permdock 0.0.0 → 0.1.0

package/dist/create-CSkhDU9T.js

@@ -0,0 +1,222 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { g as listPermissions } from "./permissions-DC7GROPA.js";
+import { t as createPermDock$1 } from "./permdock-yoZ7EjxX.js";
+import { n as isActor } from "./subject-C6dLxqHU.js";
+import { a as problemFromDecision, i as notFoundProblem, o as problemResponse, t as PROBLEM_BASE } from "./problem-Cgp9-KZA.js";
+import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-DsAU9ppl.js";
+//#region src/server/create.ts
+/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+async function tenantScope(option, context) {
+	if (option === void 0 || typeof option === "string") return { tenant: option };
+	try {
+		return { tenant: await option(context) };
+	} catch {
+		return { tenant: void 0 };
+	}
+}
+async function resolveActor(request, options) {
+	const verified = options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request);
+	if (verified !== void 0) return verified;
+	if (options.actor === void 0) return;
+	try {
+		const resolved = await options.actor(request);
+		return isActor(resolved) ? resolved : void 0;
+	} catch {
+		return;
+	}
+}
+const NO_TENANT = "\0";
+function createPermDock(policy, options) {
+	return createKernel(policy, options);
+}
+function problemFor(decision, init, approval) {
+	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, {
+		principal: null,
+		context: {}
+	}, compact({
+		instance: init.instance,
+		approval
+	}));
+	return problemResponse({
+		type: `${PROBLEM_BASE}/denied`,
+		title: "Permission denied",
+		status: 403,
+		detail: decision.outcome
+	});
+}
+/**
+* The kernel behind every HTTP adapter. The subject and actor are resolved
+* once per `Request`; one instance is cached per `(Request, tenant)`, so a
+* global middleware and a later tenant-scoped `protect` never share a tenant.
+*/
+function createKernel(policy, options) {
+	const adapter = options.adapter ?? "server";
+	const subjects = /* @__PURE__ */ new WeakMap();
+	const instances = /* @__PURE__ */ new WeakMap();
+	const resolveSubject = (request) => {
+		const hit = subjects.get(request);
+		if (hit !== void 0) return hit;
+		const resolved = (async () => {
+			const actor = await resolveActor(request, options);
+			let user = null;
+			try {
+				user = await options.subject(request);
+			} catch {
+				user = null;
+			}
+			return {
+				user,
+				actor
+			};
+		})();
+		subjects.set(request, resolved);
+		return resolved;
+	};
+	const freshSubject = async (request) => {
+		const actor = await resolveActor(request, options);
+		try {
+			return {
+				user: await options.subject(request),
+				actor
+			};
+		} catch {
+			return {
+				user: null,
+				actor
+			};
+		}
+	};
+	const instanceFor = async ({ user, actor }, tenant) => {
+		const coreOptions = compact({
+			tenant,
+			memberships: options.memberships,
+			relations: options.relations,
+			entitlements: options.entitlements,
+			customRoles: options.customRoles,
+			policies: options.policies,
+			sink: options.sink,
+			limits: options.limits,
+			actor
+		});
+		const permdock = await createPermDock$1(policy, user, coreOptions);
+		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, coreOptions);
+		return {
+			permdock: options.wrap === void 0 ? permdock : options.wrap(permdock),
+			remote
+		};
+	};
+	const build = async (request, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		let byTenant = instances.get(request);
+		if (byTenant === void 0) {
+			byTenant = /* @__PURE__ */ new Map();
+			instances.set(request, byTenant);
+		}
+		const key = tenant ?? NO_TENANT;
+		const hit = byTenant.get(key);
+		if (hit !== void 0) return hit;
+		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
+		byTenant.set(key, built);
+		return built;
+	};
+	const connection = async (request, connectionOptions = {}, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		const { openConnection } = await import("./connection-JvqwHODC.js");
+		return openConnection({
+			open: async () => (await build(request, { tenant })).permdock,
+			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
+			tenant,
+			...options.revocations === void 0 ? {} : { feed: options.revocations },
+			adapter,
+			options: connectionOptions
+		});
+	};
+	const permdock = async (request, scope) => (await build(request, scope)).permdock;
+	const protect = (permission, loadData, protectOptions = {}) => async (request, scope) => {
+		let instance;
+		let remote;
+		try {
+			({permdock: instance, remote} = await build(request, scope));
+		} catch (error) {
+			if (error instanceof InvalidSignatureError) return {
+				ok: false,
+				response: error.response
+			};
+			throw error;
+		}
+		let data;
+		if (loadData !== void 0) {
+			const loaded = await loadData(request);
+			if (loaded === null || loaded === void 0) return {
+				ok: false,
