hammerkit 1.23.0 → 1.25.0

package/dist/server/oauth.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifier = exports.quote = exports.TokenError = void 0;
+const crypto_1 = require("crypto");
+// The reason is for the operator's log, never for the caller.
+class TokenError extends Error {
+}
+exports.TokenError = TokenError;
+// Values from a token are written to the operator's log before the signature
+// is checked, so they are quoted and cut: they can't start a log line of their own.
+function quote(value) {
+    return JSON.stringify(String(value).slice(0, 80));
+}
+exports.quote = quote;
+// Asymmetric algorithms only: there is no shared secret, and `none` and HS*
+// are never accepted.
+const ALGORITHMS = {
+    RS256: { hash: 'sha256', kty: 'RSA' },
+    RS384: { hash: 'sha384', kty: 'RSA' },
+    RS512: { hash: 'sha512', kty: 'RSA' },
+    PS256: { hash: 'sha256', kty: 'RSA', pss: true },
+    ES256: { hash: 'sha256', kty: 'EC', crv: 'P-256' },
+    ES384: { hash: 'sha384', kty: 'EC', crv: 'P-384' },
+    ES512: { hash: 'sha512', kty: 'EC', crv: 'P-521' },
+};
+const CLOCK_SKEW_SECONDS = 60;
+const KEYS_TTL_MS = 10 * 60 * 1000;
+// an unknown kid refreshes the keys, but not more often than this
+const REFRESH_COOLDOWN_MS = 60 * 1000;
+const FETCH_TIMEOUT_MS = 5000;
+// after a failed load the issuer is left alone for this long, instead of being hit by every request
+const FAILURE_BACKOFF_MS = 10 * 1000;
+// keys that could not be refreshed are still used for this long past their TTL, so a short IdP outage does not lock everyone out
+const STALE_KEYS_MS = 60 * 60 * 1000;
+class TokenVerifier {
+    constructor(issuers, options = {}) {
+        this.issuers = issuers;
+        this.keys = new Map();
+        this.loading = new Map();
+        this.failures = new Map();
+        const fetcher = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.fetchJson = async (url) => {
+            const response = await fetcher(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+            if (!response.ok) {
+                throw new TokenError(`${url} answered ${response.status}`);
+            }
+            return response.json();
+        };
+    }
+    async verify(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+            throw new TokenError('not a signed JWT');
+        }
+        const header = decodeObject(parts[0], 'header');
+        const payload = decodeObject(parts[1], 'payload');
+        const algorithm = typeof header.alg === 'string' ? ALGORITHMS[header.alg] : undefined;
+        if (!algorithm) {
+            throw new TokenError(`algorithm ${quote(header.alg)} is not accepted`);
+        }
+        const issuer = this.issuers.find((i) => i.issuer === payload.iss);
+        if (!issuer) {
+            throw new TokenError(`issuer ${quote(payload.iss)} is not accepted`);
+        }
+        const jwk = await this.findKey(issuer, algorithm, typeof header.kid === 'string' ? header.kid : undefined);
+        const signature = Buffer.from(parts[2], 'base64url');
+        const data = Buffer.from(`${parts[0]}.${parts[1]}`);
+        const key = (0, crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+        if (!verifySignature(algorithm, data, key, signature)) {
+            throw new TokenError('signature does not match');
+        }
+        return this.readClaims(issuer, payload);
+    }
+    readClaims(issuer, payload) {
+        const now = this.now() / 1000;
+        if (typeof payload.exp !== 'number') {
+            throw new TokenError('token has no expiry');
+        }
+        if (payload.exp + CLOCK_SKEW_SECONDS < now) {
+            throw new TokenError('token expired');
+        }
+        if (typeof payload.nbf === 'number' && payload.nbf - CLOCK_SKEW_SECONDS > now) {
+            throw new TokenError('token not valid yet');
+        }
+        const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!audiences.includes(issuer.audience)) {
+            throw new TokenError(`token is not meant for ${issuer.audience}`);
+        }
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+            throw new TokenError('token has no subject');
+        }
+        const groups = payload[issuer.groupsClaim];
+        const claims = {};
+        for (const [name, value] of Object.entries(payload)) {
+            if (typeof value === 'string') {
+                claims[name] = value;
+            }
+        }
+        return {
+            iss: issuer.issuer,
+            sub: payload.sub,
+            groups: Array.isArray(groups)
+                ? groups.filter((g) => typeof g === 'string')
+                : typeof groups === 'string'
+                    ? [groups]
+                    : [],
+            claims,
+        };
+    }
+    async findKey(issuer, algorithm, kid) {
+        const known = this.keys.get(issuer.issuer);
+        const stale = !known || this.now() - known.loadedAt > KEYS_TTL_MS;
+        let loaded;
+        if (stale) {
+            try {
+                loaded = await this.loadKeys(issuer);
