mindoodb 0.0.86 → 0.0.89

package/dist/core/BaseMindooTenantDirectory.js

@@ -8,6 +8,7 @@ const singleFlight_1 = require("./utils/singleFlight");
 const logging_1 = require("./logging");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
 const types_2 = require("./accesscontrol/types");
+const builtinDbInvariants_1 = require("./builtinDbInvariants");
 const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const DirectoryTimeTravelIndex_1 = require("./accesscontrol/DirectoryTimeTravelIndex");
 const directoryProjection_1 = require("./accesscontrol/directoryProjection");
@@ -1321,6 +1322,10 @@ class BaseMindooTenantDirectory {
      * server to gate all sync operations for a database id.
      */
     async evaluateDbAccessForSigningKey(input) {
+        return (await this.evaluateDbAccessModeForSigningKey(input)).mode === "read";
+    }
+    /** The configured gates (§6.7 id allowlist, §6.8 read gate), without the personal-database invariant. */
+    async evaluateConfiguredReadGate(input) {
         // Gate 1 — tenant-wide database-id allowlist (`databaseCreationPolicy`).
         // Orthogonal to read access: a database must clear BOTH gates.
         if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey }))) {
@@ -1348,6 +1353,281 @@ class BaseMindooTenantDirectory {
         });
         return decision.allowed;
     }
+    /**
+     * The read scope of a principal in `dbid` (docs/accesscontrol.md §6.12):
+     * `"all"` when it reads every document, `"own"` when the database's
+     * `docReadScope` is `"own"` and the principal is neither the tenant admin nor
+     * matched by a `doc_read_all` allow rule. The directory databases are never
+     * scoped. Evaluated at the directory head, like the read gate.
+     */
+    async evaluateReadScopeForSigningKey(input) {
+        if (input.dbid === types_1.DIRECTORY_DB_ID || input.dbid === types_1.USER_DIRECTORY_DB_ID)
+            return "all";
+        const adminKey = this.tenant.getAdministrationPublicKey();
+        if (input.signingKey === adminKey)
+            return "all";
+        const decision = await this.evaluateAccessForSigningKey({
+            op: "doc_read_all",
+            dbid: input.dbid,
+            signingKey: input.signingKey,
+            trustedTime: Number.MAX_SAFE_INTEGER,
+        });
+        return decision.allowed ? "all" : "own";
+    }
+    /**
+     * The current user's read scope in `dbid` (§6.12), the client-side
+     * counterpart of {@link evaluateReadScopeForSigningKey}, e.g. to tell the
+     * user that a list only shows their own documents.
+     */
+    async getReadScope(dbid) {
+        const currentUser = await this.tenant.getCurrentUserId();
+        return this.evaluateReadScopeForSigningKey({ dbid, signingKey: currentUser.userSigningPublicKey });
+    }
+    /**
+     * Like {@link evaluateDbAccessForSigningKey}, but distinguishes the deposit
+     * right (docs/accesscontrol.md §6.10): `"read"` passes the read gate (all
+     * sync), `"deposit"` fails it but holds a `doc_deposit` allow (push of
+     * sealed creates only), `"none"` neither. `maxRecipients` is the bound from
+     * the matching deposit rule.
+     */
+    async evaluateDbAccessModeForSigningKey(input) {
+        // Built-in personal-database invariant (§6.11): decides first, and a
+        // configured policy can only take away what it grants.
+        const personal = await this.evaluatePersonalDatabaseAccess(input);
+        if (personal) {
+            if (personal.mode === "none")
+                return personal;
+            if ((0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey())) {
+                return personal;
+            }
+            if (personal.mode === "read") {
+                return (await this.evaluateConfiguredReadGate(input)) ? personal : { mode: "none", reason: "denied by the configured policy" };
+            }
+            if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey })))
+                return { mode: "none" };
+            const configured = await this.evaluateAccessForSigningKey({
+                op: "doc_deposit",
+                dbid: input.dbid,
+                signingKey: input.signingKey,
+                trustedTime: Number.MAX_SAFE_INTEGER,
+            });
+            // Only a matching deny rule counts here; the built-in grant replaces the allow rule.
