bazis 0.139.0 → 0.140.0

package/core/access/index.ts

@@ -16,8 +16,17 @@ import type { PermissionsOf } from "./catalog/permissions";
  */
 export interface BazisPermissions extends PermissionsOf<typeof accessPermissions> {}
 
+/**
+ * The prefixes of the application's permission sources (ACCESS-001 §3.1): any
+ * key under one of them is accepted by `can`, `access.can` and `access.filter`.
+ * Nobody writes it by hand: `bazis codegen` fills it from `permissionSources`
+ * of the application's modules.
+ */
+export interface BazisPermissionSources {}
+
 export { AccessModule } from "./Access.module";
-export { definePermissions, type AttributeSpec, type OwnPermissionKey, type PermissionDeclarations, type PermissionKey, type PermissionsOf, type PermissionSpec, type ScopeSource } from "./catalog/permissions";
+export { definePermissions, type AnyPermissionKey, type AttributeSpec, type OwnPermissionKey, type PermissionDeclarations, type PermissionKey, type PermissionsOf, type PermissionSpec, type ScopeSource, type SourcePermissionKey } from "./catalog/permissions";
+export type { PermissionSourceState } from "./catalog/PermissionSources";
 export { IAccessCatalog } from "./catalog/IAccessCatalog.service";
 export type { DeclaredRole, OwnedPermission, OwnedReferenceKind } from "./catalog/AccessCatalog";
 export { IAccess } from "./check/IAccess.service";
@@ -27,12 +36,14 @@ export { can } from "./check/can";
 export { grantsToWhere, type AccessFilter, type ColumnCondition } from "./check/filter";
 export { AccessPolicy, type ScopePrincipals } from "./contracts/AccessPolicy";
 export { AttributeLookup, type LookupColumn } from "./contracts/AttributeLookup";
+export { PermissionSource } from "./contracts/PermissionSource";
 export { References, type ReferenceContext, type ReferenceItem, type ReferencePage } from "./contracts/References";
 export { AccessFilterTooLargeError, AccessSetupError } from "./contracts/errors";
 export type {
   AccessObject,
   AccessSubject,
   AccessValue,
+  CompareTest,
   Condition,
   Grant,
   GrantFields,

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.139.0" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.140.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/scripts/di-generate.ts

@@ -191,6 +191,8 @@ interface ConstructorDependencies {
 let classDeps = new Map<ts.ClassDeclaration, readonly CollectedDependency[]>();
 /** `permissions` of the target's modules: the exported constant and its file. */
 let permissionDeclarations = new Map<string, { readonly name: string; readonly file: string }>();
+/** The prefixes of `permissionSources` of the target's modules: any key under one is a permission key. */
+let permissionSourcePrefixes = new Set<string>();
 let inferredDiClasses = new Set<ts.ClassDeclaration>();
 let explicitlyBoundDiClasses = new Set<ts.ClassDeclaration>();
 // Known runtime token names: createToken descriptions + class names usable as class-tokens.
@@ -507,7 +509,7 @@ function collectDynamicImportDiagnostics(source: ts.SourceFile, target: string,
 