+            }
+            catch (e) {
+                if (!known || this.now() - known.loadedAt > KEYS_TTL_MS + STALE_KEYS_MS) {
+                    throw e;
+                }
+                loaded = known;
+            }
+        }
+        else {
+            loaded = known;
+        }
+        let jwk = pickKey(loaded.keys, algorithm, kid);
+        if (!jwk && !stale && this.now() - loaded.loadedAt > REFRESH_COOLDOWN_MS) {
+            // the issuer may have rotated its keys since they were cached
+            try {
+                loaded = await this.loadKeys(issuer);
+                jwk = pickKey(loaded.keys, algorithm, kid);
+            }
+            catch {
+                // keep the cached keys: the token simply has no key we know
+            }
+        }
+        if (!jwk) {
+            throw new TokenError(`issuer has no ${algorithm.kty} key${kid ? ` ${quote(kid)}` : ''}`);
+        }
+        return jwk;
+    }
+    // One load per issuer at a time, and none right after a failed one.
+    loadKeys(issuer) {
+        const running = this.loading.get(issuer.issuer);
+        if (running) {
+            return running;
+        }
+        const failure = this.failures.get(issuer.issuer);
+        if (failure && this.now() - failure.at < FAILURE_BACKOFF_MS) {
+            return Promise.reject(failure.error);
+        }
+        const load = this.fetchKeys(issuer)
+            .then((loaded) => {
+            this.failures.delete(issuer.issuer);
+            return loaded;
+        })
+            .catch((error) => {
+            this.failures.set(issuer.issuer, { at: this.now(), error });
+            throw error;
+        })
+            .finally(() => this.loading.delete(issuer.issuer));
+        this.loading.set(issuer.issuer, load);
+        return load;
+    }
+    async fetchKeys(issuer) {
+        const base = issuer.issuer.replace(/\/+$/, '');
+        const metadata = (await this.fetchJson(`${base}/.well-known/openid-configuration`));
+        if (metadata.issuer !== issuer.issuer) {
+            throw new TokenError(`issuer metadata names ${quote(metadata.issuer)}`);
+        }
+        const jwksUri = typeof metadata.jwks_uri === 'string' ? metadata.jwks_uri : '';
+        if (!isSecureUrl(jwksUri)) {
+            throw new TokenError(`jwks_uri ${quote(jwksUri)} is not https`);
+        }
+        const jwks = (await this.fetchJson(jwksUri));
+        const loaded = { keys: Array.isArray(jwks.keys) ? jwks.keys : [], loadedAt: this.now() };
+        this.keys.set(issuer.issuer, loaded);
+        return loaded;
+    }
+}
+exports.TokenVerifier = TokenVerifier;
+function pickKey(keys, algorithm, kid) {
+    const candidates = keys.filter((jwk) => jwk.kty === algorithm.kty &&
+        jwk.use !== 'enc' &&
+        (algorithm.crv === undefined || jwk.crv === algorithm.crv));
+    if (kid !== undefined) {
+        return candidates.find((jwk) => jwk.kid === kid);
+    }
+    // a token without kid is only unambiguous when the issuer has one such key
+    return candidates.length === 1 ? candidates[0] : undefined;
+}
+function verifySignature(algorithm, data, key, signature) {
+    if (algorithm.kty === 'EC') {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, dsaEncoding: 'ieee-p1363' }, signature);
+    }
+    if (algorithm.pss) {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST }, signature);
+    }
+    return (0, crypto_1.verify)(algorithm.hash, data, key, signature);
+}
+function decodeObject(part, what) {
+    try {
+        const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // reported below
+    }
+    throw new TokenError(`token ${what} is not a JSON object`);
+}
+function isSecureUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'https:' ||
+            (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/plan.js

@@ -0,0 +1,296 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectBundle = exports.planBundle = exports.DefinitionError = void 0;
+const promises_1 = require("fs/promises");
+const os_1 = require("os");
+const path_1 = require("path");
+const yaml_1 = require("yaml");
+const get_file_context_1 = require("../file/get-file-context");
+const resolve_git_source_1 = require("../includes/resolve-git-source");
+const schema_parser_1 = require("../schema/schema-parser");
+const reference_parser_1 = require("../schema/reference-parser");
+const work_scope_parser_1 = require("../schema/work-scope-parser");
+const work_task_1 = require("../planner/work-task");
+const work_service_1 = require("../planner/work-service");
+const log_1 = require("../log");
+const parse_error_1 = require("../schema/parse-error");
+class DefinitionError extends Error {
+}
+exports.DefinitionError = DefinitionError;
+// 40 (sha-1) or 64 (sha-256) hex digits
+const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
+// A hash alone can only name what is inside the bundle, so everything a build
+// file pulls in from elsewhere has to be pinned: a git include needs a commit
+// and a remote that is not a path on the server.
