permdock 0.0.0 → 0.1.0

package/dist/store-C6hFW6ta.js

@@ -0,0 +1,508 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as parseSnapshot } from "./snapshot-DE8dE_hz.js";
+import { s as nowSeconds } from "./validity-D0uRmJKJ.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+//#region src/react/store.ts
+/** Milliseconds a decision, refresh or approval request may take; a slower one is an error like a failed request. */
+const STORE_TIMEOUT_MS = 1e4;
+function cacheKey(permission, data) {
+	if (data === null || typeof data !== "object") return `${permission.key}:*`;
+	const id = data["id"];
+	return `${permission.key}:${typeof id === "string" || typeof id === "number" ? String(id) : "*"}`;
+}
+function withTenant(source, tenant) {
+	if (tenant === void 0) return source;
+	const hashAt = source.indexOf("#");
+	const hash = hashAt === -1 ? "" : source.slice(hashAt);
+	const rest = hashAt === -1 ? source : source.slice(0, hashAt);
+	const queryAt = rest.indexOf("?");
+	const path = queryAt === -1 ? rest : rest.slice(0, queryAt);
+	const params = new URLSearchParams(queryAt === -1 ? "" : rest.slice(queryAt + 1));
+	params.set("tenant", tenant);
+	return `${path}?${params.toString()}${hash}`;
+}
+function refKey(ref) {
+	if ("key" in ref && typeof ref.key === "string") return ref.key;
+	return "";
+}
+function isJws(value) {
+	const parts = value.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+const CURRENT = Symbol.for("permdock.current");
+const SERVER_ONLY = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "opaque-condition"
+	}],
+	alternatives: []
+};
+/** The client has no endpoint to ask (`endpoint: false`, or none given). */
+const NO_ENDPOINT = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "server-only"
+	}],
+	alternatives: []
+};
+function needsEndpoint(decision) {
+	return decision.outcome === "denied" && decision.denials.some((denial) => denial.reason === "opaque-condition");
+}
+function createClientStore(options) {
+	const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+	const server = options.server ?? globalThis.window === void 0;
+	const listeners = /* @__PURE__ */ new Set();
+	const answers = /* @__PURE__ */ new Map();
+	let queued = [];
+	let flushScheduled = false;
+	let emitScheduled = false;
+	let snapshot = emptySnapshot();
+	let tenant = options.tenant;
+	let base = "server-only";
+	let instance = fromSnapshot(snapshot, compact({ tenant }));
+	let cached;
+	let verifying = false;
+	let refreshing = 0;
+	let following = 0;
+	let refreshSeq = 0;
+	let silent = false;
+	let adopted;
+	let generation = 0;
+	const emit = () => {
+		cached = wrap(instance);
+		if (silent) return;
+		for (const listener of listeners) listener();
+	};
+	const emitSoon = () => {
+		if (emitScheduled) return;
+		emitScheduled = true;
+		queueMicrotask(() => {
+			emitScheduled = false;
+			emit();
+		});
+	};
+	const reset = () => {
+		generation += 1;
+		answers.clear();
+		queued = [];
+	};
+	const hydrate = (next) => {
+		reset();
+		snapshot = next;
+		instance = fromSnapshot(snapshot, compact({ tenant }));
+		base = "ready";
+		options.onSnapshot?.(next, tenant);
+		emit();
+	};
+	const storeStatus = () => {
+		if (verifying || refreshing > 0 || following > 0) return "pending";
+		if (base === "server-only") return "server-only";
+		if (base === "stale" || isStale()) return "stale";
+		for (const entry of answers.values()) if (entry.status === "pending") return "pending";
+		return "ready";
+	};
+	const isStale = () => {
+		const maxAge = snapshot.issuedAt > 0 ? options.maxAge : void 0;
+		if (snapshot.expiresAt === void 0 && maxAge === void 0) return false;
+		const now = nowSeconds();
+		if (snapshot.expiresAt !== void 0 && snapshot.expiresAt <= now) return true;
+		return maxAge !== void 0 && now - snapshot.issuedAt > maxAge;
+	};
+	const serverOnly = () => {
+		hydrate(emptySnapshot());
+		base = "server-only";
+		emit();
+	};
+	const applyParsed = (value) => {
+		try {
+			hydrate(parseSnapshot(value));
+		} catch {
+			serverOnly();
+		}
+	};
+	const verifyJws = async (raw) => {
+		if (options.verifier === void 0) return;
+		try {
