permdock 0.0.0 → 0.1.0

package/dist/saas-BRrZzJkM.js

@@ -0,0 +1,1193 @@
+import { r as principal } from "./refs-ChLSxbST.js";
+import { a as definePolicy, d as role, m as memoryLimitStore, o as deny, t as allow } from "./policy-ANp36PnI.js";
+import { m as memoryRoleSource } from "./src-CTNT-PBW.js";
+import { d as relation, n as anyone } from "./grantee-Bv04_Vzf.js";
+import { t as memoryRelations } from "./relations-r4soIFZB.js";
+import { i as quoteSqlLiteral } from "./sql-Bll1d7y0.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CofRqesP.js";
+//#region src/testing/saas/policy.ts
+function isSubject(user) {
+	return user !== null && "context" in user && "principal" in user;
+}
+const p = saasPermissions;
+const r = saasRoles;
+const readers = [
+	r.viewer,
+	r.member,
+	r.admin,
+	r.owner
+];
+const writers = [
+	r.member,
+	r.admin,
+	r.owner
+];
+const admins = [r.admin, r.owner];
+function each(list, build) {
+	return list.map((to) => build(to));
+}
+/** Daily API-key quota per subject; the bucket should be per tenant too. */
+const SAAS_API_KEY_LIMIT = 5;
+const saasPolicy = definePolicy({
+	permissions: saasPermissions,
+	roles: saasRoles,
+	plans: saasPlans
+}, {
+	scopes: {
+		tenant: { key: "orgId" },
+		team: {
+			key: "teamId",
+			within: "tenant"
+		}
+	},
+	subject: (user) => isSubject(user) ? user.principal : user,
+	roles: [role(r.lead, [allow(p.doc.update, { to: r.lead }), deny(p.doc.update, (doc) => doc.locked)]), role(r.collaborator, [allow(p.project.update, { to: r.collaborator })], { on: p.project })],
+	grants: [
+		...each(readers, (to) => allow(p.project.read, { to })),
+		...each(readers, (to) => allow(p.project.list, { to })),
+		...each(readers, (to) => allow(p.integration.read, { to })),
+		...each(writers, (to) => allow(p.project.create, { to })),
+		allow(p.project.update, {
+			to: r.member,
+			where: { ownerId: principal.id }
+		}),
+		allow(p.project.delete, {
+			to: r.member,
+			where: { ownerId: principal.id }
+		}),
+		...each(admins, (to) => allow(p.project.update, { to })),
+		...each(admins, (to) => allow(p.project.delete, { to })),
+		...each(admins, (to) => allow(p.member.list, { to })),
+		...each(admins, (to) => allow(p.member.invite, { to })),
+		...each(admins, (to) => allow(p.member.assignRole, { to })),
+		...each(admins, (to) => allow(p.settings.manage, { to })),
+		...each(admins, (to) => allow(p.apiKey.manage, { to })),
+		...each(admins, (to) => allow(p.apiKey.create, {
+			to,
+			limit: {
+				count: 5,
+				per: "day"
+			}
+		})),
+		allow(p.apiKey.revokeAll, {
+			to: r.admin,
+			approval: {
+				by: r.owner,
+				distinct: true
+			}
+		}),
+		allow(p.apiKey.revokeAll, { to: r.owner }),
+		...each(admins, (to) => allow(p.analytics.read, { to: [to, saasPlans.pro] })),
+		...each(admins, (to) => allow(p.audit.read, { to: [to, saasPlans.pro] })),
+		...each(admins, (to) => allow(p.sso.manage, { to: [to, saasPlans.pro] })),
+		allow(p.billing.read, { to: r.owner }),
+		allow(p.billing.manage, { to: r.owner }),
+		deny(p.project.delete, {
+			to: anyone(),
+			where: { archived: true }
+		}),
+		...each(readers, (to) => allow(p.doc.read, { to })),
+		allow(p.doc.update, { to: relation(p.doc, "team") }),
+		...each(admins, (to) => allow(p.folder.read, { to })),
+		allow(p.folder.read, { to: relation(p.folder, "viewer", {
+			through: "parent",
+			depth: 8
+		}) }),
+		allow(p.folder.update, { to: relation(p.folder, "editor", {
+			through: "parent",
+			depth: 8
+		}) })
+	]
+});
+//#endregion
+//#region src/testing/saas/seed.ts
+/** Epoch seconds in the past, so the membership is expired for any clock. */
+const SAAS_EXPIRED_AT = 1e9;
+/**
+* Users, one hazard each:
+* - alice: admin in acme, viewer in globex (different role per org)
+* - bob: member in acme (owns p1, p3, p4)
+* - carol: owner in acme
+* - dave: custom `contractor` role in acme (includes member)
+* - erin: admin in acme AND globex (same role in two orgs)
+* - frank: expired acme membership
+* - mallory: no memberships at all
+* - gina: `lead` of team-a in acme
+* - hank: viewer in acme, `collaborator` on project p3 only
+* - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+* - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
+* - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+*
+* Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
+* (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
+* `eng`, frank's view of `root` expired.