+function findLooseIncludes(bundle, noRemote = false) {
+    const problems = [];
+    for (const [path, content] of Object.entries(bundle.files)) {
+        if (!/\.ya?ml$/i.test(path)) {
+            continue;
+        }
+        let document;
+        try {
+            document = (0, yaml_1.parse)(content);
+        }
+        catch {
+            continue; // a file that isn't valid yaml is reported when the bundle is parsed
+        }
+        for (const block of ['includes', 'references']) {
+            for (const [name, include] of Object.entries(document?.[block] ?? {})) {
+                const source = include;
+                if (!source || typeof source !== 'object' || source.git === undefined) {
+                    continue;
+                }
+                if (noRemote) {
+                    problems.push(`${path}: ${block}.${name}: a proposal may not include from git, the server would fetch it before anybody approved it`);
+                    continue;
+                }
+                if (typeof source.git !== 'string' || !/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
+                    problems.push(`${path}: ${block}.${name}: git has to be an https:// or ssh:// address`);
+                }
+                if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
+                    problems.push(`${path}: ${block}.${name}: pin ref to a commit, a branch or tag can move`);
+                }
+            }
+        }
+    }
+    return problems;
+}
+// What a build file may not name on a server: the places it would run or store things
+// are the operator's. The docker host, a Kubernetes cluster and a remote cache are
+// credentials of the machine, not of the build file, and a project file that could carry
+// them could send runs, or the cache, anywhere.
+function findHostProblems(bundle) {
+    const problems = [];
+    for (const [path, content] of Object.entries(bundle.files)) {
+        if (!/\.ya?ml$/i.test(path)) {
+            continue;
+        }
+        let document;
+        try {
+            document = (0, yaml_1.parse)(content);
+        }
+        catch {
+            continue; // reported when the bundle is parsed
+        }
+        if (!document || typeof document !== 'object') {
+            continue;
+        }
+        if (document.environments && Object.keys(document.environments).length > 0) {
+            problems.push(`${path}: environments pick a docker host or a Kubernetes cluster, which are the server's to choose, remove them`);
+        }
+        for (const [name, cache] of Object.entries(document.caches ?? {})) {
+            if (cache?.backend?.type !== 'local' || cache.backend.path !== undefined) {
+                problems.push(`${path}: caches.${name}: a server keeps its own cache, a build file names no backend or path`);
+            }
+        }
+        for (const [name, service] of Object.entries(document.services ?? {})) {
+            if (service &&
+                typeof service === 'object' &&
+                ('selector' in service || 'kubeconfig' in service || 'context' in service)) {
+                problems.push(`${path}: services.${name}: Kubernetes services are not supported on a server`);
+            }
+        }
+    }
+    return problems;
+}
+// What a build file may read while it is inspected: its own files. The rest of
+// the server is not its business (a missing file is "not there", not an error).
+function confined(files, root) {
+    const check = (path) => {
+        if (!(0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path))) {
+            throw new DefinitionError(`${path} is outside of the bundle`);
+        }
+    };
+    const guarded = (fn) => (path) => {
+        check(path);
+        return fn.call(files, path);
+    };
+    return {
+        ...files,
+        read: guarded(files.read),
+        readStream: guarded(files.readStream),
+        listFiles: guarded(files.listFiles),
+        stats: guarded(files.stats),
+        exists: async (path) => (0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path)) && files.exists(path),
+        watch: files.watch,
+    };
+}
+// A path of a task, written relative to the root of the bundle with forward
+// slashes. A leading `!` (an exclusion) is kept. Nothing is returned for a path
+// outside of the bundle.
