permdock 0.0.0 → 0.2.0

package/dist/errors-DAqevpNk.d.ts

@@ -0,0 +1,125 @@
+import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { t as Disclosure } from "./problem-details-CkL50EEf.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/errors.d.ts
+/** Where and how a human approves; carries no secret. */
+type ApprovalHint = {
+  readonly at?: string;
+  readonly hint?: string;
+};
+type ProblemDetails = {
+  readonly type: string;
+  readonly title: string;
+  readonly status: number;
+  readonly detail: string;
+  readonly instance?: string;
+  readonly permission?: string;
+  readonly scope?: string;
+  readonly resource?: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly denials?: readonly WireDenial[];
+  readonly alternatives?: readonly string[];
+  readonly reason?: string;
+  readonly token?: string;
+  readonly issues?: readonly StandardSchemaV1.Issue[];
+  readonly approval?: ApprovalHint;
+  /** RFC 9470 step-up parameters on `step-up-required`. */
+  readonly acrValues?: readonly string[];
+  readonly maxAge?: number;
+  /** The plans that would grant the permission, on `not-entitled`. */
+  readonly plans?: readonly string[];
+};
+declare class PermDockDeniedError extends Error {
+  override readonly name: "PermDockDeniedError";
+  readonly decision: Extract<Decision, {
+    readonly outcome: "denied";
+  }>;
+  readonly permission: string;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly subject: Subject;
+  /** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+  readonly disclosure?: Disclosure;
+  /** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+  readonly digest: string;
+  constructor(input: {
+    readonly decision: Extract<Decision, {
+      readonly outcome: "denied";
+    }>;
+    readonly permission: string;
+    readonly scope: string;
+    readonly resource: {
+      readonly type: string;
+      readonly id?: string;
+    };
+    readonly subject: Subject;
+    readonly message: string;
+    readonly disclosure?: Disclosure;
+  });
+  /** The same status matrix as `protect`: `401`, `404`, `429`, `503` or `403`. */
+  toProblemDetails(options?: {
+    readonly instance?: string;
+    readonly disclosure?: Disclosure;
+  }): ProblemDetails;
+}
+declare class PermDockApprovalRequiredError extends Error {
+  override readonly name: "PermDockApprovalRequiredError";
+  readonly decision: Extract<Decision, {
+    readonly outcome: "approval-required";
+  }>;
+  readonly permission: string;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly token: string;
+  readonly reason: string;
+  /** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+  readonly digest: string;
+  constructor(input: {
+    readonly decision: Extract<Decision, {
+      readonly outcome: "approval-required";
+    }>;
+    readonly permission: string;
+    readonly scope: string;
+    readonly resource: {
+      readonly type: string;
+      readonly id?: string;
+    };
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+type RevokedCode = "session-revoked" | "expired" | "denied" | "subject-changed";
+/**
+ * The `reason` of a long-lived connection's aborted `signal`. `denied` carries
+ * the decision that re-denied the permission the connection was opened for.
+ */
+declare class PermDockRevokedError extends Error {
+  override readonly name: "PermDockRevokedError";
+  readonly code: RevokedCode;
+  readonly permission?: string;
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
+  constructor(input: {
+    readonly code: RevokedCode;
+    readonly permission?: string;
+    readonly decision?: Exclude<Decision, {
+      readonly outcome: "granted";
+    }>;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+//#endregion
+export { ProblemDetails as a, PermDockRevokedError as i, PermDockApprovalRequiredError as n, RevokedCode as o, PermDockDeniedError as r, ApprovalHint as t };

package/dist/errors-DRnGZHzF.js

@@ -0,0 +1,30 @@
+//#region src/approvals/errors.ts
+var ApprovalError = class extends Error {
+	name = "ApprovalError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"approval-not-found",
+	"approval-not-pending",
+	"approval-expired",
+	"approver-unauthenticated",
+	"approver-is-actor",
+	"approver-is-principal",
+	"approver-not-eligible",
+	"approver-repeated"
+]);
+function isApprovalErrorCode(value) {
+	return typeof value === "string" && CODES.has(value);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+function isApprovalError(value) {
+	if (!(value instanceof Error) || value.name !== "ApprovalError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+export { isApprovalError as n, isApprovalErrorCode as r, ApprovalError as t };

package/dist/evaluation-items-CfCCejQd.js

@@ -0,0 +1,40 @@
+import { _ as listPermissions, a as formerKeys, o as formerScopes } from "./permissions-DVoF6dMt.js";
+//#region src/server/evaluation-items.ts
+function firstWins(map, name, leaf) {
+	if (!map.has(name)) map.set(name, leaf);
+}
+/**
+* Indexes `tree` once. The lookup tries `action` as a permission key or
+* scope, then `<resource.type>.<action>`, then the leaf with that resource
+* and action; current names win over former ones and earlier leaves over
+* later ones. Anything else is `undefined`, which the caller denies.