+			const verified = await options.verifier.verify(raw, { typ: "permdock-snapshot+jwt" });
+			return verified.ok ? verified.claims["snapshot"] : void 0;
+		} catch {
+			return;
+		}
+	};
+	const bootJws = async (raw) => {
+		if (options.verifier === void 0) {
+			serverOnly();
+			return;
+		}
+		const started = generation;
+		verifying = true;
+		emit();
+		const claim = await verifyJws(raw);
+		verifying = false;
+		if (started !== generation) {
+			emit();
+			return;
+		}
+		if (claim === void 0) {
+			serverOnly();
+			return;
+		}
+		applyParsed(claim);
+	};
+	const scheduleFlush = () => {
+		if (flushScheduled || options.endpoint === void 0) return;
+		flushScheduled = true;
+		queueMicrotask(() => {
+			flushScheduled = false;
+			flush();
+		});
+	};
+	const flush = async () => {
+		const batch = queued;
+		queued = [];
+		if (batch.length === 0 || options.endpoint === void 0) return;
+		const started = generation;
+		if (snapshot.simulated === true) {
+			for (const item of batch) answers.set(item.key, {
+				decision: SERVER_ONLY,
+				status: "server-only"
+			});
+			emit();
+			return;
+		}
+		try {
+			const response = await fetchImpl(options.endpoint, {
+				method: "POST",
+				credentials: "include",
+				signal: timeoutSignal(STORE_TIMEOUT_MS),
+				headers: {
+					accept: "application/json",
+					"content-type": "application/json",
+					...options.headers
+				},
+				body: JSON.stringify({ evaluations: batch.map((item) => ({
+					subject: {
+						type: instance.subject.principal?.kind ?? "user",
+						id: instance.subject.principal?.id ?? ""
+					},
+					action: { name: item.permission.action },
+					resource: {
+						type: item.permission.resource,
+						id: item.data !== null && typeof item.data === "object" && "id" in item.data ? String(item.data.id ?? "") : void 0,
+						properties: item.data
+					}
+				})) })
+			});
+			if (!response.ok) throw new Error("evaluations failed");
+			const body = await response.json();
+			if (started !== generation) return;
+			for (const [index, item] of batch.entries()) {
+				const decision = (body.evaluations?.[index])?.context?.permdock ?? SERVER_ONLY;
+				answers.set(item.key, {
+					decision,
+					status: "ready"
+				});
+			}
+		} catch {
+			if (started !== generation) return;
+			for (const item of batch) answers.set(item.key, {
+				decision: SERVER_ONLY,
+				status: "server-only"
+			});
+		}
+		emit();
+	};
+	const enqueue = (key, permission, data) => {
+		if (answers.has(key)) return;
+		if (options.endpoint === void 0) {
+			answers.set(key, {
+				decision: NO_ENDPOINT,
+				status: "server-only"
+			});
+			options.onServerOnly?.(permission);
+			emitSoon();
+			return;
+		}
+		answers.set(key, {
+			decision: SERVER_ONLY,
+			status: "pending"
+		});
+		queued.push({
+			permission,
+			data,
+			key
+		});
+		emitSoon();
+		scheduleFlush();
+	};
+	const permissionState = (permission, data) => {
+		const key = `${tenant ?? ""}|${cacheKey(permission, data)}`;
+		const hit = answers.get(key);
+		if (hit !== void 0) return {
+			allowed: hit.decision.outcome === "granted",
+			status: hit.status,
+			decision: hit.decision
+		};
+		const decision = instance.decide(permission, data);
+		if (needsEndpoint(decision)) {
+			if (server && options.endpoint !== void 0) return {
+				allowed: false,
+				status: "pending",
+				decision: SERVER_ONLY
+			};
+			enqueue(key, permission, data);
+			const next = answers.get(key);
+			if (next !== void 0) return {
+				allowed: false,
+				status: next.status,
+				decision: next.decision
+			};
+			return {
+				allowed: false,
+				status: "server-only",
+				decision: NO_ENDPOINT
+			};
+		}
+		return {
+			allowed: decision.outcome === "granted",
+			status: verifying || following > 0 ? "pending" : isStale() ? "stale" : "ready",
+			decision
+		};
+	};
+	const approvalInterval = options.approvalInterval ?? 2e3;
+	const approvals = /* @__PURE__ */ new Map();
+	const polls = /* @__PURE__ */ new Map();
+	let approvalEpoch = 0;
+	const TERMINAL = /* @__PURE__ */ new Set([
+		"approved",
+		"rejected",
+		"expired"
+	]);
+	const stopPolls = () => {
+		for (const timer of polls.values()) clearTimeout(timer);
