permdock 0.0.0 → 0.1.0

package/dist/from-snapshot-BMGnhmgv.js

@@ -0,0 +1,552 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { g as listPermissions } from "./permissions-DC7GROPA.js";
+import { a as resolveScope, f as tenantOf, i as normalizeMemberships, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { T as synthesiseRole, b as findRole, l as matchGrantee, w as listRoles } from "./grantee-Bv04_Vzf.js";
+import { a as approvalMessage, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+import { a as whereFromGrants, f as resourceIdOf, g as evaluateCondition, h as simulateArazzo, m as isArazzoSimulateInput, o as decisionToken, s as payloadDigest, u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { d as rowInScope, i as isMembershipExpired, m as pickVisible, p as grantCoversField, r as inTeam, s as nowSeconds, t as isActive, u as resolveActiveTenant } from "./validity-D0uRmJKJ.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+//#region src/core/snapshot-evaluate.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+function coveredByInclude(snapshot, permission) {
+	const include = snapshot.include;
+	if (include === void 0 || include.length === 0) return true;
+	return include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+}
+function rowId(data) {
+	if (data === null || typeof data !== "object") return "*";
+	const id = data["id"];
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+}
+function scopeOk(snapshot, grant, permission, subject, data, team, now) {
+	const scope = grant.scope;
+	if (scope === void 0) return { ok: true };
+	const principal = subject.principal;
+	const membership = grant.membership;
+	if (principal === null || membership === void 0) return {
+		ok: false,
+		reason: "no-membership"
+	};
+	if (isMembershipExpired(membership, now)) return {
+		ok: false,
+		reason: "expired-membership"
+	};
+	if (typeof scope === "string") {
+		const scopes = scopeList(snapshot.scopes);
+		if (membership.scope !== scope || !scopes.some((entry) => entry.name === scope)) return {
+			ok: false,
+			reason: "scope"
+		};
+		if (!activeFor(membership, scopes, principal.tenant)) return {
+			ok: false,
+			reason: principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
+		};
+		if (!inTeam(membership, scopes, team)) return {
+			ok: false,
+			reason: "scope"
+		};
+		if (permission.kind !== "instance" && (data === null || typeof data !== "object")) return { ok: true };
+		const partitioned = (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true;
+		return rowInScope(membership, scopes, data !== null && typeof data === "object" ? data : {}, partitioned);
+	}
+	const on = membership.on;
+	if (on === void 0 || on.resource !== scope.resource || on.resource !== permission.resource) return {
+		ok: false,
+		reason: "scope"
+	};
+	if (on.id !== rowId(data)) return {
+		ok: false,
+		reason: "scope"
+	};
+	return { ok: true };
+}
+function conditionOk(grant, permission, current, next, subject, now, scopes) {
+	let opaqueReached = false;
+	const onOpaque = () => {
+		opaqueReached = true;
+	};
+	if (grant.portable === false) return {
+		matched: false,
+		reason: "opaque-condition"
+	};
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection" || current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		const matched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
+		if (opaqueReached) return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	const check = grant.check;
+	if (check !== void 0) {
+		if (check.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(check, next, subject, now, scopes, void 0, onOpaque);
+		if (opaqueReached) return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
+}
+function matchedOf(grant) {
+	return compact({
+		role: grant.role,
+		permission: grant.permission,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval
+	});
+}
+function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
+	const now = options.now ?? nowSeconds();
+	const tracer = options.explain === true ? {
+		evaluated: 0,
+		allows: [],
+		denies: [],
+		skipped: []
+	} : void 0;
+	const done = (decision) => freezeDeep(tracer === void 0 ? decision : {
+		...decision,
+		trace: {
+			evaluated: tracer.evaluated,
+			allows: tracer.allows,
+			denies: tracer.denies,
+			skipped: tracer.skipped
+		}
+	});
+	const skip = (grant, why) => {
+		tracer?.skipped.push({
+			role: grant.role,
+			permission: grant.permission,
+			effect: grant.effect,
+			why
+		});
+	};
+	if (!coveredByInclude(snapshot, permission)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "opaque-condition"
+		}],
+		alternatives: []
+	});
+	let current = data;
+	let next = data;
+	if (permission.kind === "instance" && isRowPair(data)) {
+		current = data.current;
