permdock 0.0.0 → 0.1.0

package/dist/index-CltcQ4Bf.d.ts

@@ -0,0 +1,138 @@
+import { Mn as Decision, Tt as TokenSigner, ft as RelationSource, hr as Subject, pr as Membership } from "./policy-CInmNGkM.js";
+import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
+import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, r as ApprovalCancelMeta } from "./types-B8w5PFtS.js";
+//#region src/approvals/errors.d.ts
+type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
+declare class ApprovalError extends Error {
+  override readonly name: "ApprovalError";
+  readonly code: ApprovalErrorCode;
+  constructor(code: ApprovalErrorCode, message: string);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+declare function isApprovalError(value: unknown): value is ApprovalError;
+//#endregion
+//#region src/approvals/handler.d.ts
+type ApprovalsHandlerOptions = {
+  readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
+  /** Refuse the principal even on grants that set `approval: { distinct: false }`. */
+  readonly requireDistinctApprover?: boolean;
+  readonly signer?: TokenSigner;
+  readonly audience?: string | readonly string[];
+  /** Where `relation()` approvers are read, by the request's resource id; without it they match nobody. */
+  readonly relations?: RelationSource;
+  /** The policy's permission tree, for `through` links and `includes` on relation approvers. */
+  readonly permissions?: PermissionTree;
+};
+declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/approvals/relations.d.ts
+type ApproverRelationsOptions = {
+  /** The object graph relation approvers are read from; without it they match nobody. */
+  readonly relations?: RelationSource;
+  /** The permission tree the policy declares; needed to follow `through` links and `includes`. */
+  readonly permissions?: PermissionTree;
+  readonly now?: Date;
+};
+/**
+ * The relation approvers of `request` that `subject` holds on its resource,
+ * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
+ * through `relations` by the request's resource id; a request without an id,
+ * a missing source or a read that fails holds nothing.
+ */
+declare function approverRelations(request: ApprovalRequest, subject: Subject, options: ApproverRelationsOptions): Promise<readonly string[]>;
+//#endregion
+//#region src/approvals/helpers.d.ts
+declare function summariseSubject(subject: Subject): ApprovalRequest["subject"];
+declare function requestApproval(store: ApprovalStore, decision: Extract<Decision, {
+  readonly outcome: "approval-required";
+}>, meta: {
+  readonly permission: Permission | {
+    readonly key: string;
+    readonly scope: string;
+    readonly resource: string;
+  };
+  readonly resource?: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly subject: Subject;
+  readonly membership?: Membership;
+  readonly adapter?: string;
+  readonly ttl?: number;
+  readonly now?: Date;
+  readonly detail?: string;
+}): Promise<ApprovalRequest>;
+/**
+ * Checks `verdict.by` and resolves the request. Relation approvers are read
+ * through `options.relations` unless `verdict.relations` is already set.
+ */
+declare function resolveApproval(store: ApprovalStore, token: string, verdict: ApprovalVerdict, options?: ApproverRelationsOptions & {
+  readonly requireDistinctApprover?: boolean;
+}): Promise<ApprovalRequest>;
+declare function inspectApproval(store: ApprovalStore, token: string, now?: Date): Promise<ApprovalInspectResult>;
+/** Inspects `token` and, when it is approved, consumes it so it resumes once. */
+declare function consumeApproval(store: ApprovalStore, token: string, now?: Date): Promise<ApprovalInspectResult>;
+/**
+ * Applies a resume token to a decision. The token only matters when the
+ * decision is `approval-required` and the token is the one this call was
+ * issued; otherwise a new approval is requested. A matching token is consumed
+ * unless `consume` is `false`, so an approval resumes exactly one call. Under
+ * `staleOn: 'resource-change'`, a token issued for an earlier version of the
+ * same row denies with `stale-approval`; the next call without it asks again.
+ */
+declare function resumeDecision(input: {
+  readonly decision: Decision;
+  readonly permission: Permission | {
+    readonly key: string;
+    readonly scope: string;
+    readonly resource: string;
+  };
+  readonly subject: Subject;
+  readonly store: ApprovalStore | undefined;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly adapter: string;
+  readonly token: string | undefined;
+  /** `false` for checks that do not run the action, such as the decision endpoint. */
+  readonly consume?: boolean;
+  readonly now?: Date;
+}): Promise<Decision>;
+declare function cancelApprovals(store: ApprovalStore, filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number>;
+declare function readApprovalHeader(headers: Headers | {
+  readonly get: (name: string) => string | null;
+}): string | undefined;
+declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
+  readonly get: (name: string) => string | null;
+}, now?: Date): Promise<ApprovalInspectResult>;
+//#endregion
+//#region src/approvals/store.d.ts
+/**
+ * Refuses `by` as an approver of `request`, or returns the index of the
+ * stage the approval counts for (`undefined` without `stages`). Eligibility
+ * is `approvers.by` or, under `stages`, the first incomplete stage
+ * (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
+ * is eligible too once the request has waited `escalation.after`. A
+ * principal who already approved is refused, so one person never completes
+ * two stages. `relations` are the relation approvers `by` holds on the
+ * request's resource (see `ApprovalVerdict.relations`).
+ */
+declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, now?: Date, relations?: readonly string[]): number | undefined;
+/**
+ * The request after `verdict`, for a store to persist: a rejection resolves
+ * it; an approval is appended to `approvals` and resolves it once there are
+ * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
+ * is not pending, has expired or `verdict.by` may not approve it. Stores
+ * should write the result only when the stored row is still pending with the
+ * same number of approvals, so two approvers racing both count.
+ */
+declare function applyApprovalVerdict(request: ApprovalRequest, verdict: ApprovalVerdict, now?: Date): ApprovalRequest;
+type MemoryApprovalStore = ApprovalStore & {
+  readonly ttl: number;
+};
+declare function memoryApprovalStore(options?: {
+  readonly ttl?: number;
+}): MemoryApprovalStore;
+//#endregion
+export { approvalsHandler as _, cancelApprovals as a, isApprovalError as b, readApprovalHeader as c, resumeDecision as d, resumeFromHeader as f, ApprovalsHandlerOptions as g, approverRelations as h, memoryApprovalStore as i, requestApproval as l, ApproverRelationsOptions as m, applyApprovalVerdict as n, consumeApproval as o, summariseSubject as p, assertApprover as r, inspectApproval as s, MemoryApprovalStore as t, resolveApproval as u, ApprovalError as v, ApprovalErrorCode as y };

