cauthy-auth 0.28.0 → 0.30.0

package/dist/index.js

@@ -41,7 +41,9 @@ __export(src_exports, {
   passwordPolicyOf: () => passwordPolicyOf,
   passwordProblems: () => passwordProblems,
   policySource: () => policySource,
+  pullCatalog: () => pullCatalog,
   pullPolicy: () => pullPolicy,
+  pushCatalog: () => pushCatalog,
   pushPolicy: () => pushPolicy,
   pushTheme: () => pushTheme,
   themeFromStackmyth: () => themeFromStackmyth,
@@ -107,9 +109,6 @@ async function unseal(sealed, key) {
   }
 }
 
-// src/system.ts
-var import_jose2 = require("jose");
-
 // src/url.ts
 function withoutTrailingSlashes(s) {
   let end = s.length;
@@ -117,6 +116,218 @@ function withoutTrailingSlashes(s) {
   return s.slice(0, end);
 }
 
+// src/permissions.ts
+function matches(entry, resource, action) {
+  const i = entry.lastIndexOf(":");
+  if (i < 0) return false;
+  const r = entry.slice(0, i);
+  const a = entry.slice(i + 1);
+  return (r === "*" || r === resource) && (a === "*" || a === action);
+}
+function can(organization, resource, action) {
+  if (!organization?.permissions) return false;
+  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
+  return organization.permissions.some((p) => matches(p, resource, action));
+}
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
+  const entry = (p) => `${p.resource}:${p.action}`;
+  const byName = new Map(roles.map((r) => [r.role, r]));
+  const split = (permission) => {
+    const i = permission.lastIndexOf(":");
+    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
+  };
+  return {
+    roles: roles.map((r) => ({
+      role: r.role,
+      ...r.name !== void 0 ? { name: r.name } : {},
+      ...r.description !== void 0 ? { description: r.description } : {},
+      ...r.inherits ? { inherits: [...r.inherits] } : {},
+      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
+    })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
+    roleNames: roles.map((r) => r.role),
+    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
+    can(organization, permission) {
+      const [resource, action] = split(permission);
+      return can(organization, resource, action);
+    },
+    hasRole(organization, ...wanted) {
+      return organization != null && wanted.includes(organization.role);
+    },
+    permissionsOf(role) {
+      const seen = /* @__PURE__ */ new Set();
+      const out2 = /* @__PURE__ */ new Set();
+      const walk = (name) => {
+        if (seen.has(name)) return;
+        seen.add(name);
+        const r = byName.get(name);
+        for (const p of r?.permissions ?? []) out2.add(entry(p));
+        for (const parent of r?.inherits ?? []) walk(parent);
+      };
+      walk(role);
+      return [...out2];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
+    }
+  };
+}
+var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function policySource(system, read) {
+  const roles = Array.isArray(read) ? read : read.roles;
+  const catalog = Array.isArray(read) ? [] : read.catalog ?? [];
+  const text = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text(k);
+  const one = (r, pad) => {
+    const parts = [`role: ${text(r.role)}`];
+    if (r.name) parts.push(`name: ${text(r.name)}`);
+    if (r.description) parts.push(`description: ${text(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
+    if (r.permissions?.length) {
+      const list = r.permissions.map((p) => `${pad}      { ${[
+        ...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [],
+        `resource: ${text(p.resource)}`,
+        `action: ${text(p.action)}`,
+        ...p.condition ? [`condition: ${text(p.condition)}`] : []
+      ].join(", ")} },`);
+      parts.push(`permissions: [
+${list.join("\n")}
+${pad}    ]`);
+    }
+    return `${pad}  {
+${pad}    ${parts.join(`,
+${pad}    `)},
+${pad}  },`;
+  };
+  const resource = (c) => {
+    const parts = [`resource: ${text(c.resource)}`];
+    if (c.description) parts.push(`description: ${text(c.description)}`);
+    parts.push(`actions: [${c.actions.map(text).join(", ")}]`);
+    const attrs = Object.entries(c.attributes ?? {});
+    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text(v)}`).join(", ")} }`);
+    return `    { ${parts.join(", ")} },`;
+  };
+  const head = `// The catalog of roles of ${text(system)}, as Cauthy has it.
+// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
+// changes, and do not edit this file by hand.