+				response: notFoundProblem()
+			};
+			data = loaded;
+		}
+		const decideOptions = compact({
+			source: "adapter",
+			adapter,
+			...protectOptions.trusted === true ? { trusted: true } : {
+				trusted: false,
+				boundary: "http-body"
+			}
+		});
+		const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "pdp-unavailable"
+			}],
+			alternatives: []
+		}));
+		const decision = await applyApprovalResume(raw, permission, instance, options.store, request, compact({
+			type: permission.resource,
+			id: data !== null && typeof data === "object" && "id" in data && (typeof data.id === "string" || typeof data.id === "number") ? String(data.id) : void 0
+		}), adapter);
+		if (decision.outcome === "granted") return {
+			ok: true,
+			permdock: instance,
+			decision,
+			data
+		};
+		return {
+			ok: false,
+			response: problemFromDecision(decision, permission, instance.subject, compact({
+				approval: options.approval,
+				credentials: request.headers.has("authorization"),
+				disclosure: data === void 0 ? void 0 : policy.resources.get(permission.resource)?.disclosure
+			}))
+		};
+	};
+	const openapi = {
+		security: (permission) => ({
+			security: [{ oauth2: [permission.scope] }],
+			"x-permdock-permissions": [permission.key]
+		}),
+		securitySchemes: () => {
+			const scopes = {};
+			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
+			return { oauth2: {
+				type: "oauth2",
+				flows: {},
+				scopes
+			} };
+		}
+	};
+	const permdockHandler = (scope) => createEvaluationsHandler(compact({
+		policy,
+		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
+		store: options.store,
+		adapter
+	}));
+	return {
+		permdock,
+		protect,
+		connection,
+		problem: (decision, init) => problemFor(decision, init, options.approval),
+		openapi,
+		permdockHandler
+	};
+}
+//#endregion
+export { createPermDock as n, tenantScope as r, createKernel as t };

package/dist/credential-B_rkUNlY.js

@@ -0,0 +1,326 @@
+import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { a as formerKeys, g as listPermissions } from "./permissions-DC7GROPA.js";
+import { u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { a as ownRecord, n as idList, r as isId } from "./capability-B68OFnZx.js";
+//#region src/core/revocations.ts
+function isRevocationEvent(value) {
+	if (value === null || typeof value !== "object") return false;
+	const event = value;
+	return typeof event["principal"] === "string" && event["principal"].length > 0 && (event["kind"] === "session-revoked" || event["kind"] === "changed") && (event["session"] === void 0 || typeof event["session"] === "string") && (event["tenant"] === void 0 || typeof event["tenant"] === "string");
+}
+/** In-process feed; a multi-replica app bridges `revoke` to its own pub/sub. */
+function memoryRevocationFeed() {
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		revoke(event) {
+			if (!isRevocationEvent(event)) throw new TypeError("PermDock: invalid revocation event.");
+			const frozen = Object.freeze({ ...event });
+			for (const listener of listeners) try {
+				listener(frozen);
+			} catch {}
+		}
+	});
+}
+//#endregion
+//#region src/core/credential.ts
+const MAX_ENTRIES = 64;
+const MAX_NAME = 256;
+function policies(policy) {
+	return isReadonlyArray(policy) ? policy : [policy];
+}
+/**
+* The first rule of `policy` the credential breaks, or `undefined`. A key
+* without `expiresAt` passes only when some policy sets `allowNoExpiry` and
+* none sets `maxTtl`; an empty list therefore refuses it.
+*/
+function credentialPolicyViolation(credential, policy) {
+	const list = policies(policy);
+	for (const item of list) if (item.kinds !== void 0 && !item.kinds.includes(credential.kind)) return "kind";
+	if (credential.expiresAt === void 0) return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	for (const item of list) {
+		const max = item.maxTtl;
+		if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max) || max < 0 || credential.expiresAt - credential.createdAt > max)) return "ttl";
+	}
+}
+function parsePermissions(value) {
+	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ENTRIES) return;
+	const out = [];
+	for (const item of value) {
+		const entry = ownRecord(item);
+		if (entry === void 0 || !isId(entry["permission"])) return;
+		const ids = entry["ids"] === void 0 ? void 0 : idList(entry["ids"]);
+		if (entry["ids"] !== void 0 && ids === void 0) return;
+		out.push(compact({
+			permission: entry["permission"],
+			ids
+		}));
+	}
+	return out;
+}
+function isTime(value) {
+	return typeof value === "number" && Number.isFinite(value);
+}
+/**
+* Validates an untrusted credential record and returns a frozen copy with
+* only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
+* type in a known field, a service credential without `tenant` and `roles`,
+* or a user credential with either, rejects the whole record.