+function insideBundle(root, cwd, path) {
+    const negated = path.startsWith('!');
+    const absolute = (0, path_1.resolve)(cwd, negated ? path.slice(1) : path);
+    const inside = (0, path_1.relative)(root, absolute);
+    if (inside === '..' || inside.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(inside)) {
+        return [];
+    }
+    const portable = inside.split(path_1.sep).join(path_1.posix.sep);
+    // a pattern keeps its glob characters, `resolve` only normalizes separators
+    return [`${negated ? '!' : ''}${portable === '' ? '.' : portable}`];
+}
+function itemsOf(workTree) {
+    return [...Object.values(workTree.tasks), ...Object.values(workTree.services)];
+}
+function secretsOf(item) {
+    return 'secrets' in item.data ? item.data.secrets : [];
+}
+function describeSecret(secret) {
+    const target = secret.target.type === 'env' ? secret.target.name : secret.target.path;
+    const source = secret.source;
+    if (source.type === 'provider') {
+        return { from: `${source.provider}:${source.ref}`, account: source.account, target };
+    }
+    return { from: source.type === 'env' ? `env:${source.name}` : `file:${source.path}`, account: null, target };
+}
+// What a server refuses to publish. A secret that reads a file or a variable of the
+// server has no account, so nothing would stand between the build file and the
+// operator's own credentials.
+function findPolicyProblems(items, policy, root) {
+    const problems = [];
+    for (const item of items) {
+        const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
+        if (policy.runtimes && !policy.runtimes.includes(runtime)) {
+            problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
+        }
+        const data = item.data;
+        if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
+            for (const mount of data.mounts) {
+                // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
+                if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
+                    problems.push(`${item.name}: mounts ${mount.localPath}, which is outside of the bundle`);
+                }
+            }
+        }
+        for (const secret of secretsOf(item)) {
+            const source = secret.source;
+            if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+            }
+            else if (source.type === 'file') {
+                problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+            }
+            else if (source.type === 'env' && !policy.envs.includes(source.name)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in runs.env.allow`);
+            }
+        }
+    }
+    return problems;
+}
+function toPlan(root, item) {
+    const data = item.data;
+    const secrets = secretsOf(item).map(describeSecret);
+    const accounts = [...new Set(secrets.flatMap((secret) => (secret.account ? [secret.account] : [])))].sort();
+    const mounts = (0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)
+        ? data.mounts.map((mount) => {
+            const inside = insideBundle(root, data.cwd, mount.localPath);
+            return `${inside.length > 0 ? inside[0] : mount.localPath}:${mount.containerPath}${mount.readOnly ? ':ro' : ''}`;
+        })
+        : [];
+    const ports = 'ports' in data ? data.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`) : [];
+    const flags = [];
+    if (data.type === 'local-task') {
+        flags.push('local-task');
+    }
+    if ('ports' in data && data.ports.some((port) => port.hostPort !== null)) {
+        flags.push('host-port');
+    }
+    if (data.scope.remote) {
+        flags.push('remote-include');
+    }
+    const isTask = data.type === 'local-task' || data.type === 'container-task';
+    return {
+        kind: isTask ? 'task' : 'service',
+        runtime: data.type === 'local-task' ? 'local' : 'docker',
+        ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
+        cmds: 'cmds' in data ? data.cmds.map((cmd) => cmd.cmd) : 'cmd' in data && data.cmd ? [data.cmd.cmd] : [],
+        deps: item.deps.map((dep) => dep.name).sort(),
+        needs: item.needs.map((need) => need.name).sort(),
+        accounts,
+        secrets,
+        mounts,
+        ports,
+        generates: 'generates' in data ? data.generates.map((generate) => generate.path) : [],
+        flags,
+    };
+}
+// A file that does not match the schema says where, not only that it does not.
+function describeFailure(e) {
+    if (e instanceof parse_error_1.ParseError) {
+        const issue = e.zod.issues[0];
+        return `${e.buildFilePath}: ${issue.path.length > 0 ? `${issue.path.join('.')}: ` : ''}${issue.message}`;
+    }
+    return (0, log_1.getErrorMessage)(e);
+}
+// Writes the bundle into a directory of its own and reads it the way a run
+// would, so a build file that doesn't parse is refused when it is published, not
+// when somebody wants to run it. The same function answers what a run will do,
+// with the scope of the run: which tasks, services and accounts it involves.