+*/
+function permissionLookup(tree) {
+	const current = /* @__PURE__ */ new Map();
+	const former = /* @__PURE__ */ new Map();
+	const byPair = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(tree)) {
+		firstWins(current, leaf.key, leaf);
+		firstWins(current, leaf.scope, leaf);
+		for (const name of [...formerKeys(leaf), ...formerScopes(leaf)]) firstWins(former, name, leaf);
+		firstWins(byPair, `${leaf.resource}\u0000${leaf.action}`, leaf);
+	}
+	const named = (name) => current.get(name) ?? former.get(name);
+	return (action, resource) => {
+		if (action === void 0) return;
+		const byKey = named(action);
+		if (byKey !== void 0) return byKey;
+		const type = typeof resource?.type === "string" ? resource.type : void 0;
+		if (type === void 0) return;
+		return named(`${type}.${action}`) ?? byPair.get(`${type}\u0000${action}`);
+	};
+}
+/** The row an item's resource describes: its `properties`, else `{ id }`. */
+function itemResourceData(resource) {
+	const properties = resource?.properties;
+	if (properties !== null && typeof properties === "object") return properties;
+	const id = resource?.id;
+	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
+}
+//#endregion
+export { permissionLookup as n, itemResourceData as t };

package/dist/evaluations-tz6D9A2G.js

@@ -0,0 +1,461 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { a as wireDenials } from "./problem-details-_AMOYz-w.js";
+import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
+import { s as problemResponse, t as batchTooLarge, u as validationProblem } from "./problem-B43ztKIm.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-H_KARDVC.js";
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+import { n as permissionLookup, t as itemResourceData } from "./evaluation-items-CfCCejQd.js";
+//#region src/core/decision.ts
+/** The denial for a check that failed or named no declared permission. */
+const NO_GRANT = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "no-grant"
+	})]),
+	alternatives: Object.freeze([])
+});
+//#endregion
+//#region src/server/web-bot-auth.ts
+/** Milliseconds a key directory fetch may take before the signature counts as unverifiable. */
+const DIRECTORY_TIMEOUT_MS = 5e3;
+const DEFAULT_MAX_AGE = 300;
+const FUTURE_SKEW = 60;
+const DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+var InvalidSignatureError = class extends Error {
+	name = "InvalidSignatureError";
+	response;
+	constructor(response) {
+		super("Web Bot Auth signature was rejected");
+		this.response = response;
+	}
+};
+function invalidSignatureResponse(error) {
+	return error instanceof InvalidSignatureError ? error.response : void 0;
+}
+function invalidSignatureProblem(detail) {
+	return problemResponse(compact({
+		type: `${PROBLEM_BASE}/invalid-signature`,
+		title: "Invalid signature",
+		status: 403,
+		detail
+	}));
+}
+function discoverViaSignatureAgent(options) {
+	const fetchFn = options.fetch ?? fetch;
+	const allow = new Set(options.allow);
+	const cache = /* @__PURE__ */ new Map();
+	const lookup = async ({ keyid, agent }) => {
+		if (agent === void 0) return;
+		let url;
+		try {
+			url = new URL(agent);
+		} catch {
+			return;
+		}
+		if (url.protocol !== "https:" || !allow.has(url.hostname)) return;
+		const directoryUrl = url.pathname === "/" || url.pathname === "" ? `${url.origin}${DIRECTORY_PATH}` : agent;
+		let pending = cache.get(directoryUrl);
+		if (pending === void 0) {
+			pending = loadDirectory(fetchFn, directoryUrl);
+			cache.set(directoryUrl, pending);
+		}
+		let keys;
+		try {
+			keys = await pending;
+		} catch {
+			cache.delete(directoryUrl);
+			return;
+		}
+		return keys.find((key) => key.kid === keyid);
+	};
+	return { lookup };
+}
+async function verifyWebBotAuth(request, options) {
+	if (options === void 0 || options.verify === false) return;
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput === null) {
+		if (options.required === true) throw new InvalidSignatureError(invalidSignatureProblem("Signature-Input is required"));
+		return;
+	}
+	const parsed = parseSignatureInput(signatureInput);
+	const signatureHeader = request.headers.get("Signature");