 function resetTargetAnalysis(files: Set<string>, generatedDir: string): void {
   activeGeneratedDir = generatedDir;
-  classDeps = new Map(); inferredDiClasses = new Set(); explicitlyBoundDiClasses = new Set(); permissionDeclarations = new Map();
+  classDeps = new Map(); inferredDiClasses = new Set(); explicitlyBoundDiClasses = new Set(); permissionDeclarations = new Map(); permissionSourcePrefixes = new Set();
   tokenDescriptions = new Set(); configPrefixesByType = new Map(); knownClassNames = new Set(); warnings = []; fatalErrors = [];
   httpBindings = {}; httpControllerFiles = {}; openApiSchemas = {}; openApiOperations = {};
   grpcBindings = new Map();
@@ -557,7 +559,7 @@ async function generateTarget(name: string, reachable: Set<string>, production:
   stageWrite(`${generatedDir}/httpRequestModels.ts`, requestModels);
   stageWrite(`${generatedDir}/httpListModels.ts`, listModels);
   stageWrite(`${generatedDir}/openapi.ts`, openApi);
-  if (permissionDeclarations.size > 0) stageWrite(`${generatedDir}/permissions.ts`, renderPermissions());
+  if (permissionDeclarations.size > 0 || permissionSourcePrefixes.size > 0) stageWrite(`${generatedDir}/permissions.ts`, renderPermissions());
   else stageRemove(`${generatedDir}/permissions.ts`);
   // Generated before 0.99.0, when agents were classes; nothing imports it now.
   stageRemove(`${generatedDir}/agentCatalog.ts`);
@@ -715,9 +717,17 @@ function renderGeneratedRuntime(targetId: string): string {
 /** Types only: the keys of the target's permissions for `can`, `access.can`, `access.filter` and `defineRoles`. */
 function renderPermissions(): string {
   const entries = [...permissionDeclarations.values()].sort((left, right) => left.file.localeCompare(right.file) || left.name.localeCompare(right.name));
-  const lines = ["// This file is auto-generated by `bazis codegen`.", "// Do not edit manually.", 'import type { PermissionsOf } from "bazis/core/access";'];
+  const lines = ["// This file is auto-generated by `bazis codegen`.", "// Do not edit manually."];
+  // Without an import or an export the file would be a script, and `declare module` would replace the module instead of adding to it.
+  lines.push(entries.length > 0 ? 'import type { PermissionsOf } from "bazis/core/access";' : "export {};");
   entries.forEach((entry, index) => lines.push(`import type { ${entry.name} as Permissions_${index} } from ${JSON.stringify(toModuleSpecifierFrom(activeGeneratedDir, entry.file))};`));
-  lines.push("", 'declare module "bazis/core/access" {', `  interface BazisPermissions extends ${entries.map((_, index) => `PermissionsOf<typeof Permissions_${index}>`).join(", ")} {}`, "}", "");
+  lines.push("", 'declare module "bazis/core/access" {');
+  if (entries.length > 0) lines.push(`  interface BazisPermissions extends ${entries.map((_, index) => `PermissionsOf<typeof Permissions_${index}>`).join(", ")} {}`);
+  // The prefixes of `permissionSources`: `${prefix}.${string}` is a permission key too (ACCESS-001 §3.1).
+  if (permissionSourcePrefixes.size > 0) {
+    lines.push("  interface BazisPermissionSources {", ...[...permissionSourcePrefixes].sort().map((prefix) => `    ${JSON.stringify(prefix)}: true;`), "  }");
+  }
+  lines.push("}", "");
   return lines.join("\n");
 }
 
@@ -1036,6 +1046,9 @@ function collectDiClassRegistrations(source: ts.SourceFile): void {
     // `references: { "orders.order": OrderReferences }`: the field registers the classes.
     const references = objectFor(properties.get("references"));
     if (references) for (const entry of propertiesOf(references).values()) record(entry);
+    // `permissionSources: { data: DataPermissionSource }`: the field registers the classes too.
+    const permissionSources = objectFor(properties.get("permissionSources"));
+    if (permissionSources) for (const entry of propertiesOf(permissionSources).values()) record(entry);
     // `permissions: orderPermissions`: the field registers the `lookup` classes its permissions name.
     for (const lookup of permissionLookups(properties.get("permissions"))) record(lookup);
     const imports = properties.get("imports");
@@ -1177,6 +1190,22 @@ function collectProviderFormErrors(source: ts.SourceFile): void {
     }
     permissionDeclarations.set(`${file}\0${exported.name}`, { name: exported.name, file });
   };
+  /**
+   * `permissionSources: { data: DataPermissionSource }`: the prefixes go to the
+   * generated `permissions.ts`, which makes every key under them a permission
+   * key for `can` and `access.filter`. A framework pack names its own in its sources.
+   */
+  const collectPermissionSources = (module: string, initializer: ts.Expression): void => {
+    const file = normalizeProjectPath(initializer.getSourceFile().fileName);
+    if (file.includes("/node_modules/") || isFrameworkPackPath(file)) return;
+    const object = resolved(initializer, ts.isObjectLiteralExpression);
+    const named = object?.properties.every((property) => ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)));
+    if (!object || named !== true) {
+      fatalErrors.push(`BAZIS_ACCESS_SOURCES_FORM: ${sourceLocation(initializer)}: permissionSources of ${module}: "${text(initializer)}" — write an object "prefix: Class" in the module, so that the keys under the prefixes become the type of can(...).`);
+      return;
+    }
+    for (const property of object.properties) permissionSourcePrefixes.add((property.name as ts.Identifier | ts.StringLiteralLike).text);
+  };
   const checkModule = (module: string, argument: ts.Expression | undefined): void => {
     const object = argument && resolved(argument, ts.isObjectLiteralExpression);
     if (!object) return;
@@ -1184,6 +1213,7 @@ function collectProviderFormErrors(source: ts.SourceFile): void {
       if (!ts.isPropertyAssignment(property)) continue;
       const field = property.name.getText().replace(/["']/g, "");
       if (field === "permissions") collectPermissions(module, property.initializer);
+      if (field === "permissionSources") collectPermissionSources(module, property.initializer);
       if (field !== "providers" && !CLASS_LISTS.includes(field)) continue;
       const list = resolved(property.initializer, ts.isArrayLiteralExpression);
       if (!list) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.139.0",
+  "version": "0.140.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",