canopycms 0.0.0

package/dist/authorization/index.js

@@ -0,0 +1,42 @@
+/**
+ * Authorization module for CanopyCMS
+ *
+ * This module provides a unified API for checking user access to branches and content.
+ *
+ * ## Quick Start
+ *
+ * For most use cases, use `checkContentAccess` which handles both branch and path permissions:
+ *
+ * ```ts
+ * import { checkContentAccess } from './authorization'
+ *
+ * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/post.mdx', user, 'edit')
+ * if (result.allowed) {
+ *   // User can edit the file
+ * }
+ * ```
+ *
+ * ## Module Structure
+ *
+ * - `content.ts` - Combined branch + path access (main entry point)
+ * - `branch.ts` - Branch-level access control
+ * - `path.ts` - Path-level permissions
+ * - `helpers.ts` - Utility functions (isAdmin, isReviewer, etc.)
+ * - `permissions/` - Permissions file schema and loader
+ * - `groups/` - Groups file schema and loader
+ */
+// Validation
+export { parsePermissionPath } from './validation';
+// Main content access (recommended for most cases)
+export { checkContentAccess, createCheckContentAccess } from './content';
+// Branch-level access
+export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
+// Path-level access
+export { checkPathAccess, createCheckPathAccess } from './path';
+// Helper functions
+export { RESERVED_GROUPS, isReservedGroup, isAdmin, isReviewer, isPrivileged, } from './helpers';
+// Permissions file handling
+export { PermissionsFileSchema, createDefaultPermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions';
+// Groups file handling
+export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups';
+//# sourceMappingURL=index.js.map

package/dist/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAExE,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAE/D,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}

package/dist/authorization/path.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Path-level authorization
+ *
+ * Handles checking if a user can access a specific path based on permission rules.
+ */
+import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../config';
+import type { CanopyUser } from '../user';
+import type { PathPermissionResult } from './types';
+import type { PhysicalPath } from '../paths/types';
+/**
+ * Evaluate access for a relative path against config-defined rules.
+ * Uses defaultAccess when no rule matches. First matching rule wins.
+ */
+export declare function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }: {
+    rules: PathPermission[];
+    relativePath: PhysicalPath;
+    user: CanopyUser;
+    defaultAccess: DefaultPathAccess;
+    level: PermissionLevel;
+}): PathPermissionResult;
+/**
+ * Factory to bind rules and defaultAccess once.
+ */
+export declare function createCheckPathAccess(rules: PathPermission[], defaultAccess: DefaultPathAccess): (input: {
+    relativePath: PhysicalPath;
+    user: CanopyUser;
+    level: PermissionLevel;
+}) => PathPermissionResult;
+//# sourceMappingURL=path.d.ts.map

package/dist/authorization/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EAEhB,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoClD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,iBAAiB,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,oBAAoB,CA6BvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,iBAAiB,IACrF,OAAO;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,eAAe,CAAA;CACvB,KAAG,oBAAoB,CACzB"}