+		next = data.next;
+	}
+	if (permission.kind === "collection") {
+		current = void 0;
+		next = data;
+	}
+	const denials = [];
+	const allows = [];
+	for (const grant of snapshot.grants) {
+		if (grant.permission !== permission.key) continue;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		const match = matchGrantee(grant.to, subject, now, void 0, void 0, void 0, grant.effect === "deny");
+		if (!match.matched) {
+			denials.push(compact({
+				role: grant.role,
+				reason: match.reason ?? "no-grant",
+				to: grant.to
+			}));
+			continue;
+		}
+		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now);
+		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now);
+		if (!scoped.ok) {
+			denials.push(compact({
+				role: grant.role,
+				reason: scoped.reason,
+				to: grant.to
+			}));
+			continue;
+		}
+		if (!isActive(grant.validity, now)) {
+			if (grant.effect === "allow") denials.push({
+				role: grant.role,
+				reason: "inactive-grant",
+				detail: grant.validity
+			});
+			else skip(grant, "validity");
+			continue;
+		}
+		if (grant.effect === "deny" && grant.portable === false) {
+			if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+				skip(grant, "field");
+				continue;
+			}
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "opaque-condition"
+				}],
+				alternatives: []
+			});
+		}
+		const condition = conditionOk(grant, permission, current, next, subject, now, scopeList(snapshot.scopes));
+		if (!condition.matched && grant.effect === "deny" && condition.reason === "opaque-condition" && grantCoversField(grant.fields, options.field, grant.effect)) {
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "opaque-condition"
+				}],
+				alternatives: []
+			});
+		}
+		if (!condition.matched) {
+			denials.push({
+				role: grant.role,
+				reason: condition.reason ?? "condition"
+			});
+			continue;
+		}
+		if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+			skip(grant, "field");
+			continue;
+		}
+		if (grant.effect === "deny") {
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "deny"
+				}],
+				alternatives: []
+			});
+		}
+		tracer?.allows.push(matchedOf(grant));
+		allows.push(grant);
+	}
+	const [matched] = allows;
+	if (matched === void 0) {
+		for (const entry of snapshot.notEntitled ?? []) if (entry.permission === permission.key) denials.push({
+			role: entry.role,
+			reason: "not-entitled",
+			to: entry.to
+		});
+		return done({
+			outcome: "denied",
+			denials: denials.length > 0 ? denials : [{
+				role: null,
+				reason: subject.principal === null ? "anonymous" : "no-grant"
+			}],
+			alternatives: []
+		});
+	}
+	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "not-delegated"
+		}],
+		alternatives: []
+	});
+	const miss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), subject.actor !== void 0 && snapshot.delegated === void 0);
+	if (miss !== void 0) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: miss
+		}],
+		alternatives: []
+	});
+	const resourceId = permission.kind === "collection" ? "*" : rowId(current);
+	const token = decisionToken({
+		key: permission.key,
+		resourceId,
+		principal: subject.principal,
+		actor: subject.actor,
+		fingerprint: `snapshot:${String(snapshot.issuedAt)}`,
+		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+	});
+	const grant = matchedOf(matched);
+	if (requiresApproval(matched.approval)) return done({
+		outcome: "approval-required",
+		grant,
+		reason: "human",
+		token
+	});
+	return done({
+		outcome: "granted",
+		subject,
+		matched: grant,
+		token
+	});
+}
+function whereFromSnapshot(snapshot, subject, permission, team) {
+	return whereFromGrants(snapshot.grants.filter((grant) => grant.permission === permission.key), {
+		resource: permission.resource,
+		scopes: scopeList(snapshot.scopes),
+		partitioned: (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true,
+		tenant: subject.principal?.tenant,
+		team,
+		now: nowSeconds(),
+		subject
+	});
+}
+//#endregion
+//#region src/core/snapshot-subject.ts
+function subjectFromSnapshot(snapshot, tenant) {
+	const principal = snapshot.subject.principal;
+	const nextTenant = principal === null ? void 0 : tenant === void 0 ? principal.tenant : resolveActiveTenant(compact({
+		...principal,
+		memberships: principal.memberships ?? []
+	}), tenant, scopeList(snapshot.scopes));
+	return freezeDeep(compact({
+		principal: principal === null ? null : compact({
+			...principal,
+			tenant: nextTenant
+		}),
+		delegation: snapshot.subject.delegation,
+		context: snapshot.subject.context,
+		expiresAt: snapshot.expiresAt
+	}));
+}
+/**
+* Role names held in `tenant`, or only on memberships of one `scope` (and
+* instance `id`), ordered like `rank` (the snapshot's ranked `roles`).