package/dist/index-LF_hS-yn.d.ts

@@ -0,0 +1,177 @@
+import { $ as DecisionSink, Et as TokenVerifier, ct as MembershipSource } from "./policy-CInmNGkM.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+//#region src/scim/types.d.ts
+declare const SCIM_CONTENT_TYPE = "application/scim+json";
+declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+declare const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+declare const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+declare const ROLES_EXTENSION = "urn:permdock:scim:schemas:extension:roles:1.0";
+type DirectoryMeta = {
+  readonly created: string;
+  readonly lastModified: string;
+  readonly location?: string;
+  readonly resourceType?: "User" | "Group";
+};
+type DirectoryEmail = {
+  readonly value: string;
+  readonly primary?: boolean;
+  readonly type?: string;
+};
+type DirectoryUser = {
+  readonly id: string;
+  readonly externalId?: string;
+  readonly userName: string;
+  readonly active: boolean;
+  readonly emails?: readonly DirectoryEmail[];
+  readonly meta: DirectoryMeta;
+};
+type DirectoryGroupMember = {
+  readonly value: string;
+};
+type DirectoryGroup = {
+  readonly id: string;
+  readonly externalId?: string;
+  readonly displayName: string;
+  readonly members: readonly DirectoryGroupMember[];
+  readonly roles?: readonly string[];
+  readonly meta: DirectoryMeta;
+};
+type ScimCompareOp = "eq" | "ne" | "co" | "sw";
+type ScimFilter = {
+  readonly op: ScimCompareOp;
+  readonly attribute: string;
+  readonly value: string | boolean;
+} | {
+  readonly op: "pr";
+  readonly attribute: string;
+} | {
+  readonly op: "and" | "or";
+  readonly filters: readonly ScimFilter[];
+};
+type ScimPage = {
+  readonly startIndex?: number;
+  readonly count?: number;
+  readonly cursor?: string;
+};
+type ScimPageResult<T> = {
+  readonly Resources: readonly T[];
+  readonly totalResults: number;
+  readonly startIndex?: number;
+  readonly itemsPerPage?: number;
+  readonly nextCursor?: string;
+};
+type ScimPatchOp = {
+  readonly op: "add" | "replace" | "remove";
+  readonly path?: string;
+  readonly value?: unknown;
+};
+type DirectoryStore = {
+  getUser(tenant: string, id: string): Promise<DirectoryUser | null>;
+  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryUser>>;
+  putUser(tenant: string, user: DirectoryUser): Promise<DirectoryUser>;
+  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryUser>;
+  deleteUser(tenant: string, id: string): Promise<void>;
+  getGroup(tenant: string, id: string): Promise<DirectoryGroup | null>;
+  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup(tenant: string, group: DirectoryGroup): Promise<DirectoryGroup>;
+  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryGroup>;
+  deleteGroup(tenant: string, id: string): Promise<void>;
+  groupsFor(tenant: string, userId: string): Promise<readonly DirectoryGroup[]>;
+};
+type ScimTokenOptions = {
+  readonly hash: "sha256";
+  readonly lookup: (tenant: string) => string | undefined | Promise<string | undefined>;
+};
+type DirectoryChange = {
+  readonly tenant: string;
+  readonly userIds: readonly string[];
+  /** `session-revoked` when a user was deactivated or deleted; `changed` otherwise. */
+  readonly kind: "session-revoked" | "changed";
+};
+type ScimHandlerOptions = {
+  readonly store: DirectoryStore;
+  readonly tenant: string | ((request: Request) => string | Promise<string>);
+  readonly token?: ScimTokenOptions;
+  readonly verifier?: TokenVerifier;
+  readonly audience?: string;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly assignable?: readonly string[];
+  readonly sink?: DecisionSink;
+  readonly onChange?: (change: DirectoryChange) => void | Promise<void>;
+  /**
+   * Publishes for each affected user's id, `externalId` and `userName`:
