permdock 0.0.0 → 0.1.0

package/dist/errors-Iy71s7Oj.js

@@ -0,0 +1,177 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
+//#region src/core/wire-denial.ts
+const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
+function jsonDetail(value) {
+	if (value === void 0 || value === null || value instanceof Error) return;
+	if (typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "object") return;
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		return;
+	}
+}
+function wireDenial(denial) {
+	return compact({
+		role: denial.role,
+		reason: denial.reason,
+		to: denial.to,
+		detail: IN_PROCESS.has(denial.reason) ? void 0 : jsonDetail(denial.detail)
+	});
+}
+function wireDenials(denials) {
+	return denials.map(wireDenial);
+}
+//#endregion
+//#region src/core/errors.ts
+const PROBLEM_BASE = "https://permdock.dev/problems";
+var PermDockDeniedError = class extends Error {
+	name = "PermDockDeniedError";
+	decision;
+	permission;
+	scope;
+	resource;
+	subject;
+	/** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+	digest;
+	constructor(input) {
+		super(input.message);
+		this.decision = input.decision;
+		this.permission = input.permission;
+		this.scope = input.scope;
+		this.resource = input.resource;
+		this.subject = input.subject;
+		this.digest = deniedDigest(input.permission);
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/denied`,
+			title: "Permission denied",
+			status: 403,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			scope: this.scope,
+			resource: this.resource,
+			denials: wireDenials(this.decision.denials),
+			alternatives: this.decision.alternatives.map((leaf) => leaf.key)
+		});
+	}
+};
+var PermDockApprovalRequiredError = class extends Error {
+	name = "PermDockApprovalRequiredError";
+	decision;
+	permission;
+	scope;
+	resource;
+	token;
+	reason;
+	/** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+	digest;
+	constructor(input) {
+		super(input.message);
+		this.decision = input.decision;
+		this.permission = input.permission;
+		this.scope = input.scope;
+		this.resource = input.resource;
+		this.token = input.decision.token;
+		this.reason = input.decision.reason;
+		this.digest = approvalDigest(input.permission, input.decision.token);
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/approval-required`,
+			title: "Approval required",
+			status: 403,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			scope: this.scope,
+			resource: this.resource,
+			reason: this.reason,
+			token: this.token
+		});
+	}
+};
+var PermDockValidationError = class extends Error {
+	name = "PermDockValidationError";
+	code;
+	permission;
+	resource;
+	issues;
+	boundary;
+	constructor(input) {
+		super(input.message);
+		this.code = input.code;
+		this.permission = input.permission;
+		this.resource = input.resource;
+		this.issues = input.issues ?? [];
+		this.boundary = input.boundary;
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/validation`,
+			title: "Invalid resource data",
+			status: 400,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			issues: this.issues
+		});
+	}
+};
+/** The `name` of the deny grant a `deny` denial carries in `detail`, if any. */
+function denyName(detail) {
+	if (detail === null || typeof detail !== "object" || !("name" in detail)) return;
+	return typeof detail.name === "string" ? detail.name : void 0;
+}
+function deniedMessage(permission, subjectId, denials, alternatives) {
+	const clauses = denials.map((denial) => {
+		const name = denial.reason === "deny" ? denyName(denial.detail) : void 0;
+		return name === void 0 ? `${denial.role ?? "none"} (${denial.reason})` : `${denial.role ?? "none"} (${denial.reason} '${name}')`;
+	}).join(", ");
+	const alt = alternatives.length === 0 ? "" : ` Alternatives: ${alternatives.join(", ")}.`;
+	return `${permission} denied for subject ${subjectId ?? "anonymous"}: ${clauses}.${alt}`;
+}
+function approvalMessage(permission, reason, token) {
+	return `${permission} requires human approval (${reason}). Token: ${token}.`;
+}
+/**
+* The `reason` of a long-lived connection's aborted `signal`. `denied` carries
+* the decision that re-denied the permission the connection was opened for.