+*/
+function heldRoleNames(subject, tenant, scopes, only, now) {
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal?.roles ?? [] : []);
+	for (const membership of subject.principal?.memberships ?? []) {
+		if (isMembershipExpired(membership, now)) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || membership.id === only.id))) continue;
+		for (const role of membership.roles) names.add(role);
+	}
+	const rank = only?.rank ?? [];
+	const position = (name) => {
+		const index = rank.indexOf(name);
+		return index === -1 ? rank.length : index;
+	};
+	return [...names].toSorted((a, b) => position(a) - position(b));
+}
+//#endregion
+//#region src/core/from-snapshot.ts
+function resourceRef(permission, data) {
+	const id = permission.kind === "collection" ? void 0 : rowId(data);
+	return id === void 0 || id === "*" ? { type: permission.resource } : {
+		type: permission.resource,
+		id
+	};
+}
+function assignableEntry(snapshot, tenant) {
+	if (tenant === void 0) return;
+	return snapshot.assignable?.find((entry) => entry.tenant === tenant);
+}
+function fromSnapshot(snapshot, options = {}) {
+	const subject = subjectFromSnapshot(snapshot, options.tenant);
+	const team = options.team;
+	const run = (permission, data, decideOptions = {}) => evaluateSnapshot(snapshot, subject, permission, data, team, decideOptions);
+	const decide = ((permission, data, decideOptions = {}) => run(permission, data, decideOptions));
+	const can = ((permission, data, decideOptions) => run(permission, data, decideOptions).outcome === "granted");
+	const assert = ((permission, data, decideOptions) => {
+		const decision = run(permission, data, decideOptions);
+		if (decision.outcome === "granted") return decision;
+		if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef(permission, data),
+			message: approvalMessage(permission.key, decision.reason, decision.token)
+		});
+		throw new PermDockDeniedError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef(permission, data),
+			subject,
+			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, [])
+		});
+	});
+	const explain = ((permission, data, decideOptions) => run(permission, data, {
+		...decideOptions,
+		source: decideOptions?.source ?? "explain",
+		explain: true
+	}));
+	const instance = {
+		can,
+		decide,
+		assert,
+		explain,
+		permissions: {},
+		roles: snapshot.vocabulary?.roles ?? {},
+		plans: snapshot.vocabulary?.plans ?? {},
+		filter(permission, rows, decideOptions) {
+			return rows.filter((row) => can(permission, row, decideOptions) === true);
+		},
+		pick(permission, row, decideOptions) {
+			if (row === null || typeof row !== "object") return {};
+			if (can(permission, row, decideOptions) !== true) return {};
+			return pickVisible(row, (field) => {
+				const next = compact({
+					...decideOptions,
+					field
+				});
+				return can(permission, row, next) === true;
+			});
+		},
+		where(permission) {
+			return whereFromSnapshot(snapshot, subject, permission, team);
+		},
+		actions(resource, data, decideOptions) {
+			return listPermissions(resource).filter((item) => run(item, data, decideOptions).outcome === "granted");
+		},
+		simulate: ((input, simulateOptions) => {
+			if (Array.isArray(input)) return input.map(([permission, data]) => run(permission, data, compact({ now: simulateOptions?.now })));
+			if (isArazzoSimulateInput(input)) return simulateArazzo(input, input.permissions, (permission, data) => run(permission, data));