+*/
+const saasSeed = Object.freeze({
+	orgs: [
+		{
+			id: "acme",
+			name: "Acme",
+			plan: "free",
+			customRoles: [{
+				tenant: "acme",
+				name: "contractor",
+				includes: ["member"]
+			}]
+		},
+		{
+			id: "globex",
+			name: "Globex",
+			plan: "pro",
+			customRoles: []
+		},
+		{
+			id: "org-1",
+			name: "Org One",
+			plan: "pro",
+			customRoles: []
+		},
+		{
+			id: "tenant-1",
+			name: "Tenant One",
+			plan: "pro",
+			customRoles: []
+		}
+	],
+	members: [
+		{
+			user: "alice",
+			tenant: "acme",
+			roles: ["admin"]
+		},
+		{
+			user: "alice",
+			tenant: "globex",
+			roles: ["viewer"]
+		},
+		{
+			user: "bob",
+			tenant: "acme",
+			roles: ["member"]
+		},
+		{
+			user: "carol",
+			tenant: "acme",
+			roles: ["owner"]
+		},
+		{
+			user: "dave",
+			tenant: "acme",
+			roles: ["contractor"]
+		},
+		{
+			user: "erin",
+			tenant: "acme",
+			roles: ["admin"]
+		},
+		{
+			user: "erin",
+			tenant: "globex",
+			roles: ["admin"]
+		},
+		{
+			user: "frank",
+			tenant: "acme",
+			roles: ["member"],
+			expiresAt: SAAS_EXPIRED_AT
+		},
+		{
+			user: "gina",
+			tenant: "acme",
+			roles: ["viewer"]
+		},
+		{
+			user: "gina",
+			tenant: "acme",
+			team: "team-a",
+			roles: ["lead"]
+		},
+		{
+			user: "hank",
+			tenant: "acme",
+			roles: ["viewer"]
+		},
+		{
+			user: "hank",
+			on: {
+				resource: "project",
+				id: "p3"
+			},
+			roles: ["collaborator"]
+		},
+		{
+			user: "user-2",
+			tenant: "org-1",
+			roles: ["member"]
+		},
+		{
+			user: "2",
+			tenant: "org-1",
+			roles: ["member"]
+		},
+		{
+			user: "tina",
+			tenant: "tenant-1",
+			roles: ["member"]
+		},
+		{
+			user: "ivan",
+			tenant: "acme",
+			roles: ["viewer", "lead"]
+		}
+	],
+	projects: [
+		{
+			id: "p1",
+			orgId: "acme",
+			ownerId: "bob",
+			name: "Rocket",
+			archived: false
+		},
+		{
+			id: "p2",
+			orgId: "acme",
+			ownerId: "alice",
+			name: "Anvil",
+			archived: false
+		},
+		{
+			id: "p3",
+			orgId: "acme",
+			ownerId: "bob",
+			name: "Magnet",
+			archived: false
+		},
+		{
+			id: "p4",
+			orgId: "acme",
+			ownerId: "bob",
+			name: "Old tunnel",
+			archived: true
+		},
+		{
+			id: "g1",
+			orgId: "globex",
+			ownerId: "alice",
+			name: "Hammock",
+			archived: false
+		},
+		{
+			id: "n1",
+			orgId: "org-1",
+			ownerId: "user-2",
+			name: "Numbered",
+			archived: false
+		},
+		{
+			id: "o1",
+			orgId: "org-1",
+			ownerId: "tina",
+			name: "Lookalike",
+			archived: false
+		}
+	],
+	docs: [
+		{
+			id: "d1",
+			orgId: "acme",
+			teamId: "team-a",
+			title: "Roadmap",
+			locked: false
+		},
+		{
+			id: "d2",
+			orgId: "acme",
+			teamId: "team-a",
+			title: "Signed contract",
+			locked: true
+		},
+		{
+			id: "d3",
+			orgId: "acme",
+			teamId: "team-b",