+*/
+function parseCredential(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
+	if (value["kind"] !== "user" && value["kind"] !== "service") return;
+	if (!isId(value["principal"]) || !isId(value["createdBy"])) return;
+	const permissions = parsePermissions(value["permissions"]);
+	if (permissions === void 0 || !isTime(value["createdAt"])) return;
+	if (value["expiresAt"] !== void 0 && !isTime(value["expiresAt"])) return;
+	if (value["name"] !== void 0 && (typeof value["name"] !== "string" || value["name"].length > MAX_NAME)) return;
+	let tenant;
+	let roles;
+	if (value["kind"] === "service") {
+		roles = idList(value["roles"]);
+		if (!isId(value["tenant"]) || roles === void 0) return;
+		tenant = value["tenant"];
+	} else if (value["tenant"] !== void 0 || value["roles"] !== void 0) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		kind: value["kind"],
+		principal: value["principal"],
+		tenant,
+		roles,
+		permissions,
+		createdBy: value["createdBy"],
+		createdAt: value["createdAt"],
+		expiresAt: value["expiresAt"],
+		name: value["name"]
+	}));
+}
+function leafByKey(tree) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(tree)) {
+		byKey.set(leaf.key, leaf);
+		for (const old of formerKeys(leaf)) byKey.set(old, leaf);
+	}
+	return byKey;
+}
+/**
+* The delegation a credential narrows its principal to: OAuth scopes for
+* permissions on every instance, one RFC 9396 entry per id otherwise. A key
+* the definitions no longer declare is dropped, so a credential whose every
+* key is gone delegates nothing and every check is denied.
+*/
+function credentialDelegation(credential, permissions) {
+	const leaves = leafByKey(permissions);
+	const scopes = [];
+	const details = [];
+	for (const entry of credential.permissions) {
+		const leaf = leaves.get(entry.permission);
+		if (leaf === void 0) continue;
+		if (entry.ids === void 0) {
+			scopes.push(leaf.scope);
+			continue;
+		}
+		for (const id of entry.ids) details.push({
+			type: leaf.resource,
+			actions: [leaf.action],
+			identifier: id
+		});
+	}
+	return compact({
+		scopes: scopes.length > 0 || details.length === 0 ? scopes : void 0,
+		authorizationDetails: details.length > 0 ? details : void 0
+	});
+}
+/**
+* The subject a verified credential acts as. A `user` credential is its
+* owner, passed live as `owner` (roles and memberships as of this request),
+* with the credential's delegation: every check is the owner's rights
+* intersected with the key's. A `service` credential is a `service`
+* principal whose only membership is `roles` in `tenant`. An owner whose id
+* is not the credential's `principal`, or who is not a user, is anonymous.
+*/
+function credentialSubject(credential, options) {
+	const delegation = credentialDelegation(credential, options.permissions);
+	let principal;
+	if (credential.kind === "user") {
+		const owner = options.owner ?? {
+			id: credential.principal,
+			kind: "user"
+		};
+		if (owner.id !== credential.principal || owner.kind !== void 0 && owner.kind !== "user") return anonymousSubject();
+		principal = {
+			...owner,
+			kind: "user",
+			credential
+		};
+	} else {
+		const membership = compact({
+			tenant: credential.tenant,
+			roles: credential.roles ?? [],
+			via: "credential"
+		});
+		principal = compact({
+			id: credential.principal,
+			kind: "service",
+			tenant: credential.tenant,
+			memberships: [membership],
+			credential
+		});
+	}
+	return freezeDeep(compact({
+		principal,
+		delegation,
+		context: {},
+		expiresAt: credential.expiresAt
+	}));
+}
+function credentialToken(credential) {
+	const payload = JSON.stringify({
+		t: "credential",
+		id: credential.id,
+		kind: credential.kind,
+		principal: credential.principal,
+		tenant: credential.tenant ?? null,
+		roles: credential.roles ?? null,
+		permissions: credential.permissions,
+		createdBy: credential.createdBy,
+		expiresAt: credential.expiresAt ?? null,
+		name: credential.name ?? null
+	});
+	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function permissionEntries(request, declared) {
+	if (!isReadonlyArray(request.permissions) || request.permissions.length === 0 || request.permissions.length > MAX_ENTRIES) return;
+	const out = [];
+	for (const item of request.permissions) {
+		const entry = permissionEntry(item);
+		if (entry === void 0 || declared.get(entry.leaf.key) === void 0) return;
+		out.push(entry);
+	}
+	return out;
+}
+function permissionEntry(item) {
+	if (!isScopedInput(item)) return { leaf: item };
+	const ids = idList(item.ids);
+	return ids === void 0 ? void 0 : {
+		leaf: item.permission,