+            return !configured.allowed && configured.matchedRuleId
+                ? { mode: "none", reason: `deposit denied by rule ${configured.matchedRuleId}` }
+                : personal;
+        }
+        if (await this.evaluateConfiguredReadGate(input)) {
+            return { mode: "read" };
+        }
+        // The id allowlist (gate 1) applies to depositors as well.
+        if (!(await this.isDatabaseAllowed(input.dbid, { signingKey: input.signingKey }))) {
+            return { mode: "none" };
+        }
+        const decision = await this.evaluateAccessForSigningKey({
+            op: "doc_deposit",
+            dbid: input.dbid,
+            signingKey: input.signingKey,
+            trustedTime: Number.MAX_SAFE_INTEGER,
+        });
+        if (!decision.allowed)
+            return { mode: "none" };
+        const rule = await this.depositRule(decision.matchedRuleId);
+        return {
+            mode: "deposit",
+            maxRecipients: rule?.maxRecipients ?? types_2.DEFAULT_DEPOSIT_MAX_RECIPIENTS,
+            ...(rule?.docIdPrefixes?.length ? { docIdPrefixes: rule.docIdPrefixes } : {}),
+        };
+    }
+    /**
+     * The built-in rule for personal databases (§6.11), or `null` when `dbid` is
+     * not one. `<prefix><grantDocId>` may be read and synced by the devices on
+     * that grant and by the tenant admin; it may be deposited into by
+     * identities whose grant lists the prefix in `depositPrefixes`; nobody
+     * else gets anything. An unknown grant id leaves everyone but the admin out.
+     * `mbusy_` (free/busy) is the exception: other members read it read-only
+     * (`readOnly`, pushes refused) under the tenant's `freeBusy` setting.
+     */
+    async evaluatePersonalDatabaseAccess(input) {
+        const head = await this.getDirectoryStateHead();
+        const owner = (0, builtinDbInvariants_1.personalDatabaseOwner)(input.dbid, head.defaultPolicy?.personalDatabasePrefixes ?? []);
+        if (!owner)
+            return null;
+        if ((0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey())) {
+            return { mode: "read", reason: "tenant admin" };
+        }
+        const grant = await this.loadGrantDocument(owner.grantDocId);
+        if (grant && (0, grantKeys_1.extractActiveKeyPairs)(grant).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, input.signingKey))) {
+            return { mode: "read", reason: "a device of the owner" };
+        }
+        const signerGrants = await this.grantsForSigningKey(input.signingKey);
+        const listed = (grant, field) => Array.isArray(grant[field]) && grant[field].includes(owner.prefix);
+        if (signerGrants.some((grant) => listed(grant, "accessPrefixes"))) {
+            return { mode: "read", reason: `service access to ${owner.prefix}* granted` };
+        }
+        // Free/busy (§6.11): other members read the owner's busy times, read-only,
+        // under the tenant's `freeBusy` setting. Nobody but the owner writes.
+        if (owner.prefix === "mbusy_" && grant && signerGrants.length > 0) {
+            const mode = head.defaultPolicy?.freeBusy ?? "members";
+            let allowed = mode === "members";
+            if (mode === "rules") {
+                const decision = await this.evaluateAccessForSigningKey({
+                    op: "doc_read",
+                    dbid: input.dbid,
+                    signingKey: input.signingKey,
+                    trustedTime: Number.MAX_SAFE_INTEGER,
+                });
+                allowed = decision.allowed && decision.matchedRuleId !== undefined;
+            }
+            if (allowed)
+                return { mode: "read", readOnly: true, reason: `free/busy (${mode})` };
+            return { mode: "none", reason: `free/busy of another person (${mode})` };
+        }
+        const depositors = signerGrants.filter((grant) => listed(grant, "depositPrefixes"));
+        if (depositors.length > 0) {
+            // Document ids a deposit may use: the grant's `depositDocIdPrefixes`
+            // (per database prefix, e.g. {"mmail_": ["memo_"]}), else the built-in
+            // default for the prefix (mmail_: "memo_", MindooMail messages).