+			title: "Other team",
+			locked: false
+		}
+	],
+	folders: [
+		{
+			id: "root",
+			orgId: "acme",
+			parentId: null,
+			name: "Acme",
+			restricted: false
+		},
+		{
+			id: "eng",
+			orgId: "acme",
+			parentId: "root",
+			name: "Engineering",
+			restricted: false
+		},
+		{
+			id: "platform",
+			orgId: "acme",
+			parentId: "eng",
+			name: "Platform",
+			restricted: false
+		},
+		{
+			id: "infra",
+			orgId: "acme",
+			parentId: "platform",
+			name: "Infra",
+			restricted: false
+		},
+		{
+			id: "hr",
+			orgId: "acme",
+			parentId: "root",
+			name: "People",
+			restricted: true
+		},
+		{
+			id: "payroll",
+			orgId: "acme",
+			parentId: "hr",
+			name: "Payroll",
+			restricted: false
+		},
+		{
+			id: "globex-root",
+			orgId: "globex",
+			parentId: null,
+			name: "Globex",
+			restricted: false
+		}
+	],
+	shares: [
+		{
+			folder: "root",
+			user: "bob",
+			relation: "viewer"
+		},
+		{
+			folder: "hr",
+			user: "hank",
+			relation: "viewer"
+		},
+		{
+			folder: "eng",
+			user: "gina",
+			relation: "editor"
+		},
+		{
+			folder: "root",
+			user: "frank",
+			relation: "viewer",
+			expiresAt: SAAS_EXPIRED_AT
+		}
+	]
+});
+/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+function saasRelations(seed = saasSeed) {
+	const edges = (relation) => seed.shares.filter((share) => share.relation === relation).map((share) => share.expiresAt === void 0 ? {
+		id: share.folder,
+		principal: share.user
+	} : {
+		id: share.folder,
+		principal: share.user,
+		expiresAt: share.expiresAt
+	});
+	return memoryRelations(saasPermissions, {
+		rows: { folder: seed.folders },
+		edges: { folder: {
+			viewer: edges("viewer"),
+			editor: edges("editor")
+		} }
+	});
+}
+/** Every user id in the seed. */
+const saasUsers = [...new Set(saasSeed.members.map((member) => member.user)), "mallory"];
+function saasOrg(id) {
+	return saasSeed.orgs.find((org) => org.id === id);
+}
+function toMembership(member) {
+	const membership = { roles: [...member.roles] };
+	if (member.tenant !== void 0) membership.tenant = member.tenant;
+	if (member.team !== void 0) membership.team = member.team;
+	if (member.on !== void 0) membership.on = {
+		resource: member.on.resource,
+		id: member.on.id
+	};
+	if (member.expiresAt !== void 0) membership.expiresAt = member.expiresAt;
+	return membership;
+}
+/** Memberships of `user` as the PermDock `Membership` shape. */
+function saasMemberships(user, members = saasSeed.members) {
+	return members.filter((member) => member.user === user).map((member) => toMembership(member));
+}
+/** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
+const saasCustomRoles = saasSeed.orgs.flatMap((org) => org.customRoles);
+/**
+* The principal for `user`, with the plans of the requested `tenant`'s org.