+		ids
+	};
+}
+function isScopedInput(item) {
+	return "permission" in item && "ids" in item;
+}
+function refuse(reason, detail) {
+	return {
+		ok: false,
+		decision: denied(reason, detail)
+	};
+}
+function checkRequest(permdock, request, now) {
+	const creator = permdock.subject.principal;
+	if (creator === null) return refuse("anonymous");
+	if (creator.kind === "link" || "credential" in creator) return refuse("exceeds-creator", { creator: creator.kind === "link" ? "link" : "credential" });
+	const entries = permissionEntries(request, leafByKey(permdock.permissions));
+	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (!isTime(request.expiresAt) || request.expiresAt <= now)) return refuse("validation");
+	const subject = permdock.subject;
+	for (const entry of entries) for (const id of entry.ids ?? [void 0]) if (coveredByDelegation(entry.leaf, subject.delegation, id, subject.actor !== void 0) !== void 0) return refuse("exceeds-creator", { permission: entry.leaf.key });
+	const credential = parseCredential(compact({
+		v: 1,
+		id: request.id,
+		kind: request.kind,
+		principal: request.kind === "service" ? request.principal ?? request.id : creator.id,
+		tenant: request.kind === "service" ? request.tenant : void 0,
+		roles: request.kind === "service" ? request.roles : void 0,
+		permissions: entries.map((entry) => compact({
+			permission: entry.leaf.key,
+			ids: entry.ids
+		})),
+		createdBy: creator.id,
+		createdAt: now,
+		expiresAt: request.expiresAt === void 0 ? void 0 : Math.floor(request.expiresAt),
+		name: request.name
+	}));
+	if (credential === void 0) return refuse("validation");
+	if (credential.tenant !== void 0) {
+		const tenant = credential.tenant;
+		if (!permdock.tenants().includes(tenant)) return refuse("exceeds-creator", { tenant });
+		const roles = new Set(permdock.assignableRoles({ tenant }).map((role) => role.key));
+		for (const name of credential.roles ?? []) if (!roles.has(name)) return refuse("exceeds-creator", { role: name });
+		const ceiling = new Set(permdock.assignablePermissions({ tenant }).map((leaf) => leaf.key));
+		for (const entry of credential.permissions) if (!ceiling.has(entry.permission)) return refuse("exceeds-creator", { permission: entry.permission });
+	}
+	return {
+		ok: true,
+		credential
+	};
+}
+/**
+* The tenant whose `credentials` policy governs a credential: a service
+* key's own tenant, otherwise `active` (the creator's or the request's).
+*/
+function credentialTenant(credential, active) {
+	return credential.tenant ?? active;
+}
+/**
+* Decides whether the subject of `permdock` may create the credential in
+* `request`. The creator must be a signed-in user or service that is not
+* itself a link or a credential; a delegated creator hands out only what its
+* delegation covers. A service key's tenant must be one the creator is a
+* member of, its roles among the creator's `assignableRoles` there and its
+* permissions within `assignablePermissions` there (`exceeds-creator`). The
+* `credentials` policy of the key's tenant (a service key's own, a user
+* key's the creator's active tenant) then applies (`credential-policy`; a
+* settings source that throws denies with `rule: 'unavailable'`), and
+* `approval` makes the result `approval-required` until `approved` carries
+* its token. PermDock never stores the credential; the application does,
+* after a `granted` result.
+*/
+async function decideCredential(permdock, request, options = {}) {
+	const checked = checkRequest(permdock, request, options.now ?? Math.floor(Date.now() / 1e3));
+	if (!checked.ok) return checked.decision;
+	const { credential } = checked;
+	const tenant = credentialTenant(credential, permdock.subject.principal?.tenant);
+	let policy;
+	if (options.settings !== void 0 && tenant !== void 0) try {
+		policy = (await options.settings.settingsFor(tenant))?.credentials;
+	} catch {
+		return denied("credential-policy", { rule: "unavailable" });
+	}
+	const list = policy === void 0 ? [] : [policy];
+	const violation = credentialPolicyViolation(credential, list);
+	if (violation !== void 0) return denied("credential-policy", { rule: violation });
+	if (list.some((item) => item.approval === true)) {
+		const token = credentialToken(credential);
+		if (options.approved !== token) return freezeDeep({
+			outcome: "approval-required",
+			credential,
+			token
+		});
+	}
+	return freezeDeep({
+		outcome: "granted",
+		credential
+	});
+}
+//#endregion
+export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, memoryRevocationFeed as s, credentialDelegation as t };