permdock 0.0.0 → 0.1.0

package/dist/types-DbWdEfcm.d.ts

@@ -0,0 +1,87 @@
+import { E as PolicyVocabulary, Et as TokenVerifier, Mn as Decision, Zt as PermDock, gt as Snapshot, ir as Actor, mr as Principal, ur as Delegation } from "./policy-CInmNGkM.js";
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { ReactNode } from "react";
+//#region src/react/types.d.ts
+type ClientStatus = "ready" | "pending" | "stale" | "server-only";
+type PermissionState = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+};
+type PermissionSet = {
+  readonly granted: readonly Permission[];
+  get(permission: Permission): PermissionState | undefined;
+};
+type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
+  status(permission?: Permission, data?: unknown): ClientStatus;
+  invalidate(ref: Permission | {
+    readonly [key: string]: unknown;
+  }): void;
+  refresh(options?: {
+    readonly tenant?: string;
+  }): Promise<void>;
+  clear(): void;
+  subscribe(listener: () => void): () => void;
+};
+type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
+type ApprovalHandle = {
+  readonly state: ApprovalState;
+  readonly token: string | undefined;
+  readonly request: (note?: string) => Promise<void>;
+};
+type SubjectView = {
+  readonly principal: Principal | null;
+  readonly actor: Actor | undefined;
+  readonly delegation: Delegation | undefined;
+  readonly expiresAt: number | undefined;
+  readonly simulated: boolean;
+};
+type TenantView = {
+  readonly tenant: string | null;
+  readonly tenants: readonly string[];
+  readonly switchTo: (id: string) => Promise<void>;
+  readonly status: ClientStatus;
+};
+type FilterResult<T> = readonly T[] & {
+  readonly partial: boolean;
+};
+type PermDockProviderProps = ({
+  readonly snapshot: Snapshot | string;
+  readonly snapshotPromise?: never;
+} | {
+  /**
+   * An unawaited snapshot from a Server Component. Hooks suspend until it resolves, so only
+   * the components that read permissions wait. A rejection reaches the nearest error boundary.
+   */
+  readonly snapshotPromise: PromiseLike<Snapshot | string>;
+  readonly snapshot?: never;
+}) & {
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer. `false` never
+   * fetches: those checks answer `denied` with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  readonly children: ReactNode;
+};
+type UseRolesOptions = {
+  readonly tenant?: string;
+  readonly team?: string;
+};
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly pending?: ReactNode;
+  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
+  readonly children: ReactNode | ((decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>) => ReactNode);
+};
+//#endregion
+export { FilterResult as a, PermissionState as c, TenantView as d, UseRolesOptions as f, ClientStatus as i, ProtectedProps as l, ApprovalState as n, PermDockProviderProps as o, ClientPermDock as r, PermissionSet as s, ApprovalHandle as t, SubjectView as u };

