hammerkit 1.23.0 → 1.24.0

package/dist/server/executor.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostExecutor = exports.passedEnvironment = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const cli_1 = require("../cli");
+const get_file_context_1 = require("../file/get-file-context");
+const log_1 = require("../log");
+const resolve_git_source_1 = require("../includes/resolve-git-source");
+const parse_label_arguments_1 = require("../parser/parse-label-arguments");
+const schema_parser_1 = require("../schema/schema-parser");
+const reference_parser_1 = require("../schema/reference-parser");
+const work_scope_parser_1 = require("../schema/work-scope-parser");
+const work_item_status_1 = require("../planner/work-item-status");
+const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
+const redact_1 = require("../utils/redact");
+const empty_writable_1 = require("../utils/empty-writable");
+const units_1 = require("../utils/units");
+const git_checkout_1 = require("./git-checkout");
+// What a task on the server sees of the server's own environment: the tools it
+// needs to find and reach docker, nothing the operator keeps there for the server.
+const PASSED_ENVS = [
+    'PATH',
+    'HOME',
+    'LANG',
+    'LC_ALL',
+    'TMPDIR',
+    'DOCKER_HOST',
+    'DOCKER_CONFIG',
+    'SSL_CERT_FILE',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'SSH_AUTH_SOCK',
+    // Windows: without these powershell and git can not find their profile
+    'SystemRoot',
+    'SystemDrive',
+    'windir',
+    'ComSpec',
+    'PATHEXT',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'TEMP',
+    'TMP',
+    'ProgramData',
+    'ProgramFiles',
+    'ProgramFiles(x86)',
+    // powershell is very slow to start without it
+    'PSModulePath',
+];
+// one log line of a task is cut here, the registry caps how many events a run keeps
+const MAX_LOG_TEXT = 8 * 1024;
+function passedEnvironment(envs) {
+    const passed = {};
+    for (const name of PASSED_ENVS) {
+        if (envs[name] !== undefined) {
+            passed[name] = envs[name];
+        }
+    }
+    return passed;
+}
+exports.passedEnvironment = passedEnvironment;
+/**
+ * Runs the tasks of a run on this machine with the engine of `hammerkit run`.
+ *
+ * The working directory is made for the run and removed afterwards. Its build
+ * file is the published version the run is pinned to, written over the code of the
+ * source, so the commands are the published ones whatever the source says. The
+ * local cache is shared by all runs, a task is keyed by its definition and
+ * sources and not by where they are.
+ */
+class HostExecutor {
+    constructor(options) {
+        this.options = options;
+    }
+    async execute(run, context) {
+        const { definitions, config, environment } = this.options;
+        const version = definitions.find(run.definition.name, run.definition.hash);
+        const bundle = version ? await definitions.files(version) : undefined;
+        if (!version || !bundle) {
+            throw new Error(`the build file ${run.definition.name} at ${run.definition.hash} is no longer on this server`);
+        }
+        if (run.source.type !== 'ref') {
+            throw new Error('runs from an upload are not supported by this server yet, use a git ref');
+        }
+        const repository = config.sources[run.definition.name]?.git;
+        if (!repository) {
+            throw new Error(`this server has no repository for ${run.definition.name} to run ${run.source.ref} from, ` +
+                `the operator sets sources.${run.definition.name}.git`);
+        }
+        const abortCtrl = new AbortController();
+        const abort = () => abortCtrl.abort();
+        if (context.signal.aborted) {
+            abort();
+        }
+        context.signal.addEventListener('abort', abort, { once: true });
+        const root = (0, path_1.join)(this.options.directory, run.id);
+        const checkout = (0, path_1.join)(root, 'source');
+        try {
+            const passed = passedEnvironment(environment.processEnvs);
+            const commit = await (0, git_checkout_1.checkoutRef)(repository, run.source.ref, checkout, passed, abortCtrl.signal);
+            context.emit({ type: 'log', task: 'hammerkit', stream: 'stdout', text: `checked out ${commit}` });
+            await this.writeBundle(checkout, bundle.files);
+            await this.runTasks(run, context, (0, path_1.join)(checkout, version.entry), checkout, passed, abortCtrl);
+        }
+        finally {
+            context.signal.removeEventListener('abort', abort);
+            await (0, promises_1.rm)(root, { recursive: true, force: true });
+        }
+    }
+    // The published files go over the checkout; nothing may land outside of it or in
+    // its git directory.