+* The tenant itself is passed to `createPermDock({ tenant })`, never trusted
+* from here.
+*/
+function saasPrincipal(user, tenant) {
+	const org = tenant === void 0 ? void 0 : saasOrg(tenant);
+	return {
+		id: user,
+		memberships: saasMemberships(user),
+		plans: org === void 0 ? [] : [org.plan]
+	};
+}
+//#endregion
+//#region src/testing/saas/sql.ts
+/**
+* Postgres tables for the SaaS domain. Column names match the resource
+* fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
+* against them without a column map. RLS is enabled and forced on the row
+* tables; policies come from `permdock rls generate`.
+*/
+const saasSchemaSql = `
+create table org (
+  id text primary key,
+  name text not null,
+  plan text not null check (plan in ('free', 'pro'))
+);
+create table org_member (
+  user_id text not null,
+  org_id text references org (id),
+  team_id text,
+  resource text,
+  resource_id text,
+  role text not null,
+  expires_at bigint
+);
+create table project (
+  id text primary key,
+  "orgId" text not null references org (id),
+  "ownerId" text not null,
+  name text not null,
+  archived boolean not null default false
+);
+alter table project enable row level security;
+alter table project force row level security;
+create table doc (
+  id text primary key,
+  "orgId" text not null references org (id),
+  "teamId" text,
+  title text not null,
+  locked boolean not null default false
+);
+alter table doc enable row level security;
+alter table doc force row level security;
+create table folder (
+  id text primary key,
+  "orgId" text not null references org (id),
+  "parentId" text references folder (id),
+  name text not null,
+  restricted boolean not null default false
+);
+alter table folder enable row level security;
+alter table folder force row level security;
+create table folder_share (
+  folder_id text not null references folder (id) on delete cascade,
+  user_id text not null,
+  expires_at timestamptz
+);
+create table folder_editor (
+  folder_id text not null references folder (id) on delete cascade,
+  user_id text not null
+);
+`;
+function literal(value) {
+	if (value === null || value === void 0) return "null";
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("PermDock: non-finite number in fixture seed");
+		return String(value);
+	}
+	if (typeof value === "boolean") return value ? "true" : "false";
+	return quoteSqlLiteral(value);
+}
+function values(rows) {
+	return rows.map((row) => `(${row.map((cell) => literal(cell)).join(", ")})`).join(",\n  ");
+}
+/** `insert` statements for a seed; the default is the full shared seed. */
+function saasSeedSql(seed = saasSeed) {
+	const members = seed.members.flatMap((member) => member.roles.map((role) => [
+		member.user,
+		member.tenant,
+		member.team ?? null,
+		member.on?.resource ?? null,
+		member.on?.id ?? null,
+		role,
+		member.expiresAt ?? null
+	]));
+	const statements = [`insert into org (id, name, plan) values\n  ${values(seed.orgs.map((org) => [
+		org.id,
+		org.name,
+		org.plan
+	]))};`];
+	if (members.length > 0) statements.push(`insert into org_member (user_id, org_id, team_id, resource, resource_id, role, expires_at) values\n  ${values(members)};`);
+	if (seed.projects.length > 0) statements.push(`insert into project (id, "orgId", "ownerId", name, archived) values\n  ${values(seed.projects.map((row) => [
+		row.id,
+		row.orgId,
+		row.ownerId,
+		row.name,
+		row.archived
+	]))};`);