+*/
+var PermDockRevokedError = class extends Error {
+	name = "PermDockRevokedError";
+	code;
+	permission;
+	decision;
+	constructor(input) {
+		super(`PermDock: connection ended (${input.code}).`);
+		this.code = input.code;
+		if (input.permission !== void 0) this.permission = input.permission;
+		if (input.decision !== void 0) this.decision = input.decision;
+	}
+	toProblemDetails(options) {
+		if (this.code === "denied") return compact({
+			type: `${PROBLEM_BASE}/denied`,
+			title: "Permission denied",
+			status: 403,
+			detail: this.code,
+			instance: options?.instance,
+			permission: this.permission,
+			denials: this.decision?.outcome === "denied" ? wireDenials(this.decision.denials) : void 0
+		});
+		return compact({
+			type: `${PROBLEM_BASE}/unauthenticated`,
+			title: "Authorization ended",
+			status: 401,
+			detail: this.code,
+			instance: options?.instance,
+			permission: this.permission
+		});
+	}
+};
+//#endregion
+export { approvalMessage as a, PermDockValidationError as i, PermDockDeniedError as n, deniedMessage as o, PermDockRevokedError as r, wireDenials as s, PermDockApprovalRequiredError as t };

package/dist/errors-m3u9TmDu.js

@@ -0,0 +1,27 @@
+//#region src/approvals/errors.ts
+var ApprovalError = class extends Error {
+	name = "ApprovalError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"approval-not-found",
+	"approval-not-pending",
+	"approval-expired",
+	"approver-unauthenticated",
+	"approver-is-actor",
+	"approver-is-principal",
+	"approver-not-eligible",
+	"approver-repeated"
+]);
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+function isApprovalError(value) {
+	if (!(value instanceof Error) || value.name !== "ApprovalError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+export { isApprovalError as n, ApprovalError as t };

package/dist/evaluations-DsAU9ppl.js

@@ -0,0 +1,479 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { g as listPermissions, i as findPermission } from "./permissions-DC7GROPA.js";
+import { s as wireDenials } from "./errors-Iy71s7Oj.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DnSOrhB9.js";
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+import { l as validationProblem, n as batchTooLarge, o as problemResponse, t as PROBLEM_BASE } from "./problem-Cgp9-KZA.js";
+//#region src/server/web-bot-auth.ts
+/** Milliseconds a key directory fetch may take before the signature counts as unverifiable. */
+const DIRECTORY_TIMEOUT_MS = 5e3;
+const DEFAULT_MAX_AGE = 300;
+const FUTURE_SKEW = 60;
+const DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+var InvalidSignatureError = class extends Error {
+	name = "InvalidSignatureError";
+	response;
+	constructor(response) {
+		super("Web Bot Auth signature was rejected");
+		this.response = response;
+	}
+};
+function invalidSignatureResponse(error) {
+	return error instanceof InvalidSignatureError ? error.response : void 0;
+}
+function invalidSignatureProblem(detail) {
+	return problemResponse(compact({
+		type: `${PROBLEM_BASE}/invalid-signature`,
+		title: "Invalid signature",
+		status: 403,
+		detail
+	}));
+}
+function discoverViaSignatureAgent(options) {
+	const fetchFn = options.fetch ?? fetch;
+	const allow = new Set(options.allow);
+	const cache = /* @__PURE__ */ new Map();
+	const lookup = async ({ keyid, agent }) => {
+		if (agent === void 0) return;
+		let url;
+		try {
+			url = new URL(agent);
+		} catch {
+			return;
+		}
+		if (url.protocol !== "https:" || !allow.has(url.hostname)) return;
+		const directoryUrl = url.pathname === "/" || url.pathname === "" ? `${url.origin}${DIRECTORY_PATH}` : agent;
+		let pending = cache.get(directoryUrl);
+		if (pending === void 0) {
+			pending = loadDirectory(fetchFn, directoryUrl);
+			cache.set(directoryUrl, pending);
+		}
+		let keys;
+		try {
+			keys = await pending;
+		} catch {
+			cache.delete(directoryUrl);
+			return;
+		}
+		return keys.find((key) => key.kid === keyid);
+	};
+	return { lookup };
+}
+async function verifyWebBotAuth(request, options) {
+	if (options === void 0 || options.verify === false) return;
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput === null) {
+		if (options.required === true) throw new InvalidSignatureError(invalidSignatureProblem("Signature-Input is required"));
+		return;
+	}
+	const parsed = parseSignatureInput(signatureInput);
+	const signatureHeader = request.headers.get("Signature");
+	if (parsed === void 0 || signatureHeader === null) throw reject("Signature-Input could not be parsed");