+    async writeBundle(directory, files) {
+        for (const [path, content] of Object.entries(files)) {
+            const target = (0, path_1.resolve)(directory, path);
+            if (!(0, resolve_git_source_1.isWithin)(directory, target) || /^\.git(\/|$)/.test(path)) {
+                throw new Error(`the published file ${JSON.stringify(path)} can not be written into the source`);
+            }
+            await (0, promises_1.mkdir)((0, path_1.dirname)(target), { recursive: true });
+            await (0, promises_1.writeFile)(target, content);
+        }
+    }
+    async runTasks(run, context, entry, cwd, passed, abortCtrl) {
+        const secrets = (0, redact_1.createSecretRegistry)();
+        const status = (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets);
+        // what the engine would print to a terminal is not wanted, its status console
+        // is what is streamed: it is redacted with the secrets of this run
+        const environment = {
+            processEnvs: passed,
+            abortCtrl,
+            cwd,
+            file: (0, get_file_context_1.getFileContext)(cwd),
+            console: (0, log_1.consoleContext)((0, empty_writable_1.emptyWritable)()),
+            status,
+            secrets,
+            stdout: (0, empty_writable_1.emptyWritable)(),
+            stderr: (0, empty_writable_1.emptyWritable)(),
+            stdoutColumns: 120,
+        };
+        const listener = status.on((message) => {
+            if (message.type === 'console') {
+                context.emit({
+                    type: 'log',
+                    task: message.context.name,
+                    stream: message.console,
+                    text: message.message.slice(0, MAX_LOG_TEXT),
+                });
+            }
+            else if (message.level === 'error' || message.level === 'warn') {
+                context.emit({
+                    type: 'log',
+                    task: message.context.name,
+                    stream: 'stderr',
+                    text: message.message.slice(0, MAX_LOG_TEXT),
+                });
+            }
+        });
+        try {
+            const options = run.options;
+            const execOptions = {
+                logMode: 'live',
+                cacheDefault: options.cache ?? 'checksum',
+                cacheReadOnly: options.cacheReadOnly ?? false,
+                timeout: options.timeout ? (0, units_1.parseDuration)(options.timeout) : null,
+                skipDeps: options.skipDeps !== false,
+            };
+            // the tasks in the order they were named; by labels when none is
+            const scopes = run.tasks.length > 0
+                ? run.tasks.map((task) => ({
+                    name: task,
+                    scope: { taskName: task, environmentName: options.env ?? null },
+                }))
+                : [
+                    {
+                        name: 'labels',
+                        scope: {
+                            filterLabels: labels(options.filter),
+                            excludeLabels: labels(options.exclude),
+                            environmentName: options.env ?? null,
+                        },
+                    },
+                ];
+            for (const { name, scope } of scopes) {
+                const { ctx, scope: parsed } = await (0, schema_parser_1.createParseContext)(entry, environment);
+                const workTree = (0, work_scope_parser_1.getWorkContext)(await (0, reference_parser_1.parseReferences)(ctx, parsed, environment), scope, environment);
+                const cli = (0, cli_1.getCli)(workTree, environment);
+                if (cli.tasks().length === 0) {
+                    throw new Error(`no tasks found for ${name}`);
+                }
+                const execution = cli.exec({ ...execOptions, workers: cli.defaultWorkers() });
+                const seen = new Map();
+                const watch = execution.state.on('run-events', () => reportTasks(context, execution.state.current, seen));
+                try {
+                    const result = await execution.start();
+                    reportTasks(context, execution.state.current, seen);
+                    if (!result.success) {
+                        throw new Error(context.signal.aborted ? 'the run was cancelled' : `${name} failed`);
+                    }
+                }
+                finally {
+                    watch.close();
+                }
+            }
+        }
+        finally {
+            listener.close();
+        }
+    }
+}
+exports.HostExecutor = HostExecutor;
+function labels(values) {
+    return values && values.length > 0 ? (0, parse_label_arguments_1.parseLabelArguments)(values) : undefined;
+}
+// A task event when a task has moved on since the last look.
