permdock 0.0.0 → 0.1.0

package/dist/src-CTNT-PBW.js

@@ -0,0 +1,430 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { _ as assertSqlFunctionArg, g as assertPortableTwin, h as normalizeWhere, s as grantList, v as assertSqlFunctionName } from "./policy-ANp36PnI.js";
+import { f as tenantOf, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { C as listPlans, s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
+import { l as canonicalJson } from "./snapshot-DE8dE_hz.js";
+import { f as tenantsOf } from "./validity-D0uRmJKJ.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { n as isThenable } from "./thenable-okc2xDsj.js";
+import { i as snapshotOf, n as resolveSubject, o as declaredRoleNames, r as collectSnapshotGrants } from "./permdock-yoZ7EjxX.js";
+//#region src/conditions/sql-function.ts
+function sqlFunction(name, options) {
+	assertSqlFunctionName(name);
+	const args = options.args ?? [];
+	for (const arg of args) assertSqlFunctionArg(arg);
+	const twin = normalizeWhere(options.twin);
+	assertPortableTwin(twin);
+	return freezeDeep({
+		op: "sqlFunction",
+		name,
+		args,
+		twin
+	});
+}
+//#endregion
+//#region src/core/interfaces.ts
+function memoryEntitlementSource(entries) {
+	return { entitlementsFor(_principal, options) {
+		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
+	} };
+}
+function memorySettings(settings) {
+	const byTenant = new Map(Object.entries(settings));
+	return Object.freeze({ settingsFor(tenant) {
+		return byTenant.get(tenant);
+	} });
+}
+function memoryRoleSource(customRoles) {
+	const byTenant = /* @__PURE__ */ new Map();
+	const global = [];
+	for (const role of customRoles) {
+		if (role.tenant === void 0) {
+			global.push(role);
+			continue;
+		}
+		const list = byTenant.get(role.tenant) ?? [];
+		list.push(role);
+		byTenant.set(role.tenant, list);
+	}
+	return {
+		rolesFor(tenant) {
+			return byTenant.get(tenant) ?? [];
+		},
+		globalRoles() {
+			return global;
+		}
+	};
+}
+//#endregion
+//#region src/core/stripe-entitlements.ts
+const PAGE = 100;
+const MAX_PAGES = 10;
+/**
+* Plan names from Stripe Entitlements: the `lookup_key` of every active
+* entitlement of the tenant's Stripe customer. `customer` maps the active
+* tenant to its customer id; no tenant or no customer means no entitlements.
+* Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
+*/
+function fromStripeEntitlements(options) {
+	return { async entitlementsFor(principal, query) {
+		if (query.tenant === void 0) return [];
+		const customer = await options.customer(query.tenant, principal);
+		if (customer === void 0 || customer === "") return [];
+		const keys = /* @__PURE__ */ new Set();
+		let after;
+		for (let page = 0; page < MAX_PAGES; page += 1) {
+			const result = await options.stripe.entitlements.activeEntitlements.list(after === void 0 ? {
+				customer,
+				limit: PAGE
+			} : {
+				customer,
+				limit: PAGE,
+				starting_after: after
+			});
+			for (const item of result.data) if (typeof item.lookup_key === "string" && item.lookup_key !== "") keys.add(item.lookup_key);
+			const last = result.data.at(-1);
+			if (!result.has_more || last === void 0) break;
+			after = last.id;
+		}
+		return [...keys].toSorted();
+	} };
+}
+//#endregion
+//#region src/core/may-access.ts
+function policyPlans(policy) {
+	const names = new Set(listPlans(policy.vocabulary?.plans).map((p) => p.key));
+	for (const grant of grantList(policy)) for (const item of flattenGrantee(grant.to)) if (item.kind === "plan") names.add(item.plan);
+	return [...names];
+}
+function heldRoleNames(principal) {
+	return [...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((item) => item.roles)];
+}
+/**
+* An optimistic routing hint for a proxy or middleware, never a decision.