+		polls.clear();
+	};
+	const schedulePoll = (token) => {
+		if (server || options.approvals === void 0 || polls.has(token) || listeners.size === 0) return;
+		const epoch = approvalEpoch;
+		const href = `${options.approvals.replace(/\/+$/u, "")}/${encodeURIComponent(token)}`;
+		polls.set(token, setTimeout(() => {
+			(async () => {
+				let next;
+				try {
+					const response = await fetchImpl(href, {
+						method: "GET",
+						credentials: "include",
+						signal: timeoutSignal(STORE_TIMEOUT_MS),
+						headers: {
+							accept: "application/json",
+							...options.headers
+						}
+					});
+					if (response.status === 404) next = "expired";
+					else if (response.ok) {
+						const body = await response.json();
+						next = body.status === "pending" || body.status === "approved" || body.status === "rejected" || body.status === "expired" ? body.status : void 0;
+					}
+				} catch {
+					next = void 0;
+				}
+				if (epoch !== approvalEpoch) return;
+				polls.delete(token);
+				if (next !== void 0 && approvals.get(token) !== next) {
+					approvals.set(token, next);
+					emit();
+				}
+				if (!TERMINAL.has(approvals.get(token) ?? "required")) schedulePoll(token);
+			})();
+		}, approvalInterval));
+	};
+	const approvalState = (decision) => {
+		if (decision.outcome !== "approval-required") return "not-needed";
+		const current = approvals.get(decision.token) ?? "required";
+		if (!TERMINAL.has(current)) schedulePoll(decision.token);
+		return current;
+	};
+	const subscribe = (listener) => {
+		listeners.add(listener);
+		return () => {
+			listeners.delete(listener);
+			if (listeners.size === 0) stopPolls();
+		};
+	};
+	const wrap = (permdock) => {
+		const client = {
+			...permdock,
+			status(permission, data) {
+				if (permission === void 0) return storeStatus();
+				return permissionState(permission, data).status;
+			},
+			invalidate(ref) {
+				const prefix = refKey(ref);
+				for (const key of answers.keys()) {
+					const unscoped = key.slice(key.indexOf("|") + 1);
+					if (prefix === "" || unscoped === prefix || unscoped.startsWith(`${prefix}:`) || unscoped.startsWith(`${prefix}.`)) answers.delete(key);
+				}
+				base = "stale";
+				emit();
+			},
+			async refresh(query) {
+				const requested = query?.tenant;
+				const source = options.snapshotUrl ?? options.endpoint;
+				if (requested !== void 0 && (snapshot.tenants.includes(requested) || source === void 0)) {
+					tenant = requested;
+					hydrate(snapshot);
+					return;
+				}
+				if (source === void 0) return;
+				const started = generation;
+				refreshSeq += 1;
+				const seq = refreshSeq;
+				refreshing += 1;
+				emit();
+				let body;
+				let ok = false;
+				try {
+					const response = await fetchImpl(withTenant(source, requested), {
+						method: "GET",
+						credentials: "include",
+						signal: timeoutSignal(STORE_TIMEOUT_MS),
+						headers: {
+							accept: "application/json",
+							...options.headers
+						}
+					});
+					if (response.ok) {
+						body = await response.json();
+						ok = true;
+					}
+				} catch {
+					ok = false;
+				}
+				if (ok && typeof body === "string" && isJws(body)) {
+					body = await verifyJws(body);
+					ok = body !== void 0;
+				}
+				refreshing -= 1;
+				if (started !== generation || seq !== refreshSeq) {
+					emit();
+					return;
+				}
+				let next;
+				try {
+					next = ok ? parseSnapshot(body) : void 0;
+				} catch {
+					next = void 0;
+				}
+				if (next === void 0) {
+					base = "stale";
+					emit();
+					return;
+				}
+				if (requested !== void 0) tenant = requested;
+				hydrate(next);
+			},
+			clear() {
+				reset();
+				tenant = options.tenant;
+				snapshot = emptySnapshot();
+				instance = fromSnapshot(snapshot, compact({ tenant }));
+				base = "server-only";
+				approvalEpoch += 1;
+				stopPolls();
+				approvals.clear();
+				options.onClear?.();
+				emit();
+			},
+			subscribe
+		};
+		Object.defineProperty(client, CURRENT, { value: () => cached });
+		return client;
+	};
+	const boot = (value) => {
+		if (typeof value === "string" && isJws(value)) {
+			cached = wrap(instance);