+function reportTasks(context, workTree, seen) {
+    for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(workTree)) {
+        const state = task.state.current;
+        let event = null;
+        if (state.type === 'running') {
+            event = 'running';
+        }
+        else if (state.type === 'completed') {
+            event = state.skipped ? null : state.cached ? 'cached' : 'succeeded';
+        }
+        else if (state.type === 'error' || state.type === 'crash') {
+            event = 'failed';
+        }
+        if (event && seen.get(task.name) !== event) {
+            seen.set(task.name, event);
+            context.emit({ type: 'task', task: task.name, state: event });
+        }
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/server/git-checkout.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkoutRef = exports.isValidRef = void 0;
+const child_process_1 = require("child_process");
+const promises_1 = require("fs/promises");
+const util_1 = require("util");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+// Anything but plain network and local transports is refused: `ext::` runs a command.
+const ALLOWED_PROTOCOLS = 'file:git:http:https:ssh';
+// A branch, a tag or a commit. It is passed after `--` as well, but a ref that
+// looks like an option, has a `..` or odd characters is not one of the three.
+const REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$/;
+function isValidRef(ref) {
+    return (REF_PATTERN.test(ref) && !ref.includes('..') && !ref.includes('//') && !ref.endsWith('/') && !ref.endsWith('.lock'));
+}
+exports.isValidRef = isValidRef;
+/**
+ * Fetches one commit of a repository into `directory` and checks it out, and
+ * answers which commit that is. The repository is the operator's, the ref is the
+ * caller's. Credentials come from the git configuration of the server, there is no
+ * prompt a run could hang on.
+ */
+async function checkoutRef(repository, ref, directory, env, signal) {
+    if (!isValidRef(ref)) {
+        throw new Error(`${JSON.stringify(ref.slice(0, 80))} is not a branch, tag or commit`);
+    }
+    await (0, promises_1.mkdir)(directory, { recursive: true });
+    const run = (args) => git(args, env, signal, `${repository} at ${ref}`);
+    await run(['init', '--quiet', directory]);
+    await run(['-C', directory, 'fetch', '--quiet', '--depth', '1', '--', repository, ref]);
+    await run(['-C', directory, '-c', 'advice.detachedHead=false', 'checkout', '--quiet', 'FETCH_HEAD']);
+    return (await run(['-C', directory, 'rev-parse', 'HEAD'])).trim();
+}
+exports.checkoutRef = checkoutRef;
+async function git(args, baseEnv, signal, what) {
+    const env = {};
+    for (const [key, value] of Object.entries(baseEnv)) {
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    env.GIT_TERMINAL_PROMPT = '0';
+    env.GIT_ALLOW_PROTOCOL = ALLOWED_PROTOCOLS;
+    try {
+        return (await execFileAsync('git', args, { env, signal })).stdout;
+    }
+    catch (e) {
+        const error = e;
+        if (error.code === 'ABORT_ERR') {
+            throw new Error(`fetching ${what} was cancelled`);
+        }
+        if (error.code === 'ENOENT') {
+            throw new Error(`unable to fetch ${what}: git is not installed`);
+        }
+        const reason = (error.stderr ?? '')
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0)
+            .pop() ?? error.message;
+        throw new Error(`unable to fetch ${what}: ${reason}`);
+    }
+}
+//# sourceMappingURL=git-checkout.js.map

package/dist/server/http.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readJson = exports.MAX_BODY_BYTES = exports.HttpError = exports.send = void 0;
+function send(res, status, body, headers = {}) {
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers });
+    res.end(JSON.stringify(body));
+}
+exports.send = send;
+// An answer to the caller, thrown from wherever the request turns out to be wrong.