+	const signature = parseSignature(signatureHeader, parsed.label);
+	if (signature === void 0) throw reject("Signature could not be parsed");
+	const now = options.now?.() ?? Math.floor(Date.now() / 1e3);
+	const maxAge = options.maxAge ?? DEFAULT_MAX_AGE;
+	if (typeof parsed.created !== "number") throw reject("Signature-Input created is required");
+	if (parsed.created > now + FUTURE_SKEW) throw reject("Signature-Input created is in the future");
+	if (now - parsed.created > maxAge) throw reject("Signature-Input created is too old");
+	if (typeof parsed.expires === "number" && parsed.expires < now) throw reject("Signature-Input expires is in the past");
+	if (parsed.keyid === void 0) throw reject("Signature-Input keyid is required");
+	const agent = parseSignatureAgent(request.headers.get("Signature-Agent"), parsed.label);
+	const lookup = typeof options.keys === "function" ? options.keys : options.keys.lookup;
+	let key;
+	try {
+		key = await lookup({
+			request,
+			keyid: parsed.keyid,
+			agent
+		});
+	} catch {
+		throw reject("Web Bot Auth key lookup failed");
+	}
+	if (key === void 0) throw reject("Web Bot Auth key was not found");
+	const base = signatureBase(request, parsed);
+	if (base === void 0) throw reject("signed components could not be covered");
+	const alg = parsed.alg ?? algorithmFromJwk(key);
+	if (alg === void 0) throw reject("signature algorithm is not supported");
+	if (!await verifyBytes(key, alg, signature, base)) throw reject("HTTP Message Signature did not verify");
+	return Object.freeze({
+		id: parsed.keyid,
+		kind: "web-bot-auth"
+	});
+}
+function reject(detail) {
+	return new InvalidSignatureError(invalidSignatureProblem(detail));
+}
+function parseSignatureInput(header) {
+	const member = firstDictionaryMember(header);
+	if (member === void 0) return;
+	const inner = parseInnerListAndParams(member.value);
+	if (inner === void 0) return;
+	return compact({
+		label: member.key,
+		components: inner.components,
+		created: inner.created,
+		expires: inner.expires,
+		keyid: inner.keyid,
+		alg: inner.alg,
+		innerListAndParams: member.value.trim()
+	});
+}
+function parseSignature(header, label) {
+	const member = dictionaryMember(header, label);
+	if (member === void 0) return;
+	return decodeSfBytes(member);
+}
+function parseSignatureAgent(header, label) {
+	if (header === null) return;
+	const trimmed = header.trim();
+	if (trimmed.startsWith("\"")) return unquote(trimmed);
+	const member = dictionaryMember(trimmed, label) ?? firstDictionaryMember(trimmed)?.value;
+	if (member === void 0) return;
+	return unquote(member.trim());
+}
+function firstDictionaryMember(header) {
+	const first = splitTopLevel(header, ",")[0];
+	if (first === void 0) return;
+	const eq = first.indexOf("=");
+	if (eq <= 0) return;
+	return {
+		key: first.slice(0, eq).trim(),
+		value: first.slice(eq + 1)
+	};
+}
+function dictionaryMember(header, label) {
+	for (const part of splitTopLevel(header, ",")) {
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		if (part.slice(0, eq).trim() === label) return part.slice(eq + 1);
+	}
+}
+function parseInnerListAndParams(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("(")) return;
+	const close = trimmed.indexOf(")");
+	if (close < 0) return;
+	const components = parseQuotedList(trimmed.slice(1, close));
+	if (components === void 0) return;
+	const params = parseParams(trimmed.slice(close + 1));
+	return compact({
+		components,
+		created: asUnix(params["created"]),
+		expires: asUnix(params["expires"]),
+		keyid: typeof params["keyid"] === "string" ? params["keyid"] : void 0,
+		alg: typeof params["alg"] === "string" ? params["alg"] : void 0
+	});
+}
+function parseQuotedList(inner) {
+	const items = [];
+	const parts = splitTopLevel(inner, " ");
+	for (const part of parts) {
+		const next = part.trim();
+		if (next === "") continue;
+		if (!next.startsWith("\"") || !next.endsWith("\"")) return;
+		const item = unquote(next);
+		if (item === void 0) return;
+		items.push(item);
+	}
+	return items;
+}
+function parseParams(suffix) {
+	const params = {};
+	for (const part of suffix.split(";")) {
+		const next = part.trim();
+		if (next === "") continue;
+		const eq = next.indexOf("=");
+		if (eq <= 0) continue;
+		const name = next.slice(0, eq);
+		const raw = next.slice(eq + 1);
+		if (raw.startsWith("\"")) {
+			const quoted = unquote(raw);
+			if (quoted !== void 0) params[name] = quoted;
+			continue;
+		}
+		const numeric = Number(raw);
+		params[name] = Number.isFinite(numeric) ? numeric : raw;