+async function planBundle(bundle, environment, options = {}) {
+    const problems = [...findLooseIncludes(bundle, options.noRemote), ...(options.policy ? findHostProblems(bundle) : [])];
+    if (problems.length > 0) {
+        throw new DefinitionError(problems.join('\n'));
+    }
+    const directory = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), 'hammerkit-definition-'));
+    try {
+        for (const [path, content] of Object.entries(bundle.files)) {
+            await (0, promises_1.mkdir)((0, path_1.dirname)((0, path_1.join)(directory, path)), { recursive: true });
+            await (0, promises_1.writeFile)((0, path_1.join)(directory, path), content);
+        }
+        const inspected = {
+            ...environment,
+            cwd: directory,
+            file: confined((0, get_file_context_1.getFileContext)(directory), directory),
+        };
+        try {
+            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected);
+            const context = await (0, reference_parser_1.parseReferences)(ctx, scope, inspected);
+            const workTree = (0, work_scope_parser_1.getWorkContext)(context, options.scope ?? { environmentName: null }, inspected);
+            const items = itemsOf(workTree);
+            if (options.policy) {
+                const policyProblems = findPolicyProblems(items, options.policy, directory);
+                if (policyProblems.length > 0) {
+                    throw new DefinitionError(policyProblems.join('\n'));
+                }
+            }
+            const inputs = {};
+            for (const item of Object.values(workTree.tasks)) {
+                inputs[item.name] = {
+                    // the sources a task inherits from its dependencies belong to those
+                    src: item.data.src
+                        .filter((source) => source.inherited === null)
+                        .flatMap((source) => insideBundle(directory, item.data.cwd, source.source)),
+                    mounts: (0, work_task_1.isContainerWorkTask)(item.data)
+                        ? item.data.mounts.flatMap((mount) => insideBundle(directory, item.data.cwd, mount.localPath))
+                        : [],
+                    deps: item.deps.map((dep) => dep.name).sort(),
+                    needs: item.needs.map((need) => need.name).sort(),
+                };
+            }
+            const plan = {};
+            for (const item of items) {
+                plan[item.name] = toPlan(directory, item);
+            }
+            const sorted = (record) => Object.fromEntries(Object.entries(record).sort(([a], [b]) => (a < b ? -1 : 1)));
+            return {
+                tasks: Object.keys(context.tasks).sort(),
+                services: Object.keys(context.services).sort(),
+                inputs: sorted(inputs),
+                plan: sorted(plan),
+                accounts: [...new Set(Object.values(plan).flatMap((entry) => entry.accounts))].sort(),
+            };
+        }
+        catch (e) {
+            throw new DefinitionError(describeFailure(e).split(directory).join('.'));
+        }
+    }
+    finally {
+        await (0, promises_1.rm)(directory, { recursive: true, force: true });
+    }
+}
+exports.planBundle = planBundle;
+// Reads a bundle the way a run would; see planBundle.
+const inspectBundle = (bundle, environment) => planBundle(bundle, environment);
+exports.inspectBundle = inspectBundle;
+//# sourceMappingURL=plan.js.map

package/dist/server/policy.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideRun = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
+const repo_1 = require("./repo");
+const BUILDS_ORDER = ['run', 'propose', 'publish'];
+function matches(entitlement, principal) {
+    if (entitlement.subject) {
+        return entitlement.subject.iss === principal.iss && entitlement.subject.sub === principal.sub;
+    }
+    if (entitlement.group) {
+        return entitlement.group.iss === principal.iss && principal.groups.includes(entitlement.group.name);
+    }
+    if (entitlement.claims) {
+        return (entitlement.claims.iss === principal.iss &&
+            Object.entries(entitlement.claims.match).every(([name, value]) => principal.claims[name] === value));
+    }
+    return false;
+}
+exports.matches = matches;
+function atLeast(grant, level) {
+    return grant.builds !== null && BUILDS_ORDER.indexOf(grant.builds) >= BUILDS_ORDER.indexOf(level);
+}
+const mayRun = (grant) => atLeast(grant, 'run');
+exports.mayRun = mayRun;
+const mayPropose = (grant) => atLeast(grant, 'propose');
+exports.mayPropose = mayPropose;
+const mayPublish = (grant) => atLeast(grant, 'publish');
+exports.mayPublish = mayPublish;
+// A caller who can neither run nor publish anything sees nothing of the server's
+// build files either. Someone who uses an account sees them: they have to know what
+// they approve.