+class HttpError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.HttpError = HttpError;
+exports.MAX_BODY_BYTES = 64 * 1024;
+async function readJson(req, limit = exports.MAX_BODY_BYTES) {
+    if (!/^application\/json(;|$)/i.test(req.headers['content-type'] ?? '')) {
+        throw new HttpError(415, 'send application/json');
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > limit) {
+            throw new HttpError(413, `the request is larger than ${limit} bytes`);
+        }
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new HttpError(400, 'the body is not valid JSON');
+    }
+}
+exports.readJson = readJson;
+//# sourceMappingURL=http.js.map

package/dist/server/oauth.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifier = exports.quote = exports.TokenError = void 0;
+const crypto_1 = require("crypto");
+// The reason is for the operator's log, never for the caller.
+class TokenError extends Error {
+}
+exports.TokenError = TokenError;
+// Values from a token are written to the operator's log before the signature
+// is checked, so they are quoted and cut: they can't start a log line of their own.
+function quote(value) {
+    return JSON.stringify(String(value).slice(0, 80));
+}
+exports.quote = quote;
+// Asymmetric algorithms only: there is no shared secret, and `none` and HS*
+// are never accepted.
+const ALGORITHMS = {
+    RS256: { hash: 'sha256', kty: 'RSA' },
+    RS384: { hash: 'sha384', kty: 'RSA' },
+    RS512: { hash: 'sha512', kty: 'RSA' },
+    PS256: { hash: 'sha256', kty: 'RSA', pss: true },
+    ES256: { hash: 'sha256', kty: 'EC', crv: 'P-256' },
+    ES384: { hash: 'sha384', kty: 'EC', crv: 'P-384' },
+    ES512: { hash: 'sha512', kty: 'EC', crv: 'P-521' },
+};
+const CLOCK_SKEW_SECONDS = 60;
+const KEYS_TTL_MS = 10 * 60 * 1000;
+// an unknown kid refreshes the keys, but not more often than this
+const REFRESH_COOLDOWN_MS = 60 * 1000;
+const FETCH_TIMEOUT_MS = 5000;
+// after a failed load the issuer is left alone for this long, instead of being hit by every request
+const FAILURE_BACKOFF_MS = 10 * 1000;
+// keys that could not be refreshed are still used for this long past their TTL, so a short IdP outage does not lock everyone out
+const STALE_KEYS_MS = 60 * 60 * 1000;
+class TokenVerifier {
+    constructor(issuers, options = {}) {
+        this.issuers = issuers;
+        this.keys = new Map();
+        this.loading = new Map();
+        this.failures = new Map();
+        const fetcher = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.fetchJson = async (url) => {
+            const response = await fetcher(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+            if (!response.ok) {
+                throw new TokenError(`${url} answered ${response.status}`);
+            }
+            return response.json();
+        };
+    }
+    async verify(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+            throw new TokenError('not a signed JWT');
+        }
+        const header = decodeObject(parts[0], 'header');
+        const payload = decodeObject(parts[1], 'payload');
+        const algorithm = typeof header.alg === 'string' ? ALGORITHMS[header.alg] : undefined;
+        if (!algorithm) {
+            throw new TokenError(`algorithm ${quote(header.alg)} is not accepted`);
+        }
+        const issuer = this.issuers.find((i) => i.issuer === payload.iss);
+        if (!issuer) {
+            throw new TokenError(`issuer ${quote(payload.iss)} is not accepted`);
+        }
+        const jwk = await this.findKey(issuer, algorithm, typeof header.kid === 'string' ? header.kid : undefined);
+        const signature = Buffer.from(parts[2], 'base64url');
+        const data = Buffer.from(`${parts[0]}.${parts[1]}`);
+        const key = (0, crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+        if (!verifySignature(algorithm, data, key, signature)) {
+            throw new TokenError('signature does not match');
+        }
+        return this.readClaims(issuer, payload);
+    }
+    readClaims(issuer, payload) {
+        const now = this.now() / 1000;
+        if (typeof payload.exp !== 'number') {
+            throw new TokenError('token has no expiry');
+        }
+        if (payload.exp + CLOCK_SKEW_SECONDS < now) {
+            throw new TokenError('token expired');
+        }