+            const configured = depositors
+                .map((grant) => grant.depositDocIdPrefixes)
+                .map((byPrefix) => (byPrefix && Array.isArray(byPrefix[owner.prefix]) ? byPrefix[owner.prefix] : null))
+                .find((list) => list !== null);
+            const docIdPrefixes = configured
+                ? configured.map(String).filter((p) => p.length > 0)
+                : [...(builtinDbInvariants_1.BUILTIN_PERSONAL_DEPOSIT_DOC_ID_PREFIXES[owner.prefix] ?? [])];
+            return {
+                mode: "deposit",
+                maxRecipients: 1,
+                ...(docIdPrefixes.length ? { docIdPrefixes } : {}),
+                reason: `deposit into ${owner.prefix}* granted`,
+            };
+        }
+        // Internal mail (§6.11): members deposit MindooMail messages into each
+        // other's mailbox, under the tenant's `internalMail` setting.
+        if (owner.prefix === "mmail_" && grant && signerGrants.length > 0) {
+            const mode = head.defaultPolicy?.internalMail ?? "members";
+            let allowed = mode === "members";
+            if (mode === "rules") {
+                const decision = await this.evaluateAccessForSigningKey({
+                    op: "doc_deposit",
+                    dbid: input.dbid,
+                    signingKey: input.signingKey,
+                    trustedTime: Number.MAX_SAFE_INTEGER,
+                });
+                allowed = decision.allowed && decision.matchedRuleId !== undefined;
+            }
+            if (allowed) {
+                const limits = head.defaultPolicy?.internalMailLimits ?? {};
+                return {
+                    mode: "deposit",
+                    maxRecipients: 1,
+                    docIdPrefixes: [...(builtinDbInvariants_1.BUILTIN_PERSONAL_DEPOSIT_DOC_ID_PREFIXES.mmail_ ?? [])],
+                    internalMail: {
+                        maxBytesPerMail: limits.maxBytesPerMail ?? types_2.DEFAULT_INTERNAL_MAIL_LIMITS.maxBytesPerMail,
+                        maxMailsPerHour: limits.maxMailsPerHour ?? types_2.DEFAULT_INTERNAL_MAIL_LIMITS.maxMailsPerHour,
+                    },
+                    reason: `internal mail (${mode})`,
+                };
+            }
+        }
+        return { mode: "none", reason: grant ? "personal database of another person" : "personal database without a matching grant" };
+    }
+    /** A `grantaccess` document by id, or null (missing, deleted, or another kind of document). */
+    async loadGrantDocument(grantDocId) {
+        const directoryDB = await this.getDirectoryDB();
+        try {
+            const doc = await directoryDB.getDocument(grantDocId);
+            if (doc.isDeleted())
+                return null;
+            const data = doc.getData();
+            return data.form === "useroperation" && data.type === "grantaccess" ? data : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The active grants that list `signingKey` as a device. */
+    async grantsForSigningKey(signingKey) {
+        const lookup = await this.getUserBySigningPublicKey(signingKey);
+        if (!lookup)
+            return [];
+        const grants = await this.findGrantAccessDocuments(lookup.username);
+        return grants
+            .filter((doc) => !doc.isDeleted())
+            .map((doc) => doc.getData())
+            .filter((data) => (0, grantKeys_1.extractActiveKeyPairs)(data).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, signingKey)));
+    }
+    /**
+     * Let an identity deposit into personal databases with these prefixes
+     * (§6.11), e.g. `["mmail_"]` for a mail gateway. Written on the person's
+     * grant, admin-signed; an empty list takes the right away again.