+function maySeeDefinitions(grant) {
+    return grant.builds !== null || Object.keys(grant.accounts).length > 0;
+}
+exports.maySeeDefinitions = maySeeDefinitions;
+// `use` includes deciding about the runs others request on the account.
+function canUse(grant, account) {
+    return grant.accounts[account] === 'use';
+}
+exports.canUse = canUse;
+// Pulling a version back is a safe thing to do, so it is open to who publishes the build
+// file, and to who uses an account the version works with: they are the ones who
+// answer for what runs as it.
+function mayYank(grant, version) {
+    return (0, exports.mayPublish)(grant) || (version.accounts ?? []).some((account) => canUse(grant, account));
+}
+exports.mayYank = mayYank;
+function usedAccounts(grant) {
+    return Object.keys(grant.accounts).filter((account) => grant.accounts[account] === 'use');
+}
+exports.usedAccounts = usedAccounts;
+// Default deny: a caller without a matching entitlement gets nothing.
+function getGrant(entitlements, principal) {
+    const matched = [];
+    const accounts = {};
+    const repos = [];
+    let builds = null;
+    entitlements.forEach((entitlement, index) => {
+        if (!matches(entitlement, principal)) {
+            return;
+        }
+        matched.push(index);
+        for (const [account, level] of Object.entries(entitlement.accounts)) {
+            if (accounts[account] !== 'use') {
+                accounts[account] = level;
+            }
+        }
+        for (const repo of entitlement.repos) {
+            if (!repos.includes(repo)) {
+                repos.push(repo);
+            }
+        }
+        if (entitlement.builds &&
+            (builds === null || BUILDS_ORDER.indexOf(entitlement.builds) > BUILDS_ORDER.indexOf(builds))) {
+            builds = entitlement.builds;
+        }
+    });
+    return { accounts, repos, builds, matched };
+}
+exports.getGrant = getGrant;
+const COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
+// The single place that decides what happens to a run that was submitted: it
+// starts, waits for an approval, or is refused with the reason.
+function decideRun(input) {
+    const { grant, accounts, catalog, source, approvable, readable } = input;
+    if (!(0, exports.mayRun)(grant)) {
+        return { type: 'refuse', status: 403, error: 'you are not entitled to run anything on this server' };
+    }
+    if (source.type === 'upload') {
+        return {
+            type: 'refuse',
+            status: 501,
+            error: 'runs from an upload are not supported by this server yet, use a git ref',
+        };
+    }
+    // the caller's own list first: what they may not name is not told whether the server can read it
+    if (!(0, repo_1.matchesAnyRepo)(grant.repos, source.repo)) {
+        return {
+            type: 'refuse',
+            status: 403,
+            error: grant.repos.length > 0
+                ? `you may not run from ${source.repo}, your repositories are ${grant.repos.join(', ')}`
+                : `you may not run from ${source.repo}, no entitlement of yours lists a repository`,
+        };
+    }
+    if (!readable(source.repo)) {
+        return { type: 'refuse', status: 400, error: `this server can not read ${source.repo}` };
+    }
+    const request = [];
+    for (const account of accounts) {
+        const level = grant.accounts[account];
+        if (level === undefined) {
+            return { type: 'refuse', status: 403, error: `you may not use the account ${account}, it needs use or request` };
+        }
+        const rules = catalog[account];
+        if (rules?.source && !rules.source.includes(source.type)) {
+            return { type: 'refuse', status: 403, error: `the account ${account} is not used by runs from ${source.type}` };
+        }
+        if (rules?.refs) {
+            if (COMMIT.test(source.ref) || !(0, repo_1.matchesRef)(rules.refs, source.ref)) {
+                return {
+                    type: 'refuse',
+                    status: 403,
+                    error: `the account ${account} is only used by runs from ${rules.refs.join(', ')}`,
+                };
+            }
+        }
+        if (level === 'request') {
+            if (!approvable(account)) {
+                return { type: 'refuse', status: 409, error: `nobody can approve ${account}, no entitlement uses it` };
+            }
+            request.push(account);
+        }
+    }
+    return request.length > 0 ? { type: 'approval', accounts: request } : { type: 'run' };
+}
+exports.decideRun = decideRun;
+//# sourceMappingURL=policy.js.map