+        if (typeof payload.nbf === 'number' && payload.nbf - CLOCK_SKEW_SECONDS > now) {
+            throw new TokenError('token not valid yet');
+        }
+        const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!audiences.includes(issuer.audience)) {
+            throw new TokenError(`token is not meant for ${issuer.audience}`);
+        }
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+            throw new TokenError('token has no subject');
+        }
+        const groups = payload[issuer.groupsClaim];
+        const claims = {};
+        for (const [name, value] of Object.entries(payload)) {
+            if (typeof value === 'string') {
+                claims[name] = value;
+            }
+        }
+        return {
+            iss: issuer.issuer,
+            sub: payload.sub,
+            groups: Array.isArray(groups)
+                ? groups.filter((g) => typeof g === 'string')
+                : typeof groups === 'string'
+                    ? [groups]
+                    : [],
+            claims,
+        };
+    }
+    async findKey(issuer, algorithm, kid) {
+        const known = this.keys.get(issuer.issuer);
+        const stale = !known || this.now() - known.loadedAt > KEYS_TTL_MS;
+        let loaded;
+        if (stale) {
+            try {
+                loaded = await this.loadKeys(issuer);
+            }
+            catch (e) {
+                if (!known || this.now() - known.loadedAt > KEYS_TTL_MS + STALE_KEYS_MS) {
+                    throw e;
+                }
+                loaded = known;
+            }
+        }
+        else {
+            loaded = known;
+        }
+        let jwk = pickKey(loaded.keys, algorithm, kid);
+        if (!jwk && !stale && this.now() - loaded.loadedAt > REFRESH_COOLDOWN_MS) {
+            // the issuer may have rotated its keys since they were cached
+            try {
+                loaded = await this.loadKeys(issuer);
+                jwk = pickKey(loaded.keys, algorithm, kid);
+            }
+            catch {
+                // keep the cached keys: the token simply has no key we know
+            }
+        }
+        if (!jwk) {
+            throw new TokenError(`issuer has no ${algorithm.kty} key${kid ? ` ${quote(kid)}` : ''}`);
+        }
+        return jwk;
+    }
+    // One load per issuer at a time, and none right after a failed one.
+    loadKeys(issuer) {
+        const running = this.loading.get(issuer.issuer);
+        if (running) {
+            return running;
+        }
+        const failure = this.failures.get(issuer.issuer);
+        if (failure && this.now() - failure.at < FAILURE_BACKOFF_MS) {
+            return Promise.reject(failure.error);
+        }
+        const load = this.fetchKeys(issuer)
+            .then((loaded) => {
+            this.failures.delete(issuer.issuer);
+            return loaded;
+        })
+            .catch((error) => {
+            this.failures.set(issuer.issuer, { at: this.now(), error });
+            throw error;
+        })
+            .finally(() => this.loading.delete(issuer.issuer));
+        this.loading.set(issuer.issuer, load);
+        return load;
+    }
+    async fetchKeys(issuer) {
+        const base = issuer.issuer.replace(/\/+$/, '');
+        const metadata = (await this.fetchJson(`${base}/.well-known/openid-configuration`));
+        if (metadata.issuer !== issuer.issuer) {
+            throw new TokenError(`issuer metadata names ${quote(metadata.issuer)}`);
+        }
+        const jwksUri = typeof metadata.jwks_uri === 'string' ? metadata.jwks_uri : '';
+        if (!isSecureUrl(jwksUri)) {
+            throw new TokenError(`jwks_uri ${quote(jwksUri)} is not https`);
+        }
+        const jwks = (await this.fetchJson(jwksUri));
+        const loaded = { keys: Array.isArray(jwks.keys) ? jwks.keys : [], loadedAt: this.now() };
+        this.keys.set(issuer.issuer, loaded);
+        return loaded;
+    }
+}
+exports.TokenVerifier = TokenVerifier;
+function pickKey(keys, algorithm, kid) {
+    const candidates = keys.filter((jwk) => jwk.kty === algorithm.kty &&
+        jwk.use !== 'enc' &&
+        (algorithm.crv === undefined || jwk.crv === algorithm.crv));
+    if (kid !== undefined) {
+        return candidates.find((jwk) => jwk.kid === kid);
+    }
+    // a token without kid is only unambiguous when the issuer has one such key