package/dist/types-bva3i4Gf.d.ts

@@ -0,0 +1,98 @@
+import { Et as TokenVerifier, J as AuthEvent, ct as MembershipSource, hr as Subject, ir as Actor, mr as Principal, nt as JwtClaims, wt as TokenFailureCause } from "./policy-CInmNGkM.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/jwt/types.d.ts
+type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
+type JwtProfile = "fapi2";
+type JsonWebKeySet = {
+  readonly keys: readonly Record<string, unknown>[];
+};
+type JwtJwks = URL | string | JsonWebKeySet | {
+  readonly secret: Uint8Array | string;
+};
+type DiscoveryInput = string | {
+  readonly issuer: string;
+  readonly metadata?: {
+    readonly issuer?: string;
+    readonly jwks_uri?: string;
+  };
+};
+type JwksCacheOptions = {
+  readonly minTtl?: number;
+  readonly maxTtl?: number;
+  readonly cooldown?: number;
+  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  readonly timeout?: number;
+};
+type JoseTokenVerifierOptions = {
+  readonly jwks?: JwtJwks;
+  readonly discovery?: DiscoveryInput;
+  readonly issuer?: string;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly typ?: string | readonly string[];
+  readonly audience?: string | readonly string[];
+  readonly clockTolerance?: number;
+  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
+  readonly decryptionAlgorithms?: readonly string[];
+  readonly profile?: JwtProfile;
+  readonly jwksCache?: JwksCacheOptions;
+  readonly fetch?: typeof fetch;
+};
+type JoseTokenSignerOptions = {
+  readonly key: Record<string, unknown> | Uint8Array;
+  readonly alg: JwtAlgorithm;
+  readonly kid: string;
+  readonly issuer?: string;
+};
+type JwtClaimPaths = {
+  readonly id?: string;
+  readonly roles?: string;
+  readonly groups?: string;
+  readonly entitlements?: string;
+  readonly plans?: string;
+  readonly tenant?: string;
+  readonly memberships?: string;
+  readonly kind?: string;
+  readonly assurance?: string | {
+    readonly acr?: string;
+    readonly amr?: string;
+    readonly authTime?: string;
+    /** OpenID Connect for Identity Assurance; default `verified_claims`. */
+    readonly verified?: string;
+  };
+  readonly session?: string;
+};
+type JwtDelegationPaths = {
+  readonly scopes?: string;
+  readonly authorizationDetails?: string;
+  readonly access?: string;
+};
+type JwtSubjectOptions = JoseTokenVerifierOptions & {
+  readonly accept?: "access-token" | "id-token";
+  readonly claims?: JwtClaimPaths;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly schema?: StandardSchemaV1;
+  readonly delegation?: JwtDelegationPaths;
+  readonly actor?: {
+    readonly from?: "act";
+    readonly kind?: string;
+  } | ((claims: JwtClaims) => Actor | undefined);
+  readonly sender?: "none" | "dpop" | "mtls";
+  readonly memberships?: MembershipSource;
+  readonly verifier?: TokenVerifier;
+  readonly certificateThumbprint?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+type JwtPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type DpopProofResult = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: TokenFailureCause;
+};
+type MappedSubject = Subject<JwtPrincipal>;
+//#endregion
+export { JsonWebKeySet as a, JwtJwks as c, MappedSubject as d, JoseTokenVerifierOptions as i, JwtPrincipal as l, DpopProofResult as n, JwtAlgorithm as o, JoseTokenSignerOptions as r, JwtClaimPaths as s, DiscoveryInput as t, JwtSubjectOptions as u };

package/dist/types-i4BAOvdb.d.ts

@@ -0,0 +1,97 @@
+import { Et as TokenVerifier, wt as TokenFailureCause } from "./policy-CInmNGkM.js";
+import { f as ApprovalStore } from "./types-B8w5PFtS.js";
+import { c as JwtJwks, t as DiscoveryInput } from "./types-bva3i4Gf.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+//#region src/ssf/types.d.ts
+type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change";
+type SetSubject = {
+  readonly format: string;
+  readonly [key: string]: unknown;
+};
+type SsfSubject = {
+  readonly id: string;
+  readonly session?: string;
+  readonly issuer?: string;
+};
+type SsfSubjectMapper = (setSubject: SetSubject, meta?: {
+  readonly session?: string;
+  readonly issuer?: string;
+}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
+type SsfEventInput = {
+  readonly subject: SsfSubject;
+  readonly event: Readonly<Record<string, unknown>>;
+  readonly event_timestamp?: number;
+  readonly jti: string;
+  readonly type: string;
+};
+type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
+type SsfOnEvent = { readonly [K in CaepEventName]?: SsfEventHandler; } & {
+  readonly "*"?: SsfEventHandler;
+};
+/**
+ * Keys are opaque strings namespaced by issuer. A store that implements both
+ * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
+ * one with only `seen` and `remember` is checked and recorded non-atomically.
+ */
+type ReplayStore = {
+  seen(key: string): boolean | Promise<boolean>;
+  remember(key: string, expiresAt?: number): void | Promise<void>;
+  /** Records `key` and returns `true` only if it was not already recorded. */
+  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  /** Forgets a claimed `key` so a failed delivery can be retried. */
+  release?(key: string): void | Promise<void>;
+};
+type SsfAuditEvent = {
+  readonly type: string;
+  readonly subject?: SsfSubject;
+  readonly transmitter?: string;
+  readonly jti?: string;
+  readonly replayed?: true;
+  readonly cancelled?: number;
+  readonly unknown?: "event" | "subject";
+  readonly err?: string;
+  readonly cause?: TokenFailureCause;
+};
+type SsfEventListener = (event: SsfAuditEvent) => void;
+type PollOptions = {
+  readonly endpoint: string;
+  readonly every?: number | string;
+  readonly token?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+type PollHandle = {
+  readonly stop: () => void;
+};
+type PollResult = {
+  readonly acked: readonly string[];
+};
+type SsfPermDockOptions = {
+  readonly issuer?: string;
+  readonly audience: string | readonly string[];
+  readonly jwks?: JwtJwks | string;
+  readonly discovery?: DiscoveryInput;
+  readonly verifier?: TokenVerifier;
+  readonly subject: SsfSubjectMapper;
+  readonly onEvent?: SsfOnEvent;
+  readonly replay?: ReplayStore;
+  readonly approvals?: ApprovalStore;
+  /**
+   * Publishes `session-revoked` for a revoked session and `changed` for
+   * credential, assurance and claims changes, so open connections end or
+   * revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly clockTolerance?: number;
+};
+type SsfReceiver = {
+  push(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  poll(options: PollOptions): Promise<PollResult> | PollHandle;
+  on(event: "event", handler: SsfEventListener): () => void;
+};
+type SsfPermDock = {
+  readonly receiver: SsfReceiver;
+};
+//#endregion
+export { ReplayStore as a, SsfEventHandler as c, SsfOnEvent as d, SsfPermDock as f, SsfSubjectMapper as g, SsfSubject as h, PollResult as i, SsfEventInput as l, SsfReceiver as m, PollHandle as n, SetSubject as o, SsfPermDockOptions as p, PollOptions as r, SsfAuditEvent as s, CaepEventName as t, SsfEventListener as u };