+     */
+    async setGrantDepositPrefixes(username, prefixes, administrationPrivateKey, administrationPrivateKeyPassword) {
+        await this.setGrantPersonalDatabaseRights(username, { depositPrefixes: prefixes }, administrationPrivateKey, administrationPrivateKeyPassword);
+    }
+    /**
+     * The rights an identity has in other people's personal databases (§6.11):
+     * `depositPrefixes` (push sealed creates only) and `accessPrefixes` (read
+     * and sync, for a service such as the mail gateway serving every outbox).
+     * Written on the identity's grant, admin-signed; a field left out stays as
+     * it is, an empty list removes the right. `depositDocIdPrefixes` sets the
+     * document ids a deposit may use per database prefix (e.g.
+     * `{ mmail_: ["memo_"] }`, the built-in default); an empty list allows any id.
+     */
+    async setGrantPersonalDatabaseRights(username, rights, administrationPrivateKey, administrationPrivateKeyPassword) {
+        for (const prefix of [...(rights.depositPrefixes ?? []), ...(rights.accessPrefixes ?? [])]) {
+            if (!builtinDbInvariants_1.PERSONAL_DATABASE_PREFIX_REGEX.test(prefix)) {
+                throw new Error(`depositPrefixes: "${prefix}" is not a personal-database prefix like "mmail_"`);
+            }
+        }
+        for (const [prefix, ids] of Object.entries(rights.depositDocIdPrefixes ?? {})) {
+            if (!builtinDbInvariants_1.PERSONAL_DATABASE_PREFIX_REGEX.test(prefix)) {
+                throw new Error(`depositDocIdPrefixes: "${prefix}" is not a personal-database prefix like "mmail_"`);
+            }
+            (0, types_2.validateDocIdPrefixes)(ids, `depositDocIdPrefixes.${prefix}`);
+        }
+        const grants = (await this.findGrantAccessDocuments(username)).filter((doc) => !doc.isDeleted());
+        if (grants.length === 0)
+            throw new Error(`No grant for ${username}`);
+        const directoryDB = await this.getDirectoryDB();
+        const signingKeyPair = {
+            publicKey: this.tenant.getAdministrationPublicKey(),
+            privateKey: administrationPrivateKey,
+        };
+        for (const grant of grants) {
+            await directoryDB.changeDoc(grant, (d) => {
+                const data = d.getData();
+                if (rights.depositPrefixes)
+                    data.depositPrefixes = [...new Set(rights.depositPrefixes)];
+                if (rights.accessPrefixes)
+                    data.accessPrefixes = [...new Set(rights.accessPrefixes)];
+                if (rights.depositDocIdPrefixes) {
+                    const merged = { ...(data.depositDocIdPrefixes ?? {}) };
+                    for (const [prefix, ids] of Object.entries(rights.depositDocIdPrefixes))
+                        merged[prefix] = [...new Set(ids)];
+                    data.depositDocIdPrefixes = merged;
+                }
+            }, { signingKeyPair, signingKeyPassword: administrationPrivateKeyPassword });
+        }
+        await this.updateUnifiedCache();
+    }
+    /**
+     * Whether the current user holds the deposit right on `dbid` (§6.10): a
+     * `doc_deposit` allow rule matches and no deny does. Says nothing about the
+     * read gate; callers check {@link canReadDatabase} first.
+     */
+    async canDepositDatabase(dbid) {
+        if (dbid === types_1.DIRECTORY_DB_ID || dbid === types_1.USER_DIRECTORY_DB_ID)
+            return false;
+        const currentUser = await this.tenant.getCurrentUserId();
+        const access = await this.evaluateDbAccessModeForSigningKey({ dbid, signingKey: currentUser.userSigningPublicKey });
+        return access.mode === "deposit";
+    }
+    async depositRule(ruleId) {
+        if (!ruleId)
+            return null;
+        const head = await this.getDirectoryStateHead();
+        return (head.rulesByType.get("doc_deposit") ?? []).find((r) => r.ruleId === ruleId) ?? null;
+    }
     /**
      * Whether the current user may open and sync `dbid` under the database read
      * gate (`doc_read`, §6.6). The client-side counterpart of
@@ -1364,6 +1644,10 @@ class BaseMindooTenantDirectory {
         const adminKey = this.tenant.getAdministrationPublicKey();
         if (currentUser.userSigningPublicKey === adminKey)
             return true;
+        // The personal-database invariant (§6.11) decides first, policy on top.