package/dist/authorization/path.js

@@ -0,0 +1,71 @@
+/**
+ * Path-level authorization
+ *
+ * Handles checking if a user can access a specific path based on permission rules.
+ */
+import path from 'node:path';
+import { minimatch } from 'minimatch';
+import { isAdmin } from './helpers';
+/**
+ * Normalize a path for consistent matching
+ */
+function normalize(p) {
+    const normalized = p.split(path.sep).join('/');
+    return normalized.replace(/^\.?\/*/, '');
+}
+/**
+ * Check if a path matches a permission rule
+ */
+function matchesRule(rule, relativePath) {
+    return minimatch(relativePath, rule.path, { dot: true });
+}
+/**
+ * Check if user matches a permission target
+ */
+function isAllowedByTarget(target, user) {
+    const hasUserConstraint = !!target.allowedUsers?.length;
+    const hasGroupConstraint = !!target.allowedGroups?.length;
+    // No constraints means allowed (rule applies to everyone)
+    if (!hasUserConstraint && !hasGroupConstraint) {
+        return true;
+    }
+    const matchesUser = hasUserConstraint && target.allowedUsers?.includes(user.userId);
+    const matchesGroup = hasGroupConstraint && user.groups?.some((gid) => target.allowedGroups?.includes(gid));
+    return Boolean(matchesUser || matchesGroup);
+}
+/**
+ * Evaluate access for a relative path against config-defined rules.
+ * Uses defaultAccess when no rule matches. First matching rule wins.
+ */
+export function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }) {
+    const normalizedPath = normalize(relativePath);
+    // Only Admins bypass all path permissions
+    if (isAdmin(user.groups)) {
+        return { allowed: true, reason: 'admin' };
+    }
+    for (const rule of rules) {
+        if (!matchesRule(rule, normalizedPath)) {
+            continue;
+        }
+        // Get the permission target for this level
+        const target = rule[level];
+        if (!target) {
+            // No permissions defined for this level on this rule, continue to next rule
+            continue;
+        }
+        const allowed = isAllowedByTarget(target, user);
+        return {
+            allowed,
+            matchedRule: rule,
+            reason: allowed ? 'allowed_by_rule' : 'denied_by_rule',
+        };
+    }
+    return { allowed: defaultAccess === 'allow', reason: 'no_rule_match' };
+}
+/**
+ * Factory to bind rules and defaultAccess once.
+ */
+export function createCheckPathAccess(rules, defaultAccess) {
+    return (input) => checkPathAccess({ ...input, rules, defaultAccess });
+}
+//# sourceMappingURL=path.js.map

package/dist/authorization/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC;;GAEG;AACH,SAAS,SAAS,CAAC,CAAe;IAChC,MAAM,UAAU,GAAI,CAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAiB,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAoB,EAAE,YAA0B;IACnE,OAAO,SAAS,CAAC,YAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAwB,EAAE,IAAgB;IACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IAEzD,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvF,OAAO,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GAON;IACC,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QAED,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4EAA4E;YAC5E,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO;YACL,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;SACvD,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,aAAgC;IAC7F,OAAO,CAAC,KAIP,EAAwB,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;AACjF,CAAC"}

package/dist/authorization/permissions/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Permissions module exports
+ */
+export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile } from './schema';
+export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/index.js

@@ -0,0 +1,6 @@
+/**
+ * Permissions module exports
+ */
+export { PermissionsFileSchema, createDefaultPermissionsFile } from './schema';
+export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader';
+//# sourceMappingURL=index.js.map

package/dist/authorization/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAwB,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/loader.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Permissions file loader
+ *
+ * Handles loading and saving path permissions from the filesystem.
+ */
+import type { PathPermission } from '../../config';
+import type { PermissionsFile } from './schema';
+import type { OperatingMode } from '../../operating-mode';
+/**
+ * Load full permissions file (for version checking)
+ * Returns null if file doesn't exist.
+ *
+ * @param repoRoot - Repository root directory
+ * @param mode - Operating mode (determines file path)
+ */
+export declare function loadPermissionsFile(repoRoot: string, mode: OperatingMode): Promise<PermissionsFile | null>;
+/**
+ * Load path permissions from .canopycms/permissions.json (or .local.json in dev mode)
+ * Returns empty array if file doesn't exist (no restrictions).
+ *
+ * @param repoRoot - Repository root directory
+ * @param mode - Operating mode (determines file path)
+ */
+export declare function loadPathPermissions(repoRoot: string, mode: OperatingMode): Promise<PathPermission[]>;
+/**
+ * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ */
+export declare function savePathPermissions(repoRoot: string, permissions: PathPermission[], updatedBy: string, mode: OperatingMode, contentVersion?: number): Promise<void>;
+/**
+ * Initialize permissions file if it doesn't exist
+ */
+export declare function ensurePermissionsFile(repoRoot: string, userId: string, mode: OperatingMode): Promise<void>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/authorization/permissions/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAUzD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,cAAc,EAAE,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/authorization/permissions/loader.js