+	if (seed.docs.length > 0) statements.push(`insert into doc (id, "orgId", "teamId", title, locked) values\n  ${values(seed.docs.map((row) => [
+		row.id,
+		row.orgId,
+		row.teamId,
+		row.title,
+		row.locked
+	]))};`);
+	if (seed.folders.length > 0) statements.push(`insert into folder (id, "orgId", "parentId", name, restricted) values\n  ${values(seed.folders.map((row) => [
+		row.id,
+		row.orgId,
+		row.parentId,
+		row.name,
+		row.restricted
+	]))};`);
+	const viewers = seed.shares.filter((share) => share.relation === "viewer");
+	if (viewers.length > 0) statements.push(`insert into folder_share (folder_id, user_id, expires_at) values\n  ${values(viewers.map((share) => [
+		share.folder,
+		share.user,
+		null
+	]))};`, ...viewers.filter((share) => share.expiresAt !== void 0).map((share) => `update folder_share set expires_at = to_timestamp(${String(share.expiresAt)}) where folder_id = ${literal(share.folder)} and user_id = ${literal(share.user)};`));
+	const editors = seed.shares.filter((share) => share.relation === "editor");
+	if (editors.length > 0) statements.push(`insert into folder_editor (folder_id, user_id) values\n  ${values(editors.map((share) => [share.folder, share.user]))};`);
+	return `${statements.join("\n")}\n`;
+}
+//#endregion
+//#region src/testing/saas/tokens.ts
+const saasPublicJwk = {
+	kty: "EC",
+	crv: "P-256",
+	x: "p5Q0wX-3-mOBqOcCTP-RHesn80ydMMNOpr_YNY6uE1I",
+	y: "Tr8Bo2w8QPJ1l0BfNLOEUsSz2VVJGx8AWMOika2yUeA",
+	kid: "e2e",
+	alg: "ES256",
+	use: "sig"
+};
+const saasPrivateJwk = {
+	kty: "EC",
+	crv: "P-256",
+	x: "p5Q0wX-3-mOBqOcCTP-RHesn80ydMMNOpr_YNY6uE1I",
+	y: "Tr8Bo2w8QPJ1l0BfNLOEUsSz2VVJGx8AWMOika2yUeA",
+	kid: "e2e",
+	alg: "ES256",
+	use: "sig",
+	d: "8gTksJVtlkViFAL5tSmPaxnrR3QzONTODL6l8xDZiCk"
+};
+const saasJwks = { keys: [saasPublicJwk] };
+const saasIssuer = "https://saas.permdock.test";
+const saasAudience = "permdock-saas";
+const SAAS_TOKEN_TTL_SECONDS = 3600;
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function encodeJson(value) {
+	return base64url(new TextEncoder().encode(JSON.stringify(value)));
+}
+/** Signs an ES256 access token for `sub` with WebCrypto; no dependency. */
+async function signSaasToken(sub, options = {}) {
+	const iat = options.now ?? Math.floor(Date.now() / 1e3);
+	const memberships = options.memberships === false ? void 0 : options.memberships ?? saasMemberships(sub);
+	const header = {
+		alg: "ES256",
+		kid: saasPublicJwk.kid,
+		typ: "at+jwt"
+	};
+	const payload = {
+		...options.claims,
+		...memberships === void 0 ? {} : { memberships },
+		iss: options.issuer ?? "https://saas.permdock.test",
+		aud: options.audience ?? "permdock-saas",
+		sub,
+		iat,
+		exp: iat + (options.ttl ?? 3600)
+	};
+	const input = `${encodeJson(header)}.${encodeJson(payload)}`;
+	const key = await crypto.subtle.importKey("jwk", { ...saasPrivateJwk }, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, new TextEncoder().encode(input));
+	return `${input}.${base64url(new Uint8Array(signature))}`;
+}
+function decodeSegment(segment) {
+	const padded = segment.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+	return Uint8Array.from(binary, (char) => char.codePointAt(0) ?? 0);
+}
+function parseSegment(segment) {
+	try {
+		const parsed = JSON.parse(new TextDecoder().decode(decodeSegment(segment)));
+		return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
+* and returns its `sub`, or `null`; never throws. Identity only: memberships
+* and plans come from the seed, never from the token.