+	if (parsed === void 0 || signatureHeader === null) throw reject("Signature-Input could not be parsed");
+	const signature = parseSignature(signatureHeader, parsed.label);
+	if (signature === void 0) throw reject("Signature could not be parsed");
+	const now = options.now?.() ?? Math.floor(Date.now() / 1e3);
+	const maxAge = options.maxAge ?? DEFAULT_MAX_AGE;
+	if (typeof parsed.created !== "number") throw reject("Signature-Input created is required");
+	if (parsed.created > now + FUTURE_SKEW) throw reject("Signature-Input created is in the future");
+	if (now - parsed.created > maxAge) throw reject("Signature-Input created is too old");
+	if (typeof parsed.expires === "number" && parsed.expires < now) throw reject("Signature-Input expires is in the past");
+	if (parsed.keyid === void 0) throw reject("Signature-Input keyid is required");
+	const agent = parseSignatureAgent(request.headers.get("Signature-Agent"), parsed.label);
+	const lookup = typeof options.keys === "function" ? options.keys : options.keys.lookup;
+	let key;
+	try {
+		key = await lookup({
+			request,
+			keyid: parsed.keyid,
+			agent
+		});
+	} catch {
+		throw reject("Web Bot Auth key lookup failed");
+	}
+	if (key === void 0) throw reject("Web Bot Auth key was not found");
+	const base = signatureBase(request, parsed);
+	if (base === void 0) throw reject("signed components could not be covered");
+	const alg = parsed.alg ?? algorithmFromJwk(key);
+	if (alg === void 0) throw reject("signature algorithm is not supported");
+	if (!await verifyBytes(key, alg, signature, base)) throw reject("HTTP Message Signature did not verify");
+	return Object.freeze({
+		id: parsed.keyid,
+		kind: "web-bot-auth"
+	});
+}
+function reject(detail) {
+	return new InvalidSignatureError(invalidSignatureProblem(detail));
+}
+function parseSignatureInput(header) {
+	const member = firstDictionaryMember(header);
+	if (member === void 0) return;
+	const inner = parseInnerListAndParams(member.value);
+	if (inner === void 0) return;
+	return compact({
+		label: member.key,
+		components: inner.components,
+		created: inner.created,
+		expires: inner.expires,
+		keyid: inner.keyid,
+		alg: inner.alg,
+		innerListAndParams: member.value.trim()
+	});
+}
+function parseSignature(header, label) {
+	const member = dictionaryMember(header, label);
+	if (member === void 0) return;
+	return decodeSfBytes(member);
+}
+function parseSignatureAgent(header, label) {
+	if (header === null) return;
+	const trimmed = header.trim();
+	if (trimmed.startsWith("\"")) return unquote(trimmed);
+	const member = dictionaryMember(trimmed, label) ?? firstDictionaryMember(trimmed)?.value;
+	if (member === void 0) return;
+	return unquote(member.trim());
+}
+function firstDictionaryMember(header) {
+	const first = splitTopLevel(header, ",")[0];
+	if (first === void 0) return;
+	const eq = first.indexOf("=");
+	if (eq <= 0) return;
+	return {
+		key: first.slice(0, eq).trim(),
+		value: first.slice(eq + 1)
+	};
+}
+function dictionaryMember(header, label) {
+	for (const part of splitTopLevel(header, ",")) {
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		if (part.slice(0, eq).trim() === label) return part.slice(eq + 1);
+	}
+}
+function parseInnerListAndParams(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("(")) return;
+	const close = trimmed.indexOf(")");
+	if (close < 0) return;
+	const components = parseQuotedList(trimmed.slice(1, close));
+	if (components === void 0) return;
+	const params = parseParams(trimmed.slice(close + 1));
+	return compact({
+		components,
+		created: asUnix(params["created"]),
+		expires: asUnix(params["expires"]),
+		keyid: typeof params["keyid"] === "string" ? params["keyid"] : void 0,
+		alg: typeof params["alg"] === "string" ? params["alg"] : void 0
+	});
+}
+function parseQuotedList(inner) {
+	const items = [];
+	const parts = splitTopLevel(inner, " ");
+	for (const part of parts) {
+		const next = part.trim();
+		if (next === "") continue;
+		if (!next.startsWith("\"") || !next.endsWith("\"")) return;
+		const item = unquote(next);
+		if (item === void 0) return;
+		items.push(item);
+	}
+	return items;
+}
+function parseParams(suffix) {
+	const params = {};