@@ -0,0 +1,85 @@
+/**
+ * Permissions file loader
+ *
+ * Handles loading and saving path permissions from the filesystem.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { PermissionsFileSchema } from './schema';
+import { operatingStrategy } from '../../operating-mode';
+/**
+ * Get the appropriate permissions file path based on mode
+ */
+function getPermissionsFilePath(repoRoot, mode) {
+    return operatingStrategy(mode).getPermissionsFilePath(repoRoot);
+}
+/**
+ * Load full permissions file (for version checking)
+ * Returns null if file doesn't exist.
+ *
+ * @param repoRoot - Repository root directory
+ * @param mode - Operating mode (determines file path)
+ */
+export async function loadPermissionsFile(repoRoot, mode) {
+    const permissionsPath = getPermissionsFilePath(repoRoot, mode);
+    try {
+        const fileContent = await fs.readFile(permissionsPath, 'utf-8');
+        const parsed = JSON.parse(fileContent);
+        const validated = PermissionsFileSchema.parse(parsed);
+        return validated;
+    }
+    catch (error) {
+        // File doesn't exist
+        if (error.code === 'ENOENT') {
+            return null;
+        }
+        // Parse/validation error - this is more serious
+        console.error('CanopyCMS: Failed to parse permissions file', error);
+        throw new Error(`Invalid permissions file: ${error instanceof Error ? error.message : 'unknown error'}`);
+    }
+}
+/**
+ * Load path permissions from .canopycms/permissions.json (or .local.json in dev mode)
+ * Returns empty array if file doesn't exist (no restrictions).
+ *
+ * @param repoRoot - Repository root directory
+ * @param mode - Operating mode (determines file path)
+ */
+export async function loadPathPermissions(repoRoot, mode) {
+    const file = await loadPermissionsFile(repoRoot, mode);
+    return file?.pathPermissions ?? [];
+}
+/**
+ * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ */
+export async function savePathPermissions(repoRoot, permissions, updatedBy, mode, contentVersion) {
+    const permissionsPath = getPermissionsFilePath(repoRoot, mode);
+    const canopyDir = path.dirname(permissionsPath);
+    // Ensure .canopycms directory exists
+    await fs.mkdir(canopyDir, { recursive: true });
+    const permissionsFile = {
+        version: 1,
+        contentVersion: contentVersion ?? 1,
+        updatedAt: new Date().toISOString(),
+        updatedBy,
+        pathPermissions: permissions,
+    };
+    // Validate before writing
+    PermissionsFileSchema.parse(permissionsFile);
+    await fs.writeFile(permissionsPath, JSON.stringify(permissionsFile, null, 2), 'utf-8');
+}
+/**
+ * Initialize permissions file if it doesn't exist
+ */
+export async function ensurePermissionsFile(repoRoot, userId, mode) {
+    const permissionsPath = getPermissionsFilePath(repoRoot, mode);
+    try {
+        await fs.access(permissionsPath);
+        // File exists, nothing to do
+    }
+    catch {
+        // File doesn't exist, create default
+        await savePathPermissions(repoRoot, [], userId, mode);
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/authorization/permissions/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAmB;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,EAAE,eAAe,IAAI,EAAE,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,WAA6B,EAC7B,SAAiB,EACjB,IAAmB,EACnB,cAAuB;IAEvB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAE/C,qCAAqC;IACrC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE9C,MAAM,eAAe,GAAoB;QACvC,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,eAAe,EAAE,WAAW;KAC7B,CAAA;IAED,0BAA0B;IAC1B,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAE5C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AACxF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,MAAc,EACd,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAChC,6BAA6B;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACvD,CAAC;AACH,CAAC"}