+    return candidates.length === 1 ? candidates[0] : undefined;
+}
+function verifySignature(algorithm, data, key, signature) {
+    if (algorithm.kty === 'EC') {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, dsaEncoding: 'ieee-p1363' }, signature);
+    }
+    if (algorithm.pss) {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST }, signature);
+    }
+    return (0, crypto_1.verify)(algorithm.hash, data, key, signature);
+}
+function decodeObject(part, what) {
+    try {
+        const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // reported below
+    }
+    throw new TokenError(`token ${what} is not a JSON object`);
+}
+function isSecureUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'https:' ||
+            (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/policy.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGrant = exports.isAdmin = exports.maySeeDefinitions = exports.mayPropose = exports.mayPublish = exports.matches = void 0;
+function matches(entitlement, principal) {
+    if (entitlement.subject) {
+        return entitlement.subject.iss === principal.iss && entitlement.subject.sub === principal.sub;
+    }
+    if (entitlement.group) {
+        return entitlement.group.iss === principal.iss && principal.groups.includes(entitlement.group.name);
+    }
+    if (entitlement.claims) {
+        return (entitlement.claims.iss === principal.iss &&
+            Object.entries(entitlement.claims.match).every(([name, value]) => principal.claims[name] === value));
+    }
+    return false;
+}
+exports.matches = matches;
+function mayPublish(grant, name) {
+    return grant.publish.includes('*') || grant.publish.includes(name);
+}
+exports.mayPublish = mayPublish;
+function mayPropose(grant, name) {
+    return grant.propose.includes('*') || grant.propose.includes(name);
+}
+exports.mayPropose = mayPropose;
+// A caller who can neither run nor publish anything sees nothing of the server's
+// build files either. Admins see them, they have to know what they approve.
+function maySeeDefinitions(grant) {
+    return grant.accounts.length > 0 || grant.request.length > 0 || grant.publish.length > 0 || grant.propose.length > 0;
+}
+exports.maySeeDefinitions = maySeeDefinitions;
+// Admin of an account decides about the runs on it.
+function isAdmin(grant, account) {
+    return account !== null && grant.accounts.includes(account);
+}
+exports.isAdmin = isAdmin;
+// Default deny: a caller without a matching entitlement gets no account.
+function getGrant(entitlements, principal) {
+    const matched = [];
+    const accounts = [];
+    const requested = [];
+    const publish = [];
+    const propose = [];
+    let defaultAccount = null;
+    let source = null;
+    entitlements.forEach((entitlement, index) => {
+        if (!matches(entitlement, principal)) {
+            return;
+        }
+        matched.push(index);
+        for (const account of entitlement.accounts) {
+            if (!accounts.includes(account)) {
+                accounts.push(account);
+            }
+        }
+        for (const account of entitlement.request ?? []) {
+            if (!requested.includes(account)) {
+                requested.push(account);
+            }
+        }
+        for (const name of entitlement.publish ?? []) {
+            if (!publish.includes(name)) {
+                publish.push(name);
+            }
+        }
+        for (const name of entitlement.propose ?? []) {
+            if (!propose.includes(name)) {
+                propose.push(name);
+            }
+        }
+        defaultAccount = defaultAccount ?? entitlement.default ?? null;
+        if (entitlement.source) {
+            source = source ? source.filter((s) => entitlement.source?.includes(s)) : [...entitlement.source];
+        }
+    });
+    // admin wins over request when two entitlements give both
+    const request = requested.filter((account) => !accounts.includes(account));
+    const usable = [...accounts, ...request];
+    return {
+        accounts,
+        request,
+        publish,
+        propose,
+        default: defaultAccount ?? (usable.length === 1 ? usable[0] : null),
+        source: source ?? ['upload', 'ref'],
+        matched,
+    };
+}
+exports.getGrant = getGrant;
+//# sourceMappingURL=policy.js.map