clawclamp 0.1.11 → 0.1.12

package/assets/app.js

@@ -21,7 +21,6 @@ const policyCreateBtn = qs("policy-create");
 const policyUpdateBtn = qs("policy-update");
 const policyDeleteBtn = qs("policy-delete");
 const policyStatusEl = qs("policy-status");
-const policySchemaEl = qs("policy-schema");
 let policyReadOnly = false;
 let policies = [];
 let deniedTools = new Set();
@@ -188,7 +187,6 @@ async function refreshPolicies() {
   const result = await fetchJson(`${API_BASE}/policies`);
   policyReadOnly = result.readOnly === true;
   renderPolicyList(result.policies || []);
-  policySchemaEl.textContent = result.schema || "";
   policyCreateBtn.disabled = policyReadOnly;
   policyUpdateBtn.disabled = policyReadOnly;
   policyDeleteBtn.disabled = policyReadOnly;

package/assets/index.html

@@ -91,10 +91,6 @@
               </div>
               <div id="policy-status" class="note"></div>
             </div>
-            <div class="policy-schema">
-              <div class="label">Schema</div>
-              <pre id="policy-schema"></pre>
-            </div>
           </div>
         </div>
       </section>

package/assets/styles.css

@@ -313,18 +313,6 @@ input {
   flex-wrap: wrap;
 }
 
-.policy-schema pre {
-  margin: 0;
-  padding: 10px;
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  background: #f3f5f9;
-  font-size: 0.75rem;
-  line-height: 1.4;
-  max-height: 260px;
-  overflow: auto;
-}
-
 @media (max-width: 900px) {
   .policy-grid {
     grid-template-columns: 1fr;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawclamp",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "OpenClaw Cedar authorization guard with audit UI",
   "type": "module",
   "dependencies": {

package/src/http.ts

@@ -291,11 +291,11 @@ export function createClawClampHttpHandler(params: {
 
     if (apiPath === "policies" && req.method === "GET") {
       if (params.config.policyStoreUri) {
-        sendJson(res, 200, { readOnly: true, policies: [], schema: "" });
+        sendJson(res, 200, { readOnly: true, policies: [] });
         return true;
       }
-      const { policies, schema } = await listPolicies({ stateDir: params.stateDir });
-      sendJson(res, 200, { readOnly: false, policies, schema });
+      const { policies } = await listPolicies({ stateDir: params.stateDir });
+      sendJson(res, 200, { readOnly: false, policies });
       return true;
     }
 

package/src/policy-store.ts

@@ -20,11 +20,17 @@ type PolicyRecord = {
 type PolicyStoreBody = {
   name?: string;
   description?: string;
-  schema?: string;
+  schema?: EncodedContent;
   trusted_issuers?: Record<string, unknown>;
   policies?: Record<string, PolicyRecord>;
 };
 
+type EncodedContent = {
+  encoding?: "none" | "base64";
+  content_type?: "cedar" | "cedar-json";
+  body?: string;
+};
+
 export type PolicyStoreSnapshot = {
   cedar_version: string;
   policy_stores: Record<string, PolicyStoreBody>;
@@ -67,7 +73,16 @@ function normalizePolicyStore(raw: unknown): PolicyStoreSnapshot {
 
   const candidate = raw as Record<string, unknown>;
   if (candidate.policy_stores && typeof candidate.policy_stores === "object") {
-    return candidate as PolicyStoreSnapshot;
+    const normalized = candidate as PolicyStoreSnapshot;
+    const writable = normalized.policy_stores?.[POLICY_STORE_ID];
+    if (writable?.schema && typeof writable.schema === "string") {
+      writable.schema = {
+        encoding: "base64",
+        content_type: "cedar",
+        body: writable.schema,
+      };
+    }
+    return normalized;
   }
 
   const legacyPolicies =
@@ -87,9 +102,14 @@ function normalizePolicyStore(raw: unknown): PolicyStoreSnapshot {
         name: "Clawclamp Policy Store",
         description: "Migrated legacy policy store.",
         schema:
-          legacySchema ||
           fallback.policy_stores[POLICY_STORE_ID]?.schema ||
-          "",
+          (legacySchema
+            ? {
+                encoding: "base64",
+                content_type: "cedar",
+                body: legacySchema,
+              }
+            : undefined),
         trusted_issuers: {},
         policies: legacyPolicies,
       },
@@ -105,7 +125,7 @@ function getWritableStore(store: PolicyStoreSnapshot): PolicyStoreBody {
   const fallback = buildDefaultPolicyStore() as PolicyStoreSnapshot;
   const created = fallback.policy_stores[POLICY_STORE_ID] ?? {
     policies: {},
-    schema: "",
+    schema: undefined,
     trusted_issuers: {},
   };
   if (!store.policy_stores) {
@@ -149,7 +169,7 @@ export async function ensurePolicyStore(params: {
 
 export async function listPolicies(params: {
   stateDir: string;
-}): Promise<{ policies: PolicyEntry[]; schema: string }> {
+}): Promise<{ policies: PolicyEntry[] }> {
   return withStateFileLock(params.stateDir, "policy-store", async () => {
     const store = await readPolicyStore(params.stateDir);
     const policyStore = getWritableStore(store);
@@ -157,8 +177,7 @@ export async function listPolicies(params: {
       id,
       content: decodeBase64(payload.policy_content ?? ""),
     }));
-    const schemaEncoded = policyStore.schema ?? "";
-    return { policies, schema: schemaEncoded ? decodeBase64(schemaEncoded) : "" };
+    return { policies };
   });
 }
 

package/src/policy.ts

@@ -1,18 +1,31 @@
-const DEFAULT_SCHEMA = `entity User {
-  attrs {
-    role: String,
-  }
-}
+const DEFAULT_SCHEMA = `entity id_token = {
+  aud: Set<String>,
+  iss: String,
+  sub: String
+};
 
-entity Tool {
-  attrs {
-    name: String,
-    risk: String,
-  }
-}
+entity Role;
+
+entity User in [Role] = {
+  role: String
+};
+
+entity Access_token = {
+  aud: String,
+  iss: String,
+  jti: String,
+  client_id: String
+};
+
+entity Workload = {};
+
+entity Tool = {
+  name: String,
+  risk: String
+};
 
 action "Invoke" appliesTo {
-  principal: [User],
+  principal: [User, Role, Workload],
   resource: [Tool],
   context: {
     now: Long,
@@ -33,10 +46,24 @@ when {
 
 const POLICY_STORE_ID = "clawclamp";
 
+type EncodedContent = {
+  encoding: "none" | "base64";
+  content_type: "cedar" | "cedar-json";
+  body: string;
+};
+
 function toBase64(raw: string): string {
   return Buffer.from(raw, "utf8").toString("base64");
 }
 
+function buildSchemaContent(): EncodedContent {
+  return {
+    encoding: "none",
+    content_type: "cedar",
+    body: DEFAULT_SCHEMA,
+  };
+}
+
 export function buildDefaultPolicyStore(): Record<string, unknown> {
   const policies: Record<
     string,
@@ -63,7 +90,7 @@ export function buildDefaultPolicyStore(): Record<string, unknown> {
         name: "Clawclamp Policy Store",
         description: "Local Cedar policies for Clawclamp.",
         policies,
-        schema: toBase64(DEFAULT_SCHEMA),
+        schema: buildSchemaContent(),
         trusted_issuers: {},
       },
     },