+* `false` only when the subject's declared roles provably lack `permission`;
+* `true` whenever custom roles, plans, memberships the claims do not carry or
+* row conditions could still grant it. Synchronous, no network, never throws.
+* Pages, Server Actions and RLS remain the enforcement points.
+*/
+function mayAccess(policy, user, permission, options = {}) {
+	try {
+		const resolved = resolveSubject(policy, user, compact({ tenant: options.tenant }), []);
+		if (isThenable(resolved)) return true;
+		const principal = resolved.principal;
+		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
+		if (principal !== null) {
+			const declared = declaredRoleNames(policy);
+			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
+			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
+		}
+		const tenant = options.tenant;
+		const subject = principal === null ? resolved : {
+			...resolved,
+			principal: {
+				...principal,
+				plans: policyPlans(policy),
+				memberships: (principal.memberships ?? []).filter((item) => {
+					const owner = tenantOf(item, scopeList(policy.scopes));
+					return tenant === void 0 || owner === void 0 || owner === tenant;
+				})
+			}
+		};
+		const matched = collectSnapshotGrants(policy, subject, []).filter((item) => item.grant.permission.key === permission.key);
+		if (matched.some((item) => item.grant.effect === "deny" && item.grant.where === void 0 && item.grant.check === void 0 && item.grant.portable)) return false;
+		return matched.some((item) => item.grant.effect === "allow");
+	} catch {
+		return true;
+	}
+}
+//#endregion
+//#region src/core/snapshot-for.ts
+function withPlans(subject, plans) {
+	if (plans === void 0 || subject.principal === null) return subject;
+	return freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...subject.principal,
+			plans: [...plans]
+		})
+	}));
+}
+/**
+* Builds the serializable access snapshot for a subject without a request,
+* a network call or a cache directive: call it inside the app's own
+* `'use cache: private'` function. Synchronous; the policy's `subject` and
+* `context` mappers must be synchronous too.
+*/
+function snapshotFor(policy, user, options = {}) {
+	const auth = [];
+	const memberships = options.memberships;
+	const resolved = resolveSubject(policy, user, compact({
+		tenant: options.tenant,
+		memberships: memberships === void 0 ? void 0 : { membershipsFor: () => [...memberships] }
+	}), auth);
+	if (isThenable(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use createPermDock(...).snapshot().");
+	const subject = withPlans(resolved, options.plans);
+	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
+	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
+	const names = options.assignable;
+	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
+	return snapshotOf(policy, subject, compact({
+		customRoles,
+		assignable,
+		include: options.include,
+		tenants: options.tenants,
+		now: options.now
+	}));
+}
+//#endregion
+//#region src/core/presets.ts
+const CRUD_ACTIONS = {
+	read: { readOnly: true },
+	update: {},
+	delete: { destructive: true }
+};
+const CRUD_COLLECTION = {
+	create: {},
+	list: { readOnly: true }
+};
+const READABLE_ACTIONS = { read: { readOnly: true } };
+const READABLE_COLLECTION = { list: { readOnly: true } };
+const WRITABLE_ACTIONS = {
+	read: { readOnly: true },
+	update: {}
+};
+const WRITABLE_COLLECTION = {};
+function isNameList(list) {
+	return Array.isArray(list);
+}
+function toRecord(list) {
+	if (list === void 0) return {};
+	if (isNameList(list)) {
+		const out = {};
+		for (const name of list) out[name] = {};
+		return out;
+	}
+	return { ...list };
+}
+function mergeMeta(base, extra) {
+	return compact({