+`;
+  if (catalog.length === 0) {
+    return `${head}
+import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy([
+${roles.map((r) => one(r, "")).join("\n")}
+])
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+`;
+  }
+  return `${head}
+import { definePolicy, type CheckOf, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy({
+  catalog: [
+${catalog.map(resource).join("\n")}
+  ],
+  roles: [
+${roles.map((r) => one(r, "  ")).join("\n")}
+  ],
+})
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+/** What a check may ask: \`policy.check(auth, request, { organization, ...question })\`. */
+export type Check = CheckOf<typeof policy>
+`;
+}
+function reach(o, doing) {
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const r = {
+    issuer: withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? ""),
+    system: o.system ?? env4("CAUTHY_SYSTEM") ?? "",
+    tenant: o.tenant ?? env4("CAUTHY_TENANT") ?? "",
+    token: o.token ?? env4("CAUTHY_TOKEN") ?? ""
+  };
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: r.issuer, CAUTHY_SYSTEM: r.system, CAUTHY_TENANT: r.tenant, CAUTHY_TOKEN: r.token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to ${doing}`);
+  }
+  return { ...r, fetch: o.fetch ?? fetch };
+}
+async function systemCall(r, method, what, body) {
+  const res = await r.fetch(`${r.issuer}/v1/systems/${encodeURIComponent(r.system)}/${what}`, {
+    ...method === "PUT" ? { method } : {},
+    headers: {
+      authorization: `Bearer ${r.token}`,
+      "x-tenant-key": r.tenant,
+      ...body === void 0 ? { accept: "application/json" } : { "content-type": "application/json" }
+    },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  });
+  const answer = await res.json().catch(() => null);
+  if (!res.ok) {
+    const verb = method === "GET" ? `refused to give the ${what}` : `refused the ${what}`;
+    throw new Error(`cauthy-auth: Cauthy ${verb} (${res.status}): ${answer?.errors?.[0]?.message ?? res.statusText}`);
+  }
+  return answer?.data;
+}
+async function pullPolicy(o = {}) {
+  const data = await systemCall(reach(o, "read a policy"), "GET", "policy");
+  return data?.roles ?? [];
+}
+async function pullCatalog(o = {}) {
+  const data = await systemCall(reach(o, "read a catalog"), "GET", "catalog");
+  return data?.resources ?? [];
+}
+async function pushPolicy(o) {
+  const r = reach(o, "push a policy");
+  if (o.catalog !== void 0) await systemCall(r, "PUT", "catalog", { resources: o.catalog });
+  await systemCall(r, "PUT", "policy", { roles: o.roles });
+}
+async function pushCatalog(o) {
+  const data = await systemCall(reach(o, "push a catalog"), "PUT", "catalog", { resources: o.resources });
+  return data?.resources ?? [];
+}
+function checkWire(q) {
+  return {
+    resource: q.resource,
+    action: q.action,
+    ...q.resourceId !== void 0 ? { resource_id: q.resourceId } : {},
+    ...q.ownerId !== void 0 ? { owner_id: q.ownerId } : {},
+    ...q.attributes !== void 0 ? { attributes: q.attributes } : {}
+  };
+}
+function checkResultOf(d) {
+  const r = d?.rule;
+  const rule = r && typeof r === "object" ? {
+    source: r.source === "exception" ? "exception" : "role",
+    ...r.role ? { role: String(r.role) } : {},
+    kind: String(r.kind ?? "*"),
+    resource: String(r.resource ?? ""),
+    action: String(r.action ?? ""),
+    effect: r.effect === "allow" ? "allow" : "deny",
+    ...r.condition ? { condition: String(r.condition) } : {}
+  } : void 0;
+  return { allowed: d?.allowed === true, reason: String(d?.reason ?? ""), ...rule ? { rule } : {} };
+}
+function organizationIdOf(o) {
+  return typeof o === "string" ? o : typeof o?.id === "string" ? o.id : "";
+}
+
+// src/system.ts
+var import_jose2 = require("jose");
+
 // src/theme.ts
 var MAX_RADIUS = 40;
 function withoutComments(css) {
@@ -534,6 +745,7 @@ function createSystem(given = {}) {
   const clientSecret = given.clientSecret ?? env("CAUTHY_CLIENT_SECRET") ?? "";
   const envKey = env("CAUTHY_SYSTEM_KEY");
   const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
+  const ownSystem = given.system ?? env("CAUTHY_SYSTEM") ?? "";
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
   const tokenEndpoint = `${issuer}/v1/oauth/token`;
   function configured() {
@@ -651,6 +863,19 @@ function createSystem(given = {}) {
         return (await data("GET", `/v1/systems/${id(system)}/policy`)).roles ?? [];
       }
     },
+    catalog: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/catalog`)).resources ?? [];
+      },
+      async set(system, resources) {
+        return (await data("PUT", `/v1/systems/${id(system)}/catalog`, { resources })).resources ?? [];
+      }
+    },
+    async check(q) {
+      const system = q.system ?? ownSystem;