+			bootJws(value);
+		} else {
+			applyParsed(value);
+			cached = wrap(instance);
+		}
+	};
+	boot(options.snapshot);
+	return {
+		get() {
+			return cached;
+		},
+		subscribe,
+		permissionState,
+		approvalState,
+		replace(value) {
+			if (typeof value === "string" && isJws(value)) {
+				bootJws(value);
+				return;
+			}
+			applyParsed(value);
+		},
+		follow(value) {
+			const started = generation;
+			following += 1;
+			emit();
+			const settle = (next) => {
+				following -= 1;
+				if (started !== generation) {
+					emit();
+					return;
+				}
+				if (next === void 0) serverOnly();
+				else if (typeof next === "string" && isJws(next)) bootJws(next);
+				else applyParsed(next);
+			};
+			Promise.resolve(value).then(settle, () => {
+				settle(void 0);
+			});
+		},
+		adopt(value, source) {
+			if (adopted === source) return;
+			adopted = source;
+			reset();
+			silent = true;
+			try {
+				boot(value);
+			} finally {
+				silent = false;
+			}
+			queueMicrotask(emit);
+		},
+		snapshot() {
+			return snapshot;
+		},
+		async requestApproval(decision, note) {
+			if (decision.outcome !== "approval-required" || snapshot.simulated === true) return;
+			const href = options.approvals ?? options.endpoint;
+			if (href === void 0) return;
+			if ((await fetchImpl(href, {
+				method: "POST",
+				credentials: "include",
+				signal: timeoutSignal(STORE_TIMEOUT_MS),
+				headers: {
+					accept: "application/json",
+					"content-type": "application/json",
+					...options.headers
+				},
+				body: JSON.stringify({
+					permission: decision.grant.permission,
+					token: decision.token,
+					note
+				})
+			})).ok && !TERMINAL.has(approvals.get(decision.token) ?? "required")) {
+				approvals.set(decision.token, "pending");
+				emit();
+			}
+		}
+	};
+}
+//#endregion
+export { createClientStore as t };

package/dist/stores-CkG2HrSg.js

@@ -0,0 +1,140 @@
+import { n as providePermDock, t as getStore } from "./context-CKEAabd7.js";
+import { readable, toStore } from "svelte/store";
+//#region src/svelte/stores.ts
+function fromStore(store, compute) {
+	return readable(compute(), (set) => {
+		const offStore = store.subscribe(() => {
+			set(compute());
+		});
+		const offRunes = toStore(compute).subscribe(set);
+		return () => {
+			offStore();
+			offRunes();
+		};
+	});
+}
+function sveltePermDock(store) {
+	return new Proxy({}, { get(_target, prop, _receiver) {
+		return Reflect.get(store.get(), prop);
+	} });
+}
+function setPermDock(options) {
+	return sveltePermDock(providePermDock(options));
+}
+function getPermDock() {
+	return sveltePermDock(getStore());
+}
+function permission(reference, data) {
+	return permissionFor(getStore(), reference, data);
+}
+function permissionFor(store, reference, data) {
+	return fromStore(store, () => store.permissionState(reference, data?.()));
+}
+function permissions(references, data) {
+	return permissionsFor(getStore(), references, data);
+}
+function permissionsFor(store, references, data) {
+	return fromStore(store, () => {
+		const granted = [];
+		const byKey = {};
+		for (const reference of references()) {
+			const next = store.permissionState(reference, data?.());
+			byKey[reference.key] = next;
+			if (next.allowed) granted.push(reference);
+		}
+		return new Proxy({
+			granted,
+			get(reference) {
+				return byKey[reference.key];
+			}
+		}, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+			return Reflect.get(target, prop, receiver);
+		} });
+	});
+}
+function filtered(reference, rows) {
+	return filteredFor(getStore(), reference, rows);
+}
+function filteredFor(store, reference, rows) {
+	return fromStore(store, () => {
+		const permdock = store.get();
+		const next = permdock.filter(reference, rows());
+		next.partial = permdock.where(reference).partial;
+		return next;
+	});
+}
+function tenant() {
+	return tenantFor(getStore());
+}
+function tenantFor(store) {
+	return fromStore(store, () => {
+		const permdock = store.get();
+		return {
+			tenant: permdock.subject.principal?.tenant ?? null,
+			tenants: permdock.tenants(),
+			switchTo: (id) => permdock.refresh({ tenant: id }),
+			status: permdock.status()
+		};