+        const personal = await this.evaluatePersonalDatabaseAccess({ dbid, signingKey: currentUser.userSigningPublicKey });
+        if (personal && personal.mode !== "read")
+            return false;
         const decision = await this.canDo("doc_read", dbid);
         return decision.allowed;
     }
@@ -1382,12 +1666,30 @@ class BaseMindooTenantDirectory {
         (0, types_3.validateAccessPolicy)(policy);
         await this.writePolicyDoc(types_3.ACL_DEFAULT_POLICY_DOC_ID, policy, administrationPrivateKey, administrationPrivateKeyPassword);
     }
+    async requireV2EntrySignatures(administrationPrivateKey, administrationPrivateKeyPassword) {
+        const head = await this.getDirectoryStateHead();
+        const existing = head.defaultPolicy?.requireMetadataSignatureSince;
+        if (typeof existing === "number" && Number.isFinite(existing)) {
+            return { since: existing, changed: false };
+        }
+        const since = (0, timeSource_1.semanticNow)();
+        await this.setDefaultAccessPolicy(head.defaultPolicy
+            ? { requireMetadataSignatureSince: since }
+            : // No policy document yet: writing one is what activates access
+                // control, so it carries the master switch, exactly as a new tenant
+                // gets it from the factory.
+                { disableAllAccessChecksAndPolicies: true, requireMetadataSignatureSince: since }, administrationPrivateKey, administrationPrivateKeyPassword);
+        return { since, changed: true };
+    }
     /**
      * Create or update a per-database policy override (§6.2). Fields set here
      * override the tenant default for `dbid`; unset fields inherit it.
      */
     async setDatabaseAccessPolicy(dbid, policy, administrationPrivateKey, administrationPrivateKeyPassword) {
         (0, types_3.validateAccessPolicy)(policy);
+        if (policy.personalDatabasePrefixes !== undefined) {
+            throw new Error("personalDatabasePrefixes is a tenant-level setting; set it on the default policy");
+        }
         if (policy.llm !== undefined) {
             throw new Error("llm is a tenant-level setting; set it on the default policy");
         }
@@ -1439,6 +1741,8 @@ class BaseMindooTenantDirectory {
                 groups: rule.groups ?? [],
             }),
             action: rule.action ?? "allow",
+            ...(rule.maxRecipients !== undefined ? { maxRecipients: rule.maxRecipients } : {}),
+            ...(rule.docIdPrefixes !== undefined ? { docIdPrefixes: [...new Set(rule.docIdPrefixes)] } : {}),
         };
         // Fail fast on malformed clauses / operators (§6.3 closed set).
         (0, types_3.validateAclRule)(ruleDoc);
@@ -1462,6 +1766,14 @@ class BaseMindooTenantDirectory {
                 data.description = ruleDoc.description;
             if (ruleDoc.withfields !== undefined)
                 data.withfields = ruleDoc.withfields;
+            if (ruleDoc.maxRecipients !== undefined)
+                data.maxRecipients = ruleDoc.maxRecipients;
+            else if (data.maxRecipients !== undefined)
+                delete data.maxRecipients;
+            if (ruleDoc.docIdPrefixes?.length)
+                data.docIdPrefixes = ruleDoc.docIdPrefixes;
+            else if (data.docIdPrefixes !== undefined)
+                delete data.docIdPrefixes;
         }, {
             signingKeyPair: adminSigningKeyPair,
             signingKeyPassword: administrationPrivateKeyPassword,