+   * `session-revoked` when a user is deactivated (`active: false`) or
+   * deleted, so open connections end; `changed` otherwise, so they revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly onUnknownRole?: (name: string) => void;
+};
+type DirectoryMembershipMatch = "externalId" | "userName" | "either";
+type DirectoryMembershipSourceOptions = {
+  readonly match?: DirectoryMembershipMatch;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly assignable?: readonly string[];
+  readonly onUnknownRole?: (name: string) => void;
+};
+declare class DirectoryUniquenessError extends Error {
+  override readonly name = "DirectoryUniquenessError";
+  readonly code: "uniqueness";
+  constructor(message?: string);
+}
+declare class DirectoryNotFoundError extends Error {
+  override readonly name = "DirectoryNotFoundError";
+  readonly code: "not-found";
+  constructor(message?: string);
+}
+//#endregion
+//#region src/scim/auth.d.ts
+type ScimCredential = {
+  readonly kind: "token";
+} | {
+  readonly kind: "jwt";
+  readonly iss?: string;
+};
+type ScimAuthResult = {
+  readonly ok: true;
+  readonly credential: ScimCredential;
+} | {
+  readonly ok: false;
+  readonly status: 401 | 403;
+};
+declare function authenticateScim(input: {
+  readonly request: Request;
+  readonly tenant: string;
+  readonly audience?: string;
+  readonly token?: ScimTokenOptions;
+  readonly verifier?: TokenVerifier;
+}): Promise<ScimAuthResult>;
+declare function sha256Hex(value: string): string;
+//#endregion
+//#region src/scim/discovery.d.ts
+declare function serviceProviderConfig(): Record<string, unknown>;
+declare function resourceTypes(): readonly Record<string, unknown>[];
+declare function schemas(): readonly Record<string, unknown>[];
+//#endregion
+//#region src/scim/filter.d.ts
+declare function parseScimFilter(input: string): ScimFilter | undefined;
+declare function matchFilter(target: DirectoryUser | DirectoryGroup | Record<string, unknown>, filter: ScimFilter | undefined): boolean;
+declare function filterSupported(filter: ScimFilter): boolean;
+//#endregion
+//#region src/scim/handler.d.ts
+declare function scimHandler(options: ScimHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/scim/route.d.ts
+declare function tenantFromPath(request: Request): string;
+//#endregion
+//#region src/scim/patch.d.ts
+declare function normalizePatchOps(ops: readonly unknown[]): readonly ScimPatchOp[] | undefined;
+//#endregion
+//#region src/scim/source.d.ts
+declare function directoryMembershipSource(store: DirectoryStore, options?: DirectoryMembershipSourceOptions): MembershipSource;
+//#endregion
+//#region src/scim/store.d.ts
+declare function memoryDirectoryStore(): DirectoryStore;
+//#endregion
+export { ScimPageResult as A, LIST_SCHEMA as C, ScimFilter as D, SCIM_CONTENT_TYPE as E, ScimTokenOptions as M, USER_SCHEMA as N, ScimHandlerOptions as O, GROUP_SCHEMA as S, ROLES_EXTENSION as T, DirectoryNotFoundError as _, scimHandler as a, DirectoryUser as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryMembershipSourceOptions as g, DirectoryGroup as h, tenantFromPath as i, ScimPatchOp as j, ScimPage as k, resourceTypes as l, DirectoryChange as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryStore as v, PATCH_SCHEMA as w, ERROR_SCHEMA as x, DirectoryUniquenessError as y };

package/dist/index-fG6NSXlc.d.ts

@@ -0,0 +1,9 @@
+import { C as Policy, mr as Principal } from "./policy-CInmNGkM.js";
+import { a as ReplayStore, f as SsfPermDock, p as SsfPermDockOptions } from "./types-i4BAOvdb.js";
+//#region src/ssf/create.d.ts
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
+//#endregion
+//#region src/ssf/replay.d.ts
+declare function memoryReplayStore(): ReplayStore;
+//#endregion
+export { createPermDock as n, memoryReplayStore as t };