+	});
+}
+function memberships() {
+	return membershipsFor(getStore());
+}
+function membershipsFor(store) {
+	return fromStore(store, () => store.get().memberships());
+}
+function roles(options = () => ({})) {
+	return rolesFor(getStore(), options);
+}
+function rolesFor(store, options = () => ({})) {
+	return fromStore(store, () => {
+		const next = options();
+		const permdock = store.get();
+		return { roles: (next.team === void 0 ? permdock : permdock.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
+	});
+}
+function assignable() {
+	return assignableFor(getStore());
+}
+function assignableFor(store) {
+	return fromStore(store, () => store.get().assignableRoles());
+}
+function assignablePermissions(options = {}) {
+	return assignablePermissionsFor(getStore(), options);
+}
+function assignablePermissionsFor(store, options = {}) {
+	return fromStore(store, () => store.get().assignablePermissions(options));
+}
+function subject() {
+	return subjectFor(getStore());
+}
+function subjectFor(store) {
+	return fromStore(store, () => {
+		const permdock = store.get();
+		const snapshot = permdock.snapshot();
+		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
+		return {
+			principal: permdock.subject.principal,
+			actor: permdock.subject.actor,
+			delegation: permdock.subject.delegation,
+			expiresAt: permdock.subject.expiresAt,
+			simulated
+		};
+	});
+}
+function approval(decision) {
+	return approvalFor(getStore(), decision);
+}
+function approvalFor(store, decision) {
+	return fromStore(store, () => {
+		const next = decision();
+		return {
+			state: store.approvalState(next),
+			token: next.outcome === "approval-required" ? next.token : void 0,
+			request: (note) => store.requestApproval(next, note)
+		};
+	});
+}
+//#endregion
+export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, assignablePermissions as r, permission as s, approval as t, setPermDock as u };

package/dist/stores-CvOnu_2T.d.ts

@@ -0,0 +1,41 @@
+import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "./policy-CInmNGkM.js";
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { r as Role } from "./vocabulary-Dk0fs-Jk.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "./types-DbWdEfcm.js";
+import { Readable } from "svelte/store";
+//#region src/svelte/types.d.ts
+type PermDockSvelteOptions = {
+  /**
+   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
+   * store when it changes; a promise keeps the store `pending` until it
+   * settles (render the same promise with `{#await}`).
+   */
+  readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+};
+//#endregion
+//#region src/svelte/stores.d.ts
+declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
+declare function getPermDock(): ClientPermDock;
+declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
+declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
+declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
+declare function tenant(): Readable<TenantView>;
+declare function memberships(): Readable<readonly Membership[]>;
+declare function roles(options?: () => UseRolesOptions): Readable<{
+  readonly roles: readonly Role[];
+}>;
+declare function assignable(): Readable<readonly Role[]>;
+declare function assignablePermissions(options?: {
+  readonly tenant?: string;
+}): Readable<readonly Permission[]>;
+declare function subject(): Readable<SubjectView>;
+declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
+//#endregion
+export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, PermDockSvelteOptions as p, assignablePermissions as r, permission as s, approval as t, setPermDock as u };

package/dist/stream-BhMfZOwr.d.ts

@@ -0,0 +1,12 @@
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { r as ProtectOptions } from "./create-BKF3dgFk.js";
+//#region src/server/stream.d.ts
+type StreamProtectOptions = ProtectOptions & {
+  /**
+   * For a procedure that returns an async iterable: each outbound item is
+   * checked against this permission and dropped when the subscriber cannot read it.
+   */
+  readonly items?: Permission<string, unknown, "instance">;
+};
+//#endregion
+export { StreamProtectOptions as t };