+	}
+	return params;
+}
+function asUnix(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function signatureBase(request, parsed) {
+	const lines = [];
+	for (const component of parsed.components) {
+		const value = componentValue(request, component);
+		if (value === void 0) return;
+		lines.push(`"${component}": ${value}`);
+	}
+	lines.push(`"@signature-params": ${parsed.innerListAndParams}`);
+	return new TextEncoder().encode(lines.join("\n"));
+}
+function componentValue(request, component) {
+	if (component.startsWith("@")) {
+		const url = new URL(request.url);
+		switch (component) {
+			case "@method": return request.method;
+			case "@authority": return url.host;
+			case "@path": return url.pathname;
+			case "@query": return url.search;
+			case "@target-uri": return url.href;
+			case "@scheme": return url.protocol.replace(":", "");
+			case "@request-target": return `${url.pathname}${url.search}`;
+			default: return;
+		}
+	}
+	return request.headers.get(component) ?? void 0;
+}
+function algorithmFromJwk(key) {
+	if (key.kty === "OKP" && key.crv === "Ed25519") return "ed25519";
+	if (key.kty === "EC" && key.crv === "P-256") return "ecdsa-p256-sha256";
+}
+async function verifyBytes(key, alg, signature, data) {
+	try {
+		if (alg === "ed25519") {
+			const cryptoKey = await crypto.subtle.importKey("jwk", key, "Ed25519", false, ["verify"]);
+			return await crypto.subtle.verify("Ed25519", cryptoKey, signature, data);
+		}
+		if (alg === "ecdsa-p256-sha256") {
+			const cryptoKey = await crypto.subtle.importKey("jwk", key, {
+				name: "ECDSA",
+				namedCurve: "P-256"
+			}, false, ["verify"]);
+			return await crypto.subtle.verify({
+				name: "ECDSA",
+				hash: "SHA-256"
+			}, cryptoKey, signature, data);
+		}
+		return false;
+	} catch {
+		return false;
+	}
+}
+async function loadDirectory(fetchFn, directoryUrl) {
+	const response = await fetchFn(directoryUrl, {
+		headers: { accept: "application/http-message-signatures-directory+json, application/json" },
+		signal: timeoutSignal(DIRECTORY_TIMEOUT_MS)
+	});
+	if (!response.ok) throw new TypeError("directory fetch failed");
+	const body = await response.json();
+	if (body === null || typeof body !== "object" || Array.isArray(body)) return [];
+	const keys = body.keys;
+	if (!Array.isArray(keys)) return [];
+	return keys.filter(isWebBotAuthJwk);
+}
+function isWebBotAuthJwk(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function splitTopLevel(input, separator) {
+	const parts = [];
+	let current = "";
+	let quotes = false;
+	let depth = 0;
+	for (const char of input) {
+		if (char === "\"" && depth === 0) {
+			quotes = !quotes;
+			current += char;
+			continue;
+		}
+		if (!quotes && char === "(") {
+			depth += 1;
+			current += char;
+			continue;
+		}
+		if (!quotes && char === ")" && depth > 0) {
+			depth -= 1;
+			current += char;
+			continue;
+		}
+		if (!quotes && depth === 0 && char === separator) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	if (current !== "") parts.push(current);
+	return parts;
+}
+function unquote(value) {
+	if (!value.startsWith("\"")) return value;
+	if (!value.endsWith("\"") || value.length < 2) return;
+	return value.slice(1, -1).replaceAll("\\\"", "\"");
+}
+function decodeSfBytes(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith(":") || !trimmed.endsWith(":") || trimmed.length < 2) return;
+	try {
+		const binary = atob(trimmed.slice(1, -1));
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+		return bytes;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/server/evaluations.ts
+const DENIED = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant"
+	}],
+	alternatives: []
+};
+function permissionOf(tree, item) {
+	const action = typeof item.action?.name === "string" ? item.action.name : void 0;
+	if (action === void 0) return;
+	const byKey = findPermission(tree, action);
+	if (byKey !== void 0) return byKey;
+	const resource = typeof item.resource?.type === "string" ? item.resource.type : void 0;
+	if (resource === void 0) return;
+	const dotted = findPermission(tree, `${resource}.${action}`);
+	if (dotted !== void 0) return dotted;
+	return listPermissions(tree).find((leaf) => leaf.resource === resource && leaf.action === action);
+}
+function resourceData(item) {
+	const properties = item.resource?.properties;
+	if (properties !== null && typeof properties === "object") return properties;
+	const id = item.resource?.id;
+	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
+}