+	for (const part of suffix.split(";")) {
+		const next = part.trim();
+		if (next === "") continue;
+		const eq = next.indexOf("=");
+		if (eq <= 0) continue;
+		const name = next.slice(0, eq);
+		const raw = next.slice(eq + 1);
+		if (raw.startsWith("\"")) {
+			const quoted = unquote(raw);
+			if (quoted !== void 0) params[name] = quoted;
+			continue;
+		}
+		const numeric = Number(raw);
+		params[name] = Number.isFinite(numeric) ? numeric : raw;
+	}
+	return params;
+}
+function asUnix(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function signatureBase(request, parsed) {
+	const lines = [];
+	for (const component of parsed.components) {
+		const value = componentValue(request, component);
+		if (value === void 0) return;
+		lines.push(`"${component}": ${value}`);
+	}
+	lines.push(`"@signature-params": ${parsed.innerListAndParams}`);
+	return new TextEncoder().encode(lines.join("\n"));
+}
+function componentValue(request, component) {
+	if (component.startsWith("@")) {
+		const url = new URL(request.url);
+		switch (component) {
+			case "@method": return request.method;
+			case "@authority": return url.host;
+			case "@path": return url.pathname;
+			case "@query": return url.search;
+			case "@target-uri": return url.href;
+			case "@scheme": return url.protocol.replace(":", "");
+			case "@request-target": return `${url.pathname}${url.search}`;
+			default: return;
+		}
+	}
+	return request.headers.get(component) ?? void 0;
+}
+function algorithmFromJwk(key) {
+	if (key.kty === "OKP" && key.crv === "Ed25519") return "ed25519";
+	if (key.kty === "EC" && key.crv === "P-256") return "ecdsa-p256-sha256";
+}
+async function verifyBytes(key, alg, signature, data) {
+	try {
+		if (alg === "ed25519") {
+			const cryptoKey = await crypto.subtle.importKey("jwk", key, "Ed25519", false, ["verify"]);
+			return await crypto.subtle.verify("Ed25519", cryptoKey, signature, data);
+		}
+		if (alg === "ecdsa-p256-sha256") {
+			const cryptoKey = await crypto.subtle.importKey("jwk", key, {
+				name: "ECDSA",
+				namedCurve: "P-256"
+			}, false, ["verify"]);
+			return await crypto.subtle.verify({
+				name: "ECDSA",
+				hash: "SHA-256"
+			}, cryptoKey, signature, data);
+		}
+		return false;
+	} catch {
+		return false;
+	}
+}
+async function loadDirectory(fetchFn, directoryUrl) {
+	const response = await fetchFn(directoryUrl, {
+		headers: { accept: "application/http-message-signatures-directory+json, application/json" },
+		signal: timeoutSignal(DIRECTORY_TIMEOUT_MS)
+	});
+	if (!response.ok) throw new TypeError("directory fetch failed");
+	const body = await response.json();
+	if (body === null || typeof body !== "object" || Array.isArray(body)) return [];
+	const keys = body.keys;
+	if (!Array.isArray(keys)) return [];
+	return keys.filter(isWebBotAuthJwk);
+}
+function isWebBotAuthJwk(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function splitTopLevel(input, separator) {
+	const parts = [];
+	let current = "";
+	let quotes = false;
+	let depth = 0;
+	for (const char of input) {
+		if (char === "\"" && depth === 0) {
+			quotes = !quotes;
+			current += char;
+			continue;
+		}
+		if (!quotes && char === "(") {
+			depth += 1;
+			current += char;
+			continue;
+		}
+		if (!quotes && char === ")" && depth > 0) {
+			depth -= 1;
+			current += char;
+			continue;
+		}
+		if (!quotes && depth === 0 && char === separator) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	if (current !== "") parts.push(current);
+	return parts;
+}
+function unquote(value) {
+	if (!value.startsWith("\"")) return value;
+	if (!value.endsWith("\"") || value.length < 2) return;
+	return value.slice(1, -1).replaceAll("\\\"", "\"");
+}
+function decodeSfBytes(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith(":") || !trimmed.endsWith(":") || trimmed.length < 2) return;
+	try {
+		const binary = atob(trimmed.slice(1, -1));
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+		return bytes;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/server/evaluations.ts
+function permissionOf(lookup, item) {
+	return lookup(typeof item.action?.name === "string" ? item.action.name : void 0, item.resource);
+}