+		title: extra.title ?? base.title,
+		description: extra.description ?? base.description,
+		tags: extra.tags ?? base.tags,
+		readOnly: extra.readOnly ?? base.readOnly,
+		destructive: extra.destructive ?? base.destructive,
+		idempotent: extra.idempotent ?? base.idempotent
+	});
+}
+function mergeActionLists(base, extra) {
+	const extraRecord = toRecord(extra);
+	const out = {};
+	for (const [name, baseMeta] of Object.entries(base)) {
+		const extraMeta = extraRecord[name];
+		out[name] = extraMeta === void 0 ? baseMeta : mergeMeta(baseMeta, extraMeta);
+	}
+	for (const [name, extraMeta] of Object.entries(extraRecord)) {
+		if (Object.hasOwn(out, name)) continue;
+		out[name] = extraMeta;
+	}
+	return freezeDeep(out);
+}
+function finishPreset(baseActions, baseCollection, options) {
+	const actions = mergeActionLists(baseActions, options?.actions);
+	const collection = mergeActionLists(baseCollection, options?.collection);
+	return compact({
+		id: options?.id,
+		parent: options?.parent,
+		relations: options?.relations,
+		restricted: options?.restricted,
+		disclosure: options?.disclosure,
+		actions,
+		collection: Object.keys(collection).length === 0 ? void 0 : collection
+	});
+}
+function crud(options) {
+	return finishPreset(CRUD_ACTIONS, CRUD_COLLECTION, options);
+}
+function readable(options) {
+	return finishPreset(READABLE_ACTIONS, READABLE_COLLECTION, options);
+}
+function writable(options) {
+	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
+}
+//#endregion
+//#region src/core/ocsf.ts
+/** The OCSF schema version `toOcsf` emits. */
+const OCSF_VERSION = "1.3.0";
+function status(outcome) {
+	switch (outcome) {
+		case "granted": return {
+			status_id: 1,
+			status: "Success"
+		};
+		case "denied": return {
+			status_id: 2,
+			status: "Failure"
+		};
+		case "approval-required": return {
+			status_id: 99,
+			status: "Other"
+		};
+		default: return unknownStatus(outcome);
+	}
+}
+/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
+function unknownStatus(_outcome) {
+	return {
+		status_id: 0,
+		status: "Unknown"
+	};
+}
+/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
+function toOcsf(event) {
+	const principal = event.subject.principal;
+	const actor = event.subject.actor;
+	const breakGlass = event.matched?.breakGlass === true;
+	const detail = event.outcome === "approval-required" ? "approval-required" : event.denials?.map((denial) => denial.reason).join(",");
+	const time = Date.parse(event.at);
+	return compact({
+		class_uid: 3003,
+		category_uid: 3,
+		activity_id: 1,
+		type_uid: 300301,
+		severity_id: breakGlass ? 4 : 1,
+		time: Number.isNaN(time) ? 0 : time,
+		...status(event.outcome),
+		status_detail: detail === "" ? void 0 : detail,
+		message: `${event.permission} ${event.outcome}`,
+		privileges: [event.permission],
+		user: principal === null ? { name: "anonymous" } : { uid: principal.id },
+		actor: actor === void 0 ? void 0 : compact({
+			user: principal === null ? void 0 : { uid: principal.id },
+			app_name: actor.id
+		}),
+		metadata: compact({
+			version: OCSF_VERSION,
+			product: compact({
+				name: "PermDock",
+				vendor_name: "PermDock",
+				feature: event.adapter === void 0 ? void 0 : { name: event.adapter }
+			}),
+			tenant_uid: event.tenant,
+			correlation_uid: event.token
+		}),
+		unmapped: compact({
+			outcome: event.outcome,
+			scope: event.scope,
+			resource: event.resource,
+			source: event.source,
+			phase: event.phase,
+			role: event.matched?.role,
+			via: event.via,
+			breakGlass: breakGlass ? true : void 0,
+			purpose: event.purpose,
+			reason: event.reason
+		})
+	});
+}
+function accessToOcsf(event) {
+	const time = Date.parse(event.at);