+function resourceRef(permission, item, data) {
+	const fromRow = data !== null && typeof data === "object" && "id" in data ? data.id : void 0;
+	const fromWire = item.resource?.id;
+	const id = typeof fromRow === "string" || typeof fromRow === "number" ? String(fromRow) : typeof fromWire === "string" || typeof fromWire === "number" ? String(fromWire) : void 0;
+	return compact({
+		type: permission.resource,
+		id
+	});
+}
+function evaluationRow(decision) {
+	switch (decision.outcome) {
+		case "granted": return {
+			decision: true,
+			context: {
+				outcome: "granted",
+				permdock: decision
+			}
+		};
+		case "denied": return {
+			decision: false,
+			context: {
+				outcome: "denied",
+				permdock: {
+					...decision,
+					denials: wireDenials(decision.denials)
+				}
+			}
+		};
+		case "approval-required": return {
+			decision: false,
+			context: {
+				outcome: "approval-required",
+				permdock: decision
+			}
+		};
+		default: return decision;
+	}
+}
+function applyApprovalResume(decision, permission, permdock, store, request, resource, adapter) {
+	return resumeDecision({
+		decision,
+		permission,
+		subject: permdock.subject,
+		store,
+		resource,
+		adapter,
+		token: readApprovalHeader(request.headers)
+	});
+}
+function evaluateOne(policy, permdock, item, store, header, adapter) {
+	const permission = permissionOf(policy.permissions, item);
+	if (permission === void 0) return Promise.resolve(DENIED);
+	const data = resourceData(item);
+	const decide = permdock.decide;
+	const decision = decide(permission, data, compact({
+		source: "endpoint",
+		adapter,
+		trusted: false,
+		boundary: "decision-endpoint"
+	}));
+	return resumeDecision({
+		decision,
+		permission,
+		subject: permdock.subject,
+		store,
+		resource: resourceRef(permission, item, data),
+		adapter,
+		token: header,
+		consume: false
+	});
+}
+async function resolvePermdock(options, request, tenant) {
+	if (options.resolve !== void 0) {
+		const permdock = await options.resolve(request);
+		return tenant === void 0 ? permdock : permdock.tenant(tenant);
+	}
+	if (options.getPermDock !== void 0) return options.getPermDock(tenant === void 0 ? void 0 : { tenant });
+	throw new TypeError("evaluations handler needs resolve or getPermDock");
+}
+function createEvaluationsHandler(options) {
+	const adapter = options.adapter ?? "server";
+	const maxEvaluations = options.maxEvaluations ?? 256;
+	const POST = async (request) => {
+		let body;
+		try {
+			body = await request.json();
+		} catch {
+			return validationProblem("evaluations body was not valid JSON");
+		}
+		if (body === null || typeof body !== "object" || Array.isArray(body)) return validationProblem("evaluations body must be an object");
+		const evaluations = body.evaluations;
+		if (evaluations === void 0) return validationProblem("evaluations array is required");
+		if (!Array.isArray(evaluations)) return validationProblem("evaluations must be an array");
+		if (evaluations.length > maxEvaluations) return batchTooLarge(maxEvaluations);
+		const header = readApprovalHeader(request.headers);
+		let permdock;
+		try {
+			permdock = await resolvePermdock(options, request);
+		} catch (error) {
+			if (error instanceof InvalidSignatureError) return error.response;
+			throw error;
+		}
+		const rows = await Promise.all(evaluations.map(async (item) => {
+			const entry = item !== null && typeof item === "object" ? item : {};
+			return evaluationRow(await evaluateOne(options.policy, permdock, entry, options.store, header, adapter));
+		}));
+		return Response.json({ evaluations: rows });
+	};
+	const GET = async (request) => {
+		const url = new URL(request.url);
+		if (url.pathname.includes("authzen-configuration")) {
+			const origin = url.origin;
+			return Response.json({
+				policy_decision_point: origin,
+				access_evaluation_endpoint: `${origin}/access/v1/evaluation`,
+				access_evaluations_endpoint: `${origin}/access/v1/evaluations`
+			});
+		}
+		const tenant = url.searchParams.get("tenant") ?? void 0;
+		let permdock;
+		try {
+			permdock = await resolvePermdock(options, request, tenant);
+		} catch (error) {
+			if (error instanceof InvalidSignatureError) return error.response;
+			throw error;
+		}
+		const snapshot = permdock.snapshot();
+		return Response.json(await Promise.resolve(snapshot));
+	};
+	return {
+		POST,
+		GET
+	};
+}
+//#endregion
+export { invalidSignatureProblem as a, discoverViaSignatureAgent as i, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t };