+function evaluationRow(decision) {
+	switch (decision.outcome) {
+		case "granted": return {
+			decision: true,
+			context: {
+				outcome: "granted",
+				permdock: decision
+			}
+		};
+		case "denied": return {
+			decision: false,
+			context: {
+				outcome: "denied",
+				permdock: {
+					...decision,
+					denials: wireDenials(decision.denials)
+				}
+			}
+		};
+		case "approval-required": return {
+			decision: false,
+			context: {
+				outcome: "approval-required",
+				permdock: decision
+			}
+		};
+		default: return decision;
+	}
+}
+function applyApprovalResume(decision, permission, permdock, store, request, resource, adapter) {
+	return resumeDecision({
+		decision,
+		permission,
+		subject: permdock.subject,
+		store,
+		resource,
+		adapter,
+		token: request === void 0 ? void 0 : readApprovalHeader(request.headers)
+	});
+}
+function evaluateOne(lookup, permdock, item, store, header, adapter) {
+	const permission = permissionOf(lookup, item);
+	if (permission === void 0) return Promise.resolve(NO_GRANT);
+	const data = itemResourceData(item.resource);
+	const decide = permdock.decide;
+	const decision = decide(permission, data, compact({
+		source: "endpoint",
+		adapter,
+		trusted: false,
+		boundary: "decision-endpoint"
+	}));
+	return resumeDecision({
+		decision,
+		permission,
+		subject: permdock.subject,
+		store,
+		resource: resourceRef(permission, data, item.resource?.id),
+		adapter,
+		token: header,
+		consume: false
+	});
+}
+async function resolvePermdock(options, request, tenant) {
+	if (options.resolve !== void 0) {
+		const permdock = await options.resolve(request);
+		return tenant === void 0 ? permdock : permdock.tenant(tenant);
+	}
+	if (options.getPermDock !== void 0) return options.getPermDock(tenant === void 0 ? void 0 : { tenant });
+	throw new TypeError("evaluations handler needs resolve or getPermDock");
+}
+function createEvaluationsHandler(options) {
+	const adapter = options.adapter ?? "server";
+	const lookup = permissionLookup(options.policy.permissions);
+	const maxEvaluations = options.maxEvaluations ?? 256;
+	const POST = async (request) => {
+		let body;
+		try {
+			body = await request.json();
+		} catch {
+			return validationProblem("evaluations body was not valid JSON");
+		}
+		if (body === null || typeof body !== "object" || Array.isArray(body)) return validationProblem("evaluations body must be an object");
+		const evaluations = body.evaluations;
+		if (evaluations === void 0) return validationProblem("evaluations array is required");
+		if (!Array.isArray(evaluations)) return validationProblem("evaluations must be an array");
+		if (evaluations.length > maxEvaluations) return batchTooLarge(maxEvaluations);
+		const header = readApprovalHeader(request.headers);
+		let permdock;
+		try {
+			permdock = await resolvePermdock(options, request);
+		} catch (error) {
+			if (error instanceof InvalidSignatureError) return error.response;
+			throw error;
+		}
+		const rows = await Promise.all(evaluations.map(async (item) => {
+			return evaluationRow(await evaluateOne(lookup, permdock, item !== null && typeof item === "object" ? item : {}, options.store, header, adapter));
+		}));
+		return Response.json({ evaluations: rows });
+	};
+	const GET = async (request) => {
+		const url = new URL(request.url);
+		if (url.pathname.includes("authzen-configuration")) {
+			const origin = url.origin;
+			return Response.json({
+				policy_decision_point: origin,
+				access_evaluation_endpoint: `${origin}/access/v1/evaluation`,
+				access_evaluations_endpoint: `${origin}/access/v1/evaluations`
+			});
+		}
+		const tenant = url.searchParams.get("tenant") ?? void 0;
+		let permdock;
+		try {
+			permdock = await resolvePermdock(options, request, tenant);
+		} catch (error) {
+			if (error instanceof InvalidSignatureError) return error.response;
+			throw error;
+		}
+		const snapshot = permdock.snapshot();
+		return Response.json(await Promise.resolve(snapshot));
+	};
+	return {
+		POST,
+		GET
+	};
+}
+//#endregion
+export { invalidSignatureProblem as a, NO_GRANT as c, discoverViaSignatureAgent as i, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t };