+*/
+async function verifySaasToken(token, now = Math.floor(Date.now() / 1e3)) {
+	return (await verifySaasSession(token, now))?.sub ?? null;
+}
+/** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
+async function verifySaasSession(token, now = Math.floor(Date.now() / 1e3)) {
+	const parts = typeof token === "string" ? token.split(".") : [];
+	const [head, body, signature] = parts;
+	if (parts.length !== 3 || head === void 0 || body === void 0 || signature === void 0) return null;
+	const header = parseSegment(head);
+	const payload = parseSegment(body);
+	if (header?.["alg"] !== "ES256" || header["kid"] !== saasPublicJwk.kid || payload === null) return null;
+	try {
+		const key = await crypto.subtle.importKey("jwk", { ...saasPublicJwk }, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["verify"]);
+		if (!await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, key, decodeSegment(signature), new TextEncoder().encode(`${head}.${body}`))) return null;
+	} catch {
+		return null;
+	}
+	const { sub, iss, aud, exp } = payload;
+	if (typeof sub !== "string" || iss !== "https://saas.permdock.test" || aud !== "permdock-saas" || typeof exp !== "number" || exp <= now) return null;
+	return {
+		sub,
+		expiresAt: exp
+	};
+}
+//#endregion
+//#region src/testing/saas/scenarios.ts
+/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+function saasUser(scenario) {
+	const principal = saasPrincipal(scenario.user, scenario.tenant);
+	if (scenario.actor === void 0 && scenario.delegation === void 0) return principal;
+	return {
+		principal,
+		context: {},
+		...scenario.actor === void 0 ? {} : { actor: scenario.actor },
+		...scenario.delegation === void 0 ? {} : { delegation: scenario.delegation }
+	};
+}
+/** A memory quota store in which every subject has already used `used` units. */
+function saasLimitStore(used = 0) {
+	const inner = memoryLimitStore();
+	const primed = /* @__PURE__ */ new Set();
+	const prime = (input) => {
+		const id = [
+			input.key,
+			input.subjectId,
+			input.tenant ?? ""
+		].join("\0");
+		if (primed.has(id)) return;
+		primed.add(id);
+		for (let index = 0; index < used; index += 1) inner.consume(input);
+	};
+	return {
+		consume(input) {
+			prime(input);
+			return inner.consume(input);
+		},
+		remaining(input) {
+			prime(input);
+			return inner.remaining(input);
+		}
+	};
+}
+/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+function saasScenarioOptions(scenario) {
+	return {
+		...scenario.tenant === void 0 ? {} : { tenant: scenario.tenant },
+		customRoles: memoryRoleSource(saasCustomRoles),
+		limits: saasLimitStore(scenario.quotaUsed),
+		relations: saasRelations()
+	};
+}
+function saasProject(id) {
+	const row = saasSeed.projects.find((project) => project.id === id);
+	if (row === void 0) throw new Error(`unknown fixture project ${id}`);
+	return row;
+}
+function saasDoc(id) {
+	const row = saasSeed.docs.find((doc) => doc.id === id);
+	if (row === void 0) throw new Error(`unknown fixture doc ${id}`);
+	return row;
+}
+function saasFolder(id) {
+	const row = saasSeed.folders.find((folder) => folder.id === id);
+	if (row === void 0) throw new Error(`unknown fixture folder ${id}`);
+	return row;
+}
+/**
+* The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
+* A snapshot carries no graph, so every graph grant is server-only on a client.
+*/
+const saasFolderScenarios = Object.freeze([
+	{
+		name: "a viewer of the root reads a folder three levels down",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.folder.read,
+		row: saasFolder("infra"),
+		expected: { outcome: "granted" },
+		clientOutcome: "denied"
+	},
+	{
+		name: "a viewer of the root does not reach a restricted branch",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.folder.read,
+		row: saasFolder("payroll"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "a viewer of the restricted folder reads inside it",
+		user: "hank",
+		tenant: "acme",
+		permission: saasPermissions.folder.read,
+		row: saasFolder("payroll"),
+		expected: { outcome: "granted" },
+		clientOutcome: "denied"
+	},
+	{
+		name: "an editor of a folder updates its descendants but not its parent",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.folder.update,
+		row: saasFolder("platform"),
+		expected: { outcome: "granted" },
+		clientOutcome: "denied"
+	},
+	{
+		name: "an editor does not update above the shared folder",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.folder.update,
+		row: saasFolder("root"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "an expired share reaches nothing",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.folder.read,
+		row: saasFolder("eng"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "an admin reads every folder in the org, restricted or not",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.folder.read,
+		row: saasFolder("payroll"),
+		expected: { outcome: "granted" }
+	}
+]);
+/**
+* Hand-written expectations. Never derive `expected` from the engine: the
+* list is the oracle every adapter, ORM and client suite runs against.