+      if (system === "") throw new CauthyConfigError("name the system to check in (system, or CAUTHY_SYSTEM)");
+      return checkResultOf(await data("POST", `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }));
+    },
     async publicJwks() {
       if (!key) return { keys: [] };
       const { kty, n, e } = asJwk(key) ?? await (0, import_jose2.exportJWK)(await signingKey());
@@ -798,6 +1023,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -899,6 +1130,13 @@ function providerIn(segment) {
 function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return void 0;
+  }
+}
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -922,6 +1160,9 @@ function redirect(location, cookies = []) {
   for (const c of cookies) h.append("set-cookie", c);
   return new Response(null, { status: 302, headers: h });
 }
+function conditionalOf(c) {
+  return { resource: String(c?.resource ?? ""), action: String(c?.action ?? ""), effect: c?.effect === "deny" ? "deny" : "allow" };
+}
 function createCauthy(given = {}) {
   const issuer = withoutTrailingSlashes(given.issuer ?? env2("CAUTHY_ISSUER") ?? "");
   const clientId = given.clientId ?? env2("CAUTHY_CLIENT_ID") ?? "";
@@ -932,6 +1173,10 @@ function createCauthy(given = {}) {
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const baseURL = given.baseURL ?? env2("CAUTHY_BASE_URL");
+  if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
+    throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
+  }
   const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
   const afterSignIn = localPath(given.afterSignIn, "/");
   const afterSignOut = localPath(given.afterSignOut, "/");
@@ -946,8 +1191,13 @@ function createCauthy(given = {}) {
     resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, "/") : void 0,
     verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
   };
-  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
-  const originOf = (request) => withoutTrailingSlashes(given.baseURL ?? new URL(request.url).origin);
+  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || void 0, fetch: given.fetch });
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const url = new URL(request.url);
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
+  };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
@@ -1076,13 +1326,35 @@ function createCauthy(given = {}) {
         role: String(o.role ?? ""),
         metadata: o.metadata ?? {},
         ...o.external_id ? { externalId: String(o.external_id) } : {},
-        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [] } : {}
+        ...Array.isArray(o.permissions) ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [], conditional: Array.isArray(o.conditional) ? o.conditional.map(conditionalOf) : [] } : {}
       })
     );
     if (orgCache.size > 5e3) orgCache.clear();
     orgCache.set(session.accessToken, { at: Date.now(), value });
     return value;
   }
+  async function decide(token2, question) {
+    const org = organizationIdOf(question.organization);
+    if (org === "") return { allowed: false, reason: "no organization named" };
+    const res = await doFetch(`${issuer}/v1/oauth/organizations/${encodeURIComponent(org)}/check`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token2}`, "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(checkWire(question))
+    }).catch(() => null);
+    if (res === null) throw new CauthyApiError(503, "unavailable", "Cauthy could not be reached to check a permission");
+    const body2 = await res.json().catch(() => null);
+    if (res.ok) return checkResultOf(body2?.data);
+    const first = body2?.errors?.[0];
+    if (res.status === 401 || res.status === 403 || res.status === 404) {
+      return { allowed: false, reason: first?.message ?? (res.status === 401 ? "not signed in" : res.status === 404 ? "not a member of the organization" : "refused") };
+    }
+    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused to check a permission (${res.status}): ${first?.message ?? res.statusText}`);
+  }
+  async function check(who, question) {
+    const session = "accessToken" in who ? who : await getSession(who);
+    if (!session) return { allowed: false, reason: "not signed in" };
+    return decide(session.accessToken, question);
+  }
   const forgetting = (fn) => async (...args) => {
     const out2 = await fn(...args);
     orgCache.clear();
@@ -1215,7 +1487,15 @@ function createCauthy(given = {}) {
     name: String(d?.name ?? ""),
     kind: String(d?.kind ?? ""),
     role: String(d?.role ?? ""),
-    can: { readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true }
+    // A Cauthy from before a power says nothing of it: then it is not given.
