty column. */
 function inColumn(column: string, values: readonly AccessValue[]): Built {
   const known = values.filter((value) => value !== null);
@@ -128,5 +146,18 @@ function toPredicate(condition: ColumnCondition): Predicate {
   if ("not" in condition) return toPredicate(condition.not).not();
   const column = new Operand(condition.column);
   if ("isNull" in condition) return condition.isNull ? column.isNull() : column.isNotNull();
-  return condition.in.length === 1 ? column.eq(condition.in[0]) : column.in(condition.in);
+  if ("op" in condition) return column[condition.op](parameter(condition.value));
+  const values = condition.in.map(parameter);
+  return values.length === 1 ? column.eq(values[0]) : column.in(values);
+}
+
+/**
+ * A fraction goes to the database as decimal text, not as a `double`: a
+ * `decimal` column of the ORM refuses a float, and the text keeps the number
+ * the rule names (`100000.01`) for `integer` and `real` columns too.
+ */
+function parameter(value: AccessValue): AccessValue {
+  if (typeof value !== "number" || Number.isSafeInteger(value)) return value;
+  const decimal = decimalOf(value);
+  return decimal === undefined ? value : decimalText(decimal);
 }

package/core/access/contracts/PermissionSource.ts

@@ -0,0 +1,32 @@
+import type { PermissionDeclarations } from "../catalog/permissions";
+
+/**
+ * Permissions that appear while the application runs (ACCESS-001 §3.1): a
+ * data manager's tables and their fields. A class of the declaring module,
+ * named in `@Module({ permissionSources: { <prefix>: Class } })`; the catalog
+ * creates it in a scope of its own for one reading, so it may take a
+ * `DbContext`. It owns every key that starts with `<prefix>.`.
+ *
+ * ```ts
+ * export class DataPermissionSource extends PermissionSource {
+ *   constructor(private readonly db: DataDbContext) { super(); }
+ *   async version() { return String((await this.db.meta.first()).version); }
+ *   async load() { return Object.fromEntries((await this.db.tables.toList()).map((table) => [`data.${table.code}.read`, specOf(table)])); }
+ * }
+ * ```
+ */
+export abstract class PermissionSource {
+  /**
+   * The version of the source's data: a counter or a timestamp that changes in
+   * one transaction with the data. Every instance of the application asks it
+   * every `access.sourcePollSeconds` and reads the permissions again when it
+   * differs.
+   */
+  abstract version(): string | Promise<string>;
+
+  /**
+   * The permissions of the prefix, in the form of `definePermissions`. With
+   * `keys` — only these: a key missing from the answer is a removed permission.
+   */
+  abstract load(keys?: readonly string[]): PermissionDeclarations | Promise<PermissionDeclarations>;
+}

package/core/access/contracts/types.ts

@@ -7,12 +7,22 @@ export type AccessValue = string | number | boolean | null;
 /** A partition of the application (a CMS space, a tenant); `null` — no partition. */
 export type Scope = string | null;
 
-/** A test of one attribute. */
+/**
+ * A test of one attribute. The comparisons `gt`, `gte`, `lt`, `lte` are for an
+ * attribute of `type: "number"` with a `column` only (ACCESS-001 §4.2).
+ */
 export type ValueTest =
   | { readonly eq: AccessValue }
   | { readonly in: readonly AccessValue[] }
   | { readonly notIn: readonly AccessValue[] }
-  | { readonly isNull: boolean };
+  | { readonly isNull: boolean }
+  | { readonly gt: number }
+  | { readonly gte: number }
+  | { readonly lt: number }
+  | { readonly lte: number };
+
+/** The comparisons of a number attribute. */
+export type CompareTest = "gt" | "gte" | "lt" | "lte";
 
 /**
  * A condition of a grant (ACCESS-001 §4.2): a tree over the attributes the

package/core/access/generated/deps.ts

@@ -4,11 +4,15 @@ import { registerFrameworkClassDeps } from "../../di/module/autoDeps";
 import { ServiceProvider } from "../../di/ServiceProvider";
 import { AccessCatalog } from "../catalog/AccessCatalog";
 import { IAccessCatalog } from "../catalog/IAccessCatalog.service";
+import { PermissionSourceLoader } from "../catalog/PermissionSourceLoader";
+import { PermissionSources } from "../catalog/PermissionSources";
 import { Access } from "../check/Access";
 import { RolesAccessPolicy } from "../roles/RolesAccessPolicy";
 
 registerFrameworkClassDeps([
   [Access, [IAccessCatalog, "Config:access"]],
-  [AccessCatalog, [ServiceProvider]],
+  [AccessCatalog, [ServiceProvider, PermissionSources, "Config:access"]],
+  [PermissionSourceLoader, [PermissionSources]],
+  [PermissionSources, [ServiceProvider, "Config:access"]],
   [RolesAccessPolicy, [IAccessCatalog, "Config:access"]],
 ]);

package/core/access/http/AccessCatalog.controller.ts

@@ -2,6 +2,7 @@ import { contextOnlyController } from "../../http/Routing/contextOnlyControllers
 import { Authorize, BadRequestError, Controller, Get, NotFoundError, type HttpContext } from "../../http";
 import { IAccessCatalog } from "../catalog/IAccessCatalog.service";
 import { can } from "../check/can";
+import { comparable } from "../check/conditions";
 import type { Scope } from "../contracts/types";
 
 /**
@@ -15,13 +16,19 @@ export class AccessCatalogController {
   @Authorize(can("access.catalog.read"))
   catalogList(ctx: HttpContext) {
     return {
-      data: ctx.services.resolve(IAccessCatalog).permissions().map(({ key, spec, module }) => ({
+      data: ctx.services.resolve(IAccessCatalog).permissions().map(({ key, spec, module, source }) => ({
         key,
         module,
+        ...(source === undefined ? {} : { source }),
         title: spec.title,
         ...(spec.description === undefined ? {} : { description: spec.description }),
         scope: typeof spec.scope === "object" ? ("column" in spec.scope ? "column" : "lookup") : spec.scope ?? "none",
-        attributes: Object.entries(spec.on ?? {}).map(([name, attribute]) => ({ name, ...(attribute.ref === undefined ? { type: attribute.type } : { ref: attribute.ref }) })),
+        attributes: Object.entries(spec.on ?? {}).map(([name, attribute]) => ({
+          name,
+          ...(attribute.ref === undefined ? { type: attribute.type } : { ref: attribute.ref }),
+          // The administrator's screen offers >, ≥, <, ≤ only here (ACCESS-001 §4.2).
+          ...(comparable(attribute) ? { compare: true } : {}),
+        })),
         own: spec.owner !== undefined,
         fields: spec.fields === true,
       })),