+*/
+const saasScenarios = Object.freeze([
+	{
+		name: "admin updates any project in their org",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p1"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "viewer in the second org cannot update there",
+		user: "alice",
+		tenant: "globex",
+		permission: saasPermissions.project.update,
+		row: saasProject("g1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "viewer in the second org reads there",
+		user: "alice",
+		tenant: "globex",
+		permission: saasPermissions.project.read,
+		row: saasProject("g1"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "admin in acme cannot read a globex row while acting in acme",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.project.read,
+		row: saasProject("g1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "member updates their own project",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p1"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "member cannot update a colleague project",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p2"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "archived project cannot be deleted by its owner",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.project.delete,
+		row: saasProject("p4"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "archived project cannot be deleted by the org owner",
+		user: "carol",
+		tenant: "acme",
+		permission: saasPermissions.project.delete,
+		row: saasProject("p4"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "owner manages billing",
+		user: "carol",
+		tenant: "acme",
+		permission: saasPermissions.billing.manage,
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "admin cannot read billing",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.billing.read,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "free plan hides analytics from admins",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.analytics.read,
+		expected: {
+			outcome: "denied",
+			reason: "not-entitled"
+		}
+	},
+	{
+		name: "pro plan shows analytics to admins",
+		user: "erin",
+		tenant: "globex",
+		permission: saasPermissions.analytics.read,
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "same admin, free org: no analytics",
+		user: "erin",
+		tenant: "acme",
+		permission: saasPermissions.analytics.read,
+		expected: {
+			outcome: "denied",
+			reason: "not-entitled"
+		}
+	},
+	{
+		name: "custom contractor role inherits member create",
+		user: "dave",
+		tenant: "acme",
+		permission: saasPermissions.project.create,
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "custom contractor role cannot update a project it does not own",
+		user: "dave",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "expired membership reads nothing",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.project.read,
+		row: saasProject("p1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "user without memberships reads nothing",
+		user: "mallory",
+		tenant: "acme",
+		permission: saasPermissions.project.read,
+		row: saasProject("p1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "user without memberships and no tenant lists nothing",
+		user: "mallory",
+		permission: saasPermissions.project.list,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "owner id user-2 updates its own row",
+		user: "user-2",
+		tenant: "org-1",
+		permission: saasPermissions.project.update,
+		row: saasProject("n1"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "id 2 is not id user-2",
+		user: "2",
+		tenant: "org-1",
+		permission: saasPermissions.project.update,
+		row: saasProject("n1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "tenant-1 member cannot read an org-1 row",
+		user: "tina",
+		tenant: "tenant-1",
+		permission: saasPermissions.project.read,
+		row: saasProject("o1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "team lead updates a team doc",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.doc.update,
+		row: saasDoc("d1"),
+		expected: { outcome: "granted" },
+		clientOutcome: "denied"
+	},
+	{
+		name: "team lead cannot update a locked doc",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.doc.update,
+		row: saasDoc("d2"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "team lead cannot update another team doc",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.doc.update,
+		row: saasDoc("d3"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "viewer reads any doc in the org",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.doc.read,
+		row: saasDoc("d3"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "project collaborator updates that project",
+		user: "hank",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p3"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "project collaborator cannot update another project",