+    can: {
+      readMembers: d?.can?.read_members === true,
+      manageMembers: d?.can?.manage_members === true,
+      removeMembers: d?.can?.remove_members === true,
+      update: d?.can?.update === true,
+      archive: d?.can?.archive === true,
+      delete: d?.can?.delete === true
+    }
   });
   const orgMemberOf = (d) => ({
     userId: String(d?.user_id ?? ""),
@@ -1245,9 +1525,18 @@ function createCauthy(given = {}) {
   });
   const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
+  let explained = false;
   function ownRequest(request) {
     const origin = request.headers.get("origin");
-    if (origin !== null) return origin === originOf(request) || origin === new URL(request.url).origin;
+    if (origin !== null) {
+      const own = originOf(request);
+      if (origin === own || origin === new URL(request.url).origin) return true;
+      if (!explained && hostOf(origin) === new URL(own).hostname) {
+        explained = true;
+        console.warn(`cauthy-auth: refused a request from ${origin} as cross_site: this application sees itself as ${own}. Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.`);
+      }
+      return false;
+    }
     return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
   }
   async function body(request) {
@@ -1399,7 +1688,10 @@ function createCauthy(given = {}) {
       "/me/organizations/members/add",
       "/me/organizations/members/role",
       "/me/organizations/members/remove",
-      "/me/organizations/members/invite"
+      "/me/organizations/members/invite",
+      "/me/organizations/rename",
+      "/me/organizations/archive",
+      "/me/organizations/delete"
     ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
@@ -1870,6 +2162,23 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
         return signedIn(request, res.data);
       }
+      if (route === "/me/organizations/rename" || route === "/me/organizations/archive" || route === "/me/organizations/delete") {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const path = `/v1/auth/me/organizations/${org}`;
+        if (route === "/me/organizations/rename") {
+          const bad = checkOrganizationName(b.name);
+          if (bad) return invalid(bad);
+          const res2 = await as(path, { name: String(b.name).trim() }, "PATCH");
+          if (res2.error) return refused(res2, res2.error.code === "validation_error" ? "name" : void 0);
+          orgCache.delete(mine.token);
+          return json({ status: "renamed", organization: seatOf(res2.data) }, 200, mine.headers);
+        }
+        const res = route === "/me/organizations/archive" ? await as(`${path}/archive`) : await as(path, void 0, "DELETE");
+        if (res.error) return refused(res);
+        orgCache.delete(mine.token);
+        return json({ status: route === "/me/organizations/archive" ? "archived" : "deleted", organizationId: org }, 200, mine.headers);
+      }
       if (route.startsWith("/me/organizations/members/")) {
         const org = typeof b.organizationId === "string" ? b.organizationId : "";
         if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
@@ -2015,6 +2324,7 @@ function createCauthy(given = {}) {
     const get = request.method === "GET" || request.method === "HEAD";
     const mine = await ownRoute(request, url, route);
     if (mine !== null) return mine;
+    if (route === "/me/organizations/check") return checkRoute(request);
     if (route === "/login" && get) return login(request, url);
     if (route === "/callback" && get) return callback(request, url);
     if (route === "/logout" && (get || request.method === "POST")) return logout(request);
@@ -2041,6 +2351,36 @@ function createCauthy(given = {}) {
     }
     return new Response("Not found", { status: 404 });
   }
+  async function checkRoute(request) {
+    if (request.method !== "POST") return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+    if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
+    const b = await body(request);
+    if (b === null) return problem(400, "bad_request", "Send the question as JSON.");
+    const asker = await signedInAs(request);
+    if ("response" in asker) return asker.response;
+    const org = typeof b.organizationId === "string" ? b.organizationId : "";
+    if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, asker.headers);
+    const named = (v) => typeof v === "string" && v !== "" && v.length <= 200;
+    if (!named(b.resource) || !named(b.action)) return problem(400, "bad_request", "Say which resource and action.", void 0, asker.headers);
+    const attributes2 = b.attributes;
+    if (attributes2 !== void 0 && (typeof attributes2 !== "object" || attributes2 === null || Array.isArray(attributes2))) {
+      return problem(400, "bad_request", "The attributes are an object.", void 0, asker.headers);
+    }
+    try {
+      const r = await decide(asker.token, {
+        organization: org,
+        resource: b.resource,
+        action: b.action,
+        ...attributes2 !== void 0 ? { attributes: attributes2 } : {},
+        ...typeof b.resourceId === "string" ? { resourceId: b.resourceId } : {},
+        ...typeof b.ownerId === "string" ? { ownerId: b.ownerId } : {}
+      });
+      return json({ status: "decided", ...r }, 200, asker.headers);