+	const enable = event.operation === "started";
+	return compact({
+		class_uid: 3001,
+		category_uid: 3,
+		activity_id: enable ? 2 : 5,
+		type_uid: enable ? 300102 : 300105,
+		severity_id: 4,
+		time: Number.isNaN(time) ? 0 : time,
+		message: `support access ${event.operation}`,
+		user: { uid: event.principal.id },
+		actor: event.actor === void 0 ? void 0 : { user: { uid: event.actor.id } },
+		metadata: {
+			version: OCSF_VERSION,
+			product: {
+				name: "PermDock",
+				vendor_name: "PermDock"
+			},
+			tenant_uid: event.tenant
+		},
+		unmapped: compact({
+			operation: event.operation,
+			via: event.via,
+			roles: event.roles,
+			member: event.member,
+			grantedBy: event.grantedBy,
+			reason: event.reason
+		})
+	});
+}
+//#endregion
+//#region src/core/csv.ts
+/** The CSV export columns, in order; the header row of every CSV file. */
+const CSV_COLUMNS = Object.freeze([
+	"time",
+	"principal",
+	"actor",
+	"tenant",
+	"permission",
+	"outcome",
+	"matched.role",
+	"via",
+	"denials.reason",
+	"token"
+]);
+function field(value) {
+	const text = value ?? "";
+	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
+}
+/**
+* One RFC 4180 row for a decision or approval event, without a line
+* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+*/
+function toCsvRow(event) {
+	return [
+		event.at,
+		event.subject.principal?.id,
+		event.subject.actor?.id,
+		event.tenant,
+		event.permission,
+		event.outcome,
+		event.matched?.role,
+		event.via,
+		event.denials?.map((denial) => denial.reason).join(";"),
+		event.token
+	].map(field).join(",");
+}
+//#endregion
+//#region src/core/catalog-fingerprint.ts
+const OMITTED_TOP_LEVEL = /* @__PURE__ */ new Set([
+	"generatedAt",
+	"generator",
+	"fingerprint"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function fingerprintInput(catalog) {
+	const out = {};
+	for (const [key, value] of Object.entries(catalog)) {
+		if (OMITTED_TOP_LEVEL.has(key)) continue;
+		out[key] = key === "permissions" && Array.isArray(value) ? value.map((permission) => {
+			if (!isRecord(permission)) return permission;
+			const { usages: _usages, ...rest } = permission;
+			return rest;
+		}) : value;
+	}
+	return out;
+}
+/**
+* The catalog v1 fingerprint: base64url SHA-256 of canonical JSON (keys
+* sorted, no whitespace) without `generatedAt`, `generator`, `fingerprint`
+* and every `permissions[].usages`, so neither the CLI version, the clock nor
+* call sites change it.
+*/
+function catalogFingerprint(catalog) {
+	if (!isRecord(catalog)) throw new TypeError("PermDock: a catalog must be an object");
+	return bytesToBase64Url(sha256(canonicalJson(fingerprintInput(catalog))));
+}
+//#endregion
+export { accessToOcsf as a, readable as c, mayAccess as d, fromStripeEntitlements as f, sqlFunction as g, memorySettings as h, OCSF_VERSION as i, writable as l, memoryRoleSource as m, CSV_COLUMNS as n, toOcsf as o, memoryEntitlementSource as p, toCsvRow as r, crud as s, catalogFingerprint as t, snapshotFor as u };

package/dist/ssf/index.d.ts

@@ -0,0 +1,3 @@
+import { a as ReplayStore, c as SsfEventHandler, d as SsfOnEvent, f as SsfPermDock, g as SsfSubjectMapper, h as SsfSubject, i as PollResult, l as SsfEventInput, m as SsfReceiver, n as PollHandle, o as SetSubject, p as SsfPermDockOptions, r as PollOptions, s as SsfAuditEvent, t as CaepEventName, u as SsfEventListener } from "../types-i4BAOvdb.js";
+import { n as createPermDock, t as memoryReplayStore } from "../index-fG6NSXlc.js";
+export { type CaepEventName, type PollHandle, type PollOptions, type PollResult, type ReplayStore, type SetSubject, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfSubject, type SsfSubjectMapper, createPermDock, memoryReplayStore };