+		user: "hank",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "admin revoking every key needs an owner approval",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.apiKey.revokeAll,
+		expected: { outcome: "approval-required" },
+		client: false
+	},
+	{
+		name: "owner revokes every key directly",
+		user: "carol",
+		tenant: "acme",
+		permission: saasPermissions.apiKey.revokeAll,
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "member cannot revoke keys",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.apiKey.revokeAll,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "admin creates an api key within the quota",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.apiKey.create,
+		expected: { outcome: "granted" },
+		client: false
+	},
+	{
+		name: "member cannot list members",
+		user: "bob",
+		tenant: "acme",
+		permission: saasPermissions.member.list,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "admin of the second org lists its members",
+		user: "erin",
+		tenant: "globex",
+		permission: saasPermissions.member.list,
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "an agent acting for an admin without a delegation reaches nothing",
+		user: "alice",
+		tenant: "acme",
+		actor: {
+			id: "agent-1",
+			kind: "agent"
+		},
+		permission: saasPermissions.project.read,
+		row: saasProject("p1"),
+		expected: {
+			outcome: "denied",
+			reason: "no-delegation"
+		}
+	},
+	{
+		name: "an agent delegated read only reads",
+		user: "alice",
+		tenant: "acme",
+		actor: {
+			id: "agent-1",
+			kind: "agent"
+		},
+		delegation: { scopes: [saasPermissions.project.read.scope] },
+		permission: saasPermissions.project.read,
+		row: saasProject("p1"),
+		expected: { outcome: "granted" }
+	},
+	{
+		name: "an agent delegated read only cannot update what the admin can",
+		user: "alice",
+		tenant: "acme",
+		actor: {
+			id: "agent-1",
+			kind: "agent"
+		},
+		delegation: { scopes: [saasPermissions.project.read.scope] },
+		permission: saasPermissions.project.update,
+		row: saasProject("p2"),
+		expected: {
+			outcome: "denied",
+			reason: "not-delegated"
+		}
+	},
+	{
+		name: "an admin past the daily api-key quota is refused",
+		user: "alice",
+		tenant: "acme",
+		permission: saasPermissions.apiKey.create,
+		quotaUsed: 5,
+		expected: {
+			outcome: "denied",
+			reason: "limit"
+		},
+		client: false
+	},
+	{
+		name: "the quota of one org does not spill into the other",
+		user: "erin",
+		tenant: "globex",
+		permission: saasPermissions.apiKey.create,
+		quotaUsed: 4,
+		expected: { outcome: "granted" },
+		client: false
+	},
+	{
+		name: "a team role held on the tenant membership grants nothing",
+		user: "ivan",
+		tenant: "acme",
+		permission: saasPermissions.doc.update,
+		row: saasDoc("d1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "a tenant-1 member does not list org-1 projects",
+		user: "tina",
+		tenant: "org-1",
+		permission: saasPermissions.project.list,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "an org-1 member cannot create in tenant-1",
+		user: "user-2",
+		tenant: "tenant-1",
+		permission: saasPermissions.project.create,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "a tenant-1 member updates its own tenant-1 row only through tenant-1",
+		user: "tina",
+		tenant: "org-1",
+		permission: saasPermissions.project.update,
+		row: saasProject("o1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "expired membership lists nothing",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.project.list,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "expired membership creates nothing",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.project.create,
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "expired membership updates nothing",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.project.update,
+		row: saasProject("p1"),
+		expected: { outcome: "denied" }
+	},
+	{
+		name: "expired membership reads no doc",
+		user: "frank",
+		tenant: "acme",
+		permission: saasPermissions.doc.read,
+		row: saasDoc("d1"),
+		expected: { outcome: "denied" }
+	}
+]);
+//#endregion
+export { saasOrg as C, saasUsers as D, saasSeed as E, SAAS_API_KEY_LIMIT as O, saasMemberships as S, saasRelations as T, verifySaasToken as _, saasProject as a, SAAS_EXPIRED_AT as b, saasUser as c, saasIssuer as d, saasJwks as f, verifySaasSession as g, signSaasToken as h, saasLimitStore as i, saasPolicy as k, SAAS_TOKEN_TTL_SECONDS as l, saasPublicJwk as m, saasFolder as n, saasScenarioOptions as o, saasPrivateJwk as p, saasFolderScenarios as r, saasScenarios as s, saasDoc as t, saasAudience as u, saasSchemaSql as v, saasPrincipal as w, saasCustomRoles as x, saasSeedSql as y };