package/dist/authorization/permissions/schema.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Schema for permissions.json file
+ */
+import { z } from 'zod';
+import type { CanopyUserId } from '../../types';
+import type { PermissionPath } from '../types';
+/**
+ * Schema for .canopycms/permissions.json
+ *
+ * SECURITY: Permission paths are validated to prevent path traversal attacks.
+ * Any path containing '..' or other traversal sequences will be rejected.
+ */
+export declare const PermissionsFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    contentVersion: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodString;
+    updatedBy: z.ZodType<CanopyUserId>;
+    pathPermissions: z.ZodArray<z.ZodObject<{
+        path: z.ZodType<PermissionPath, z.ZodTypeDef, PermissionPath>;
+        read: z.ZodOptional<z.ZodObject<{
+            allowedUsers: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+            allowedGroups: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }>>;
+        edit: z.ZodOptional<z.ZodObject<{
+            allowedUsers: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+            allowedGroups: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }>>;
+        review: z.ZodOptional<z.ZodObject<{
+            allowedUsers: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+            allowedGroups: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }, {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        path: string & {
+            readonly __brand: "PermissionPath";
+        };
+        read?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        edit?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        review?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+    }, {
+        path: string & {
+            readonly __brand: "PermissionPath";
+        };
+        read?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        edit?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        review?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    updatedAt: string;
+    version: 1;
+    updatedBy: string;
+    pathPermissions: {
+        path: string & {
+            readonly __brand: "PermissionPath";
+        };
+        read?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        edit?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        review?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+    }[];
+    contentVersion?: number | undefined;
+}, {
+    updatedAt: string;
+    version: 1;
+    updatedBy: string;
+    pathPermissions: {
+        path: string & {
+            readonly __brand: "PermissionPath";
+        };
+        read?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        edit?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+        review?: {
+            allowedUsers?: string[] | undefined;
+            allowedGroups?: string[] | undefined;
+        } | undefined;
+    }[];
+    contentVersion?: number | undefined;
+}>;
+export type PermissionsFile = z.infer<typeof PermissionsFileSchema>;
+/**
+ * Default permissions file
+ */
+export declare function createDefaultPermissionsFile(userId: CanopyUserId): PermissionsFile;
+//# sourceMappingURL=schema.d.ts.map

package/dist/authorization/permissions/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAA;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAyB9C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;eAIP,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAShD,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAOlF"}

package/dist/authorization/permissions/schema.js

@@ -0,0 +1,56 @@
+/**
+ * Schema for permissions.json file
+ */
+import { z } from 'zod';
+import { parsePermissionPath } from '../validation';
+const permissionTargetSchema = z.object({
+    allowedUsers: z.array(z.string()).optional(),
+    allowedGroups: z.array(z.string()).optional(),
+});
+/**
+ * Zod schema for PermissionPath - validates and prevents path traversal attacks.
+ */
+const permissionPathSchema = z
+    .string()
+    .min(1)
+    .transform((val, ctx) => {
+    const result = parsePermissionPath(val);
+    if (!result.ok) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: result.error,
+        });
+        return z.NEVER;
+    }
+    return result.path;
+});
+/**
+ * Schema for .canopycms/permissions.json
+ *
+ * SECURITY: Permission paths are validated to prevent path traversal attacks.
+ * Any path containing '..' or other traversal sequences will be rejected.
+ */
+export const PermissionsFileSchema = z.object({
+    version: z.literal(1),
+    contentVersion: z.number().optional(), // For optimistic locking
+    updatedAt: z.string().datetime(),
+    updatedBy: z.string(),
+    pathPermissions: z.array(z.object({
+        path: permissionPathSchema,
+        read: permissionTargetSchema.optional(),
+        edit: permissionTargetSchema.optional(),
+        review: permissionTargetSchema.optional(),
+    })),
+});
+/**
+ * Default permissions file
+ */
+export function createDefaultPermissionsFile(userId) {
+    return {
+        version: 1,
+        updatedAt: new Date().toISOString(),
+        updatedBy: userId,
+        pathPermissions: [],
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/authorization/permissions/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,QAAQ,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA8B,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC,CAAyC,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CACtB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;CACF,CAAC,CAAA;AAIF;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,EAAE;KACpB,CAAA;AACH,CAAC"}

package/dist/authorization/test-utils.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Test utilities for authorization types.
+ *
+ * These are unsafe casts with NO validation. Import only from test files.
+ * For production code, use parsePermissionPath() instead.
+ *
+ * @example
+ * // In test files only:
+ * import { unsafeAsPermissionPath } from '../authorization/test-utils'
+ */
+import type { PermissionPath } from './types';
+/** Test-only: cast a string to PermissionPath without validation. */
+export declare const unsafeAsPermissionPath: (path: string) => PermissionPath;
+//# sourceMappingURL=test-utils.d.ts.map

package/dist/authorization/test-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-utils.d.ts","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,cAAwC,CAAA"}