+    } catch (e) {
+      const err = e instanceof CauthyApiError ? e : new CauthyApiError(503, "unavailable", "Cauthy could not be reached.");
+      return problem(err.status, err.code, err.message.replace(/^cauthy-auth: /, ""), void 0, asker.headers);
+    }
+  }
   async function protect(request) {
     const { value } = await read(request);
     if (value !== null && fresh(value)) return { session: toSession(value) };
@@ -2064,6 +2404,7 @@ function createCauthy(given = {}) {
     resolve: resolve2,
     protect,
     organizations,
+    check,
     toPublic,
     urls,
     options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
@@ -2078,128 +2419,6 @@ function legalOf(raw) {
   };
 }
 
-// src/permissions.ts
-function matches(entry, resource, action) {
-  const i = entry.lastIndexOf(":");
-  if (i < 0) return false;
-  const r = entry.slice(0, i);
-  const a = entry.slice(i + 1);
-  return (r === "*" || r === resource) && (a === "*" || a === action);
-}
-function can(organization, resource, action) {
-  if (!organization?.permissions) return false;
-  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
-  return organization.permissions.some((p) => matches(p, resource, action));
-}
-function definePolicy(roles) {
-  const entry = (p) => `${p.resource}:${p.action}`;
-  const byName = new Map(roles.map((r) => [r.role, r]));
-  const split = (permission) => {
-    const i = permission.lastIndexOf(":");
-    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
-  };
-  return {
-    roles: roles.map((r) => ({
-      role: r.role,
-      ...r.name !== void 0 ? { name: r.name } : {},
-      ...r.description !== void 0 ? { description: r.description } : {},
-      ...r.inherits ? { inherits: [...r.inherits] } : {},
-      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
-    })),
-    roleNames: roles.map((r) => r.role),
-    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
-    can(organization, permission) {
-      const [resource, action] = split(permission);
-      return can(organization, resource, action);
-    },
-    hasRole(organization, ...wanted) {
-      return organization != null && wanted.includes(organization.role);
-    },
-    permissionsOf(role) {
-      const seen = /* @__PURE__ */ new Set();
-      const out2 = /* @__PURE__ */ new Set();
-      const walk = (name) => {
-        if (seen.has(name)) return;
-        seen.add(name);
-        const r = byName.get(name);
-        for (const p of r?.permissions ?? []) out2.add(entry(p));
-        for (const parent of r?.inherits ?? []) walk(parent);
-      };
-      walk(role);
-      return [...out2];
-    }
-  };
-}
-var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-function policySource(system, roles) {
-  const text = (v) => JSON.stringify(v);
-  const key = (k) => IDENT.test(k) ? k : text(k);
-  const one = (r) => {
-    const parts = [`role: ${text(r.role)}`];
-    if (r.name) parts.push(`name: ${text(r.name)}`);
-    if (r.description) parts.push(`description: ${text(r.description)}`);
-    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
-    if (r.permissions?.length) {
-      const list = r.permissions.map((p) => `      { ${[...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [], `resource: ${text(p.resource)}`, `action: ${text(p.action)}`].join(", ")} },`);
-      parts.push(`permissions: [
-${list.join("\n")}
-    ]`);
-    }
-    return `  {
-    ${parts.join(",\n    ")},
-  },`;
-  };
-  return `// The catalog of roles of ${text(system)}, as Cauthy has it.
-// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
-// changes, and do not edit this file by hand.
-
-import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
-
-export const policy = definePolicy([
-${roles.map(one).join("\n")}
-])
-
-export const { can, hasRole } = policy
-export type Role = RoleOf<typeof policy>
-export type Permission = PermissionOf<typeof policy>
-`;
-}
-async function pullPolicy(o = {}) {
-  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
-  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to read a policy`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, accept: "application/json" }
-  });
-  const body = await res.json().catch(() => null);
-  if (!res.ok) throw new Error(`cauthy-auth: Cauthy refused to give the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  return body?.data?.roles ?? [];
-}
-async function pushPolicy(o) {
-  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = withoutTrailingSlashes(o.issuer ?? env4("CAUTHY_ISSUER") ?? "");
-  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
-  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
-    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
-  }
-  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
-    body: JSON.stringify({ roles: o.roles })
-  });
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
-  }
-}
-
 // src/connect.ts
 function sessionSecret() {
   const bytes = crypto.getRandomValues(new Uint8Array(32));
@@ -2325,7 +2544,9 @@ async function verifyToken(from, options = {}) {
   passwordPolicyOf,
   passwordProblems,
   policySource,
+  pullCatalog,
   pullPolicy,
+  pushCatalog,
   pushPolicy,
   pushTheme,
   themeFromStackmyth,