+			const preview = input;
+			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+			return fromSnapshot(freezeDeep({
+				...snapshot,
+				simulated: true,
+				subject: {
+					...snapshot.subject,
+					principal: snapshot.subject.principal === null ? null : compact({
+						...snapshot.subject.principal,
+						roles: previewRoles ?? snapshot.subject.principal.roles,
+						memberships: preview.memberships === void 0 ? snapshot.subject.principal.memberships : normalizeMemberships(preview.memberships, scopeList(snapshot.scopes)),
+						tenant: preview.tenant ?? snapshot.subject.principal.tenant
+					})
+				}
+			}), options);
+		}),
+		snapshot() {
+			return snapshot;
+		},
+		on() {
+			return () => void 0;
+		},
+		tenant(id) {
+			return fromSnapshot(snapshot, compact({
+				tenant: id,
+				team
+			}));
+		},
+		team(id) {
+			return fromSnapshot(snapshot, compact({
+				tenant: options.tenant,
+				team: id
+			}));
+		},
+		memberships() {
+			return subject.principal?.memberships ?? [];
+		},
+		tenants() {
+			return snapshot.tenants;
+		},
+		heldRoles(query) {
+			const names = heldRoleNames(subject, query?.tenant ?? subject.principal?.tenant, scopeList(snapshot.scopes), compact({
+				scope: query?.scope,
+				id: query?.id,
+				rank: snapshot.roles
+			}));
+			const tree = snapshot.vocabulary?.roles;
+			return names.map((name) => findRole(tree, name) ?? synthesiseRole(name));
+		},
+		audiences() {
+			const tenant = subject.principal?.tenant;
+			if (tenant === snapshot.subject.principal?.tenant) return snapshot.audiences ?? [];
+			const tree = snapshot.vocabulary?.roles;
+			const out = [];
+			for (const name of heldRoleNames(subject, tenant, scopeList(snapshot.scopes), { rank: snapshot.roles })) {
+				const audience = findRole(tree, name)?.meta.audience;
+				if (typeof audience === "string" && !out.includes(audience)) out.push(audience);
+			}
+			return out;
+		},
+		loadRelations() {
+			return Promise.resolve();
+		},
+		whoCan(permission) {
+			return Promise.resolve(freezeDeep({
+				permission: permission.key,
+				holders: [],
+				complete: false
+			}));
+		},
+		decideRoleChange(change) {
+			return freezeDeep({
+				outcome: "denied",
+				change,
+				denials: [{
+					role: null,
+					reason: "unsupported"
+				}]
+			});
+		},
+		activate() {
+			return freezeDeep({
+				outcome: "denied",
+				denials: [{
+					role: null,
+					reason: "unsupported"
+				}],
+				alternatives: []
+			});
+		},
+		assignableRoles(query) {
+			const tenant = query?.tenant ?? subject.principal?.tenant;
+			const tree = snapshot.vocabulary?.roles;
+			if (snapshot.assignable !== void 0) return (assignableEntry(snapshot, tenant)?.roles ?? []).map((name) => findRole(tree, name) ?? synthesiseRole(name, { assignable: true }));
+			const names = new Set(heldRoleNames(subject, tenant, scopeList(snapshot.scopes)));
+			return listRoles(tree).filter((leaf) => leaf.assignable && names.has(leaf.key));
+		},
+		assignablePermissions(query) {
+			if (query?.scope === "global") return [];
+			return assignableEntry(snapshot, query?.tenant ?? subject.principal?.tenant)?.permissions ?? [];
+		},
+		subject
+	};
+	return Object.freeze(instance);
+}
+function emptySnapshot() {
+	return freezeDeep({
+		v: 1,
+		issuedAt: 0,
+		subject: {
+			principal: null,
+			context: {}
+		},
+		roles: [],
+		grants: [],
+		tenants: []
+	});
+}
+//#endregion
+export { fromSnapshot as n, emptySnapshot as t };