package/dist/authorization/test-utils.js

@@ -0,0 +1,13 @@
+/**
+ * Test utilities for authorization types.
+ *
+ * These are unsafe casts with NO validation. Import only from test files.
+ * For production code, use parsePermissionPath() instead.
+ *
+ * @example
+ * // In test files only:
+ * import { unsafeAsPermissionPath } from '../authorization/test-utils'
+ */
+/** Test-only: cast a string to PermissionPath without validation. */
+export const unsafeAsPermissionPath = (path) => path;
+//# sourceMappingURL=test-utils.js.map

package/dist/authorization/test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-utils.js","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,IAAsB,CAAA"}

package/dist/authorization/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Authorization types for CanopyCMS
+ *
+ * This module exports all types related to authorization including
+ * branch access, path permissions, and content access results.
+ */
+import type { CanopyUserId, CanopyGroupId } from '../types';
+export type { CanopyUserId, CanopyGroupId };
+/**
+ * A path used in permission rules.
+ * SECURITY CRITICAL: Always validated to prevent path traversal.
+ * Example: "content/posts" or "content/settings/config"
+ */
+export type PermissionPath = string & {
+    readonly __brand: 'PermissionPath';
+};
+/**
+ * Result of checking branch-level access
+ */
+export interface BranchAccessResult {
+    allowed: boolean;
+    reason: 'privileged' | 'allowed_by_acl' | 'denied_by_acl' | 'no_acl';
+}
+/**
+ * Result of checking path-level permissions
+ */
+export interface PathPermissionResult {
+    allowed: boolean;
+    matchedRule?: import('../config').PathPermission;
+    reason?: string;
+}
+/**
+ * Combined result of checking both branch and path access
+ */
+export interface ContentAccessResult {
+    allowed: boolean;
+    branch: BranchAccessResult;
+    path: PathPermissionResult;
+}
+/**
+ * Dependencies for content access checking
+ */
+export interface ContentAccessDeps {
+    checkBranchAccess: (context: import('../types').BranchContext, user: import('../user').CanopyUser) => BranchAccessResult;
+    loadPathPermissions: (branchRoot: string, mode: import('../operating-mode').OperatingMode) => Promise<import('../config').PathPermission[]>;
+    defaultPathAccess: import('../config').DefaultPathAccess;
+    mode: import('../operating-mode').OperatingMode;
+    /**
+     * Get the settings branch root path for loading centralized permissions.
+     * Only used in prod/prod-sim modes.
+     * Must throw if settings branch cannot be loaded.
+     */
+    getSettingsBranchRoot?: () => Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/authorization/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAG3D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE3C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,GAAG,gBAAgB,GAAG,eAAe,GAAG,QAAQ,CAAA;CACrE;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,WAAW,EAAE,cAAc,CAAA;IAChD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,kBAAkB,CAAA;IAC1B,IAAI,EAAE,oBAAoB,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,CACjB,OAAO,EAAE,OAAO,UAAU,EAAE,aAAa,EACzC,IAAI,EAAE,OAAO,SAAS,EAAE,UAAU,KAC/B,kBAAkB,CAAA;IACvB,mBAAmB,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,KAC5C,OAAO,CAAC,OAAO,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;IAClD,iBAAiB,EAAE,OAAO,WAAW,EAAE,iBAAiB,CAAA;IACxD,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAA;IAC/C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAC9C"}

package/dist/authorization/types.js

@@ -0,0 +1,8 @@
+/**
+ * Authorization types for CanopyCMS
+ *
+ * This module exports all types related to authorization including
+ * branch access, path permissions, and content access results.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/authorization/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/authorization/validation.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Authorization validation utilities.
+ *
+ * SECURITY CRITICAL: These functions validate permission paths
+ * to prevent path traversal attacks.
+ */
+import type { PermissionPath } from './types';
+/**
+ * Parse and validate a PermissionPath.
+ *
+ * SECURITY: Prevents path traversal attacks in permission rules.
+ *
+ * @param path - The permission path to validate
+ * @returns Object with success flag and either the typed path or an error
+ *
+ * @example
+ * ```ts
+ * const result = parsePermissionPath(rule.path)
+ * if (!result.ok) {
+ *   throw new Error(`Invalid permission path: ${result.error}`)
+ * }
+ * const permissionPath: PermissionPath = result.path
+ * ```
+ */
+export declare function parsePermissionPath(path: string): {
+    ok: true;
+    path: PermissionPath;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=validation.d.ts.map