package/dist/unplugin/index.d.ts

@@ -0,0 +1,7 @@
+import { a as PermDockPluginOptions } from "../types-D6Z6-rKJ.js";
+import { createUnplugin } from "unplugin";
+//#region src/unplugin/index.d.ts
+type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;
+export declare const createPermDockUnplugin: ReturnType<CreateUnplugin>;
+//#endregion
+export type { PermDockPluginOptions };

package/dist/unplugin/index.js

@@ -0,0 +1,30 @@
+import { n as runPluginCollect } from "../plugin-4gr7IxFJ.js";
+import { t as peerHint } from "../peer-BOr_kJE1.js";
+import { createRequire } from "node:module";
+//#region src/unplugin/index.ts
+function loadCreateUnplugin() {
+	try {
+		return createRequire(import.meta.url)("unplugin").createUnplugin;
+	} catch {
+		throw new Error(peerHint("unplugin", "permdock/unplugin"));
+	}
+}
+function report(message) {
+	if (message !== void 0) process.stderr.write(`permdock: ${message}\n`);
+}
+function collectPlugin(options) {
+	return {
+		name: "permdock-collect",
+		async buildStart() {
+			report(await runPluginCollect(process.cwd(), options, options?.check === true));
+		},
+		watchChange() {
+			runPluginCollect(process.cwd(), options, false).then(report, (error) => {
+				report(error instanceof Error ? error.message : String(error));
+			});
+		}
+	};
+}
+const createPermDockUnplugin = loadCreateUnplugin()(collectPlugin);
+//#endregion
+export { createPermDockUnplugin };

package/dist/usage-1ozMubLY.js

@@ -0,0 +1,42 @@
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/usage.ts
+function usage(ctx) {
+	return defineCommand({
+		meta: {
+			name: "usage",
+			description: COMMAND_DESCRIPTIONS.usage
+		},
+		args: {
+			...globalArgs,
+			strict: {
+				type: "boolean",
+				description: "Exit 1 on any finding"
+			},
+			ignore: {
+				type: "string",
+				description: "Permission keys or globs to skip, repeatable",
+				valueHint: "glob"
+			},
+			"dynamic-as-used": {
+				type: "boolean",
+				description: "Count computed permission references as uses"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			const result = await (await import("./usage-PyEor6GA.js")).runUsage({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				ignore: listArg(rawArgs, "ignore"),
+				strict: parsed.strict === true,
+				json: ctx.json,
+				dynamicAsUsed: parsed["dynamic-as-used"] === true,
+				now: ctx.now,
+				io: ctx.io
+			});
+			ctx.report(result);
+		}
+	});
+}
+//#endregion
+export { usage };